OTL first run:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\\Flags not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55237e52-98a5-11dc-a041-001111704781}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55237e52-98a5-11dc-a041-001111704781}\ not found.
File H:\auto.exe not found.
File C:\WINDOWS\win32k.sys not found.
File C:\WINDOWS\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job not found.
File C:\WINDOWS\tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job not found.
========== FILES ==========
C:\WINDOWS\system32\asck.exe moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: drose
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\Arj.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\avlib.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\Avp1.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\AvpMgr.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\btimages.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\CAB.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\dmap.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\dtreg.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\FsDrvPlg.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\FSSync.dll scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\HashCont.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\HashMD5.PPL scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\HCCMP.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\ichk2.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\iChkSA.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\Inflate.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\IWGen.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\kave.dll scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\kosglue-7.0.26.0.dll scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\lha.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\L_llio.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\mdb.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\MDMAP.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\MemModSc.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\MemScan.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\minizip.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\MKavIO.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\msoe.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\nfio.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\NTFSstrm.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\prKernel.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\prLoader.dll scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\prseqio.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\PrUtil.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\Quantum.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\rar.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\ScanningProcess.exe scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\sfdb.PPL scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\TempFile.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\thpimpl.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\UniArc.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\UnLZX.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\UnStored.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\WDiskIO.ppl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\hsperfdata_drose\3616 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\hsperfdata_drose\3928 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\etilqs_4P0DMeJvbuBoMgOPm6a4 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\etilqs_d1nnM9ckpjgpfZPuAExZ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\etilqs_GgVHoEFBHsc49K8nASQU scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\etilqs_qOEgs5RTV7f8JtD8fuRV scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\ExchangePerflog_8484fa310bc2664acfcccd43.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\Perflib_Perfdata_b48.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temp\Perflib_Perfdata_d6c.dat scheduled to be deleted on reboot.
->Temp folder emptied: 84763334 bytes
File delete failed. C:\Documents and Settings\drose\Local Settings\Temporary Internet Files\Content.Word\~WRS{1CF96BD8-04B1-4E75-8E5D-C5B898448897}.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temporary Internet Files\Content.Word\~WRS{324FA392-DA1B-4984-ABD1-FDEF9E3CFA1D}.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temporary Internet Files\Content.Word\~WRS{9B6D1CB6-F27F-4594-9236-0AC0D1F81B6F}.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temporary Internet Files\Content.Word\~WRS{CF9D476D-82BA-4A31-B6F7-180C05596DF1}.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 234785688 bytes
File delete failed. C:\Documents and Settings\drose\Application Data\Sun\Java\Deployment\cache\6.0\14\757e808e-327e3746 scheduled to be deleted on reboot.
->Java cache emptied: 123462269 bytes
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Google Gears for Firefox\localserver.db scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Google Gears for Firefox\permissions.db scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
->FireFox cache emptied: 33667683 bytes
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\data_0 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\data_1 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\data_2 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\drose\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\data_3 scheduled to be deleted on reboot.
->Google Chrome cache emptied: 136064158 bytes
User: drose.MSHOME
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 4874468 bytes
User: gary
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
User: Laurel
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->FireFox cache emptied: 41297017 bytes
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 3293318 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes
%systemdrive% .tmp files removed: 0 bytes
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\NV30923052.TMP folder deleted successfully.
%systemroot% .tmp files removed: 1648770 bytes
%systemroot%\System32 .tmp files removed: 4818449 bytes
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_410.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 16895 bytes
RecycleBin emptied: 69462 bytes
Total Files Cleaned = 637.96 mb
OTL by OldTimer - Version 3.0.18.4 log created on 10072009_194020
Files\Folders moved on Reboot...
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\Arj.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\avlib.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\Avp1.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\AvpMgr.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\btimages.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\CAB.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\dmap.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\dtreg.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\FsDrvPlg.ppl moved successfully.
DllUnregisterServer procedure not found in C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\FSSync.dll
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\FSSync.dll NOT unregistered.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\FSSync.dll moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\HashCont.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\HashMD5.PPL moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\HCCMP.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\ichk2.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\iChkSA.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\Inflate.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\IWGen.ppl moved successfully.
DllUnregisterServer procedure not found in C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\kave.dll
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\kave.dll NOT unregistered.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\kave.dll moved successfully.
DllUnregisterServer procedure not found in C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\kosglue-7.0.26.0.dll
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\kosglue-7.0.26.0.dll NOT unregistered.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\kosglue-7.0.26.0.dll moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\lha.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\L_llio.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\mdb.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\MDMAP.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\MemModSc.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\MemScan.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\minizip.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\MKavIO.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\msoe.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\nfio.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\NTFSstrm.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\prKernel.ppl moved successfully.
