[DaveRo]

OTL log
OTL logfile created on: 11/2/2009 12:15:16 PM - Run 6
OTL by OldTimer - Version 3.1.2.2 Folder = C:\Documents and Settings\R103470\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.39 Gb Available Physical Memory | 69.44% Memory free
3.85 Gb Paging File | 3.40 Gb Available in Paging File | 88.43% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.50 Gb Total Space | 60.03 Gb Free Space | 80.59% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive K: | 74.50 Gb Total Space | 42.36 Gb Free Space | 56.87% Space Free | Partition Type: NTFS
Drive M: | 74.50 Gb Total Space | 42.36 Gb Free Space | 56.87% Space Free | Partition Type: NTFS
Drive R: | 74.50 Gb Total Space | 42.36 Gb Free Space | 56.87% Space Free | Partition Type: NTFS
Drive T: | 232.83 Gb Total Space | 197.47 Gb Free Space | 84.81% Space Free | Partition Type: FAT
Drive V: | 74.50 Gb Total Space | 42.36 Gb Free Space | 56.87% Space Free | Partition Type: NTFS
Drive X: | 74.50 Gb Total Space | 42.36 Gb Free Space | 56.87% Space Free | Partition Type: NTFS
Drive Z: | 74.50 Gb Total Space | 47.68 Gb Free Space | 64.00% Space Free | Partition Type: NTFS

Computer Name: W1115072
Current User Name: R103470
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\R103470\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardian.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardian.exe (LogMeIn, Inc.)
PRC - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe (McAfee, Inc.)
PRC - C:\Program Files\Network Associates\Common Framework\UdaterUI.exe (McAfee, Inc.)
PRC - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
PRC - C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe (Altiris, Inc.)
PRC - C:\Program Files\Altiris\Altiris Agent\AeXAgentUIHost.exe (Altiris, Inc.)
PRC - C:\Program Files\Adobe\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Network Associates\Common Framework\Mctray.exe (McAfee, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
PRC - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Utimaco\SafeGuard Easy\ecview.exe (Utimaco Safeware AG)
PRC - C:\Program Files\Utimaco\SafeGuard Easy\SgeCtl.exe (Utimaco Safeware AG)
PRC - C:\Program Files\Utimaco\SafeGuard Easy\SgeClient.exe ()
PRC - C:\Program Files\Utimaco\SafeGuard Easy\WksCfgSrv.exe (Utimaco Safeware AG)
PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\system32\SgLogPlayer.exe (Utimaco Safeware AG)
PRC - C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpsp.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe (Visioneer Inc)
PRC - c:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe (Dell Inc.)
PRC - c:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe (Dell Inc.)
PRC - C:\WINDOWS\system32\ico.exe (Primax Electronics Ltd.)
PRC - C:\WINDOWS\system32\FSRremoS.EXE ()


========== Win32 Services (SafeList) ==========

SRV - (LMIMaint) [Auto | Running] -- C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
SRV - (vpnagent) [Auto | Running] -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (McAfeeFramework) [Unknown | Running] -- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe (McAfee, Inc.)
SRV - (McShield) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (McAfee, Inc.)
SRV - (McTaskManager) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
SRV - (FontCache3.0.0.0) [On_Demand | Stopped] -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (idsvc) [Unknown | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (aspnet_state) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (AeXNSClient) [Auto | Running] -- C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe (Altiris, Inc.)
