==================================================
Scan Start Time: 2009/08/25 18:43
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS.0\System32\Drivers\dump_atapi.sys
Address: 0xACF63000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS.0\System32\Drivers\dump_WMILIB.SYS
Address: 0xBA642000 Size: 8192 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS.0\system32\drivers\rootrepeal.sys
Address: 0xAACC3000 Size: 49152 File Visible: No Signed: -
Status: -
Name: srescan.sys
Image Path: srescan.sys
Address: 0xB9DF4000 Size: 81920 File Visible: No Signed: -
Status: -
SSDT
-------------------
#: 031 Function Name: NtConnectPort
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad0f9c30
#: 037 Function Name: NtCreateFile
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad0f64f0
#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad111090
#: 046 Function Name: NtCreatePort
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad0fa320
#: 047 Function Name: NtCreateProcess
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad10e760
#: 048 Function Name: NtCreateProcessEx
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad10e970
#: 050 Function Name: NtCreateSection
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad113310
#: 056 Function Name: NtCreateWaitablePort
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad0fa410
#: 062 Function Name: NtDeleteFile
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad0f6d20
#: 063 Function Name: NtDeleteKey
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad111e90
#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad111ab0
#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad10e0e0
#: 098 Function Name: NtLoadKey
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad112560
#: 099 Function Name: NtLoadKey2
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad1125e0
#: 116 Function Name: NtOpenFile
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad0f6a80
#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad110070
#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad10fe30
#: 192 Function Name: NtRenameKey
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad112dd0
#: 193 Function Name: NtReplaceKey
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad1127a0
#: 200 Function Name: NtRequestWaitReplyPort
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad0f9840
#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad112c20
#: 210 Function Name: NtSecureConnectPort
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad0f9e80
#: 224 Function Name: NtSetInformationFile
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad0f6f90
#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad1115c0
#: 255 Function Name: NtSystemDebugControl
Status: Hooked by "C:\WINDOWS.0\System32\vsdatant.sys" at address 0xad10f0f0
#: 257 Function Name: NtTerminateProcess
Status: Hooked by "C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys" at address 0xad0980b0
==EOF==OTL logfile created on: 8/25/2009 6:47:34 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.0 | %ProgramFiles% = C:\Program Files
Drive C: | 189.91 Gb Total Space | 151.22 Gb Free Space | 79.63% Space Free | Partition Type: NTFS
Drive D: | 654.02 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: JOHN-F7660489A1
Current User Name: Administrator
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Processes (SafeList) ==========
PRC - [2009/04/27 23:30:06 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS.0\System32\Ati2evxx.exe
PRC - [2009/02/16 00:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS.0\System32\ZoneLabs\vsmon.exe
PRC - [2009/04/27 23:30:06 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS.0\System32\Ati2evxx.exe
PRC - [2009/02/12 10:25:40 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\Explorer.EXE
PRC - [2009/08/20 18:36:12 | 00,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe
PRC - [1999/12/12 20:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS.0\System32\CTsvcCDA.EXE
PRC - [2009/08/13 11:35:02 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/08/20 18:36:12 | 00,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgemc.exe
PRC - [2009/08/20 18:36:12 | 00,486,680 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgrsx.exe
PRC - [2009/08/20 18:36:12 | 00,595,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgnsx.exe
PRC - [2009/08/20 18:36:12 | 00,693,016 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgcsrvx.exe
PRC - [2009/07/27 10:33:28 | 00,341,312 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