DllUnregisterServer procedure not found in C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\prLoader.dll
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\prLoader.dll NOT unregistered.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\prLoader.dll moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\prseqio.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\PrUtil.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\Quantum.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\rar.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\ScanningProcess.exe moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\sfdb.PPL moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\TempFile.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\thpimpl.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\UniArc.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\UnLZX.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\UnStored.ppl moved successfully.
C:\Documents and Settings\drose\Local Settings\Temp\jkos-drose\binaries\WDiskIO.ppl moved successfully.
File\Folder C:\Documents and Settings\drose\Local Settings\Temp\hsperfdata_drose\3616 not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temp\hsperfdata_drose\3928 not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temp\etilqs_4P0DMeJvbuBoMgOPm6a4 not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temp\etilqs_d1nnM9ckpjgpfZPuAExZ not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temp\etilqs_GgVHoEFBHsc49K8nASQU not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temp\etilqs_qOEgs5RTV7f8JtD8fuRV not found!
C:\Documents and Settings\drose\Local Settings\Temp\ExchangePerflog_8484fa310bc2664acfcccd43.dat moved successfully.
File\Folder C:\Documents and Settings\drose\Local Settings\Temp\Perflib_Perfdata_b48.dat not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temp\Perflib_Perfdata_d6c.dat not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temporary Internet Files\Content.Word\~WRS{1CF96BD8-04B1-4E75-8E5D-C5B898448897}.tmp not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temporary Internet Files\Content.Word\~WRS{324FA392-DA1B-4984-ABD1-FDEF9E3CFA1D}.tmp not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temporary Internet Files\Content.Word\~WRS{9B6D1CB6-F27F-4594-9236-0AC0D1F81B6F}.tmp not found!
File\Folder C:\Documents and Settings\drose\Local Settings\Temporary Internet Files\Content.Word\~WRS{CF9D476D-82BA-4A31-B6F7-180C05596DF1}.tmp not found!
C:\Documents and Settings\drose\Application Data\Sun\Java\Deployment\cache\6.0\14\757e808e-327e3746 moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Google Gears for Firefox\localserver.db moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Google Gears for Firefox\permissions.db moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Mozilla\Firefox\Profiles\g9woyp9f.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\data_0 moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\data_1 moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\data_2 moved successfully.
C:\Documents and Settings\drose\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\data_3 moved successfully.
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_410.dat not found!
Registry entries deleted on Reboot...
OTL second run:
OTL logfile created on: 07/10/2009 7:48:03 PM - Run 2
OTL by OldTimer - Version 3.0.18.4 Folder = C:\bin
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy
2.00 Gb Total Physical Memory | 1.54 Gb Available Physical Memory | 77.18% Memory free
4.00 Gb Paging File | 3.65 Gb Available in Paging File | 91.14% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.82 Gb Total Space | 9.90 Gb Free Space | 4.25% Space Free | Partition Type: NTFS
Drive D: | 1.76 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
Drive F: | 581.58 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive K: | 465.76 Gb Total Space | 251.05 Gb Free Space | 53.90% Space Free | Partition Type: NTFS
Drive L: | 2.86 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive P: | 82.19 Gb Total Space | 39.88 Gb Free Space | 48.52% Space Free | Partition Type: NTFS
Drive V: | 465.76 Gb Total Space | 288.55 Gb Free Space | 61.95% Space Free | Partition Type: NTFS
Computer Name: ORION2
Current User Name: drose
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Processes (SafeList) ========== PRC - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe (Intel Corporation)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\WINDOWS\System32\MsPMSPSv.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\wscntfy.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe (Intel Corporation)
PRC - C:\Program Files\Creative\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Documents and Settings\drose\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Documents and Settings\drose\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe (Google)
PRC - C:\bin\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\System32\wbem\wmiprvse.exe (Microsoft Corporation)
========== Win32 Services (SafeList) ========== SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Stopped]) -- C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (ATI Smart [Auto | Stopped]) -- C:\WINDOWS\System32\ati2sgag.exe ()
SRV - (Automatic LiveUpdate Scheduler [Auto | Running]) -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CVPND [Auto | Running]) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (FLEXnet Licensing Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (gupdate1c9c8cfbf3b8d0a [Auto | Stopped]) -- C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (gusvc [On_Demand | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IAANTMon [Auto | Running]) -- C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe (Intel Corporation)
SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Stopped]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LiveUpdate [On_Demand | Stopped]) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (MDM [Auto | Running]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (Norton Ghost [Disabled | Stopped]) -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
SRV - (NVSvc [Auto | Running]) -- C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
SRV - (odserv [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (PDEngine [Disabled | Stopped]) -- C:\Program Files\Raxco\PerfectDisk\PDEngine.exe (Raxco Software, Inc.)
SRV - (PDSched [Disabled | Stopped]) -- C:\Program Files\Raxco\PerfectDisk\PDSched.exe (Raxco Software, Inc.)
