Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

win32.agent.pz

Started by Spector437 , Jun 06 2009 12:47 AM

Please log in to reply

#1
Spector437

Posted 06 June 2009 - 12:47 AM

Member

Member
39 posts

The worst virus I've ever come across is the win32.agent.pz trojan. It regenerates itself, so wiping it isn't helping long term. Now someone's got into my ebay account by finding my password, and I can't believe it's a coincidence.

I'm wondering if anyone here has got rid of this monster or knows of a specific .exe file that attacks it. I've seen some links to programs that are supposed to remove it, but of course I have no way of knowing whether they are trojans as well. Malwarebytes anti-malware has been used but didn't remove it, along with Spyhunter which was useless, as well as AVG. So if anyone can recommend a solution for this specific problem, then I would be euphoric.

#2
kahdah

Posted 06 June 2009 - 12:04 PM

GeekU Teacher

Retired Staff
15,822 posts

Hello Spector437

Welcome to G2Go.

=====================

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

===========
Download This file. Note its name and save it to your root folder, such as C:\.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
Click on this link to see a list of programs that should be disabled.
Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
Allow the driver to load if asked.
You may be prompted to scan immediately if it detects rootkit activity.
If you are prompted to scan your system click "Yes" to begin the scan.
If not prompted, click the "Rootkit/Malware" tab.
On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
Select all drives that are connected to your system to be scanned.
Click the Scan button to begin. (Please be patient as it can take some time to complete)
When the scan is finished, click Save to save the scan results to your Desktop.
Save the file as Results.log and copy/paste the contents in your next reply.
Exit the program and re-enable all active protection when done.

#3
Spector437

Posted 07 June 2009 - 04:45 AM

Member

Topic Starter
Member
39 posts

Hi

Here is the copied text from the OTL.txt Notepad file:

OTL logfile created on: 07/06/2009 08:42:11 - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\William Hosie\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

510.07 Mb Total Physical Memory | 206.11 Mb Available Physical Memory | 40.41% Memory free
1.22 Gb Paging File | 0.99 Gb Available in Paging File | 81.21% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.32 Gb Total Space | 32.33 Gb Free Space | 22.40% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WMHOSIE06
Current User Name: William Hosie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\CTsvcCDA.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation)
PRC - C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
PRC - C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe (Intel Corporation)
PRC - C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\VoiceCenter\AndreaVC.exe (Andrea Electronics Corporation)
PRC - C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Napster\napster.exe (Napster)
PRC - C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001 (Macrovision Europe Ltd.)
PRC - C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe (Creative Technology Ltd)
PRC - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
PRC - C:\Documents and Settings\William Hosie\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Running]) -- C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (Creative Labs Licensing Service [On_Demand | Running]) -- C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
SRV - (Creative Service for CDROM Access [Auto | Running]) -- C:\WINDOWS\system32\CTsvcCDA.exe (Creative Technology Ltd)
SRV - (ehRecvr [Auto | Running]) -- C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation)
SRV - (ehSched [Auto | Running]) -- C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (McrdSvc [Auto | Running]) -- C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation)
SRV - (MHN [On_Demand | Stopped]) -- C:\WINDOWS\System32\mhn.dll (Microsoft Corporation)
SRV - (NetSvc [On_Demand | Stopped]) -- C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe (Intel® Corporation)
SRV - (ServiceLayer [On_Demand | Stopped]) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (YPCService [On_Demand | Stopped]) -- C:\WINDOWS\system32\YPcservice.exe (Yahoo! Inc.)

========== Driver Services (SafeList) ==========

DRV - (AliIde [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (amdagp [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (asc [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (ati2mtag [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (CmdIde [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (ctsfm2k [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys (Creative Technology Ltd)
DRV - (CTUSFSYN [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\ctusfsyn.sys (Creative Technology Ltd.)
DRV - (dac2w2k [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (DLABOIOM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLACDBHM [System | Running]) -- C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLADResN [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLAIFS_M [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLAOPIOM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLARTL_N [System | Running]) -- C:\WINDOWS\System32\Drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DLAUDFAM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DRVMCDB [Boot | Running]) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DRVNDDM [Auto | Running]) -- C:\WINDOWS\System32\Drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (E100B [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (hcwPP2 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\hcwPP2.sys (Hauppauge Computer Works, Inc.)
DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (IntelC51 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\IntelC51.sys (Intel Corporation)
DRV - (IntelC52 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\IntelC52.sys (Intel Corporation)
DRV - (IntelC53 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\IntelC53.sys (Intel Corporation)
DRV - (MODEMCSA [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (mohfilt [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\mohfilt.sys (Intel Corporation)
DRV - (mraid35x [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (nmwcd [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdc [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (NwlnkIpx [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys (Microsoft Corporation)
DRV - (ossrv [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ctoss2k.sys (Creative Technology Ltd.)
DRV - (pccsmcfd [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys (Nokia)
DRV - (PfModNT [Auto | Running]) -- C:\WINDOWS\system32\drivers\PfModNT.sys (Creative Technology Ltd.)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ql1080 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql12160 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1280 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (sigfilt [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sigfilt.sys (Creative Technology Ltd.)
DRV - (sisagp [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (Sparrow [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (STHDA [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (symc810 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (symc8xx [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (sym_hi [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (sym_u3 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (ultra [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (upperdev [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys (Windows ® Codename Longhorn DDK provider)
DRV - (Usb5200 [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usb5200.sys (Atarimax)
DRV - (usbser [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser.sys (Microsoft Corporation)
DRV - (UsbserFilt [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys (Windows ® Codename Longhorn DDK provider)
DRV - (XGUSBV4 [Auto | Stopped]) -- C:\WINDOWS\System32\Drivers\SlimLoaderV4.sys (XingA)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.euro.del.......;l=en&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.client...arch.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.client...arch.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.del.......;l=en&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://uk.red.client...fo/bt_side.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.client...arch.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...m...tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/03/06 14:58:36 | 00,000,000 | ---D | M]

O1 HOSTS File: (727 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SidebarAutoLaunch Class) - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" (ATI Technologies, Inc.)
O4 - HKLM..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe File not found
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r (Creative Technology Ltd)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe (Intel Corporation)
O4 - HKLM..\Run: [internat] C:\WINDOWS\internat.exe File not found
O4 - HKLM..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon File not found
O4 - HKLM..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall File not found
O4 - HKLM..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray (Napster)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Computer, Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKLM..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u File not found
O4 - HKLM..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray (Andrea Electronics Corporation)
O4 - HKCU..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R (Creative Technology Ltd)
O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [SetDefaultMIDI] MIDIDef.exe (Creative Technology Ltd)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra Button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [Tcpip] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [NTDS] - C:\WINDOWS\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [Network Location Awareness (NLA) Namespace] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [NWLink IPX/SPX/NetBIOS Compatible Transport Protocol] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [PSP] - C:\WINDOWS\system32\lspoky.dll (Adobe)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} http://download.sopc...oad/SOPCORE.CAB (SopCore Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} http://www.ooxtv.com/livetv.ocx (KooPlayer Control)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: Install247 http://www.netsuppor...stallClient.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Filter: - application/octet-stream - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-complus - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-internet-signup - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O18 - Protocol\Filter: - application/x-msdownload - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - Class Install Handler - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - deflate - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - gzip - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - lzdhtml - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/webviewhtml - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\intel32.exe) - C:\WINDOWS\system32\intel32.exe [FILE handle not seen by OS]
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\system32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\system32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\system32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\system32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\system32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\System32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\system32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\system32\WlNotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\system32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\Your Image File Name Here without a path: Debugger - C:\WINDOWS\System32\ntsd.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\system32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\system32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\system32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\system32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 05:43:04 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\setup.exe -- [2008/04/14 01:12:34 | 00,023,040 | ---- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009/06/06 20:40:44 | 00,000,000 | ---D | M]