SRV - (helpsvc) [Auto | Running] -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll (Microsoft Corporation)
SRV - (LogMeIn) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
SRV - (PrismXL) [Auto | Running] -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
SRV - (odserv) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (CVPND) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (awhost32) [On_Demand | Stopped] -- C:\Program Files\Symantec\pcAnywhere\awhost32.exe (Symantec Corporation)
SRV - (ose) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (WMPNetworkSvc) [On_Demand | Stopped] -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (SgeCtl) [Auto | Running] -- C:\Program Files\Utimaco\SafeGuard Easy\SgeCtl.exe (Utimaco Safeware AG)
SRV - (SgeClient) [Auto | Running] -- C:\Program Files\Utimaco\SafeGuard Easy\SgeClient.exe ()
SRV - (WksCfgSrv) [Auto | Running] -- C:\Program Files\Utimaco\SafeGuard Easy\WksCfgSrv.exe (Utimaco Safeware AG)
SRV - (ATI Smart) [Auto | Stopped] -- C:\WINDOWS\system32\ati2sgag.exe ()
SRV - (Ati HotKey Poller) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
SRV - (Multi-user Cleanup Service) [Disabled | Stopped] -- C:\Program Files\Lotus\Notes\ntmulti.exe (IBM Corp)
SRV - (Lotus Notes Single Logon) [Disabled | Stopped] -- C:\Program Files\Lotus\Notes\nslsvice.exe (IBM Corp)
SRV - (SgLogPlayer) [Auto | Running] -- C:\WINDOWS\system32\SgLogPlayer.exe (Utimaco Safeware AG)
SRV - (OneTouch 4.0 Monitor) [Auto | Running] -- C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe (Visioneer Inc)
SRV - (DLSDB) [Auto | Running] -- c:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe (Dell Inc.)
SRV - (DLPWD) [Auto | Running] -- c:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe (Dell Inc.)


========== Driver Services (SafeList) ==========

DRV - (LMIRfsClientNP) LMIRfsClientNP [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (vpnva) Cisco AnyConnect VPN Virtual Miniport Adapter for Windows [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (mfehidk) McAfee Inc. [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) McAfee Inc. [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) McAfee Inc. [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfetdik) McAfee Inc. [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfetdik.sys (McAfee, Inc.)
DRV - (mfebopk) McAfee Inc. [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) VSCore mferkdk [Kernel | System | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys (McAfee, Inc.)
DRV - (LMIRfsDriver) LogMeIn Remote File System Driver [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (HDAudBus) Microsoft UAA Bus Driver for High Definition Audio [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (LMIInfo) LogMeIn Kernel Information Provider [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)
DRV - (lmimirr) lmimirr [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lmimirr.sys (LogMeIn, Inc.)
DRV - (Secdrv) Secdrv [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SymEvent) SymEvent [Kernel | On_Demand | Stopped] -- C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (CVPNDRVA) Cisco Systems Inc. IPSec Driver [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (AW_HOST) AW_HOST [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AW_HOST5.sys (Symantec Corporation)
DRV - (awlegacy) awlegacy [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\awlegacy.sys (Symantec Corporation)
DRV - (awecho) awecho [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\awechomd.sys (Symantec Corporation)
DRV - (Gernuwa) Gernuwa [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\GERNUWA.sys (Symantec Corporation)
DRV - (DNE) Deterministic Network Enhancer Miniport [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (CVirtA) Cisco Systems VPN Adapter [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (SgeFlt) SgeFlt [Kernel | Boot | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\SGEFLT.SYS (Utimaco Safeware AG)
DRV - (AES-256) AES-256 [Kernel | Boot | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AES256.SYS (Utimaco Safeware AG)
DRV - (ADIHdAudAddService) ADI UAA Function Driver for High Definition Audio Service [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (ati2mtag) ati2mtag [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (b57w2k) Broadcom NetXtreme Gigabit Ethernet [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (SenFiltService) SenFilt Service [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (DSproct) DSproct [Kernel | On_Demand | Stopped] -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys (GTek Technologies Ltd.)
DRV - (PxHelp20) PxHelp20 [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (NTIDrvr) Upper Class Filter Driver [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (UBHelper) UBHelper [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\UBHelper.sys ()
DRV - (cercsr6) cercsr6 [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\cercsr6.sys (Adaptec, Inc.)