SRV - (PnkBstrA [Disabled | Stopped]) -- C:\WINDOWS\System32\PnkBstrA.exe ()
SRV - (PnkBstrB [Disabled | Stopped]) -- C:\WINDOWS\System32\PnkBstrB.exe ()
SRV - (rpcapd [On_Demand | Stopped]) -- C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (usnjsvc [Disabled | Stopped]) -- C:\Program Files\MSN Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (vpnagent [Auto | Running]) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (WMDM PMSP Service [Auto | Running]) -- C:\WINDOWS\System32\MsPMSPSv.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc [Disabled | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
========== Driver Services (SafeList) ========== DRV - (61883 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\61883.sys (Microsoft Corporation)
DRV - (ACCSKMD [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\accskmd.sys (Canon Inc)
DRV - (ati2mtag [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Avc [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\avc.sys (Microsoft Corporation)
DRV - (b57w2k [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\b57xp32.sys (Broadcom Corporation)
DRV - (cpuz132 [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\cpuz132_x32.sys (Windows ® Codename Longhorn DDK provider)
DRV - (ctljystk [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\ctljystk.sys (Creative Technology Ltd.)
DRV - (ctsfm2k [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys (Creative Technology Ltd)
DRV - (CVirtA [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\CVirtA.sys (Cisco Systems, Inc.)
DRV - (CVPNDRVA [Auto | Running]) -- C:\WINDOWS\System32\Drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (Defrag32 [Auto | Running]) -- C:\WINDOWS\System32\drivers\defrag32.sys (Raxco Software, Inc.)
DRV - (Defrag32b [Boot | Running]) -- C:\WINDOWS\System32\drivers\defrag32b.sys (Raxco Software, Inc.)
DRV - (DNE [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\dne2000.sys (Deterministic Networks, Inc.)
DRV - (DSDrv4 [On_Demand | Stopped]) -- C:\Program Files\DScaler\DSDrv4.sys ()
DRV - (emu10k [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (emu10k1 [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (gameenum [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (giveio [On_Demand | Stopped]) -- C:\WINDOWS\System32\giveio.sys ()
DRV - (iaStor [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (IrBus [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\IrBus.sys (Microsoft Corporation)
DRV - (lusbaudio [System | Running]) -- C:\WINDOWS\System32\drivers\lvsound2.sys (Logitech Inc.)
DRV - (MarvinBus [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\MarvinBus.sys (Pinnacle Systems GmbH)
DRV - (mcdbus [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\mcdbus.sys (MagicISO, Inc.)
DRV - (MSDV [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\msdv.sys (Microsoft Corporation)
DRV - (nm [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\NMnt.sys (Microsoft Corporation)
DRV - (NPF [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\npf.sys (CACE Technologies)
DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (ossrv [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ctoss2k.sys (Creative Technology Ltd.)
DRV - (P17 [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\P17.sys (Creative Technology Ltd.)
DRV - (Partizan [Boot | Stopped]) -- C:\WINDOWS\Partizan.txt ()
DRV - (PCLEPCI [System | Running]) -- C:\WINDOWS\System32\drivers\pclepci.sys (Pinnacle Systems GmbH)
DRV - (pcouffin [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\pcouffin.sys (VSO Software)
DRV - (pfc [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\pfc.sys (Padus, Inc.)
DRV - (PinnacleMarvinAVS [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\MarvinAVS.sys (Pinnacle a division of Avid Technology, Inc.)
DRV - (Point32 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\point32.sys (Microsoft Corporation)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (QCAbsee [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\LVCA.sys (Logitech Inc.)
DRV - (ROOTMODEM [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\RootMdm.sys (Microsoft Corporation)
DRV - (RT73 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\Dr71WU.sys (Ralink Technology, Corp.)
DRV - (rtl8139 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS (Realtek Semiconductor Corporation)
DRV - (SCDEmu [System | Running]) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (senfilt [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\senfilt.sys (Creative Technology Ltd.)
DRV - (sfman [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (smwdm [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\smwdm.sys (Analog Devices, Inc.)
DRV - (SVKP [Auto | Running]) -- C:\WINDOWS\System32\SVKP.sys (AntiCracking)
DRV - (symsnap [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\symsnap.sys (StorageCraft)
DRV - (tap0801 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\tap0801.sys (The OpenVPN Project)
DRV - (USBAAPL [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbaudio [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (v2imount [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\v2imount.sys (Symantec Corporation)
DRV - (VirtualCam [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\VirtualCam.sys (MorningSound Co., Ltd.)
DRV - (vmm [System | Running]) -- C:\WINDOWS\System32\Drivers\vmm.sys (Microsoft Corporation)
DRV - (VMnetAdapter [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\vmnetadapter.sys (VMware, Inc.)
DRV - (VPCNetS2 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\VMNetSrv.sys (Microsoft Corporation)
DRV - (vpnva [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\vpnva.sys (Cisco Systems, Inc.)