========== Files/Folders - Created Within 30 Days ==========

[1 C:\WINDOWS\*.tmp files]
[2009/06/07 08:32:41 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2009/06/06 20:40:43 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\William Hosie\Desktop\OTL.exe
[2009/06/05 10:06:32 | 00,000,000 | ---D | C] -- C:\spoolerlogs
[2009/05/27 08:38:06 | 00,000,000 | ---D | C] -- C:\ERDNT
[2009/05/27 08:38:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2009/05/27 08:38:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/05/27 08:37:53 | 00,000,000 | ---D | C] -- C:\!FixIEDef
[2009/05/26 00:25:42 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Napster Shared
[2009/05/26 00:24:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\William Hosie\Application Data\InstallShield
[2009/05/16 23:28:58 | 00,025,205 | ---- | C] () -- C:\Documents and Settings\William Hosie\Desktop\Ryanair_comitinery.htm
[2009/05/16 23:28:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\William Hosie\Desktop\Ryanair_comitinery_files
[2009/05/12 16:54:56 | 00,001,270 | ---- | C] () -- C:\Documents and Settings\William Hosie\Desktop\Booking Confirm.htm
[2008/07/13 10:24:20 | 00,000,018 | ---- | C] () -- C:\WINDOWS\avi2divx.INI
[2008/03/04 19:52:34 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\libcurl.dll
[2007/10/31 10:39:54 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2007/05/17 14:58:10 | 00,143,360 | ---- | C] () -- C:\WINDOWS\System32\libexpatw.dll
[2007/03/29 23:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2006/12/23 17:27:30 | 00,000,022 | ---- | C] () -- C:\WINDOWS\kodakpcd.William Hosie.ini
[2006/09/07 09:52:09 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\YCRWin32.dll
[2006/05/12 20:28:58 | 00,002,090 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/04/16 14:53:30 | 00,005,852 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/04/16 14:53:30 | 00,000,104 | RHS- | C] () -- C:\WINDOWS\System32\FAE7C63E8D.sys
[2006/04/16 14:22:24 | 00,000,525 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2006/04/16 10:53:34 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\usb5200.dll
[2006/04/16 10:29:05 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/04/16 07:26:48 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/04/02 17:12:18 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2006/03/21 11:27:36 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/03/21 11:24:26 | 00,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/03/21 11:15:36 | 00,005,811 | ---- | C] () -- C:\WINDOWS\System32\CTSBMB.INI
[2006/03/21 10:50:02 | 00,004,969 | ---- | C] () -- C:\WINDOWS\System32\Sigfilt.ini
[2006/03/21 10:50:02 | 00,000,029 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2006/03/21 10:49:46 | 01,345,520 | ---- | C] () -- C:\WINDOWS\System32\CTMBHA.DLL
[2006/03/21 10:49:20 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\hcwXDS.dll
[2006/03/21 10:48:54 | 00,000,475 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/11/10 09:56:34 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/16 05:37:24 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 05:18:43 | 00,000,603 | ---- | C] () -- C:\WINDOWS\win.ini
[2005/08/16 05:18:41 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2005/08/05 15:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[1999/07/05 11:00:00 | 00,073,906 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dll

========== Files - Modified Within 30 Days ==========

[10 C:\WINDOWS\System32\*.tmp files]
[1 C:\WINDOWS\*.tmp files]
[2009/06/07 08:30:39 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/06/07 08:30:37 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\William Hosie\Local Settings\desktop.ini
[2009/06/07 08:30:34 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/06/07 08:30:31 | 53,492,5312 | -HS- | M] () -- C:\hiberfil.sys
[2009/06/06 20:40:44 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\William Hosie\Desktop\OTL.exe
[2009/06/04 18:49:41 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/06/01 17:06:54 | 00,000,727 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/05/26 13:20:08 | 00,040,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/05/26 13:19:56 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/05/26 00:24:45 | 00,001,544 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Napster.lnk
[2009/05/19 07:50:48 | 00,002,483 | ---- | M] () -- C:\Documents and Settings\William Hosie\Desktop\Microsoft Word.lnk
[2009/05/16 23:28:59 | 00,025,205 | ---- | M] () -- C:\Documents and Settings\William Hosie\Desktop\Ryanair_comitinery.htm
[2009/05/12 16:54:56 | 00,001,270 | ---- | M] () -- C:\Documents and Settings\William Hosie\Desktop\Booking Confirm.htm

========== LOP Check ==========

[2009/04/13 20:38:18 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
[2006/11/25 19:29:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2006/04/16 10:29:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AOL
[2009/04/04 19:49:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg7
[2009/04/04 19:51:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg8
[2008/07/13 00:05:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2006/03/21 11:15:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Creative Labs
[2005/08/16 21:54:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DIGStream
[2009/03/03 14:42:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2006/03/21 11:19:51 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\GTek
[2008/04/24 18:57:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
[2006/03/21 11:20:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallShield
[2007/01/27 09:46:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iolo
[2007/01/07 18:31:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kodak
[2009/04/04 20:48:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[2008/12/07 11:19:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2006/03/21 11:24:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2006/09/13 19:30:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee.com
[2006/08/31 18:16:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee.com Personal Firewall
[2009/01/27 13:41:33 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2006/07/15 07:48:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster
[2009/01/27 13:40:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
[2006/03/21 11:22:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QuickTime
[2006/09/27 20:13:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2006/03/21 11:14:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sonic
[2009/04/04 20:00:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2006/04/16 14:22:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2006/04/16 14:22:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanWizard
[2008/12/08 10:52:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/04/13 20:38:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TVU Networks
[2006/03/21 11:22:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2006/05/03 07:00:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2006/09/07 10:04:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\yahoo!
[2008/06/25 11:25:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2008/09/04 19:51:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Zoom Player
[2009/05/26 00:24:40 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\William Hosie\Application Data
[2006/11/25 19:31:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Adobe
[2006/12/02 14:34:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\AdobeUM
[2006/04/16 10:29:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\AOL
[2006/04/16 14:29:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\ArcSoft
[2009/03/03 14:42:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\AVG7
[2008/07/13 00:05:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\AVS4YOU
[2009/05/02 21:07:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Canon
[2006/03/21 11:21:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Corel
[2006/04/16 14:53:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Corel Photo Album
[2006/10/14 13:00:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Creative
[2009/03/14 20:48:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\FreeStone Group
[2008/12/16 18:33:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Google
[2006/03/21 11:19:51 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\William Hosie\Application Data\Gtek
[2006/09/13 19:06:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Help
[2005/08/16 05:50:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Identities
[2009/05/26 00:24:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\InstallShield
[2007/01/24 18:22:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\iolo
[2006/04/16 10:32:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Leadertech
[2008/12/22 13:26:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\LimeWire
[2006/04/01 18:45:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Macromedia
[2008/12/07 11:19:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Malwarebytes
[2006/04/01 21:10:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\McAfee.com Personal Firewall
[2006/12/07 21:04:14 | 00,000,000 | --SD | M] -- C:\Documents and Settings\William Hosie\Application Data\Microsoft
[2008/05/18 10:25:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Nokia
[2008/03/31 11:27:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Nokia Multimedia Player
[2008/02/13 13:35:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\PC Suite
[2008/04/24 21:52:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Real
[2009/05/26 08:57:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Roxio
[2006/04/16 14:22:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\ScanSoft
[2006/04/16 10:32:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Sonic
[2006/08/22 15:17:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Spectaculator
[2006/03/21 11:08:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Sun
[2009/04/13 20:37:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\TVU networks
[2007/10/09 15:33:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\vlc
[2006/09/07 09:57:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\Yahoo!
[2006/03/21 11:22:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William Hosie\Application Data\You've Got Pictures Screensaver
[2009/04/24 12:02:00 | 00,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2004/08/10 06:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/06/07 08:30:39 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
< End of report >