PRC - [2009/02/16 00:10:22 | 00,981,384 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2009/06/10 11:05:38 | 04,182,784 | ---- | M] (Space Sciences Laboratory) -- C:\Program Files\BOINC\boincmgr.exe
PRC - [2009/06/10 11:05:38 | 00,058,112 | ---- | M] (Space Sciences Laboratory) -- C:\Program Files\BOINC\boinctray.exe
PRC - [2008/12/18 14:32:52 | 00,049,152 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
PRC - [2009/08/20 18:36:13 | 02,007,832 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgtray.exe
PRC - [2009/08/06 18:55:45 | 01,830,128 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2009/03/05 16:07:20 | 02,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/06/10 11:05:34 | 00,758,528 | ---- | M] (Space Sciences Laboratory) -- C:\Program Files\BOINC\boinc.exe
PRC - [2008/12/18 13:19:44 | 00,049,152 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
PRC - [2009/05/17 07:01:36 | 00,843,776 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\BOINC\projects\setiathome.berkeley.edu\AK_v8b_win_SSE3_AMD.exe
PRC - [2009/05/17 07:01:36 | 00,843,776 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\BOINC\projects\setiathome.berkeley.edu\AK_v8b_win_SSE3_AMD.exe
PRC - [2009/05/17 07:01:36 | 00,843,776 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\BOINC\projects\setiathome.berkeley.edu\AK_v8b_win_SSE3_AMD.exe
PRC - [2009/05/17 07:01:36 | 00,843,776 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\BOINC\projects\setiathome.berkeley.edu\AK_v8b_win_SSE3_AMD.exe
PRC - [2009/08/04 04:39:31 | 00,908,280 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/08/25 18:46:05 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\OTL.exe
========== Win32 Services (SafeList) ==========
SRV - [2008/07/25 10:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2009/04/27 23:30:06 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS.0\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2009/04/27 21:20:00 | 00,593,920 | ---- | M] () -- C:\WINDOWS.0\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2009/08/20 18:36:12 | 00,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc [Auto | Running])
SRV - [2009/08/20 18:36:12 | 00,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd [Auto | Running])
SRV - [2008/07/25 10:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [1999/12/12 20:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS.0\System32\CTsvcCDA.EXE -- (Creative Service for CDROM Access [Auto | Running])
SRV - [2008/07/29 20:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS.0\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2009/06/21 08:50:25 | 00,182,768 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped])
SRV - [2008/04/13 21:42:04 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2008/07/29 18:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS.0\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped])
SRV - [2009/08/13 11:35:02 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
SRV - [2008/07/29 18:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS.0\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])
SRV - [2009/02/16 00:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS.0\System32\ZoneLabs\vsmon.exe -- (vsmon [Auto | Running])
SRV - [2009/02/12 10:50:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2008/04/13 19:12:11 | 00,006,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wuauserv.dll -- (wuauserv [Auto | Running])
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS.0\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://red.clientapp.../search/ie.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS.0\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapp...//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 84 E5 5F B9 8F 90 C9 01 [binary data]
IE - URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5
FF - prefs.js..extensions.enabledItems: avg@igeared:2.507.024.001
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.6
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.5
FF - prefs.js..extensions.enabledItems: [email protected]:1.2.1
FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.11.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16
FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1
FF - prefs.js..extensions.enabledItems: [email protected]:2.1.2
FF - prefs.js..extensions.enabledItems: [email protected]:3.5
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.2
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.7
FF - prefs.js..extensions.enabledItems: {66871bd1-5ba2-4739-b485-2a15f5969bd8}:2.090608