DRV - (VProEventMonitor [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\vproeventmonitor.sys (Symantec Corporation)
DRV - (vsdatant [Auto | Running]) -- C:\WINDOWS\System32\vsdatant.sys (Zone Labs, LLC)
DRV - (WimFltr [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wimfltr.sys (Microsoft Corporation)
DRV - (ZDPNDIS5 [On_Demand | Stopped]) -- C:\WINDOWS\System32\ZDPNDIS5.SYS (Printing Communications Assoc., Inc. (PCAUSA))
========== Standard Registry (All) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =
http://ie.search.msn...st/srchcust.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
http://www.google.com/ieIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
http://ie.search.msn...st/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://www.google.com/ieIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft...amp;ar=iesearchIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL =
http://www.google.co...m...tf8&oe=utf8IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://weatheroffice...8_metric_e.htmlIE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "
http://www.google.co...-8&oe=UTF-8&q="FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "
http://www.drcs.ca/m..._metric_e.html"FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.32.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
FF - prefs.js..extensions.enabledItems:
[email protected]:1.0
FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:0.0.0
FF - prefs.js..extensions.enabledItems: {06997db0-c027-4d5f-bd37-b0d9230226ea}:0.52
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.3
FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/02 03:00:38 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\
[email protected]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/04/25 14:37:36 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2009/09/04 17:32:19 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/09/16 20:55:54 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/09/16 20:55:54 | 00,000,000 | ---D | M]
[2009/04/25 14:38:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Extensions
[2008/08/06 06:24:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/04/25 14:38:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Extensions\
[email protected][2009/10/04 09:16:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Firefox\Profiles\g9woyp9f.default\extensions
[2009/05/26 08:03:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Firefox\Profiles\g9woyp9f.default\extensions\{06997db0-c027-4d5f-bd37-b0d9230226ea}
[2007/10/28 11:40:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Firefox\Profiles\g9woyp9f.default\extensions\{32537848-7D38-4ee2-B5A2-47562E69C59E}
[2009/02/09 17:15:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Firefox\Profiles\g9woyp9f.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25c}
[2009/08/17 21:53:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Firefox\Profiles\g9woyp9f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2008/01/10 22:08:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Firefox\Profiles\g9woyp9f.default\extensions\
[email protected][2009/04/25 10:37:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\drose\Application Data\mozilla\Firefox\Profiles\g9woyp9f.default\extensions\
[email protected][2009/10/04 09:16:47 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2007/02/02 18:17:53 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/09/16 20:55:54 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/04/25 14:37:45 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009/05/13 05:24:16 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/06/11 06:25:11 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/17 21:42:47 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009/09/16 20:55:50 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/09/16 20:55:50 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2007/11/08 15:39:00 | 00,827,392 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\libeay32.dll
[2009/07/25 05:23:01 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2008/10/17 13:29:52 | 01,332,224 | ---- | M] (DivX,Inc.) -- C:\Program Files\mozilla firefox\plugins\npdivx32.dll
[2008/09/15 19:12:12 | 00,098,304 | ---- | M] (DivX, Inc) -- C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll
[2007/02/04 13:26:26 | 01,124,080 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\NPFxViewer.dll
[2006/11/29 17:32:30 | 01,440,560 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll
[2007/11/08 15:39:00 | 00,864,256 | ---- | M] (VMware, Inc.) -- C:\Program Files\mozilla firefox\plugins\npmks.dll
[2009/09/16 20:55:51 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2006/10/26 20:12:16 | 00,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL
[2008/10/14 22:33:30 | 00,095,600 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2008/11/22 09:23:05 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2008/11/22 09:23:05 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2008/11/22 09:23:05 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2008/11/22 09:23:05 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2008/11/22 09:23:05 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2008/11/22 09:23:05 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2008/11/22 09:23:05 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2007/11/08 15:39:00 | 00,159,744 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\ssleay32.dll
[2009/08/15 07:15:45 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/08/15 07:15:45 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/08/15 07:15:45 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/08/15 07:15:45 | 00,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/08/15 07:15:45 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/08/15 07:15:45 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (VirtualCamera IEMenu Class) - {0246A1A7-820A-469A-85A7-7B7F01EB808C} - C:\Program Files\VirtualCamera\VirtualCameraMenu.dll (MorningSound Soft)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll (Google Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\System32\ieframe.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [COMMUNICATOR] C:\Program Files\Microsoft Office Communicator\Communicator.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\drose\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\WINDOWS\Installer\{F3C1DE9E-5E16-4BA9-B854-7B53A45E3579}\Icon3E5562ED7.ico ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll (Google Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 59 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: adobe.com ([www] http in Local intranet)
O15 - HKCU\..Trusted Domains: vantagemedia.com ([vpn] https in Trusted sites)
O15 - HKCU\..Trusted Domains: vantage-media.net ([webvpn] https in Local intranet)
O15 - HKCU\..Trusted Domains: vm.local ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: vm.local ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: vm.local ([dw02-drac] https in Local intranet)
O15 - HKCU\..Trusted Domains: 61 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B}
http://support.dell....iler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8}
http://download.micr.../OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83}
http://upload.facebo...toUploader5.cab (Facebook Photo Uploader 5)
O16 - DPF: {0DA69429-A757-4D6F-A827-DB1AF052DDAF}
https://mytbb.primus.../plugins/VA.cab ()
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2D0CBE69-DAFC-11D3-96D2-0020182E2E27}
http://itanium2.dial...ia4skype083.cab (Reg Error: Key error.)