======================================================================================
======================================================================================

Here is the copied text from the Extras.txt file:

OTL Extras logfile created on: 07/06/2009 08:42:11 - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\William Hosie\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

510.07 Mb Total Physical Memory | 206.11 Mb Available Physical Memory | 40.41% Memory free
1.22 Gb Paging File | 0.99 Gb Available in Paging File | 81.21% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.32 Gb Total Space | 32.33 Gb Free Space | 22.40% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WMHOSIE06
Current User Name: William Hosie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = YBrowser.HTML] -- C:\Program Files\Yahoo!\browser\ybrowser.exe (Yahoo!, Inc.)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"1226:UDP" = 1226:UDP:*:Enabled:Windows Media Format SDK (wmplayer.exe)
"1227:UDP" = 1227:UDP:*:Enabled:Windows Media Format SDK (wmplayer.exe)
"1229:UDP" = 1229:UDP:*:Enabled:Windows Media Format SDK (wmplayer.exe)

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 (Microsoft Corporation)
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL File not found
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL File not found
C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL File not found
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 (Microsoft Corporation)
C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger (Microsoft Corporation)
C:\Program Files\Yahoo!\Messenger\ypager.exe:*:Enabled:Yahoo! Messenger ()
C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server (Yahoo! Inc.)
C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer (RealNetworks, Inc.)
C:\Program Files\BT Home Hub\Help\SmartBridge\BTHelpNotifier.exe:*:Disabled:BTHelpNotifier Module File not found
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Disabled:Kodak Software Updater File not found
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare File not found
C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer (Microsoft Corporation)
C:\Program Files\TVAnts\Tvants.exe:*:Enabled:TVAnts (Zhejiang University)
C:\Program Files\SopCast\adv\SopAdver.exe:*:Disabled:SopCast Adver (www.sopcast.com)
C:\Program Files\TVUPlayer\TVUPlayer.exe:*:Enabled:TVUPlayer Component (TVU networks)
C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application (www.sopcast.com)
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Disabled:AOL File not found
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Disabled:AOL File not found
C:\Program Files\AOL 9.0\waol.exe:*:Disabled:AOL File not found
C:\Program Files\LimeWire\LimeWire.exe:*:Disabled:LimeWire File not found

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03CE1BCB-03F5-4C6A-B37E-69799AA3C544}" = SpyHunter
"{03F1CC67-5BD8-4C36-8394-76311B2AE69A}" = ArcSoft PhotoStudio 5
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0FC76B71-2534-4354-B255-3468578E3F47}" = Nokia PC Suite
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA
"{1D3C662A-F6C6-4767-A788-7AA43A9A1317}" = ARTEuro
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Roxio MyDVD LE
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 12
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{3248F0A8-6813-11D6-A77B-00B0D0150030}" = J2SE Runtime Environment 5.0 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold
"{43CAC9A1-1993-4F65-9096-7C9AFC2BBF54}" = Dell CinePlayer
"{4F1DCA42-2030-437C-A94E-736692A499C1}" = Nokia Connectivity Cable Driver
"{53C6D09E-EAB6-49E5-BA4C-BA7FF13830FB}" = Sound Blaster Audigy ADVANCED MB
"{58B2B6D3-E5FF-4D16-87AC-52CC5717C7C6}" = Tiscali Internet
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module
"{6249C22D-E6A8-407B-BA8B-40298848ED94}" = OmniPage SE
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA}" = Intel® PROSet for Wired Connections
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D2AE3F6-79DF-423C-91CB-389F6FB5837B}" = Andrea VoiceCenter
"{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Napster Burn Engine
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{AAB5FB61-7B8D-4E0C-83F4-1E107B0205BA}" = NEO Power Kit
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy
"{B360A8E5-C171-4AAE-9777-65B3CDB0072C}" = CanoScan LiDE20,30 Manual
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7AC5A96-C8BC-431C-B661-27A09781DFA8}" = Wanadoo Europe Installer
"{BBBCAE4B-B416-4182-A6F2-438180894A81}" = Napster
"{BCE46757-7674-4416-BEDB-68205A60409E}" = Canon CanoScan Toolbox 4.1
"{C335649B-351B-4865-8136-F92D23340CF6}" = Spectaculator 6.25
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{EFD0BFEB-980E-491B-833B-A8848E5E0F0F}" = Hyplay
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)
"6A630DCEC5EEC912115F2FF59D8C2C769798D930" = Windows Driver Package - Nokia Modem (10/12/2007 3.6)
"819D45A9F73817F5B6D7C71A33ADAB88C5DA1765" = Windows Driver Package - Nokia Modem (08/03/2007 6.84.0.2)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AOL YGP Screensaver" = AOL You've Got Pictures Screensaver
"Atarimax ColecoVision Multi-Cart Studio" = Atarimax ColecoVision Multi-Cart Studio
"ATI Display Driver" = ATI Display Driver
"avi2divx_is1" = avi2divx
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.2
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"BT Home Hub" = BT Home Hub
"BT Yahoo! Applications" = BT Yahoo! Applications
"BTTotalBroadband220V" = BTTotalBroadband220V
"CBF192A85B624E32B8D19ADEEF2DCFC5BC3AA73A" = Windows Driver Package - Nokia Modem (03/05/2008 3.7)
"Cool MP3 Converter_is1" = Cool MP3 Converter V1.86
"DellSupport" = Dell Support 5.0.0 (630)
"DirectVobSub" = DirectVobSub (remove only)
"E092B2EBF2FFE83E896F8F7F829A7B5D7D1B2F9D" = Windows Driver Package - Nokia Modem (03/13/2008 6.86.0.1)
"EmeraldQFE2" = Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
"EPSON Printer and Utilities" = EPSON Printer Software
"ESPNMotion" = ESPNMotion
"FLVPlayer" = FLV Player 1.3.3
"Free YouTube Download_is1" = Free YouTube Download 2.2
"GoogleVideoPlayer" = Google Video Player
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"Intel® 537EP V9x DF PCI Modem" = Intel® 537EP V9x DF PCI Modem
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"Playbin" = Cuttle Cart Playbin (remove only)
"PROSet" = Intel® PRO Network Connections Drivers
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer
"save2pc Light_is1" = save2pc Light 3.24
"SopCast" = SopCast 2.0.4
"Sound Blaster Audigy ADVANCED MB Product Registration" = Sound Blaster Audigy ADVANCED MB Product Registration
"StreetPlugin" = Learn2 Player (Uninstall Only)
"TVAnts 1.0" = TVAnts 1.0
"TVUPlayer" = TVUPlayer 2.4.5.1
"Uninstall_is1" = Uninstall 1.0.0.1
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VideoLAN VLC media player 0.8.6c
"WAV-PRG" = Uninstall WAV-PRG and Audiotap
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5
"Yahoo! Toolbar" = Yahoo! Toolbar
"ZoomPlayer" = Zoom Player (remove only)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Magical Glass" = Magical Glass

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 07/06/2009 03:32:25 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

Error - 07/06/2009 03:32:35 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

Error - 07/06/2009 03:32:40 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

Error - 07/06/2009 03:32:44 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

Error - 07/06/2009 03:32:48 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

Error - 07/06/2009 03:32:53 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

Error - 07/06/2009 03:32:56 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

Error - 07/06/2009 03:33:00 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

Error - 07/06/2009 03:33:03 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

Error - 07/06/2009 03:36:50 | Computer Name = WMHOSIE06 | Source = Application Error | ID = 1000
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module lspoky.dll, version 1.0.0.1, fault address 0x00004290.