FF - prefs.js..extensions.enabledItems: [email protected]:0.6.20090630
FF - prefs.js..extensions.enabledItems: {c1dffba0-628e-11d9-9669-0800200c9a66}:3.5.0
FF - prefs.js..keyword.URL: "http://us.yhs.search...2-tb-web_us&p="
FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/06/28 20:33:56 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/08/13 11:35:02 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2009/08/20 18:36:18 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/08/20 18:36:11 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/08/08 18:30:02 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/08/04 04:39:38 | 00,000,000 | ---D | M]
[2009/02/15 18:28:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Extensions
[2009/02/15 18:28:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/08/25 18:07:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions
[2009/06/29 04:47:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/06/30 19:24:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2009/02/27 20:59:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/06/11 04:56:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\{66871bd1-5ba2-4739-b485-2a15f5969bd8}
[2009/08/01 02:44:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(2)
[2009/07/09 17:19:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66}
[2009/08/13 16:39:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009/05/01 22:03:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2009/06/30 19:46:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]
[2009/07/01 18:50:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]
[2009/07/13 20:54:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]
[2009/06/30 19:49:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]
[2009/07/01 18:50:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]
[2009/08/08 18:34:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]
[2009/08/20 20:09:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]
[2009/06/30 19:49:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\global\extensions
[2009/06/30 19:49:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\global\extensions\chatzilla
[2009/06/30 19:49:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\global\extensions\Console2
[2009/06/30 19:49:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\global\extensions\downthemall
[2009/06/30 19:49:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\global\extensions\emusic
[2009/06/30 19:49:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\global\extensions\fullerscreen
[2009/06/30 19:49:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\global\extensions\sage
[2009/06/30 19:49:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\global\extensions\toolkit
[2009/06/30 19:49:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\global\extensions\webdeveloper
[2009/06/30 19:49:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\mozilla\Firefox\Profiles\ebrl3i1o.default\extensions\[email protected]\chrome\mozapps\extensions
[2009/08/25 18:07:38 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/08/04 04:39:38 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/09/13 17:34:01 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2009/02/14 15:12:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
[2009/08/08 20:42:31 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/08/13 11:35:20 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
[2008/12/16 19:22:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions
[2008/12/16 19:22:09 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}(2)
[2008/12/16 19:22:09 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2008/12/16 19:22:08 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(2)
[2008/12/16 19:22:08 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66}
[2008/12/16 19:22:08 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2008/12/16 19:22:06 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2008/12/16 19:21:56 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\{F587B2D4-7C09-4a23-AC4A-8D6E3CE8C7DA}
[2008/12/16 19:21:50 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\{F645A8C9-E969-42D9-B3F3-F325537222FD}
[2008/12/16 19:22:11 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\[email protected]
[2008/12/16 19:22:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\[email protected]
[2008/12/16 19:22:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\ipplsyxm.default\extensions\[email protected]