O16 - DPF: {338095E4-1806-4BA3-AB51-38A3179200E9}
https://vsh11.vm.loc...c-win32-x86.cab (QuickMksAxCtl Class)
O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77}
http://i.dell.com/im...r/SysProExe.cab (Scanner.SysScanner)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE}
http://office.micros...ontent/opuc.cab (Office Update Installation Engine)
O16 - DPF: {43E4476A-6C11-4274-AFA4-DF665B26EAE0}
https://webprd21-dra...VideoViewer.cab (Session Viewer)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967}
http://dlm.tools.aka...vex-2.2.4.4.cab (DLM Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537}
http://spaces.msn.co...ad/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166}
https://scan.safety....lscbase3401.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
http://v5.windowsupd...b?1102389630236 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
http://update.micros...b?1177950273173 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8F0DF9DB-AA5A-4ED0-9176-1C4A9C762C59}
http://sametime.ceri...STJNILoader.cab (JNILoader Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B2FC031D-8C74-46AE-8042-BCF4FC03C1EF}
http://hpqc.vm.local...in/Spider91.cab (Loader Class v4)
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
http://messenger.msn...pDownloader.cab (MsnMessengerSetupDownloadControl Class)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277}
http://office.micros...ntent/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CC49479E-93A8-455E-959A-C49BE895D87C}
https://mytbb.primus...ns/VMPlayer.cab ()
O16 - DPF: {CCA1618B-7D6E-4432-8FA4-3E01A1AD78A8}
https://dw01-drac.vm...s/vm/rac5vm.cab (rac5vm Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DC120706-9372-4B2E-AD15-F2135F51F30A}
https://bb01-drac.vm...VideoViewer.cab (Session Viewer)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD}
http://costco.pnimed...upv2.0.0.11.cab? (Photo Upload Plugin Class)
O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\intu-qt2007 {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\intu-qt2008 {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/octet-stream - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-complus - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-msdownload - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - Class Install Handler - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - deflate - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - gzip - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - lzdhtml - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/webviewhtml - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\ckpNotify: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\System32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\WlNotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\System32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\System32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\System32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\Your Image File Name Here without a path: Debugger - C:\WINDOWS\System32\ntsd.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/11 21:18:18 | 00,000,095 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/04/25 01:34:12 | 00,053,248 | R--- | M] () - D:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2009/04/25 01:34:12 | 00,053,248 | R--- | M] () - D:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2009/04/25 01:34:14 | 00,000,558 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2001/08/23 07:00:00 | 00,000,110 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (PDBoot.exe) - C:\WINDOWS\System32\PDBoot.exe (Raxco Software, Inc.)
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found
========== Files/Folders - Created Within 30 Days ========== [2009/10/01 21:14:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/10/03 14:40:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\drose\Application Data\AVG8
[2009/10/01 21:14:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\drose\Application Data\Malwarebytes
[2009/09/27 08:52:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\drose\Local Settings\Application Data\Cisco
[2009/09/27 08:54:11 | 00,000,000 | ---D | C] -- C:\Program Files\Cisco
[2009/09/29 20:53:59 | 00,000,000 | ---D | C] -- C:\Program Files\CopyNook
[2009/09/29 22:11:34 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/10/01 21:14:11 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/29 21:02:07 | 00,000,000 | ---D | C] -- C:\Program Files\Photocopier
[2009/09/29 21:49:22 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2009/09/29 22:24:00 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/10/07 19:40:20 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/10/03 09:39:04 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2009/10/03 09:17:12 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp
[2009/10/03 07:28:57 | 00,000,000 | RHSD | C] -- C:\cmdcons