[ System Events ]
Error - 06/06/2009 15:40:29 | Computer Name = WMHOSIE06 | Source = Service Control Manager | ID = 7034
Description = The Print Spooler service terminated unexpectedly. It has done this
3 time(s).

Error - 06/06/2009 16:56:14 | Computer Name = WMHOSIE06 | Source = Service Control Manager | ID = 7000
Description = The XGUSBV4 service failed to start due to the following error: %%1058

Error - 06/06/2009 16:56:15 | Computer Name = WMHOSIE06 | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 06/06/2009 16:59:20 | Computer Name = WMHOSIE06 | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
2 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 06/06/2009 17:02:24 | Computer Name = WMHOSIE06 | Source = Service Control Manager | ID = 7034
Description = The Print Spooler service terminated unexpectedly. It has done this
3 time(s).

Error - 07/06/2009 03:30:40 | Computer Name = WMHOSIE06 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.2 for the Network Card with network
address 00123FCB74B6 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 07/06/2009 03:31:07 | Computer Name = WMHOSIE06 | Source = Service Control Manager | ID = 7000
Description = The XGUSBV4 service failed to start due to the following error: %%1058

Error - 07/06/2009 03:31:08 | Computer Name = WMHOSIE06 | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 07/06/2009 03:33:43 | Computer Name = WMHOSIE06 | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
2 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 07/06/2009 03:36:50 | Computer Name = WMHOSIE06 | Source = Service Control Manager | ID = 7034
Description = The Print Spooler service terminated unexpectedly. It has done this
3 time(s).

< End of report >

======================================================================================
======================================================================================

Here is the text from the results.log file:

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-07 11:23:51
Windows 5.1.2600 Service Pack 3

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 10006F50 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!CryptGenKey 77E11849 5 Bytes JMP 100050B0 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] wininet.dll!InternetCreateUrlA + 1A5 771C26FC 5 Bytes JMP 10006940 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] wininet.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 100055E0 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] wininet.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 100060A0 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] wininet.dll!InternetReadFile 771C82F2 5 Bytes JMP 10003000 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 10002FD0 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] wininet.dll!InternetGetCookieExA 771D9526 5 Bytes JMP 10002A00 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] wininet.dll!InternetReadFileExW 771F8529 5 Bytes JMP 10003030 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] wininet.dll!InternetReadFileExA 771F9230 5 Bytes JMP 10003060 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] wininet.dll!InternetSetCookieExW 7721607A 5 Bytes JMP 100027A0 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\system32\svchost.exe[960] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 100050C0 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\System32\svchost.exe[1156] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 10006F50 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\System32\svchost.exe[1156] ADVAPI32.dll!CryptGenKey 77E11849 5 Bytes JMP 100050B0 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\System32\svchost.exe[1156] WININET.dll!InternetGetCookieExA 771D9526 5 Bytes JMP 10002A00 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)
.text C:\WINDOWS\System32\svchost.exe[1156] WININET.dll!InternetSetCookieExW 7721607A 5 Bytes JMP 100027A0 C:\WINDOWS\system32\lspoky.dll (LSP Dynamic Link Library/Adobe)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00405030
IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00404FCB
IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00404F99
IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\fxssvc.exe[184] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00405030
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00404FCB
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00404F99
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\svchost.exe[504] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\system32\CTsvcCDA.exe[540] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00405030
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00404FCB
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00404F99
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\System32\svchost.exe[552] @ C:\WINDOWS\System32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 000750E4
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00075030
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00074FCB
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00074F99
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0007539D
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 0007539D
IAT C:\WINDOWS\eHome\ehRecvr.exe[648] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 000750E4
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 000750E4
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00075030
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00074FCB
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00074F99
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0007539D
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 0007539D
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\eHome\ehSched.exe[704] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 000750E4
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\services.exe [ntdll.dll!NtQueryDirectoryFile] 00D050E4
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 00D050E4
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00D05030
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00D04FCB
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00D04F99
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 00D050E4
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 00D0564F
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 00D0539D
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 00D0564F
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 00D0539D
IAT C:\WINDOWS\system32\services.exe[728] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 00D0564F
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 00DB50E4
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00DB5030
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00DB4FCB
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00DB4F99
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\LSASRV.dll [ntdll.dll!LdrLoadDll] 00DB5030
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 00DB50E4
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\SAMSRV.dll [ntdll.dll!LdrLoadDll] 00DB5030
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\SAMSRV.dll [ntdll.dll!LdrGetProcedureAddress] 00DB4FCB
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 00DB539D
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 00DB564F
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 00DB564F
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 00DB539D
IAT C:\WINDOWS\system32\lsass.exe[740] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 00DB564F
IAT C:\WINDOWS\system32\svchost.exe[960] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00A94F99
IAT C:\WINDOWS\system32\svchost.exe[1060] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 00BB50E4
IAT C:\WINDOWS\system32\svchost.exe[1060] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00BB5030
IAT C:\WINDOWS\system32\svchost.exe[1060] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00BB4FCB
IAT C:\WINDOWS\system32\svchost.exe[1060] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00BB4F99
IAT C:\WINDOWS\system32\svchost.exe[1060] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 00BB539D
IAT C:\WINDOWS\system32\svchost.exe[1060] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 00BB564F
IAT C:\WINDOWS\system32\svchost.exe[1060] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 00BB564F
IAT C:\WINDOWS\system32\svchost.exe[1060] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 00BB539D
IAT C:\WINDOWS\system32\svchost.exe[1060] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 00BB564F
IAT C:\WINDOWS\system32\svchost.exe[1060] @ c:\windows\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 00BB50E4
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Java\jre6\bin\jqs.exe[1096] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\System32\svchost.exe[1156] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 016950E4
IAT C:\WINDOWS\System32\svchost.exe[1156] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 01695030
IAT C:\WINDOWS\System32\svchost.exe[1156] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 01694FCB
IAT C:\WINDOWS\System32\svchost.exe[1156] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 01694F99
IAT C:\WINDOWS\System32\svchost.exe[1156] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0169539D
IAT C:\WINDOWS\System32\svchost.exe[1156] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0169564F
IAT C:\WINDOWS\System32\svchost.exe[1156] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0169564F
IAT C:\WINDOWS\System32\svchost.exe[1156] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0169539D
IAT C:\WINDOWS\System32\svchost.exe[1156] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0169564F
IAT C:\WINDOWS\System32\svchost.exe[1156] @ c:\windows\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 016950E4
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 006350E4
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00635030
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00634FCB
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00634F99
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0063539D
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0063564F
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0063564F
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0063539D
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0063564F
IAT C:\WINDOWS\system32\svchost.exe[1216] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 006350E4
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 000750E4
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00075030
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00074FCB
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00074F99
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0007539D
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 000750E4
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 0007539D
IAT C:\WINDOWS\ehome\mcrdsvc.exe[1336] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00405030
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00404FCB
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00404F99
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\dllhost.exe[1424] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00405030
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00404FCB
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00404F99
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\svchost.exe[1432] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\Explorer.EXE [USER32.dll!TranslateMessage] 0120564F
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 012050E4
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 01205030
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 01204FCB
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 01204F99
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0120539D
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0120564F
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0120564F
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0120564F
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0120539D
IAT C:\WINDOWS\Explorer.EXE[1652] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 012050E4
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00405030
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00404FCB
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00404F99
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00405030
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00404FCB
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00404F99
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\System32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\System32\alg.exe[2140] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\4evto235.exe[2284] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 000750E4
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00075030
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00074FCB
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00074F99
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0007539D
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0007539D
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0007564F
IAT C:\WINDOWS\ehome\ehtray.exe[2348] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 000750E4
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\stsystra.exe[2368] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2392] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[2404] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00405030
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00404FCB
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00404F99
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0040539D
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0040564F
IAT C:\WINDOWS\system32\Rundll32.exe[2420] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 004050E4
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2464] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2512] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Java\jre6\bin\jusched.exe[2552] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\clclean.0001[2628] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe[2692] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrLoadDll] 00135030
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!LdrGetProcedureAddress] 00134FCB
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateThread] 00134F99
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\shell32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetClipboardData] 0013539D
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!TranslateMessage] 0013564F
IAT C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe[2760] @ C:\WINDOWS\system32\WS2HELP.dll [ntdll.dll!NtQueryDirectoryFile] 001350E4

