OTL logfile created on: 8/26/2009 11:11:42 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = E:\Documents and Settings\Darian\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.50 Gb Available Physical Memory | 75.02% Memory free
2.60 Gb Paging File | 1.97 Gb Available in Paging File | 75.85% Paging File free
Paging file location(s): E:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = E: | %SystemRoot% = E:\WINDOWS | %ProgramFiles% = E:\Program Files
Drive C: | 9.76 Gb Total Space | 2.55 Gb Free Space | 26.11% Space Free | Partition Type: FAT32
Drive D: | 6.32 Gb Total Space | 5.02 Gb Free Space | 79.47% Space Free | Partition Type: FAT32
Drive E: | 27.49 Gb Total Space | 13.46 Gb Free Space | 48.97% Space Free | Partition Type: FAT32
Drive F: | 6.32 Gb Total Space | 4.40 Gb Free Space | 69.70% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 149.05 Gb Total Space | 67.33 Gb Free Space | 45.17% Space Free | Partition Type: NTFS
Computer Name: HOME-PR8ZLTOFRZ
Current User Name: Darian
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Processes (SafeList) ==========
PRC - [2006/11/03 19:19:58 | 00,013,592 | ---- | M] (Microsoft Corporation) -- E:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2008/04/13 19:12:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\Explorer.EXE
PRC - [2008/10/10 05:45:26 | 00,013,088 | ---- | M] (Intuit Inc.) -- E:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2009/03/09 05:19:16 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- E:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2008/10/07 13:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- E:\WINDOWS\System32\nvsvc32.exe
PRC - [2008/11/09 15:48:14 | 00,602,392 | ---- | M] (Yahoo! Inc.) -- E:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- E:\Program Files\internet explorer\iexplore.exe
PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- E:\Program Files\internet explorer\iexplore.exe
PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- E:\Program Files\internet explorer\iexplore.exe
PRC - [2009/08/26 21:23:20 | 00,514,048 | ---- | M] (OldTimer Tools) -- E:\Documents and Settings\Darian\My Documents\OTL.exe
PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- E:\Program Files\internet explorer\iexplore.exe
PRC - [2008/04/13 19:12:30 | 00,069,120 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\notepad.exe
========== Win32 Services (SafeList) ==========
SRV - [2008/07/25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2008/07/25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2008/07/29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2009/08/24 12:40:50 | 00,133,104 | ---- | M] (Google Inc.) -- E:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate1ca24e26802270 [Auto | Stopped])
SRV - [2008/04/13 19:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2008/07/29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped])
SRV - [2008/10/10 05:45:26 | 00,013,088 | ---- | M] (Intuit Inc.) -- E:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService [Auto | Running])
SRV - [2009/03/09 05:19:16 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- E:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
SRV - [2008/07/29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])
SRV - File not found -- -- (NISSERV [Disabled | Stopped])
SRV - File not found -- -- (NISUM [Disabled | Stopped])
SRV - [2008/10/07 13:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- E:\WINDOWS\System32\nvsvc32.exe -- (NVSvc [Auto | Running])
SRV - [2005/01/21 22:32:12 | 00,206,552 | ---- | M] (Symantec Corporation) -- E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- (SNDSrvc [Disabled | Stopped])
SRV - File not found -- -- (SymProxySvc [Disabled | Stopped])
SRV - [2006/11/03 19:19:58 | 00,013,592 | ---- | M] (Microsoft Corporation) -- E:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend [Auto | Running])
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- E:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2008/11/09 15:48:14 | 00,602,392 | ---- | M] (Yahoo! Inc.) -- E:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService [Auto | Running])