[2009/10/03 07:28:08 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2009/10/03 07:28:08 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2009/10/03 07:28:08 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2009/10/03 07:28:08 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2009/10/03 07:27:35 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/10/01 21:14:13 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/10/01 21:14:11 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/09/30 20:25:15 | 00,000,000 | ---D | C] -- C:\bin
[2009/09/29 22:12:20 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/09/29 21:46:26 | 00,000,000 | ---D | C] -- C:\UBCD4Win
[2009/09/29 21:02:07 | 00,210,200 | ---- | C] (Pegasus Imaging Corp.) -- C:\WINDOWS\System32\TWNPRO3.DLL
[2009/09/29 21:02:07 | 00,122,880 | ---- | C] (Pegasus Imaging Corp.) -- C:\WINDOWS\System32\TWNLIB3.DLL
[2009/09/11 20:40:04 | 00,000,000 | ---D | C] -- C:\UBCD4Win_old
[2009/09/09 12:34:51 | 00,153,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\triedit.dll
[2007/12/08 09:31:19 | 00,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\drose\Application Data\pcouffin.sys
[2002/04/11 02:41:06 | 00,065,536 | R--- | C] ( ) -- C:\WINDOWS\System32\A3d.dll
========== Files - Modified Within 30 Days ========== [2009/10/07 19:47:23 | 00,555,168 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/10/07 19:47:23 | 00,466,748 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/10/07 19:47:23 | 00,079,674 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/10/07 19:43:43 | 00,002,447 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
[2009/10/07 19:43:35 | 00,199,939 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009/10/07 19:43:20 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/10/07 19:43:19 | 00,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009/10/07 19:43:06 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/10/07 19:43:04 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/10/07 19:43:02 | 24,139,81696 | -HS- | M] () -- C:\hiberfil.sys
[2009/10/07 19:41:00 | 00,000,978 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-688789844-839522115-1003UA.job
[2009/10/07 19:21:00 | 00,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2009/10/07 15:41:00 | 00,000,926 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-688789844-839522115-1003Core.job
[2009/10/06 16:53:41 | 00,002,284 | ---- | M] () -- C:\Documents and Settings\drose\Desktop\Google Chrome.lnk
[2009/10/04 15:56:50 | 00,004,342 | ---- | M] () -- C:\Documents and Settings\drose\My Documents\kapersky.html
[2009/10/04 09:10:46 | 00,000,349 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\PCLECHAL.INI
[2009/10/03 09:21:25 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/10/03 09:21:14 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/10/03 07:29:03 | 00,000,281 | RHS- | M] () -- C:\boot.ini
[2009/10/03 07:24:22 | 03,324,455 | R--- | M] () -- C:\Documents and Settings\drose\Desktop\ComboFix.exe
[2009/09/30 20:31:37 | 00,159,472 | ---- | M] () -- C:\Documents and Settings\drose\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/09/29 22:24:02 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\drose\Desktop\HijackThis.lnk
[2009/09/29 22:11:38 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\drose\Desktop\ERUNT.lnk
[2009/09/29 22:08:51 | 00,000,202 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/09/29 21:49:39 | 00,000,933 | ---- | M] () -- C:\Documents and Settings\drose\Desktop\Spybot - Search & Destroy.lnk
[2009/09/29 21:48:36 | 00,001,241 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\UBCD4Win.lnk
[2009/09/29 21:21:10 | 00,507,400 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/09/29 21:02:12 | 00,000,691 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Photocopier.lnk
[2009/09/29 20:40:02 | 03,712,564 | -H-- | M] () -- C:\Documents and Settings\drose\Local Settings\Application Data\IconCache.db
[2009/09/29 20:38:45 | 00,000,600 | ---- | M] () -- C:\Documents and Settings\drose\Local Settings\Application Data\PUTTY.RND
[2009/09/27 08:16:22 | 00,001,848 | ---- | M] () -- C:\Documents and Settings\drose\Desktop\ASDM on vpn.vm.local.lnk
[2009/09/23 20:09:28 | 00,002,644 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/09/20 07:44:11 | 00,001,930 | -H-- | M] () -- C:\Documents and Settings\drose\My Documents\Default.rdp
[2009/09/15 21:14:06 | 00,003,349 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/09/14 02:12:36 | 00,229,888 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2009/09/10 14:54:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/09/10 14:53:50 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/09/10 03:01:28 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
========== Files - No Company Name ==========[2009/10/04 15:56:50 | 00,004,342 | ---- | C] () -- C:\Documents and Settings\drose\My Documents\kapersky.html
[2009/10/03 07:29:03 | 00,000,211 | ---- | C] () -- C:\Boot.bak
[2009/10/03 07:29:01 | 00,260,272 | ---- | C] () -- C:\cmldr