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Fastfat \Fat B9CF2D20
Device \FileSystem\Fastfat \Fat B9D02428
Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\intel32.exe 294400 bytes executable
File C:\WINDOWS\system32\polime 0 bytes
File C:\WINDOWS\system32\polime\duco.ss 143626 bytes
File C:\WINDOWS\system32\polime\duco.ss.lll 109596 bytes
File C:\WINDOWS\system32\polime\locks.pss 24320 bytes

---- EOF - GMER 1.0.15 ----

======================================================================================
======================================================================================

Hope that's of use to you guys

BTW I put in the =========== lines just to separate things for you.

#4
kahdah

Posted 07 June 2009 - 07:32 AM

GeekU Teacher

Retired Staff
15,822 posts

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [internat] C:\WINDOWS\internat.exe File not found
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\intel32.exe) - C:\WINDOWS\system32\intel32.exe [FILE handle not seen by OS]

:files
C:\WINDOWS\system32\polime

:Commands
[emptytemp]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.

================================Malwarebytes' Anti-Malware=================================
Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.
================================Follow up scan=================================

Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open one notepad window. OTListIt.Txt a This is saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

#5
Spector438

Posted 08 June 2009 - 10:05 AM

New Member

Member
1 posts

I'm actually Spector437, but I can't get into my thread about the win32.agent.pz virus anymore. After doing an OTL scan, my cookies were disabled upon restart, and I am not allowed into my account to post log files. Can someone please help me out here? Sorry for the hassle, but I just need into my Spector437 account, that's all.

#6
JSntgRvr

Posted 08 June 2009 - 01:38 PM

Global Moderator

Global Moderator
11,579 posts

I'm actually Spector437, but I can't get into my thread about the win32.agent.pz virus anymore. After doing an OTL scan, my cookies were disabled upon restart, and I am not allowed into my account to post log files. Can someone please help me out here? Sorry for the hassle, but I just need into my Spector437 account, that's all.

Try again. Send me a Private message if you still experiencing this issue.

#7
Spector437

Posted 08 June 2009 - 02:18 PM

Member

Topic Starter
Member
39 posts

Hi again

I'm in!

Here's the log file for the first OTL scan:

========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Search_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\CustomSearch| /E : value set successfully!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F2CF5485-4E02-4F68-819C-B92DE9277049} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2CF5485-4E02-4F68-819C-B92DE9277049}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\internat deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\WINDOWS\system32\intel32.exe deleted successfully.
File move failed. C:\WINDOWS\system32\intel32.exe scheduled to be moved on reboot.
========== FILES ==========
File\Folder C:\WINDOWS\system32\polime not found.
========== COMMANDS ==========
File delete failed. C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001.dir.1382\~df394b.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001.dir.1382\~efe2.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_738.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.

OTL by OldTimer - Version 2.1.1.0 log created on 06082009_154535

Files moved on Reboot...
File move failed. C:\WINDOWS\system32\intel32.exe scheduled to be moved on reboot.
File C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001.dir.1382\~df394b.tmp not found!
File C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001.dir.1382\~efe2.tmp not found!
C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001 moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_738.dat not found!

Registry entries deleted on Reboot...

Here's the log file from Malwarebytes' full scan:

Malwarebytes' Anti-Malware 1.37
Database version: 2248
Windows 5.1.2600 Service Pack 3

08/06/2009 16:25:46
mbam-log-2009-06-08 (16-25-46).txt

Scan type: Full Scan (C:\|)
Objects scanned: 211739
Time elapsed: 32 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\$ntservicepackuninstall$\taskmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Finally here's the log file from the second OTL scan:

OTL logfile created on: 08/06/2009 16:48:26 - Run 2
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\William Hosie\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

510.07 Mb Total Physical Memory | 238.57 Mb Available Physical Memory | 46.77% Memory free
1.22 Gb Paging File | 1.01 Gb Available in Paging File | 82.76% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.32 Gb Total Space | 32.36 Gb Free Space | 22.42% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WMHOSIE06
Current User Name: William Hosie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
PRC - C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe (Intel Corporation)
PRC - C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
PRC - C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001 (Macrovision Europe Ltd.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\system32\CTsvcCDA.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
PRC - C:\Program Files\Yahoo!\browser\ycommon.exe (Yahoo!, Inc.)
PRC - C:\Documents and Settings\William Hosie\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Running]) -- C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (Creative Labs Licensing Service [On_Demand | Running]) -- C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
SRV - (Creative Service for CDROM Access [Auto | Running]) -- C:\WINDOWS\system32\CTsvcCDA.exe (Creative Technology Ltd)
SRV - (ehRecvr [Auto | Running]) -- C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation)
SRV - (ehSched [Auto | Running]) -- C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (McrdSvc [Auto | Running]) -- C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation)
SRV - (MHN [On_Demand | Stopped]) -- C:\WINDOWS\System32\mhn.dll (Microsoft Corporation)
SRV - (NetSvc [On_Demand | Stopped]) -- C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe (Intel® Corporation)
SRV - (ServiceLayer [On_Demand | Stopped]) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (YPCService [On_Demand | Stopped]) -- C:\WINDOWS\system32\YPcservice.exe (Yahoo! Inc.)