DRV - (Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (SDDMI2) SDDMI2 [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\DDMI2.sys (Gteko Ltd.)
DRV - (pelusblf) USB Mouse Low Filter Driver [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pelusblf.sys (Primax Electronics Ltd.)
DRV - (pelmouse) Mouse Suite Driver [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PELMOUSE.SYS (Primax Electronics Ltd.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\R103470\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\wbem\framedyn.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\AMInit.dll (Altiris, Inc.)
MOD - C:\Program Files\Utimaco\SafeGuard Easy\SgMsgBhk.dll (Utimaco Safeware AG)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo....e...-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.advisorcompass.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/02 13:16:00 | 00,000,000 | ---D | M]


O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files\Adobe\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [AeXAgentLogon] C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe (Altiris, Inc.)
O4 - HKLM..\Run: [AltirisConfiguration] C:\Program Files\Configuration\ConfigCheck\ScheduleConfig.vbs ()
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [DLPSP] c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE (Dell Inc.)
O4 - HKLM..\Run: [EdWizard] C:\Program Files\Utimaco\SafeGuard Easy\EdWizard.exe (Utimaco Safeware AG)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\Network Associates\Common Framework\udaterui.exe (McAfee, Inc.)
O4 - HKLM..\Run: [Mouse Suite 98 Daemon] C:\WINDOWS\System32\ico.exe (Primax Electronics Ltd.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RunningApp] C:\Program Files\Configuration\shared\Runningapp.vbs ()
O4 - HKLM..\Run: [ScheduleEncompass] C:\Program Files\Configuration\Encompass\altiris.vbs ()
O4 - HKLM..\Run: [SGEConfiguration] C:\Program Files\Utimaco\SafeGuard Easy\SGEConfigurations.bat ()
O4 - HKLM..\Run: [SgeEcView] C:\Program Files\Utimaco\SafeGuard Easy\Ecview.exe (Utimaco Safeware AG)
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [USG] C:\WINDOWS\system32\USG.EXE ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoControlPanel = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 127.0.0.1 ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: 50below.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: advisorcompass.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: aefatesting.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: aexp.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: americanexpress.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ameriprise.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ameriprise.webex.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ameriprisecentral.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ameripriseu.webex.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: amexweb.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ampadvisor.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ampf.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: assetlink.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: brainshark.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: cenveo.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: documentsonthenet.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ezdata.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ez-data.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ez-data.com ([ampf] https in Trusted sites)
O15 - HKCU\..Trusted Domains: ez-data.com/java ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ez-data.com/java/index.htm ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: fiserv.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: forefield.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: foremostadvice.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: FundPOINTDesktop.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: mainaccount.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: marketwatch.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: morningstar.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ogilvy.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: orders.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: pii121.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: riversource.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: smartofficeonline.com ([]* in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft....k/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1FA44E01-A60B-4449-BF97-66CDAA200433} https://ampf.ez-data...s/SOConfig6.cab (SOConfig6 Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1175715704046 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1175715759437 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.4.2_06)
O16 - DPF: {9C8CBDB4-53AC-4434-B3B2-404B1C5533F3} https://ams.stoneriv.../amsrptview.cab (FISERV FIPSCO Report Viewer)
O16 - DPF: {C37CCB56-C46A-4778-98C7-7B12A9C1EEAD} https://atslead.ez-d...ficeLinkOLM.cab (SmartOfficeLinkOLM Class)
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.4.2_06)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} https://webmail.advi...ecom0/dwa7W.cab (Domino Web Access 7 Control)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://ameriprise.w...bex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 159.202.20.190 159.202.50.190 159.202.70.11 165.87.13.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ampf.com
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\WINDOWS\system32\AMInit.dll) - C:\WINDOWS\system32\AMInit.dll (Altiris, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (SGGINA.DLL) - C:\WINDOWS\System32\Sggina.dll (Utimaco Safeware AG)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O20 - Winlogon\Notify\NotLog: DllName - SGLogEx.dll - C:\WINDOWS\System32\SGLogEx.dll (Utimaco Safeware AG)
O20 - Winlogon\Notify\PCANotify: DllName - PCANotify.dll - C:\WINDOWS\System32\PCANotify.dll (Symantec Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/04/04 14:27:22 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/08/08 09:59:46 | 00,000,000 | ---D | M] - T:\autorun -- [ FAT ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2007/04/04 09:10:23 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: helpsvc - C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll (Microsoft Corporation)


SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll (Microsoft Corporation)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: rootrepeal.sys - Reg Error: Value error.