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/defaultc.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C 04 07 2D BA 26 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: E:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/03/25 11:57:24 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: E:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/03/17 15:18:30 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[email protected]: E:\Program Files\BitDefender\BitDefender 2009\tbextension\
Hosts file not found
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - E:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - E:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [NvCplDaemon] E:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - Startup: E:\Documents and Settings\Darian\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = E:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.micros...tes/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///E:/Program%20Files/Risk/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.co.../sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.t...ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.syma...bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} http://acs.pandasoft...s/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} E:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll (Installation Support)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitd...can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onec...lscbase1140.cab (Windows Live Safety Center Base Module)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.syma...n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///E:/Program%20Files/Risk/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logme...trl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 192.168.0.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - E:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - E:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - E:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - E:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - E:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - E:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - E:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - E:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - E:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - E:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/04/08 02:18:56 | 00,000,092 | -HS- | M] () - C:\AUTOEXEC.DOS -- [ FAT32 ]
O32 - AutoRun File - [2002/04/08 01:49:32 | 00,000,092 | ---- | M] () - C:\AUTOEXEC.CAM -- [ FAT32 ]
O32 - AutoRun File - [2001/06/12 10:42:42 | 00,000,052 | ---- | M] () - C:\AUTOEXEC.OPL -- [ FAT32 ]
O32 - AutoRun File - [2006/02/21 04:05:42 | 00,000,262 | -HS- | M] () - C:\autoexec.bat -- [ FAT32 ]
O32 - AutoRun File - [2006/01/23 20:19:08 | 00,000,098 | ---- | M] () - C:\AUTOEXEC.001 -- [ FAT32 ]
O32 - AutoRun File - [2006/02/21 04:05:44 | 00,000,121 | ---- | M] () - C:\AUTOEXEC.TSH -- [ FAT32 ]
O32 - AutoRun File - [1998/10/21 21:41:14 | 00,000,000 | ---D | M] - I:\AUTORUN -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - E:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (/r) - File not found
O34 - HKLM BootExecute: (\??\E:) - File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - E:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
NetSvcs: 6to4 - Service key not found. File not found
NetSvcs: Ias - Service key not found. File not found
NetSvcs: Iprip - Service key not found. File not found
NetSvcs: Irmon - Service key not found. File not found
NetSvcs: NWCWorkstation - Service key not found. File not found
NetSvcs: Nwsapagent - Service key not found. File not found
NetSvcs: WmdmPmSp - Service key not found. File not found
NetSvcs: helpsvc - E:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
========== Files/Folders - Created Within 14 Days ==========
[8 E:\WINDOWS\System32\*.tmp files]
[2009/08/26 22:57:39 | 00,000,000 | ---- | C] () -- E:\Documents and Settings\Darian\Desktop\settings.dat
[2009/08/26 22:53:03 | 00,000,000 | ---D | C] -- E:\WINDOWS\ie8updates
[2009/08/26 22:52:55 | 00,000,000 | ---D | C] -- E:\WINDOWS\LastGood