[2009/08/04 04:39:30 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/08/04 04:39:30 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/01/16 20:17:04 | 00,114,688 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\np32dsw.dll
[2009/08/13 11:35:02 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2006/05/17 13:09:22 | 00,484,656 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll
[2009/08/04 04:39:34 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2009/02/27 12:13:42 | 00,103,792 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2009/06/21 08:53:51 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2009/06/21 08:53:51 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2009/06/21 08:53:51 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2009/06/21 08:53:51 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2009/06/21 08:53:51 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2009/06/21 08:53:51 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2009/06/21 08:53:51 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2009/07/15 13:10:00 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/07/15 13:10:00 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/08/20 18:38:29 | 00,001,498 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml
[2009/07/15 13:10:00 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/07/15 13:10:00 | 00,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/07/15 13:10:00 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/07/15 13:10:00 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
O1 HOSTS File: (324249 bytes) - C:\WINDOWS.0\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 11101 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll File not found
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SidebarAutoLaunch Class) - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll File not found
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [boincmgr] C:\Program Files\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [boinctray] C:\Program Files\BOINC\boinctray.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\Administrator.JOHN-F7660489A1\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 58 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 65 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS.0/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Filter: - x-sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS.0\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS.0\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS.0\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS.0\System32\WgaLogon.dll ()
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/02/15 15:39:18 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2000/06/15 22:15:26 | 01,028,881 | R--- | M] () - D:\AUTORUN.DAT -- [ CDFS ]
O32 - AutoRun File - [2000/06/15 22:49:16 | 00,176,128 | R--- | M] () - D:\AUTORUN.EXE -- [ CDFS ]
O32 - AutoRun File - [2000/06/15 23:14:38 | 00,000,142 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS.0\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
NetSvcs: 6to4 - Service key not found. File not found
NetSvcs: Ias - Service key not found. File not found
NetSvcs: Iprip - Service key not found. File not found
NetSvcs: Irmon - Service key not found. File not found
NetSvcs: NWCWorkstation - Service key not found. File not found
NetSvcs: Nwsapagent - Service key not found. File not found
NetSvcs: WmdmPmSp - Service key not found. File not found
NetSvcs: wuauserv - C:\WINDOWS\system32\wuauserv.dll (Microsoft Corporation)
NetSvcs: helpsvc - C:\WINDOWS.0\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
========== Files/Folders - Created Within 14 Days ==========
[2009/08/25 18:46:02 | 00,514,048 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\OTL.exe
[2009/08/25 17:51:44 | 00,001,374 | ---- | C] () -- C:\WINDOWS.0\imsins.BAK
[2009/08/21 04:41:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\JavaRa
[2009/08/20 18:53:25 | 00,000,000 | -H-D | C] -- C:\$AVG8.VAULT$
[2009/08/20 18:36:33 | 00,011,952 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS.0\System32\avgrsstx.dll
[2009/08/20 18:36:33 | 00,001,507 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.0\Desktop\AVG Free 8.5.lnk
[2009/08/20 18:36:32 | 00,108,552 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS.0\System32\drivers\avgtdix.sys
[2009/08/20 18:36:24 | 00,335,240 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS.0\System32\drivers\avgldx86.sys
[2009/08/20 18:36:24 | 00,027,784 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS.0\System32\drivers\avgmfx86.sys
[2009/08/20 18:36:22 | 40,158,011 | ---- | C] () -- C:\WINDOWS.0\System32\drivers\Avg\incavi.avm