========== Driver Services (SafeList) ==========

DRV - (AliIde [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (amdagp [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (asc [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (ati2mtag [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (CmdIde [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (ctsfm2k [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys (Creative Technology Ltd)
DRV - (CTUSFSYN [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\ctusfsyn.sys (Creative Technology Ltd.)
DRV - (dac2w2k [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (DLABOIOM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLACDBHM [System | Running]) -- C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLADResN [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLAIFS_M [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLAOPIOM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLARTL_N [System | Running]) -- C:\WINDOWS\System32\Drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DLAUDFAM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DRVMCDB [Boot | Running]) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DRVNDDM [Auto | Running]) -- C:\WINDOWS\System32\Drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (E100B [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (hcwPP2 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\hcwPP2.sys (Hauppauge Computer Works, Inc.)
DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (IntelC51 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\IntelC51.sys (Intel Corporation)
DRV - (IntelC52 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\IntelC52.sys (Intel Corporation)
DRV - (IntelC53 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\IntelC53.sys (Intel Corporation)
DRV - (MODEMCSA [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (mohfilt [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\mohfilt.sys (Intel Corporation)
DRV - (mraid35x [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (nmwcd [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdc [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (NwlnkIpx [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys (Microsoft Corporation)
DRV - (ossrv [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ctoss2k.sys (Creative Technology Ltd.)
DRV - (pccsmcfd [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys (Nokia)
DRV - (PfModNT [Auto | Running]) -- C:\WINDOWS\system32\drivers\PfModNT.sys (Creative Technology Ltd.)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ql1080 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql12160 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1280 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (sigfilt [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sigfilt.sys (Creative Technology Ltd.)
DRV - (sisagp [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (Sparrow [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (STHDA [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (symc810 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (symc8xx [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (sym_hi [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (sym_u3 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (ultra [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (upperdev [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys (Windows ® Codename Longhorn DDK provider)
DRV - (Usb5200 [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usb5200.sys (Atarimax)
DRV - (usbser [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser.sys (Microsoft Corporation)
DRV - (UsbserFilt [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys (Windows ® Codename Longhorn DDK provider)
DRV - (XGUSBV4 [Auto | Stopped]) -- C:\WINDOWS\System32\Drivers\SlimLoaderV4.sys (XingA)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.euro.del.......;l=en&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.del.......;l=en&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.client...arch.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...m...tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/03/06 14:58:36 | 00,000,000 | ---D | M]

O1 HOSTS File: (727 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SidebarAutoLaunch Class) - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" (ATI Technologies, Inc.)
O4 - HKLM..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe File not found
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r (Creative Technology Ltd)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe (Intel Corporation)
O4 - HKLM..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon File not found
O4 - HKLM..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall File not found
O4 - HKLM..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray (Napster)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Computer, Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKLM..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u File not found
O4 - HKLM..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray (Andrea Electronics Corporation)
O4 - HKCU..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R (Creative Technology Ltd)
O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [SetDefaultMIDI] MIDIDef.exe (Creative Technology Ltd)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra Button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [Tcpip] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [NTDS] - C:\WINDOWS\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [Network Location Awareness (NLA) Namespace] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [NWLink IPX/SPX/NetBIOS Compatible Transport Protocol] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [PSP] - C:\WINDOWS\system32\lspoky.dll (Adobe)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} http://download.sopc...oad/SOPCORE.CAB (SopCore Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} http://www.ooxtv.com/livetv.ocx (KooPlayer Control)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: Install247 http://www.netsuppor...stallClient.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Filter: - application/octet-stream - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-complus - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-internet-signup - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O18 - Protocol\Filter: - application/x-msdownload - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - Class Install Handler - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - deflate - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - gzip - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - lzdhtml - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/webviewhtml - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - c:\windows\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\intel32.exe) - C:\WINDOWS\system32\intel32.exe ()
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\system32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\system32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\system32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\system32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\system32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\System32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\system32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\system32\WlNotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\system32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\Your Image File Name Here without a path: Debugger - C:\WINDOWS\System32\ntsd.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\system32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\system32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\system32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\system32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 05:43:04 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\setup.exe -- [2008/04/14 01:12:34 | 00,023,040 | ---- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009/06/08 15:49:33 | 00,000,000 | ---D | M]

========== Files/Folders - Created Within 30 Days ==========

[1 C:\WINDOWS\*.tmp files]
[2009/06/08 15:45:35 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/06/07 08:44:50 | 00,286,208 | ---- | C] () -- C:\4evto235.exe
[2009/06/06 20:40:43 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\William Hosie\Desktop\OTL.exe
[2009/06/05 10:06:32 | 00,000,000 | ---D | C] -- C:\spoolerlogs
[2009/05/27 08:38:06 | 00,000,000 | ---D | C] -- C:\ERDNT
[2009/05/27 08:38:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2009/05/27 08:38:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/05/27 08:37:53 | 00,000,000 | ---D | C] -- C:\!FixIEDef
[2009/05/26 00:25:42 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Napster Shared
[2009/05/26 00:24:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\William Hosie\Application Data\InstallShield
[2009/05/16 23:28:58 | 00,025,205 | ---- | C] () -- C:\Documents and Settings\William Hosie\Desktop\Ryanair_comitinery.htm
[2009/05/16 23:28:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\William Hosie\Desktop\Ryanair_comitinery_files
[2009/05/12 16:54:56 | 00,001,270 | ---- | C] () -- C:\Documents and Settings\William Hosie\Desktop\Booking Confirm.htm
[2008/07/13 10:24:20 | 00,000,018 | ---- | C] () -- C:\WINDOWS\avi2divx.INI
[2008/03/04 19:52:34 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\libcurl.dll
[2007/10/31 10:39:54 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2007/05/17 14:58:10 | 00,143,360 | ---- | C] () -- C:\WINDOWS\System32\libexpatw.dll
[2007/03/29 23:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2006/12/23 17:27:30 | 00,000,022 | ---- | C] () -- C:\WINDOWS\kodakpcd.William Hosie.ini
[2006/09/07 09:52:09 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\YCRWin32.dll
[2006/05/12 20:28:58 | 00,002,090 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/04/16 14:53:30 | 00,005,852 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/04/16 14:53:30 | 00,000,104 | RHS- | C] () -- C:\WINDOWS\System32\FAE7C63E8D.sys
[2006/04/16 14:22:24 | 00,000,525 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2006/04/16 10:53:34 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\usb5200.dll
[2006/04/16 10:29:05 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/04/16 07:26:48 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/04/02 17:12:18 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2006/03/21 11:27:36 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/03/21 11:24:26 | 00,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/03/21 11:15:36 | 00,005,811 | ---- | C] () -- C:\WINDOWS\System32\CTSBMB.INI
[2006/03/21 10:50:02 | 00,004,969 | ---- | C] () -- C:\WINDOWS\System32\Sigfilt.ini
[2006/03/21 10:50:02 | 00,000,029 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2006/03/21 10:49:46 | 01,345,520 | ---- | C] () -- C:\WINDOWS\System32\CTMBHA.DLL
[2006/03/21 10:49:20 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\hcwXDS.dll
[2006/03/21 10:48:54 | 00,000,475 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/11/10 09:56:34 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/16 05:37:24 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 05:18:43 | 00,000,603 | ---- | C] () -- C:\WINDOWS\win.ini
[2005/08/16 05:18:41 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2005/08/05 15:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[1999/07/05 11:00:00 | 00,073,906 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dll

========== Files - Modified Within 30 Days ==========

[10 C:\WINDOWS\System32\*.tmp files]
[1 C:\WINDOWS\*.tmp files]
[2009/06/08 16:27:30 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\William Hosie\Local Settings\desktop.ini
[2009/06/08 16:27:30 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/06/08 16:27:28 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/06/08 16:27:26 | 53,492,5312 | -HS- | M] () -- C:\hiberfil.sys
[2009/06/07 08:44:50 | 00,286,208 | ---- | M] () -- C:\4evto235.exe
[2009/06/06 20:40:44 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\William Hosie\Desktop\OTL.exe
[2009/06/04 18:49:41 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/06/01 17:06:54 | 00,000,727 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/05/26 13:20:08 | 00,040,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/05/26 13:19:56 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/05/26 00:24:45 | 00,001,544 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Napster.lnk
[2009/05/19 07:50:48 | 00,002,483 | ---- | M] () -- C:\Documents and Settings\William Hosie\Desktop\Microsoft Word.lnk
[2009/05/16 23:28:59 | 00,025,205 | ---- | M] () -- C:\Documents and Settings\William Hosie\Desktop\Ryanair_comitinery.htm
[2009/05/12 16:54:56 | 00,001,270 | ---- | M] () -- C:\Documents and Settings\William Hosie\Desktop\Booking Confirm.htm
< End of report >

Ta!