[2009/08/26 22:52:31 | 00,000,015 | ---- | C] () -- E:\Documents and Settings\Darian\My Documents\settings.dat
[2009/08/26 21:56:03 | 00,028,544 | ---- | C] (Panda Security, S.L.) -- E:\WINDOWS\System32\drivers\pavboot.sys
[2009/08/26 21:55:57 | 00,000,000 | ---D | C] -- E:\Program Files\Panda Security
[2009/08/26 21:43:56 | 00,000,605 | ---- | C] () -- E:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/08/26 21:43:53 | 00,038,160 | ---- | C] (Malwarebytes Corporation) -- E:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/08/26 21:43:51 | 00,019,096 | ---- | C] (Malwarebytes Corporation) -- E:\WINDOWS\System32\drivers\mbam.sys
[2009/08/26 21:43:51 | 00,000,000 | ---D | C] -- E:\Program Files\Malwarebytes' Anti-Malware
[2009/08/26 21:41:46 | 00,000,676 | ---- | C] () -- E:\Documents and Settings\Darian\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/08/26 21:41:39 | 00,000,520 | ---- | C] () -- E:\Documents and Settings\Darian\Desktop\NTREGOPT.lnk
[2009/08/26 21:41:39 | 00,000,501 | ---- | C] () -- E:\Documents and Settings\Darian\Desktop\ERUNT.lnk
[2009/08/26 21:41:39 | 00,000,000 | ---D | C] -- E:\Program Files\ERUNT
[2009/08/26 21:34:43 | 00,000,000 | -HSD | C] -- E:\Recycled
[2009/08/26 21:31:18 | 00,021,504 | ---- | C] (Doug Knox) -- E:\Documents and Settings\Darian\My Documents\SysRestorePoint.exe
[2009/08/26 21:28:23 | 03,942,040 | ---- | C] (Malwarebytes Corporation ) -- E:\Documents and Settings\Darian\My Documents\mbam-setup.exe
[2009/08/26 21:23:21 | 00,514,048 | ---- | C] (OldTimer Tools) -- E:\Documents and Settings\Darian\My Documents\OTL.exe
[2009/08/26 21:23:07 | 00,472,064 | ---- | C] ( ) -- E:\Documents and Settings\Darian\Desktop\RootRepeal.exe
[2009/08/26 21:22:35 | 00,791,393 | ---- | C] (Lars Hederer ) -- E:\Documents and Settings\Darian\My Documents\erunt_setup.exe
[2009/08/26 21:21:50 | 00,272,384 | ---- | C] (OldTimer Tools) -- E:\Documents and Settings\Darian\My Documents\TFC.exe
[2009/08/26 21:05:53 | 00,000,249 | ---- | C] () -- E:\Documents and Settings\Darian\Desktop\Shortcut to My Documents.lnk
[2009/08/26 20:09:05 | 00,212,480 | ---- | C] (SteelWerX) -- E:\WINDOWS\SWXCACLS.exe
[2009/08/26 20:09:05 | 00,161,792 | ---- | C] (SteelWerX) -- E:\WINDOWS\SWREG.exe
[2009/08/26 20:09:05 | 00,136,704 | ---- | C] (SteelWerX) -- E:\WINDOWS\SWSC.exe
[2009/08/26 20:09:05 | 00,098,816 | ---- | C] () -- E:\WINDOWS\sed.exe
[2009/08/26 20:09:05 | 00,080,412 | ---- | C] () -- E:\WINDOWS\grep.exe
[2009/08/26 20:09:05 | 00,068,096 | ---- | C] () -- E:\WINDOWS\zip.exe
[2009/08/26 20:09:05 | 00,031,232 | ---- | C] (NirSoft) -- E:\WINDOWS\NIRCMD.exe
[2009/08/26 20:07:52 | 00,000,000 | ---D | C] -- E:\Qoobox
[2009/08/26 20:02:42 | 03,185,678 | R--- | C] () -- E:\Documents and Settings\Darian\Desktop\ComboFix.exe
[2009/08/26 19:36:18 | 00,396,288 | ---- | C] (Trend Micro Inc.) -- E:\HijackThis.exe
[2009/08/26 19:31:06 | 00,000,291 | ---- | C] () -- E:\Documents and Settings\Darian\Desktop\HijackThis.lnk
[2009/08/26 19:16:32 | 00,000,000 | -H-D | C] -- E:\WINDOWS\ie8
[2009/08/26 19:07:42 | 00,000,000 | ---D | C] -- E:\Program Files\ACW
[2009/08/26 17:08:09 | 00,000,000 | ---D | C] -- E:\_OTM
[2009/08/26 16:51:21 | 00,000,000 | ---D | C] -- E:\WINDOWS\System32\dllcache\cache
[2009/08/26 16:06:50 | 00,229,376 | ---- | C] () -- E:\WINDOWS\PEV.exe
[2009/08/26 16:04:56 | 00,000,000 | ---D | C] -- E:\WINDOWS\ERDNT
[2009/08/26 15:58:00 | 00,000,000 | ---D | C] -- E:\Documents and Settings\Darian\Local Settings\Application Data\Temp
[2009/08/25 16:04:41 | 00,000,000 | ---D | C] -- E:\Avenger
[2009/08/25 14:34:29 | 00,000,330 | -H-- | C] () -- E:\WINDOWS\tasks\MP Scheduled Scan.job
[2009/08/25 12:41:52 | 00,000,000 | ---D | C] -- E:\Program Files\Microsoft Windows OneCare Live
[2009/08/24 12:53:57 | 00,000,886 | ---- | C] () -- E:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2009/08/24 12:53:57 | 00,000,882 | ---- | C] () -- E:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009/08/24 12:45:44 | 00,000,000 | ---D | C] -- E:\Documents and Settings\Darian\My Documents\Downloads
[2009/08/24 12:43:00 | 00,000,000 | ---D | C] -- E:\WINDOWS\System32\DRVSTORE
[2009/08/24 12:41:42 | 00,001,722 | ---- | C] () -- E:\Documents and Settings\All Users.WINDOWS\Desktop\Google Chrome.lnk