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll (Microsoft Corporation)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {ECD292A0-0347-4244-8C24-5DBCE990FB40} - Hotfix for Microsoft .NET Framework 3.0 (KB932471)
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: Microsoft Base Smart Card Crypto Provider Package -

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2009/11/02 09:30:30 | 00,528,384 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\R103470\Desktop\OTL.exe
[2009/11/01 14:49:02 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/11/01 14:49:00 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/10/31 14:18:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\R103470\My Documents\My Received Files
[2009/10/31 14:05:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Adobe PDF
[2009/10/31 13:05:33 | 00,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\hidserv.dll
[2009/10/31 13:04:32 | 00,032,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbccgp.sys
[2009/10/30 08:19:11 | 00,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2009/10/29 11:56:18 | 00,000,000 | ---D | C] -- C:\ComboFix
[2009/10/29 09:39:33 | 00,000,000 | RHSD | C] -- C:\cmdcons
[2009/10/29 09:38:52 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2009/10/29 09:38:52 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2009/10/29 09:38:52 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2009/10/29 09:38:52 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2009/10/29 09:38:29 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/10/29 09:20:47 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/10/27 12:30:34 | 00,055,656 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2009/10/27 12:23:32 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\R103470\Desktop\RootRepeal.exe
[2009/10/27 11:58:51 | 04,045,536 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\R103470\Desktop\kelly.exe
[2009/10/27 11:58:19 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/10/27 11:57:20 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/10/27 11:55:51 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\R103470\Desktop\erunt_setup.exe
[2009/10/27 11:55:07 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\R103470\Desktop\SysRestorePoint.exe
[2009/10/27 11:49:01 | 00,271,872 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\R103470\Desktop\TFC.exe
[2009/10/27 09:07:41 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/10/27 08:38:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\R103470\Desktop\clean up
[2009/10/13 08:32:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2009/10/13 08:32:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\R103470\Application Data\Office Genuine Advantage
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK
[2009/10/13 08:05:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA
[2007/12/20 10:08:09 | 00,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\IMPLODE.DLL
[4 C:\Documents and Settings\R103470\My Documents\*.tmp files -> C:\Documents and Settings\R103470\My Documents\*.tmp -> ]
[1 C:\Documents and Settings\R103470\*.tmp files -> C:\Documents and Settings\R103470\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009/11/02 09:48:54 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/11/02 09:48:39 | 00,002,239 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