[2009/08/20 18:36:22 | 06,061,540 | ---- | C] () -- C:\WINDOWS.0\System32\drivers\Avg\avi7.avg
[2009/08/20 18:36:22 | 00,463,779 | ---- | C] () -- C:\WINDOWS.0\System32\drivers\Avg\miniavi.avg
[2009/08/20 18:36:22 | 00,068,540 | ---- | C] () -- C:\WINDOWS.0\System32\drivers\Avg\microavi.avg
[2009/08/20 18:36:22 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\drivers\Avg
[2009/08/20 18:36:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\avg8
[2009/08/20 18:10:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Local Settings\Application Data\AVG Security Toolbar
[2009/08/20 18:04:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\AVG8
[2009/08/20 18:02:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\AVG Security Toolbar
[2009/08/18 16:31:33 | 00,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2009/08/17 01:19:00 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Minidump
[2009/08/15 13:03:52 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2009/08/15 13:00:52 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\dllcache\cache
[2009/08/15 12:54:55 | 00,000,349 | ---- | C] () -- C:\Boot.bak
[2009/08/15 12:54:53 | 00,260,272 | ---- | C] () -- C:\cmldr
[2009/08/15 12:54:51 | 00,000,000 | RHSD | C] -- C:\cmdcons
[2009/08/15 12:53:19 | 00,216,064 | ---- | C] () -- C:\WINDOWS.0\PEV.exe
[2009/08/15 07:50:34 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\SysRestorePoint.exe
[2009/08/15 05:45:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\RootRepeal
[2009/08/14 23:30:56 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\ERDNT
[2009/08/14 23:30:31 | 00,000,767 | ---- | C] () -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/08/14 23:30:13 | 00,000,611 | ---- | C] () -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\NTREGOPT.lnk
[2009/08/14 23:30:13 | 00,000,592 | ---- | C] () -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\ERUNT.lnk
[2009/08/14 23:30:12 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/08/14 21:53:00 | 00,272,384 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\TFC.exe
========== Files - Modified Within 14 Days ==========
[2009/08/25 18:46:05 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\OTL.exe
[2009/08/25 18:20:59 | 00,522,498 | ---- | M] () -- C:\WINDOWS.0\System32\PerfStringBackup.INI
[2009/08/25 18:20:59 | 00,441,898 | ---- | M] () -- C:\WINDOWS.0\System32\perfh009.dat
[2009/08/25 18:20:59 | 00,071,516 | ---- | M] () -- C:\WINDOWS.0\System32\perfc009.dat
[2009/08/25 18:16:49 | 00,350,192 | ---- | M] () -- C:\WINDOWS.0\System32\vsconfig.xml
[2009/08/25 18:16:04 | 00,002,206 | ---- | M] () -- C:\WINDOWS.0\System32\wpa.dbl
[2009/08/25 18:16:02 | 00,002,048 | --S- | M] () -- C:\WINDOWS.0\bootstat.dat
[2009/08/25 17:51:45 | 00,001,374 | ---- | M] () -- C:\WINDOWS.0\imsins.BAK
[2009/08/25 16:30:11 | 40,158,011 | ---- | M] () -- C:\WINDOWS.0\System32\drivers\Avg\incavi.avm
[2009/08/25 16:30:09 | 00,068,540 | ---- | M] () -- C:\WINDOWS.0\System32\drivers\Avg\microavi.avg
[2009/08/20 18:36:33 | 00,011,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS.0\System32\avgrsstx.dll
[2009/08/20 18:36:33 | 00,001,507 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.0\Desktop\AVG Free 8.5.lnk
[2009/08/20 18:36:32 | 00,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS.0\System32\drivers\avgtdix.sys
[2009/08/20 18:36:24 | 00,335,240 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS.0\System32\drivers\avgldx86.sys
[2009/08/20 18:36:24 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS.0\System32\drivers\avgmfx86.sys
[2009/08/20 18:36:22 | 06,061,540 | ---- | M] () -- C:\WINDOWS.0\System32\drivers\Avg\avi7.avg
[2009/08/20 18:36:22 | 00,463,779 | ---- | M] () -- C:\WINDOWS.0\System32\drivers\Avg\miniavi.avg
[2009/08/20 17:55:31 | 00,002,577 | ---- | M] () -- C:\WINDOWS.0\System32\CONFIG.NT
[2009/08/20 11:33:42 | 00,000,278 | ---- | M] () -- C:\WINDOWS.0\tasks\WGASetup.job
[2009/08/19 17:15:52 | 00,324,249 | R--- | M] () -- C:\WINDOWS.0\System32\drivers\etc\hosts
[2009/08/17 18:30:30 | 00,000,507 | ---- | M] () -- C:\WINDOWS.0\win.ini
[2009/08/17 18:30:30 | 00,000,419 | RHS- | M] () -- C:\boot.ini
[2009/08/17 18:30:30 | 00,000,227 | ---- | M] () -- C:\WINDOWS.0\system.ini
[2009/08/16 18:30:55 | 00,000,714 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.0\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/08/15 07:50:36 | 00,021,504 | ---- | M] (Doug Knox) -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\SysRestorePoint.exe