[2009/08/24 12:40:38 | 00,000,000 | ---D | C] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
[2009/08/21 09:54:23 | 00,000,127 | ---- | C] () -- E:\WINDOWS\System32\MRT.INI
[2009/08/21 03:55:57 | 00,000,016 | ---- | C] () -- E:\WINDOWS\pxydb.dat
[2009/08/20 13:49:56 | 00,001,152 | ---- | C] () -- E:\WINDOWS\System32\windrv.sys
[2009/08/19 17:58:15 | 00,000,000 | ---D | C] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\Blizzard Entertainment
[2009/08/19 14:41:11 | 00,000,000 | ---D | C] -- E:\Program Files\Windows Defender
[2009/08/18 15:21:12 | 00,000,000 | ---D | C] -- E:\Program Files\Windows Live Safety Center
[2009/08/18 12:20:50 | 00,000,208 | ---- | C] () -- E:\Documents and Settings\Darian\Desktop\Yahoo!.url
[2009/08/17 18:31:04 | 00,000,000 | ---D | C] -- E:\Program Files\MSXML 4.0
[2009/08/17 18:17:19 | 00,000,104 | ---- | C] () -- E:\Documents and Settings\Darian\Desktop\My Computer.lnk
[2009/08/17 18:09:21 | 00,000,000 | ---D | C] -- E:\Program Files\CA Yahoo! Anti-Spy
[2009/08/17 18:03:22 | 00,000,000 | ---D | C] -- E:\Program Files\Common Files\Windows Live
[2009/08/17 14:00:29 | 00,000,000 | ---D | C] -- E:\Documents and Settings\Darian\Application Data\Malwarebytes
[2009/08/17 13:50:21 | 00,000,000 | ---D | C] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
[2009/08/17 13:32:24 | 00,010,752 | ---- | C] () -- E:\exefix_xp.com
[2009/08/17 13:18:36 | 26,171,928 | ---- | C] (PC Tools ) -- E:\sdsetup.exe
[2009/08/17 12:55:03 | 03,942,048 | ---- | C] (Malwarebytes Corporation ) -- E:\Malwarebytes Setup.exe
[2009/08/17 12:47:32 | 00,000,000 | -HSD | C] -- E:\WINDOWS\CSC
[2009/08/16 18:24:19 | 00,000,000 | ---D | C] -- E:\Program Files\Windows Sidebar
[2009/08/16 18:23:21 | 00,004,767 | ---- | C] () -- E:\WINDOWS\Irremote.ini
[2009/08/16 18:03:20 | 00,000,000 | ---D | C] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
[2009/08/16 17:31:43 | 00,000,040 | -HS- | C] () -- E:\Documents and Settings\All Users.WINDOWS\Application Data\.zreglib
[2009/08/16 16:22:16 | 00,000,000 | ---- | C] () -- E:\WINDOWS\AoADVDRipper.INI
========== Files - Modified Within 14 Days ==========
[8 E:\WINDOWS\System32\*.tmp files]
[2009/08/26 23:06:18 | 00,000,000 | ---- | M] () -- E:\Documents and Settings\Darian\Desktop\settings.dat
[2009/08/26 22:58:02 | 00,000,886 | ---- | M] () -- E:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2009/08/26 22:57:04 | 00,000,015 | ---- | M] () -- E:\Documents and Settings\Darian\My Documents\settings.dat
[2009/08/26 22:52:08 | 00,000,330 | -H-- | M] () -- E:\WINDOWS\tasks\MP Scheduled Scan.job
[2009/08/26 22:49:36 | 00,002,206 | ---- | M] () -- E:\WINDOWS\System32\wpa.dbl
[2009/08/26 22:49:28 | 00,195,967 | ---- | M] () -- E:\WINDOWS\System32\nvapps.xml
[2009/08/26 22:49:12 | 00,000,882 | ---- | M] () -- E:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009/08/26 22:49:04 | 00,000,006 | -H-- | M] () -- E:\WINDOWS\tasks\SA.DAT
[2009/08/26 22:48:58 | 00,002,048 | --S- | M] () -- E:\WINDOWS\bootstat.dat
[2009/08/26 21:43:58 | 00,000,605 | ---- | M] () -- E:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/08/26 21:41:48 | 00,000,676 | ---- | M] () -- E:\Documents and Settings\Darian\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/08/26 21:41:40 | 00,000,520 | ---- | M] () -- E:\Documents and Settings\Darian\Desktop\NTREGOPT.lnk
[2009/08/26 21:41:40 | 00,000,501 | ---- | M] () -- E:\Documents and Settings\Darian\Desktop\ERUNT.lnk
[2009/08/26 21:39:02 | 04,824,636 | -H-- | M] () -- E:\Documents and Settings\Darian\Local Settings\Application Data\IconCache.db
[2009/08/26 21:34:24 | 00,000,249 | ---- | M] () -- E:\Documents and Settings\Darian\Desktop\Shortcut to My Documents.lnk
[2009/08/26 21:31:16 | 00,021,504 | ---- | M] (Doug Knox) -- E:\Documents and Settings\Darian\My Documents\SysRestorePoint.exe
[2009/08/26 21:28:30 | 03,942,040 | ---- | M] (Malwarebytes Corporation ) -- E:\Documents and Settings\Darian\My Documents\mbam-setup.exe
[2009/08/26 21:23:20 | 00,514,048 | ---- | M] (OldTimer Tools) -- E:\Documents and Settings\Darian\My Documents\OTL.exe
[2009/08/26 21:23:04 | 00,472,064 | ---- | M] ( ) -- E:\Documents and Settings\Darian\Desktop\RootRepeal.exe