[2009/11/02 09:48:11 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/11/02 09:48:09 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/11/02 09:46:18 | 06,291,456 | -H-- | M] () -- C:\Documents and Settings\R103470\NTUSER.DAT
[2009/11/02 09:45:33 | 00,000,184 | ---- | M] () -- C:\Documents and Settings\R103470\Desktop\RTC on Line-Medt.com - Home.url
[2009/11/02 09:30:42 | 00,528,384 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\R103470\Desktop\OTL.exe
[2009/11/01 14:49:05 | 00,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/11/01 14:39:30 | 00,544,994 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/11/01 14:39:30 | 00,458,738 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/11/01 14:39:30 | 00,076,044 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/10/31 17:02:05 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\R103470\ntuser.ini
[2009/10/31 15:11:21 | 04,844,560 | -H-- | M] () -- C:\Documents and Settings\R103470\Local Settings\Application Data\IconCache.db
[2009/10/31 14:14:33 | 00,204,120 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/10/29 12:01:47 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/10/29 09:47:21 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/10/29 09:39:53 | 00,000,281 | RHS- | M] () -- C:\boot.ini
[2009/10/29 09:28:56 | 03,427,862 | R--- | M] () -- C:\Documents and Settings\R103470\Desktop\ComboFix.exe
[2009/10/29 09:22:51 | 00,001,744 | -H-- | M] () -- C:\WINDOWS\System32\yezaradu
[2009/10/28 11:02:03 | 00,000,036 | ---- | M] () -- C:\WINDOWS\iltwain.ini
[2009/10/27 13:05:51 | 00,009,770 | ---- | M] () -- C:\WINDOWS\wcds.ini
[2009/10/27 13:05:33 | 00,010,498 | ---- | M] () -- C:\WINDOWS\EzCDSODB.INI
[2009/10/27 12:24:13 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\R103470\Desktop\settings.dat
[2009/10/27 12:23:33 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\R103470\Desktop\RootRepeal.exe
[2009/10/27 11:58:55 | 04,045,536 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\R103470\Desktop\kelly.exe
[2009/10/27 11:57:21 | 00,000,639 | ---- | M] () -- C:\Documents and Settings\R103470\Desktop\NTREGOPT.lnk
[2009/10/27 11:57:21 | 00,000,620 | ---- | M] () -- C:\Documents and Settings\R103470\Desktop\ERUNT.lnk
[2009/10/27 11:55:52 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\R103470\Desktop\erunt_setup.exe
[2009/10/27 11:55:07 | 00,021,504 | ---- | M] (Doug Knox) -- C:\Documents and Settings\R103470\Desktop\SysRestorePoint.exe
[2009/10/27 11:49:02 | 00,271,872 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\R103470\Desktop\TFC.exe
[2009/10/25 05:11:34 | 00,077,312 | ---- | M] () -- C:\WINDOWS\MBR.exe
[2009/10/21 12:58:31 | 00,244,873 | ---- | M] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Milliken Household 10- 21- 2009.XLSM
[2009/10/21 12:55:37 | 00,241,700 | ---- | M] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Skarda Household 10- 21- 2009.XLSM
[2009/10/21 12:54:11 | 00,240,338 | ---- | M] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Cooper Household 10- 21- 2009.XLSM
[2009/10/21 12:50:10 | 00,242,049 | ---- | M] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Thomas Household 10- 21- 2009.XLSM
[2009/10/14 16:07:24 | 00,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/10/12 12:01:30 | 00,242,192 | ---- | M] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Lindstrom Household 10- 12- 2009.XLSM
[2009/10/11 07:10:09 | 00,236,544 | ---- | M] () -- C:\WINDOWS\PEV.exe