[2009/08/14 23:30:31 | 00,000,767 | ---- | M] () -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/08/14 23:30:13 | 00,000,611 | ---- | M] () -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\NTREGOPT.lnk
[2009/08/14 23:30:13 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\ERUNT.lnk
[2009/08/14 21:53:01 | 00,272,384 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop\TFC.exe
[2009/08/12 11:30:12 | 00,321,507 | R--- | M] () -- C:\WINDOWS.0\System32\drivers\etc\hosts.20090819-171552.backup
========== LOP Check ==========
[2009/08/20 18:04:21 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data
[2009/02/15 16:14:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\ATI
[2009/04/14 17:57:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\Blitware
[2009/06/15 11:33:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\Microgaming
[2009/02/17 18:00:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\OpenOffice.org
[2009/03/11 17:55:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\RichCasino
[2009/06/26 22:51:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\VTExtra
[2009/02/15 15:58:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\Windows Desktop Search
[2009/02/15 16:03:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\Windows Search
[2009/02/16 21:03:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JOHN-F7660489A1\Application Data\WinPatrol
[2009/08/20 18:36:08 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data
[2009/08/06 20:20:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\ATI
[2009/08/20 19:15:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\AVG Security Toolbar
[2009/08/25 18:48:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\BOINC
[2009/03/06 23:40:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\MGS
[2009/04/03 11:27:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Microgaming
[2009/06/04 16:43:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\PC Drivers HeadQuarters
[2009/08/15 16:15:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\TEMP
[2009/06/21 08:52:52 | 00,000,284 | ---- | M] () -- C:\WINDOWS.0\Tasks\AppleSoftwareUpdate.job
[2001/08/23 06:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS.0\Tasks\desktop.ini
[2009/02/17 18:16:09 | 00,000,006 | -H-- | M] () -- C:\WINDOWS.0\Tasks\SA.DAT
[2009/05/13 17:32:51 | 00,000,296 | ---- | M] () -- C:\WINDOWS.0\Tasks\Spybot - Search & Destroy - Scheduled Task.job
[2009/08/20 11:33:42 | 00,000,278 | ---- | M] () -- C:\WINDOWS.0\Tasks\WGASetup.job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
< %systemroot%\system32\eventlog.dll >
[2008/04/13 21:41:54 | 00,056,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\system32\eventlog.dll
< %systemroot%\system32\scecli.dll >
[2008/04/13 21:42:06 | 00,181,248 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\system32\scecli.dll
< %systemroot%\netlogon.dll >
< %systemroot%\system32\cngaudit.dll >
< %systemroot%\system32\sceclt.dll >
< %systemroot%\ntelogon.dll >
< %systemroot%\system32\logevent.dll >
========== Alternate Data Streams ==========
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WINDOWS.0\Application Data\TEMP:5C321E34
< End of report >
OTL Extras logfile created on: 8/25/2009 6:47:34 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = C:\Documents and Settings\Administrator.JOHN-F7660489A1\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.0 | %ProgramFiles% = C:\Program Files
Drive C: | 189.91 Gb Total Space | 151.22 Gb Free Space | 79.63% Space Free | Partition Type: NTFS
Drive D: | 654.02 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: JOHN-F7660489A1
Current User Name: Administrator
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG8\avgnsx.exe" = C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0C98E73E-D495-CA87-EF1D-50D3A719351E}" = CCC Help Dutch
"{0FF1802B-4FE0-81D5-D28F-5095543CB57B}" = Skins
"{173A4BD8-B1E5-252A-FE86-C84C7E7B5F2E}" = CCC Help English
"{17986CD6-070C-BE3E-E4D6-C36DDEEAA37C}" = Catalyst Control Center Graphics Previews Common
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet
"{20D1D37A-817B-3A45-FDF5-507BD8A79680}" = CCC Help Chinese Traditional
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{21879F6C-52F6-7A6F-6736-A7C912653608}" = CCC Help Danish
"{21E4AB1F-C62E-C5C1-96A3-F4378A763C5B}" = CCC Help Chinese Standard
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216013F0}" = Java™ 6 Update 13
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 16
"{272DDF13-3B89-D0D8-B668-CEC4FB34C1E7}" = Catalyst Control Center Localization All
"{2743B5EB-7C1C-36CC-FBBB-A02F2F4EC52D}" = ccc-utility