[2009/08/26 21:22:24 | 00,791,393 | ---- | M] (Lars Hederer ) -- E:\Documents and Settings\Darian\My Documents\erunt_setup.exe
[2009/08/26 21:21:42 | 00,272,384 | ---- | M] (OldTimer Tools) -- E:\Documents and Settings\Darian\My Documents\TFC.exe
[2009/08/26 20:37:30 | 00,000,227 | ---- | M] () -- E:\WINDOWS\system.ini
[2009/08/26 20:02:48 | 03,185,678 | R--- | M] () -- E:\Documents and Settings\Darian\Desktop\ComboFix.exe
[2009/08/26 19:36:20 | 00,396,288 | ---- | M] (Trend Micro Inc.) -- E:\HijackThis.exe
[2009/08/26 19:36:20 | 00,000,291 | ---- | M] () -- E:\Documents and Settings\Darian\Desktop\HijackThis.lnk
[2009/08/26 19:19:26 | 00,001,374 | ---- | M] () -- E:\WINDOWS\imsins.BAK
[2009/08/26 15:58:30 | 00,001,722 | ---- | M] () -- E:\Documents and Settings\All Users.WINDOWS\Desktop\Google Chrome.lnk
[2009/08/23 03:09:14 | 00,229,376 | ---- | M] () -- E:\WINDOWS\PEV.exe
[2009/08/22 18:29:56 | 00,000,094 | ---- | M] () -- E:\WINDOWS\MusicRip.ini
[2009/08/21 17:34:50 | 00,000,911 | ---- | M] () -- E:\WINDOWS\win.ini
[2009/08/21 09:54:24 | 00,000,127 | ---- | M] () -- E:\WINDOWS\System32\MRT.INI
[2009/08/21 08:27:36 | 00,000,207 | ---- | M] () -- E:\Documents and Settings\Darian\Desktop\unemployment claim.url
[2009/08/21 03:56:00 | 00,000,016 | ---- | M] () -- E:\WINDOWS\pxydb.dat
[2009/08/20 13:49:58 | 00,001,152 | ---- | M] () -- E:\WINDOWS\System32\windrv.sys
[2009/08/19 14:48:06 | 00,000,208 | ---- | M] () -- E:\Documents and Settings\Darian\Desktop\Yahoo!.url
[2009/08/17 18:17:20 | 00,000,104 | ---- | M] () -- E:\Documents and Settings\Darian\Desktop\My Computer.lnk
[2009/08/17 13:32:18 | 00,010,752 | ---- | M] () -- E:\exefix_xp.com
[2009/08/17 13:18:38 | 26,171,928 | ---- | M] (PC Tools ) -- E:\sdsetup.exe
[2009/08/17 12:55:40 | 00,000,664 | ---- | M] () -- E:\WINDOWS\System32\d3d9caps.dat
[2009/08/17 12:55:04 | 03,942,048 | ---- | M] (Malwarebytes Corporation ) -- E:\Malwarebytes Setup.exe
[2009/08/16 18:23:22 | 00,004,767 | ---- | M] () -- E:\WINDOWS\Irremote.ini
[2009/08/16 17:32:14 | 00,000,040 | -HS- | M] () -- E:\Documents and Settings\All Users.WINDOWS\Application Data\.zreglib
[2009/08/16 16:22:18 | 00,000,000 | ---- | M] () -- E:\WINDOWS\AoADVDRipper.INI
[2009/08/16 14:28:26 | 00,000,067 | ---- | M] () -- E:\WINDOWS\Easy DVD Creator.INI
========== LOP Check ==========
[2004/01/15 13:34:50 | 00,000,000 | RH-D | M] -- E:\Documents and Settings\All Users.WINDOWS\Application Data
[2008/10/25 13:38:44 | 00,000,000 | ---D | M] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\BitDefender
[2008/10/14 10:35:32 | 00,000,000 | ---D | M] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\Blizzard
[2009/08/19 17:58:16 | 00,000,000 | ---D | M] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\Blizzard Entertainment
[2008/09/26 11:01:08 | 00,000,000 | ---D | M] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\DVD Shrink
[2008/01/20 18:52:48 | 00,000,000 | ---D | M] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\Intuit
[2008/03/03 08:57:18 | 00,000,000 | ---D | M] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6
[2008/01/16 15:05:40 | 00,000,000 | ---D | M] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\Support.com
[2008/12/08 21:19:32 | 00,000,000 | ---D | M] -- E:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2004/01/15 13:34:50 | 00,000,000 | -H-D | M] -- E:\Documents and Settings\Darian\Application Data
[2008/09/26 22:03:12 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\AccurateRip
[2008/09/26 18:34:52 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\Ahead
[2008/09/28 17:24:32 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\ArcSoft
[2008/09/27 10:57:40 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\dBpoweramp
[2008/02/06 15:01:16 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\Image Zone Express
[2008/01/20 18:54:22 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\Intuit
[2008/12/09 22:14:44 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\iWin
[2008/03/03 08:57:18 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\MSN6
[2008/02/06 15:01:16 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\Printer Info Cache
[2008/12/08 21:19:02 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\SpinTop