#8
kahdah

Posted 17 June 2009 - 05:39 AM

GeekU Teacher

Retired Staff
15,822 posts

Sorry for the delay I was never notified of your reply.

Please download TFC by Old Timer.
Double-click TFC.exe to run the program.
(If using Vista please Right Click and Choose "Run as Administrator")
Click the Start button.
Please reboot when prompted.
==============================================
Please do a scan with Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.

The program will install and then begin downloading the latest definition files.
After the files have been downloaded on the left side of the page in the Scan section select My Computer
This will start the program and scan your system.
The scan will take a while, so be patient and let it run.
Once the scan is complete, click on View scan report
Now, click on the Save Report as button.
Save the file to your desktop.
Copy and paste that information in your next post.

#9
Spector437

Posted 20 June 2009 - 01:23 AM

Member

Topic Starter
Member
39 posts

I couldn't use TFC, I'm afraid. On pressing 'start', a blue screen came up telling me something had terminated unexpectedly and my computer had been shut down to prevent further damage.

Should I continue on and try the Kapersky Online Scanner?

#10
kahdah

Posted 20 June 2009 - 05:18 AM

GeekU Teacher

Retired Staff
15,822 posts

Yes go ahead .

#11
Spector437

Posted 21 June 2009 - 06:32 AM

Member

Topic Starter
Member
39 posts

Hi

Here are the results from the Kaspersky Online Scanner:
======================================================================================
Sunday, June 21, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Sunday, June 21, 2009 10:36:41
Records in database: 2373607

Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes

Scan area My Computer
C:\
D:\

Scan statistics
Files scanned 139516
Threat name 3
Infected objects 8
Suspicious objects 0
Duration of the scan 03:06:01

File name Threat name Threats count
C:\WINDOWS\system32\lspoky.dll/C:\WINDOWS\system32\lspoky.dll Infected: Trojan-PSW.Win32.Agent.mmy 5

C:\WINDOWS\Motive\btbb\UninstallHelper.exe Infected: not-a-virus:RiskTool.Win32.PsKill.1101 1

C:\WINDOWS\system32\calc.tmp Infected: Trojan-Spy.Win32.Zbot.wap 1

C:\WINDOWS\system32\lspoky.dll Infected: Trojan-PSW.Win32.Agent.mmy 1

The selected area was scanned.
==========================================================================

Thanks

#12
kahdah

Posted 21 June 2009 - 08:51 AM

GeekU Teacher

Retired Staff
15,822 posts

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:files
C:\WINDOWS\system32\lspoky.dll
C:\WINDOWS\system32\calc.tmp

:Commands
[emptytemp]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.

================================Follow up scan=================================

Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open one notepad window. OTListIt.Txt a This is saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

#13
Spector437

Posted 22 June 2009 - 01:15 AM

Member

Topic Starter
Member
39 posts

Here's the resul from the Custom Fix:

========== FILES ==========
DllUnregisterServer procedure not found in C:\WINDOWS\system32\lspoky.dll
C:\WINDOWS\system32\lspoky.dll NOT unregistered.
C:\WINDOWS\system32\lspoky.dll moved successfully.
C:\WINDOWS\system32\calc.tmp moved successfully.
========== COMMANDS ==========
File delete failed. C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001.dir.0000\~df394b.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001.dir.0000\~efe2.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_4e4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.

OTL by OldTimer - Version 2.1.1.0 log created on 06222009_074559

Files moved on Reboot...
File C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001.dir.0000\~df394b.tmp not found!
File C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001.dir.0000\~efe2.tmp not found!
C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001 moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_4e4.dat not found!

Registry entries deleted on Reboot...

======================================================================================

Here's the OTL text file:

OTL logfile created on: 22/06/2009 08:11:43 - Run 4
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\William Hosie\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

510.07 Mb Total Physical Memory | 233.16 Mb Available Physical Memory | 45.71% Memory free
1.22 Gb Paging File | 1.00 Gb Available in Paging File | 81.96% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.32 Gb Total Space | 31.81 Gb Free Space | 22.04% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WMHOSIE06
Current User Name: William Hosie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\CTsvcCDA.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation)
PRC - C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
PRC - C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe (Intel Corporation)
PRC - C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\VoiceCenter\AndreaVC.exe (Andrea Electronics Corporation)
PRC - C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
PRC - C:\Documents and Settings\William Hosie\Local Settings\Temp\clclean.0001 (Macrovision Europe Ltd.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Napster\napster.exe (Napster)
PRC - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
PRC - C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe (Creative Technology Ltd)
PRC - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\browser\ycommon.exe (Yahoo!, Inc.)
PRC - C:\Documents and Settings\William Hosie\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Running]) -- C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (Creative Labs Licensing Service [On_Demand | Running]) -- C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
SRV - (Creative Service for CDROM Access [Auto | Running]) -- C:\WINDOWS\system32\CTsvcCDA.exe (Creative Technology Ltd)
SRV - (ehRecvr [Auto | Running]) -- C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation)
SRV - (ehSched [Auto | Running]) -- C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (McrdSvc [Auto | Running]) -- C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation)
SRV - (MHN [On_Demand | Stopped]) -- C:\WINDOWS\System32\mhn.dll (Microsoft Corporation)
SRV - (NetSvc [On_Demand | Stopped]) -- C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe (Intel® Corporation)
SRV - (ServiceLayer [On_Demand | Stopped]) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (YPCService [On_Demand | Stopped]) -- C:\WINDOWS\system32\YPcservice.exe (Yahoo! Inc.)

========== Driver Services (SafeList) ==========

DRV - (AliIde [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (amdagp [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (asc [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (ati2mtag [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (CmdIde [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (ctsfm2k [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys (Creative Technology Ltd)
DRV - (CTUSFSYN [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\ctusfsyn.sys (Creative Technology Ltd.)
DRV - (dac2w2k [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (DLABOIOM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLACDBHM [System | Running]) -- C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLADResN [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLAIFS_M [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLAOPIOM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLARTL_N [System | Running]) -- C:\WINDOWS\System32\Drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DLAUDFAM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DRVMCDB [Boot | Running]) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DRVNDDM [Auto | Running]) -- C:\WINDOWS\System32\Drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (E100B [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (hcwPP2 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\hcwPP2.sys (Hauppauge Computer Works, Inc.)
DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (IntelC51 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\IntelC51.sys (Intel Corporation)
DRV - (IntelC52 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\IntelC52.sys (Intel Corporation)
DRV - (IntelC53 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\IntelC53.sys (Intel Corporation)
DRV - (MODEMCSA [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (mohfilt [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\mohfilt.sys (Intel Corporation)
DRV - (mraid35x [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (nmwcd [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdc [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (NwlnkIpx [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys (Microsoft Corporation)
DRV - (ossrv [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ctoss2k.sys (Creative Technology Ltd.)
DRV - (pccsmcfd [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys (Nokia)
DRV - (PfModNT [Auto | Running]) -- C:\WINDOWS\system32\drivers\PfModNT.sys (Creative Technology Ltd.)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ql1080 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql12160 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1280 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (sigfilt [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sigfilt.sys (Creative Technology Ltd.)
DRV - (sisagp [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (Sparrow [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (STHDA [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (symc810 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (symc8xx [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (sym_hi [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (sym_u3 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (ultra [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (upperdev [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys (Windows ® Codename Longhorn DDK provider)
DRV - (Usb5200 [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usb5200.sys (Atarimax)
DRV - (usbser [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser.sys (Microsoft Corporation)
DRV - (UsbserFilt [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys (Windows ® Codename Longhorn DDK provider)
DRV - (XGUSBV4 [Auto | Stopped]) -- C:\WINDOWS\System32\Drivers\SlimLoaderV4.sys (XingA)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.euro.del.......;l=en&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.del.......;l=en&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.client...arch.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...m...tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/03/06 14:58:36 | 00,000,000 | ---D | M]