[4 C:\Documents and Settings\R103470\My Documents\*.tmp files -> C:\Documents and Settings\R103470\My Documents\*.tmp -> ]
[1 C:\Documents and Settings\R103470\*.tmp files -> C:\Documents and Settings\R103470\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/11/01 14:49:05 | 00,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/31 14:06:00 | 00,002,239 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
[2009/10/29 09:39:53 | 00,000,211 | ---- | C] () -- C:\Boot.bak
[2009/10/29 09:39:50 | 00,260,272 | ---- | C] () -- C:\cmldr
[2009/10/29 09:38:52 | 00,236,544 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2009/10/29 09:38:52 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2009/10/29 09:38:52 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2009/10/29 09:38:52 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2009/10/29 09:38:52 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/10/29 09:28:53 | 03,427,862 | R--- | C] () -- C:\Documents and Settings\R103470\Desktop\ComboFix.exe
[2009/10/27 12:24:13 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\R103470\Desktop\settings.dat
[2009/10/27 11:57:21 | 00,000,639 | ---- | C] () -- C:\Documents and Settings\R103470\Desktop\NTREGOPT.lnk
[2009/10/27 11:57:21 | 00,000,620 | ---- | C] () -- C:\Documents and Settings\R103470\Desktop\ERUNT.lnk
[2009/10/21 12:58:30 | 00,244,873 | ---- | C] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Milliken Household 10- 21- 2009.XLSM
[2009/10/21 12:55:36 | 00,241,700 | ---- | C] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Skarda Household 10- 21- 2009.XLSM
[2009/10/21 12:54:11 | 00,240,338 | ---- | C] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Cooper Household 10- 21- 2009.XLSM
[2009/10/21 12:50:10 | 00,242,049 | ---- | C] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Thomas Household 10- 21- 2009.XLSM
[2009/10/12 12:01:30 | 00,242,192 | ---- | C] () -- C:\Documents and Settings\R103470\My Documents\Asset Class Worksheet Lindstrom Household 10- 12- 2009.XLSM
[2009/08/03 14:07:42 | 00,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/01/08 14:32:45 | 00,000,008 | ---- | C] () -- C:\WINDOWS\System32\SYSTEM.INI
[2009/01/08 14:32:45 | 00,000,008 | ---- | C] () -- C:\WINDOWS\System32\PROTOCOL.INI
[2008/04/29 08:52:24 | 00,051,392 | ---- | C] () -- C:\WINDOWS\System32\drivers\atnt40k.sys
[2008/02/06 09:35:39 | 00,122,880 | ---- | C] () -- C:\WINDOWS\System32\TaxPrintPDF.dll
[2008/02/05 13:46:57 | 00,000,101 | ---- | C] () -- C:\WINDOWS\applink.ini
[2008/02/05 13:46:56 | 00,000,128 | ---- | C] () -- C:\WINDOWS\Utdsysap.ini
[2008/02/05 13:46:51 | 00,000,000 | ---- | C] () -- C:\WINDOWS\tmp.ini
[2007/12/20 15:40:12 | 00,000,592 | ---- | C] () -- C:\Documents and Settings\R103470\Local Settings\Application Data\FASTWiz.html
[2007/12/20 15:37:49 | 00,030,393 | ---- | C] () -- C:\Documents and Settings\R103470\Local Settings\Application Data\FASTWiz.log
[2007/12/20 12:13:50 | 00,000,280 | ---- | C] () -- C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2007/12/20 10:57:19 | 00,000,036 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2007/12/20 10:57:18 | 00,000,056 | ---- | C] () -- C:\WINDOWS\Addrfixr.ini
[2007/12/20 10:56:56 | 00,007,803 | ---- | C] () -- C:\WINDOWS\System32\dymourl.ini
[2007/12/20 10:56:39 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\DYMOCFG.DLL
[2007/12/20 10:56:39 | 00,002,560 | ---- | C] () -- C:\WINDOWS\System32\lmmonres.dll