[2008/01/15 17:31:42 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\Ventrilo
[2008/10/25 21:04:42 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\Windows Desktop Search
[2008/10/25 21:22:46 | 00,000,000 | ---D | M] -- E:\Documents and Settings\Darian\Application Data\Windows Search
[2001/08/23 04:00:00 | 00,000,065 | RH-- | M] () -- E:\WINDOWS\Tasks\desktop.ini
[2009/08/26 22:49:04 | 00,000,006 | -H-- | M] () -- E:\WINDOWS\Tasks\SA.DAT
[2009/08/26 22:49:12 | 00,000,882 | ---- | M] () -- E:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
[2009/08/26 22:58:02 | 00,000,886 | ---- | M] () -- E:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
[2009/08/26 22:52:08 | 00,000,330 | -H-- | M] () -- E:\WINDOWS\Tasks\MP Scheduled Scan.job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
[2004/12/13 20:43:56 | 00,166,144 | ---- | M] (Microsoft Corporation) -- E:\DECCHECKSetup.EXE
[2004/12/27 16:33:32 | 01,163,643 | ---- | M] () -- E:\wrar342.exe
[2009/08/17 13:18:38 | 26,171,928 | ---- | M] (PC Tools ) -- E:\sdsetup.exe
[2009/08/17 12:55:04 | 03,942,048 | ---- | M] (Malwarebytes Corporation ) -- E:\Malwarebytes Setup.exe
[2005/01/09 04:10:10 | 00,823,296 | ---- | M] (Frontcode Technologies) -- E:\winmx353.exe
[2003/08/28 20:07:16 | 01,591,504 | ---- | M] (Logitech ) -- E:\imvidenu.exe
[2004/12/19 18:58:14 | 00,173,120 | ---- | M] (Yahoo! Inc.) -- E:\yinst_current.exe
[2009/08/26 19:36:20 | 00,396,288 | ---- | M] (Trend Micro Inc.) -- E:\HijackThis.exe
[2005/01/18 21:04:46 | 00,843,824 | ---- | M] () -- E:\SetupDVDDecrypter_3.5.2.0.exe
[2004/06/24 16:46:52 | 00,486,008 | ---- | M] () -- E:\msgr6suite.exe
[2007/11/24 13:26:48 | 00,561,664 | ---- | M] () -- E:\ventrilo_srv-3.0.2-Windows.exe
[2003/08/26 18:21:36 | 04,967,687 | ---- | M] () -- E:\phedinst.exe
[2003/08/28 18:22:36 | 42,057,332 | ---- | M] (Logitech, Inc. ) -- E:\is730enu.exe
[2003/08/28 21:01:44 | 00,226,464 | ---- | M] () -- E:\yahoo!_messenger_install.exe
[2003/09/04 01:01:46 | 08,392,346 | ---- | M] (BioWare Corp.) -- E:\bg2tob_26498_eng.exe
[2004/08/07 18:36:42 | 12,100,131 | ---- | M] (NVIDIA Corporation) -- E:\nForce_system_utility_1.08.5.exe
[2005/10/31 12:34:22 | 00,762,512 | ---- | M] () -- E:\ytb612_efgsip.exe
[2005/10/31 12:35:06 | 07,050,552 | ---- | M] (Adobe Systems, Inc. ) -- E:\psa30se_en_us.exe
[2005/10/31 12:37:18 | 20,921,040 | ---- | M] ( ) -- E:\AdbeRdr705_enu_full.exe
< %systemroot%\system32\eventlog.dll >
[2008/04/13 19:11:54 | 00,056,320 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\system32\EVENTLOG.DLL
[8 E:\WINDOWS\system32\*.tmp files]
< %systemroot%\system32\scecli.dll >
[2008/04/13 19:12:06 | 00,181,248 | ---- | M] (Microsoft Corporation) -- E:\WINDOWS\system32\SCECLI.DLL
[8 E:\WINDOWS\system32\*.tmp files]
< %systemroot%\netlogon.dll >
< %systemroot%\system32\cngaudit.dll >
< %systemroot%\system32\sceclt.dll >
< %systemroot%\ntelogon.dll >
< %systemroot%\system32\logevent.dll >
< End of report >
Malwarebytes' Anti-Malware 1.40
Database version: 2702
Windows 5.1.2600 Service Pack 3
8/26/2009 9:50:24 PM
mbam-log-2009-08-26 (21-50-24).txt
Scan type: Quick Scan
Objects scanned: 136573
Time elapsed: 5 minute(s), 18 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
OTL Extras logfile created on: 8/26/2009 11:10:03 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = E:\Documents and Settings\Darian\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.51 Gb Available Physical Memory | 75.35% Memory free
2.60 Gb Paging File | 1.98 Gb Available in Paging File | 76.12% Paging File free
Paging file location(s): E:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = E: | %SystemRoot% = E:\WINDOWS | %ProgramFiles% = E:\Program Files
Drive C: | 9.76 Gb Total Space | 2.55 Gb Free Space | 26.11% Space Free | Partition Type: FAT32
Drive D: | 6.32 Gb Total Space | 5.02 Gb Free Space | 79.47% Space Free | Partition Type: FAT32
Drive E: | 27.49 Gb Total Space | 13.46 Gb Free Space | 48.97% Space Free | Partition Type: FAT32
Drive F: | 6.32 Gb Total Space | 4.40 Gb Free Space | 69.70% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 149.05 Gb Total Space | 67.33 Gb Free Space | 45.17% Space Free | Partition Type: NTFS
Computer Name: HOME-PR8ZLTOFRZ
Current User Name: Darian