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{2E376AD9-5C49-4F7D-A0BA-6A44E8FA5A3B}" = Next Generation Visualisations
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38DCE347-CE45-219E-56AD-30FCB04CF71A}" = CCC Help Hungarian
"{3F9FCFE0-4979-6377-771D-E8A3F3B197E7}" = CCC Help Portuguese
"{5C844F60-CFF2-33DE-FD0D-09F3C392679B}" = Catalyst Control Center HydraVision Full
"{5F723D64-4042-ABAE-2A9E-1FEBA1FE4B00}" = CCC Help Korean
"{61709405-4DB8-410C-53DC-A76945D7EBC1}" = CCC Help Turkish
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6CDB4B41-9244-EC3F-5FBC-550A8BC697F4}" = CCC Help Japanese
"{6EF0B467-8FDD-845E-F168-C7F0C6124C26}" = CCC Help Finnish
"{72736F5F-520D-472A-88CC-7B02872FD34E}" = ATI Catalyst Registration
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74FF7813-4878-AB41-8503-22287CF11F37}" = Catalyst Control Center Graphics Light
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79469AEF-FF16-C52B-F7F8-E1E203A036E5}" = CCC Help Italian
"{83E08A1E-963B-8846-8082-88B996FC060E}" = CCC Help Swedish
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{9862B19F-4CAD-4EED-920F-2F378D84393F}" = ATI Parental Control & Encoder
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ABF04DC-A40D-B4DA-189B-89497B599AB7}" = CCC Help French
"{9D56C31A-C9C8-394C-0804-670B0D2E0E1F}" = CCC Help Norwegian
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B59A1FFA-4EE2-805D-7B48-806DE73AAE03}" = CCC Help Thai
"{BB05D173-9681-4812-A7FA-BD4042A3DA00}" = Alky for Applications (Windows XP)
"{BDCF27CA-BFC4-4F49-8D24-A925C9505AB8}" = Windows Rights Management Client with Service Pack 2
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C37810F2-3983-B864-EB7F-DCCB67703FB0}" = Catalyst Control Center Graphics Full New
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}" = AVIVO Codecs
"{C9B26742-06BE-3B75-B1DE-7B91B5956A04}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30304
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEF6D9C4-EFA6-F0EC-8E56-8C85609D267D}" = ccc-core-preinstall
"{D1C2B2A9-6FC3-69A6-DDCC-10179BD2A978}" = CCC Help German
"{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D5C8DB90-573F-A4E4-6EBF-728B634E3E07}" = CCC Help Polish
"{DD76E812-359A-FEA9-FB17-2E55EBB36543}" = Catalyst Control Center Core Implementation
"{DE4CF159-4AD2-4754-BDA0-5FB088C8B58B}" = Razer Diamondback
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{E83971BF-8FEE-F2A6-E0CC-5187C1ECBD4D}" = CCC Help Greek
"{E9C6DC23-56C9-2B27-5FEC-4EEDD107D2D6}" = ccc-core-static
"{EA1A669B-302B-4E6E-BD23-FA5572A7A85C}" = AMD Power Monitor
"{EAC31CB7-575E-8C31-468D-10D5FB31CD1A}" = Catalyst Control Center Graphics Full Existing
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Windows Rights Management Client Backwards Compatibility SP2
"{F07717A3-8376-AA87-6BE2-D560F1EBABF0}" = CCC Help Spanish
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F371C899-B40A-811A-2825-30BE7E941CC9}" = CCC Help Czech
"{F7338FA3-DAB5-49B2-900D-0AFB5760C166}" = PC Probe II
"{FAC5A618-C41C-485F-826C-3589BDA34CE7}" = BOINC
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FF6486A6-608F-F80C-BE5C-17D07E2D49BF}" = CCC Help Russian
"2Wire SetupWiz" = AT&T Yahoo! High Speed Internet Home Networking Installer
"7-Zip" = 7-Zip 9.06 beta
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"AVG8Uninstall" = AVG Free 8.5
"CCleaner" = CCleaner (remove only)
"ERUNT_is1" = ERUNT 1.1j
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FileHippo.com" = FileHippo.com Update Checker
"HijackThis" = HijackThis 2.0.2
"Icewind Dale" = Icewind Dale
"ie8" = Windows Internet Explorer 8
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"Lunatics Unified Win32" = Lunatics Unified Win32 5.05.168
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Silverlight" = Microsoft Silverlight
"Mozilla Firefox (3.5.2)" = Mozilla Firefox (3.5.2)
"MyDefrag_is1" = MyDefrag v4.1.2
"NVIDIA Drivers" = NVIDIA Drivers
"PokerStars" = PokerStars
"Revo Uninstaller" = Revo Uninstaller 1.83
"SpywareBlaster_is1" = SpywareBlaster 4.2
"Tweak UI 2.10" = Tweak UI
"Windows Rights Management Client" = Windows Rights Management Client with Service Pack 2
"Windows Rights Management Client Backwards" = Windows Rights Management Client Backwards Compatibility SP2
"WinPatrol" = WinPatrol 2009
"Yahoo! Login" = Yahoo! Login
"ZoneAlarm" = ZoneAlarm
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 8/2/2009 2:45:33 PM | Computer Name = JOHN-F7660489A1 | Source = MsiInstaller | ID = 11321
Description = Product: Adobe Reader 9.1.3 -- Error 1321.The Installer has insufficient
privileges to modify the file C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.