[2007/12/20 10:38:34 | 00,000,000 | ---- | C] () -- C:\WINDOWS\AEFALDS.INI
[2007/12/20 10:37:39 | 00,010,498 | ---- | C] () -- C:\WINDOWS\EzCDSODB.INI
[2007/12/20 10:14:41 | 00,000,349 | ---- | C] () -- C:\WINDOWS\ezmail.ini
[2007/12/20 10:14:35 | 01,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[2007/12/20 10:09:13 | 04,844,560 | -H-- | C] () -- C:\Documents and Settings\R103470\Local Settings\Application Data\IconCache.db
[2007/12/20 10:08:30 | 00,009,770 | ---- | C] () -- C:\WINDOWS\wcds.ini
[2007/12/20 10:08:21 | 00,319,488 | ---- | C] () -- C:\WINDOWS\System32\EzActRpt.dll
[2007/12/20 10:08:21 | 00,049,152 | ---- | C] () -- C:\WINDOWS\System32\ezhelp32.dll
[2007/12/20 10:08:20 | 00,147,968 | ---- | C] () -- C:\WINDOWS\System32\AL21FVB.DLL
[2007/12/20 10:08:20 | 00,007,168 | ---- | C] () -- C:\WINDOWS\System32\DTCTRACE.DLL
[2007/12/20 10:08:19 | 03,203,072 | ---- | C] () -- C:\WINDOWS\System32\LCPPN201.DLL
[2007/12/20 10:08:19 | 00,024,461 | ---- | C] () -- C:\WINDOWS\DrDll.INI
[2007/12/20 10:08:12 | 00,377,856 | ---- | C] () -- C:\WINDOWS\System32\TX32.DLL
[2007/12/20 10:08:12 | 00,244,736 | ---- | C] () -- C:\WINDOWS\System32\TAB32D20.DLL
[2007/12/20 10:08:12 | 00,163,840 | ---- | C] () -- C:\WINDOWS\System32\CTREESTD.DLL
[2007/12/20 10:08:12 | 00,128,000 | ---- | C] () -- C:\WINDOWS\System32\IMP32D20.DLL
[2007/12/20 10:08:12 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\U2LFINRA.DLL
[2007/12/20 10:08:12 | 00,000,151 | ---- | C] () -- C:\WINDOWS\System32\IC32.INI
[2007/12/20 10:08:09 | 00,316,416 | ---- | C] () -- C:\WINDOWS\System32\P2SMCUBE.DLL
[2007/12/20 10:08:09 | 00,176,128 | ---- | C] () -- C:\WINDOWS\System32\LFFAX60N.DLL
[2007/12/20 10:08:09 | 00,147,241 | ---- | C] () -- C:\WINDOWS\System32\P2OESBSE.DLL
[2007/12/20 10:08:09 | 00,141,824 | ---- | C] () -- C:\WINDOWS\System32\LFCMP60N.DLL
[2007/12/20 10:08:09 | 00,063,488 | ---- | C] () -- C:\WINDOWS\System32\U2LEXPO.DLL
[2007/12/20 10:08:09 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\U25STORE.DLL
[2007/12/20 10:08:09 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\U25TOTAL.DLL
[2007/12/20 10:08:09 | 00,044,544 | ---- | C] () -- C:\WINDOWS\System32\U25DTS.DLL
[2007/12/20 10:08:09 | 00,026,112 | ---- | C] () -- C:\WINDOWS\System32\U2LJUL.DLL
[2007/12/20 10:08:09 | 00,022,528 | ---- | C] () -- C:\WINDOWS\System32\LFEPS60N.DLL
[2007/12/20 10:08:09 | 00,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFBMP60N.DLL
[2007/12/20 10:08:08 | 00,110,080 | ---- | C] () -- C:\WINDOWS\System32\LFPNG60N.DLL
[2007/12/20 10:08:08 | 00,082,432 | ---- | C] () -- C:\WINDOWS\System32\U2LSQRT.DLL
[2007/12/20 10:08:08 | 00,070,656 | ---- | C] () -- C:\WINDOWS\System32\U2LESBSE.DLL
[2007/12/20 10:08:08 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\U2LPDXTM.DLL
[2007/12/20 10:08:08 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\U2LSSM.DLL
[2007/12/20 10:08:08 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\U2LBAR.DLL
[2007/12/20 10:08:08 | 00,038,400 | ---- | C] () -- C:\WINDOWS\System32\U2LCAPS.DLL
[2007/12/20 10:08:08 | 00,033,280 | ---- | C] () -- C:\WINDOWS\System32\U2LSTR.DLL
[2007/12/20 10:08:08 | 00,030,720 | ---- | C] () -- C:\WINDOWS\System32\U2LTIME.DLL
[2007/12/20 10:08:08 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\U2LTEC1.DLL
[2007/12/20 10:08:08 | 00,027,136 | ---- | C] () -- C:\WINDOWS\System32\U2LSTRNG.DLL