O1 HOSTS File: (727 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SidebarAutoLaunch Class) - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" (ATI Technologies, Inc.)
O4 - HKLM..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe File not found
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r (Creative Technology Ltd)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe (Intel Corporation)
O4 - HKLM..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon File not found
O4 - HKLM..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall File not found
O4 - HKLM..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray (Napster)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Computer, Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKLM..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray (Andrea Electronics Corporation)
O4 - HKCU..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R (Creative Technology Ltd)
O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [SetDefaultMIDI] MIDIDef.exe (Creative Technology Ltd)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra Button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [Tcpip] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [NTDS] - C:\WINDOWS\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [Network Location Awareness (NLA) Namespace] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [NWLink IPX/SPX/NetBIOS Compatible Transport Protocol] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [PSP] - C:\WINDOWS\system32\lspoky.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} http://download.sopc...oad/SOPCORE.CAB (SopCore Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} http://www.ooxtv.com/livetv.ocx (KooPlayer Control)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: Install247 http://www.netsuppor...stallClient.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Filter: - application/octet-stream - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-complus - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-internet-signup - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O18 - Protocol\Filter: - application/x-msdownload - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - Class Install Handler - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - deflate - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - gzip - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - lzdhtml - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/webviewhtml - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - c:\windows\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\intel32.exe) - C:\WINDOWS\system32\intel32.exe ()
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\system32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\system32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\system32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\system32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\system32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\System32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\system32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\system32\WlNotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\system32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\Your Image File Name Here without a path: Debugger - C:\WINDOWS\System32\ntsd.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\system32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\system32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\system32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\system32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 05:43:04 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\setup.exe -- [2008/04/14 01:12:34 | 00,023,040 | ---- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009/06/22 07:57:11 | 00,000,000 | ---D | M]

========== Files/Folders - Created Within 30 Days ==========

[1 C:\WINDOWS\*.tmp files]
[2009/06/21 13:29:42 | 00,003,459 | ---- | C] () -- C:\Documents and Settings\William Hosie\Desktop\kaspersky.html
[2009/06/20 08:19:26 | 00,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2009/06/08 15:45:35 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/06/07 08:44:50 | 00,286,208 | ---- | C] () -- C:\4evto235.exe
[2009/06/06 20:40:43 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\William Hosie\Desktop\OTL.exe
[2009/06/05 10:06:32 | 00,000,000 | ---D | C] -- C:\spoolerlogs
[2009/05/27 08:38:06 | 00,000,000 | ---D | C] -- C:\ERDNT
[2009/05/27 08:38:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2009/05/27 08:38:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/05/27 08:37:53 | 00,000,000 | ---D | C] -- C:\!FixIEDef
[2009/05/26 00:25:42 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Napster Shared
[2009/05/26 00:24:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\William Hosie\Application Data\InstallShield
[2008/07/13 10:24:20 | 00,000,018 | ---- | C] () -- C:\WINDOWS\avi2divx.INI
[2008/03/04 19:52:34 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\libcurl.dll
[2007/10/31 10:39:54 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2007/05/17 14:58:10 | 00,143,360 | ---- | C] () -- C:\WINDOWS\System32\libexpatw.dll
[2007/03/29 23:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2006/12/23 17:27:30 | 00,000,022 | ---- | C] () -- C:\WINDOWS\kodakpcd.William Hosie.ini
[2006/09/07 09:52:09 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\YCRWin32.dll
[2006/05/12 20:28:58 | 00,002,090 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/04/16 14:53:30 | 00,005,852 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/04/16 14:53:30 | 00,000,104 | RHS- | C] () -- C:\WINDOWS\System32\FAE7C63E8D.sys
[2006/04/16 14:22:24 | 00,000,525 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2006/04/16 10:53:34 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\usb5200.dll
[2006/04/16 10:29:05 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/04/16 07:26:48 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/04/02 17:12:18 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2006/03/21 11:27:36 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/03/21 11:24:26 | 00,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/03/21 11:15:36 | 00,005,811 | ---- | C] () -- C:\WINDOWS\System32\CTSBMB.INI
[2006/03/21 10:50:02 | 00,004,969 | ---- | C] () -- C:\WINDOWS\System32\Sigfilt.ini
[2006/03/21 10:50:02 | 00,000,029 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2006/03/21 10:49:46 | 01,345,520 | ---- | C] () -- C:\WINDOWS\System32\CTMBHA.DLL
[2006/03/21 10:49:20 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\hcwXDS.dll
[2006/03/21 10:48:54 | 00,000,475 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/11/10 09:56:34 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/16 05:37:24 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 05:18:43 | 00,000,603 | ---- | C] () -- C:\WINDOWS\win.ini
[2005/08/16 05:18:41 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2005/08/05 15:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[1999/07/05 11:00:00 | 00,073,906 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dll

========== Files - Modified Within 30 Days ==========

[9 C:\WINDOWS\System32\*.tmp files]
[1 C:\WINDOWS\*.tmp files]
[2009/06/22 08:00:13 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\William Hosie\Local Settings\desktop.ini
[2009/06/22 08:00:13 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/06/22 08:00:11 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/06/22 08:00:09 | 53,492,5312 | -HS- | M] () -- C:\hiberfil.sys
[2009/06/21 13:29:42 | 00,003,459 | ---- | M] () -- C:\Documents and Settings\William Hosie\Desktop\kaspersky.html
[2009/06/19 14:06:08 | 00,002,483 | ---- | M] () -- C:\Documents and Settings\William Hosie\Desktop\Microsoft Word.lnk
[2009/06/18 15:12:41 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/06/12 13:20:14 | 00,160,344 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/06/12 08:37:58 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/06/07 08:44:50 | 00,286,208 | ---- | M] () -- C:\4evto235.exe
[2009/06/06 20:40:44 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\William Hosie\Desktop\OTL.exe
[2009/06/01 17:51:12 | 23,635,392 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/06/01 17:06:54 | 00,000,727 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/05/26 13:20:08 | 00,040,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/05/26 13:19:56 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/05/26 00:24:45 | 00,001,544 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Napster.lnk
< End of report >

====================================================================================

Hope that's of use to you

#14
kahdah

Posted 22 June 2009 - 05:14 AM

GeekU Teacher

Retired Staff
15,822 posts

Yes how are things running?

#15
Spector437

Posted 22 June 2009 - 08:59 AM

Member

Topic Starter
Member
39 posts

Overall my PC is doing alright, but when I run spybot search and destroy, it still comes up with win32.agent.pz at the same place, so it's still there, if not as active as it was a few weeks ago. There is still the odd automatic reset when I start the PC up as further proof, but overall the system is running a little bit better now.