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- E:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"15427:TCP" = 15427:TCP:*:Enabled:BitComet 15427 TCP
"15427:UDP" = 15427:UDP:*:Enabled:BitComet 15427 UDP
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724
"14241:TCP" = 14241:TCP:*:Enabled:BitComet 14241 TCP
"14241:UDP" = 14241:UDP:*:Enabled:BitComet 14241 UDP
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"E:\Program Files\TurboTax\Premier 2007\32bit\ttax.exe" = E:\Program Files\TurboTax\Premier 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax -- (Intuit, Inc.)
"E:\Program Files\TurboTax\Premier 2007\32bit\updatemgr.exe" = E:\Program Files\TurboTax\Premier 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager -- (Intuit, Inc.)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"I:\Program Files\BitCome\BitComet\BitComet.exe" = I:\Program Files\BitCome\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client -- (www.BitComet.com)
"E:\Program Files\Ventrilo\Ventrilo.exe" = E:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe -- ()
"E:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = E:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)
"I:\Program Files\World of Warcraft\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe" = I:\Program Files\World of Warcraft\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"I:\Program Files\World of Warcraft\Launcher.exe" = I:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher -- (Blizzard Entertainment)
"E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"I:\Program Files\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe" = I:\Program Files\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{130AD1E2-9BDE-4862-AB8B-4B03C21A02C3}" = Norton Internet Security
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1EBB57D4-63FF-87CC-A0F0-D73982CF6008}" = Adobe Media Player
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 13
"{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{703C4409-D597-433A-9B17-E411D9236451}" = Button Manager v1.836
"{7169B8E4-2632-46B1-AA5F-167CB5FE5029}" = Symantec Network Drivers Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7570F1CA-016D-46AC-B586-CD74645EFB52}" = TurboTax 2008 WinPerFedFormset
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English
"{8398B542-3CC4-44D9-83DF-696CCE70124B}" = Windows Support Tools
"{88214092-836F-4E22-A5AC-569AC9EE6A0F}" = TurboTax 2008 WinPerReleaseEngine
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{92C5DB3D-9D6F-4324-BB11-57825F4C2635}" = DVD Decoder Pak for Windows XP
"{9984DF60-1C5B-11D3-ACA1-908A4FC10801}" = Intel Application Accelerator
"{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = AnswerWorks 5.0 English Runtime
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AF32FB61-AB9C-423B-A3E0-724A167953D9}" = TurboTax 2008 wohiper
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B1DB1AD8-C07E-4052-81A1-D2930232BA70}" = TurboTax 2008 wrapper
"{B23726CF-68BF-41A6-A4EB-72F12F87FE05}" = TurboTax 2008 WinPerTaxSupport
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E6D9BC25-0DBC-4368-8E4A-7DEE80661CD9}" = TurboTax 2008 WinPerProgramHelp
"{EF6F70D0-C242-4047-946B-98EA8208481A}" = ArcSoft TotalMedia Backup & Record
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"BitComet" = BitComet 1.04
"cayahooantispy" = CA Yahoo! Anti-Spy (remove only)
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.51
"dBpoweramp m4a Codec" = dBpoweramp m4a Codec
"dBpowerAMP Mp4 Codec" = dBpowerAMP Mp4 Codec
"dBpoweramp Music Converter" = dBpoweramp Music Converter
"DVD Decrypter" = DVD Decrypter (Remove Only)
"Easy DVD Creator_is1" = Easy DVD Creator 2.0.3
"ERUNT_is1" = ERUNT 1.1j
"ffdshow" = ffdshow (remove only)
"Google Chrome" = Google Chrome
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"IsoBuster_is1" = IsoBuster 2.4
"LiveReg" = LiveReg (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Office8.0" = Microsoft Office 97, Professional Edition
"Risk" = Risk
"SBC Connection Manager" = SBC Connection Manager
"SBC Yahoo! Applications" = SBC Yahoo! Applications
"TurboTax 2008" = TurboTax 2008
"TurboTax Premier 2007" = TurboTax Premier 2007
"Winamp" = Winamp