[2009/10/03 07:28:08 | 00,229,888 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2009/10/03 07:28:08 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2009/10/03 07:28:08 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2009/10/03 07:28:08 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/10/03 07:23:38 | 03,324,455 | R--- | C] () -- C:\Documents and Settings\drose\Desktop\ComboFix.exe
[2009/10/01 08:19:13 | 24,139,81696 | -HS- | C] () -- C:\hiberfil.sys
[2009/09/29 22:24:02 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\drose\Desktop\HijackThis.lnk
[2009/09/29 22:11:38 | 00,000,592 | ---- | C] () -- C:\Documents and Settings\drose\Desktop\ERUNT.lnk
[2009/09/29 21:49:38 | 00,000,933 | ---- | C] () -- C:\Documents and Settings\drose\Desktop\Spybot - Search & Destroy.lnk
[2009/09/29 21:02:12 | 00,000,691 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Photocopier.lnk
[2009/09/27 08:16:21 | 00,001,848 | ---- | C] () -- C:\Documents and Settings\drose\Desktop\ASDM on vpn.vm.local.lnk
[2009/09/11 20:41:45 | 00,001,241 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\UBCD4Win.lnk
[2009/04/22 00:19:06 | 00,172,173 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2009/01/13 11:29:00 | 00,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2009/01/13 11:28:44 | 00,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2009/01/11 15:54:01 | 00,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/01/11 15:54:01 | 00,022,328 | ---- | C] () -- C:\Documents and Settings\drose\Application Data\PnkBstrK.sys
[2009/01/07 22:04:47 | 00,237,568 | R--- | C] () -- C:\WINDOWS\System32\qtmlClient.dll
[2009/01/07 22:04:47 | 00,002,247 | ---- | C] () -- C:\WINDOWS\Graffiti5.2Pin.ini
[2009/01/07 21:40:45 | 00,909,022 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\__wdump.txt
[2008/12/27 15:20:13 | 00,029,698 | ---- | C] () -- C:\WINDOWS\System32\ashhwun.dll
[2008/11/03 22:11:31 | 00,001,993 | ---- | C] () -- C:\Documents and Settings\drose\Application Data\SCPSP6.DLL
[2008/11/03 22:11:13 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\NEOOCR.dll
[2008/11/03 22:11:13 | 00,002,985 | RHS- | C] () -- C:\Documents and Settings\drose\Local Settings\Application Data\scpsv6.dll
[2008/10/24 22:11:31 | 00,001,521 | RHS- | C] () -- C:\Documents and Settings\drose\Application Data\SCPSS6.DLL
[2008/10/07 10:13:30 | 00,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 10:13:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/09/15 19:14:24 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/09/15 19:12:02 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008/09/15 19:12:02 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008/09/15 19:11:10 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/06/03 07:09:58 | 00,000,078 | ---- | C] () -- C:\WINDOWS\lsoon.ini
[2008/06/02 23:45:35 | 00,034,716 | ---- | C] () -- C:\Documents and Settings\drose\Local Settings\Application Data\ShLog.txt
[2008/04/22 20:37:28 | 00,000,040 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2008/03/30 14:43:35 | 00,010,736 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/02/16 07:16:01 | 00,000,172 | ---- | C] () -- C:\WINDOWS\mercury.ini
[2008/02/08 18:13:44 | 00,319,488 | ---- | C] () -- C:\WINDOWS\System32\LS3Renderer.dll
[2008/02/04 18:23:10 | 00,693,792 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2008/01/03 09:26:00 | 01,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/01/03 09:26:00 | 01,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/01/03 09:26:00 | 01,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/01/03 09:26:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/01/03 09:26:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/01/01 12:38:01 | 00,000,000 | ---- | C] () -- C:\WINDOWS\VCDWizardDLL.INI
[2007/12/08 09:31:22 | 00,000,034 | ---- | C] () -- C:\Documents and Settings\drose\Application Data\pcouffin.log
[2007/12/08 09:31:19 | 00,007,887 | ---- | C] () -- C:\Documents and Settings\drose\Application Data\pcouffin.cat
[2007/12/08 09:31:19 | 00,001,144 | ---- | C] () -- C:\Documents and Settings\drose\Application Data\pcouffin.inf
[2007/12/08 09:21:56 | 00,921,600 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll
[2007/12/08 09:21:56 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2007/12/08 09:21:56 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2007/12/08 09:21:56 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2007/11/06 15:19:28 | 00,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2007/09/06 15:12:02 | 00,847,872 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2007/08/19 13:46:26 | 00,262,144 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2007/08/19 13:46:26 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\DVResampleru.dll
[2007/07/10 21:53:53 | 00,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys
[2007/07/10 21:52:21 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\GiveioIns.dll
[2007/06/13 19:02:36 | 00,000,600 | ---- | C] () -- C:\Documents and Settings\drose\Local Settings\Application Data\PUTTY.RND
[2007/05/13 19:58:44 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\resourceGeneric.dll
[2007/04/06 20:47:18 | 00,034,819 | ---- | C] () -- C:\WINDOWS\System32\ovnkcom.dll