Error - 8/2/2009 2:45:34 PM | Computer Name = JOHN-F7660489A1 | Source = MsiInstaller | ID = 1024
Description = Product: Adobe Reader 9.1.3 - Update 'Adobe Reader 9.1.3 - CPSID_49522'
could not be installed. Error code 1603. Windows Installer can create logs to help
troubleshoot issues with installing software packages. Use the following link for
instructions on turning on logging support: http://go.microsoft....k/?LinkId=23127
Error - 8/2/2009 2:45:34 PM | Computer Name = JOHN-F7660489A1 | Source = MsiInstaller | ID = 1024
Description = Product: Adobe Reader 9.1.3 - Update 'Adobe Reader 9.1.2 - CPSID_49166'
could not be installed. Error code 1603. Windows Installer can create logs to help
troubleshoot issues with installing software packages. Use the following link for
instructions on turning on logging support: http://go.microsoft....k/?LinkId=23127
Error - 8/3/2009 7:49:50 PM | Computer Name = JOHN-F7660489A1 | Source = BOINC | ID = 1
Description =
Error - 8/5/2009 5:34:29 AM | Computer Name = JOHN-F7660489A1 | Source = BOINC | ID = 1
Description =
Error - 8/5/2009 5:53:27 AM | Computer Name = JOHN-F7660489A1 | Source = BOINC | ID = 1
Description =
Error - 8/5/2009 5:49:28 PM | Computer Name = JOHN-F7660489A1 | Source = BOINC | ID = 1
Description =
Error - 8/6/2009 5:36:33 AM | Computer Name = JOHN-F7660489A1 | Source = BOINC | ID = 1
Description =
Error - 8/6/2009 5:33:08 PM | Computer Name = JOHN-F7660489A1 | Source = Application Error | ID = 1000
Description = Faulting application mbam.exe, version 1.40.0.0, faulting module ntdll.dll,
version 5.1.2600.5755, fault address 0x00010a32.
Error - 8/6/2009 7:54:55 PM | Computer Name = JOHN-F7660489A1 | Source = BOINC | ID = 1
Description =
[ System Events ]
Error - 8/20/2009 7:02:38 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7000
Description = The AVG Free On-access Scanner Minifilter Driver x86 service failed
to start due to the following error: %%87
Error - 8/20/2009 7:09:03 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7000
Description = The AVG Free On-access Scanner Minifilter Driver x86 service failed
to start due to the following error: %%87
Error - 8/20/2009 7:13:44 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7000
Description = The AVG Free On-access Scanner Minifilter Driver x86 service failed
to start due to the following error: %%87
Error - 8/20/2009 7:19:51 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7000
Description = The AVG Free On-access Scanner Minifilter Driver x86 service failed
to start due to the following error: %%87
Error - 8/20/2009 7:25:08 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7000
Description = The AVG Free On-access Scanner Minifilter Driver x86 service failed
to start due to the following error: %%87
Error - 8/25/2009 7:13:48 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).
Error - 8/25/2009 7:13:48 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7034
Description = The Creative Service for CDROM Access service terminated unexpectedly.
It has done this 1 time(s).
Error - 8/25/2009 7:13:48 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).
Error - 8/25/2009 7:13:49 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7031
Description = The AVG Free8 WatchDog service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.
Error - 8/25/2009 7:13:50 PM | Computer Name = JOHN-F7660489A1 | Source = Service Control Manager | ID = 7034
Description = The AVG Free8 E-mail Scanner service terminated unexpectedly. It
has done this 1 time(s).
< End of report >
basicly im at a lose as to whats going on and why.any help would be appricieated...dont think i spelled that right..and thanks in advance for the help.oh,heres mbamMalwarebytes' Anti-Malware 1.40
Database version: 2696
Windows 5.1.2600 Service Pack 3
8/25/2009 8:28:17 PM
mbam-log-2009-08-25 (20-28-17).txt
Scan type: Full Scan (C:\|)
Objects scanned: 241717
Time elapsed: 1 hour(s), 11 minute(s), 49 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Edited by bustermoves, 25 August 2009 - 07:30 PM.
Sign In
Create Account