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"World of Warcraft" = World of Warcraft
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Anti-Spy" = Yahoo! Anti-Spy
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 8/25/2009 2:05:21 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = MsiInstaller | ID = 1008
Description = The installation of E:\WINDOWS\Installer\bfad99.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.
Error - 8/25/2009 2:05:21 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = MsiInstaller | ID = 1008
Description = The installation of E:\WINDOWS\Installer\c356b3f.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.
Error - 8/25/2009 2:05:21 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = MsiInstaller | ID = 1008
Description = The installation of E:\WINDOWS\Installer\c356b3f.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.
Error - 8/25/2009 2:58:41 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 6.0.2900.2180, faulting
module mshtml.dll, version 6.0.2900.5803, fault address 0x0007920e.
Error - 8/25/2009 5:59:38 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
Error - 8/26/2009 5:15:13 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Application Error | ID = 1000
Description = Faulting application pev.cfxxe, version 0.0.0.0, faulting module pev.cfxxe,
version 0.0.0.0, fault address 0x0004c41d.
Error - 8/26/2009 8:19:16 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
Error - 8/26/2009 9:12:06 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Application Error | ID = 1000
Description = Faulting application pev.cfxxe, version 0.0.0.0, faulting module pev.cfxxe,
version 0.0.0.0, fault address 0x0004c41d.
Error - 8/26/2009 9:49:20 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
Error - 8/26/2009 10:38:05 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = MsiInstaller | ID = 10005
Description = Product: BitDefender Internet Security 2009 -- The installer has encountered
an unexpected error installing this package. This may indicate a problem with this
package. The error code is 2318. The arguments are: E:\Program Files\BitDefender\BitDefender
2009\quar.xml, ,
[ System Events ]
Error - 8/26/2009 11:42:07 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = DCOM | ID = 10010
Description = The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register
with DCOM within the required timeout.
Error - 8/26/2009 11:42:32 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126
Error - 8/26/2009 11:43:02 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = DCOM | ID = 10010
Description = The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register
with DCOM within the required timeout.
Error - 8/26/2009 11:44:58 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126
Error - 8/26/2009 11:45:28 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = DCOM | ID = 10010
Description = The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register
with DCOM within the required timeout.
Error - 8/26/2009 11:45:45 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126
Error - 8/26/2009 11:46:35 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126
Error - 8/26/2009 11:47:05 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = DCOM | ID = 10010
Description = The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register
with DCOM within the required timeout.
Error - 8/26/2009 11:47:05 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126
Error - 8/26/2009 11:47:35 PM | Computer Name = HOME-PR8ZLTOFRZ | Source = DCOM | ID = 10010
Description = The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register
with DCOM within the required timeout.
< End of report >
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/26 23:21
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: dump_IdeChnDr.sys
Image Path: E:\WINDOWS\System32\Drivers\dump_IdeChnDr.sys
Address: 0xAAC86000 Size: 90112 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: E:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xADA47000 Size: 49152 File Visible: No Signed: -
Status: -
Hidden Services
-------------------
Service Name: kbiwkmappuehon
Image Path: E:\WINDOWS\system32\drivers\kbiwkmopsavunw.sys
==EOF==
Sign In
Create Account