[2007/04/06 20:47:18 | 00,023,554 | ---- | C] () -- C:\WINDOWS\System32\2kpig32.dll
[2007/02/04 13:49:23 | 00,000,720 | ---- | C] () -- C:\WINDOWS\XMLEditor3.INI
[2007/02/04 13:26:42 | 00,000,063 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\Ts_infos.ini
[2007/01/03 11:24:36 | 00,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/01/03 11:22:46 | 00,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/01/03 11:22:14 | 00,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2006/12/28 22:43:32 | 00,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
[2006/12/28 22:43:32 | 00,000,143 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2006/12/28 22:43:10 | 00,749,568 | R--- | C] () -- C:\WINDOWS\System32\agissi.dll
[2006/12/28 22:43:06 | 11,194,368 | R--- | C] () -- C:\WINDOWS\System32\zhhp_res.dll
[2006/12/28 22:43:04 | 00,114,688 | R--- | C] () -- C:\WINDOWS\System32\vshp2600.dll
[2006/12/28 22:42:24 | 00,000,577 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2006/08/09 21:20:41 | 00,006,307 | ---- | C] () -- C:\WINDOWS\System32\Ludap17.ini
[2006/08/09 21:20:41 | 00,000,039 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2006/08/09 20:33:06 | 00,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll
[2006/02/09 15:19:52 | 01,216,512 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/02/09 15:19:52 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/01/02 21:16:27 | 00,003,584 | ---- | C] () -- C:\WINDOWS\System32\wmfhotfix.dll
[2005/12/11 23:16:32 | 00,000,065 | ---- | C] () -- C:\WINDOWS\MovingPicture.ini
[2005/12/11 20:20:32 | 00,194,248 | ---- | C] () -- C:\WINDOWS\System32\LTRFD13n.DLL
[2005/12/11 20:05:03 | 00,196,096 | ---- | C] () -- C:\WINDOWS\System32\macd32.dll
[2005/12/11 20:05:03 | 00,138,752 | ---- | C] () -- C:\WINDOWS\System32\mase32.dll
[2005/12/11 20:05:03 | 00,136,192 | ---- | C] () -- C:\WINDOWS\System32\mamc32.dll
[2005/12/11 20:05:03 | 00,057,856 | ---- | C] () -- C:\WINDOWS\System32\masd32.dll
[2005/12/11 20:05:03 | 00,027,648 | ---- | C] () -- C:\WINDOWS\System32\ma32.dll
[2005/12/11 20:04:58 | 00,000,056 | RHS- | C] () -- C:\WINDOWS\System32\06CE8E7C8B.sys
[2005/08/15 19:08:03 | 00,004,133 | ---- | C] () -- C:\WINDOWS\entrust.ini
[2005/06/28 20:15:00 | 00,000,016 | ---- | C] () -- C:\WINDOWS\SCN.ini
[2005/05/03 19:38:42 | 00,064,512 | ---- | C] () -- C:\WINDOWS\System32\P17.dll
[2005/04/25 17:23:13 | 03,712,564 | -H-- | C] () -- C:\Documents and Settings\drose\Local Settings\Application Data\IconCache.db
[2005/03/10 21:40:35 | 00,000,284 | ---- | C] () -- C:\WINDOWS\_delis32.ini
[2005/03/09 20:36:15 | 00,000,038 | ---- | C] () -- C:\WINDOWS\VodeiMPAVI.INI
[2005/02/22 10:26:48 | 00,000,040 | ---- | C] () -- C:\WINDOWS\sx80lc.ini
[2005/02/22 10:26:48 | 00,000,040 | ---- | C] () -- C:\WINDOWS\sx5363.ini
[2004/12/29 15:13:43 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2004/12/29 15:09:42 | 00,000,056 | RHS- | C] () -- C:\WINDOWS\System32\B32A7E584E.sys
[2004/12/29 10:56:42 | 00,000,435 | ---- | C] () -- C:\WINDOWS\graphedt.INI
[2004/12/23 21:25:18 | 00,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2004/12/20 19:24:03 | 01,663,068 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2004/12/08 08:15:09 | 00,000,202 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2004/12/07 15:44:56 | 00,043,520 | ---- | C] () -- C:\WINDOWS\System32\VoissUtils.dll
[2004/12/07 10:26:09 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/12/07 01:16:35 | 00,000,128 | ---- | C] () -- C:\Documents and Settings\drose\Local Settings\Application Data\fusioncache.dat
[2004/12/07 00:52:14 | 00,208,384 | ---- | C] () -- C:\Documents and Settings\drose\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/12/06 23:28:56 | 00,034,819 | ---- | C] () -- C:\WINDOWS\System32\orsru32.dll
[2004/12/06 23:28:56 | 00,000,264 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2004/12/06 23:12:24 | 00,000,011 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2004/12/06 22:51:33 | 00,159,472 | ---- | C] () -- C:\Documents and Settings\drose\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2004/12/06 21:48:52 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\drose\Application Data\desktop.ini
[2004/12/06 15:35:24 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2004/03/23 17:38:00 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll
[2004/03/05 16:00:58 | 00,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2003/09/01 11:51:02 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\Installrt2500qa.dll
[2002/10/02 16:24:26 | 00,000,039 | ---- | C] () -- C:\WINDOWS\System32\sx80lc.ini
[2002/08/29 07:00:00 | 00,021,507 | ---- | C] () -- C:\WINDOWS\System32\meunwel.dll
[2002/08/29 07:00:00 | 00,003,349 | ---- | C] () -- C:\WINDOWS\win.ini
[2002/08/29 07:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2002/08/29 07:00:00 | 00,000,072 | ---- | C] () -- C:\WINDOWS\System32\adckcon.ini
[2002/05/13 04:16:19 | 00,356,352 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2001/10/28 18:42:30 | 00,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
< End of report >