[2007/12/20 10:08:08 | 00,027,136 | ---- | C] () -- C:\WINDOWS\System32\U2LSAMP1.DLL
[2007/12/20 10:08:08 | 00,026,624 | ---- | C] () -- C:\WINDOWS\System32\U2LTDATE.DLL
[2007/12/20 10:08:08 | 00,023,552 | ---- | C] () -- C:\WINDOWS\System32\LFPCX60N.DLL
[2007/12/20 10:08:08 | 00,022,528 | ---- | C] () -- C:\WINDOWS\System32\LFPCT60N.DLL
[2007/12/20 10:08:08 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\LFPSD60N.DLL
[2007/12/20 10:08:08 | 00,018,432 | ---- | C] () -- C:\WINDOWS\System32\LFMSP60N.DLL
[2007/12/20 10:08:08 | 00,017,920 | ---- | C] () -- C:\WINDOWS\System32\LFMAC60N.DLL
[2007/12/20 10:08:07 | 00,046,080 | ---- | C] () -- C:\WINDOWS\System32\LFTIF60N.DLL
[2007/12/20 10:08:07 | 00,043,008 | ---- | C] () -- C:\WINDOWS\System32\LTFIL60N.DLL
[2007/12/20 10:08:07 | 00,038,400 | ---- | C] () -- C:\WINDOWS\System32\U2LDTS.DLL
[2007/12/20 10:08:07 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\U2LEXCH.DLL
[2007/12/20 10:08:07 | 00,026,112 | ---- | C] () -- C:\WINDOWS\System32\U2LASC.DLL
[2007/12/20 10:08:07 | 00,019,968 | ---- | C] () -- C:\WINDOWS\System32\LFTGA60N.DLL
[2007/12/20 10:08:07 | 00,019,456 | ---- | C] () -- C:\WINDOWS\System32\LFWPG60N.DLL
[2007/12/20 10:08:07 | 00,019,456 | ---- | C] () -- C:\WINDOWS\System32\LFWMF60N.DLL
[2007/12/19 19:42:36 | 00,049,776 | ---- | C] () -- C:\Documents and Settings\R103470\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2007/12/19 19:41:06 | 00,000,130 | ---- | C] () -- C:\Documents and Settings\R103470\Local Settings\Application Data\fusioncache.dat
[2007/12/19 19:40:36 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\R103470\Application Data\desktop.ini
[2007/07/24 13:53:44 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2007/07/23 20:22:04 | 00,164,864 | ---- | C] () -- C:\Program Files\UNWISE.EXE
[2007/07/23 20:09:09 | 00,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2007/07/23 20:08:59 | 00,000,511 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/07/23 19:29:48 | 00,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2007/07/23 19:29:45 | 00,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2007/07/23 19:22:15 | 00,200,796 | ---- | C] () -- C:\WINDOWS\System32\Crypto.dll
[2007/07/16 11:58:10 | 00,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007/07/16 11:58:00 | 00,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2007/04/04 17:04:55 | 00,000,157 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2007/04/04 15:56:59 | 00,002,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\pciinfo.sys
[2007/04/04 14:57:10 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\FSRremoC.DLL
[2007/04/04 09:15:57 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2007/03/16 16:00:00 | 00,003,403 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
[2007/02/09 20:26:04 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2006/09/22 16:06:56 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\SGEGINATHK.dll
[2006/09/22 16:06:42 | 00,016,384 | ---- | C] () -- C:\WINDOWS\System32\Sgegina040C.Dll
[2006/09/22 16:06:38 | 00,016,384 | ---- | C] () -- C:\WINDOWS\System32\SgeGina0407.Dll
[2006/08/25 10:14:36 | 00,024,576 | R--- | C] () -- C:\WINDOWS\System32\loaddlln.dll
[2006/06/29 13:58:52 | 00,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/06/29 13:53:56 | 00,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 00,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/04/18 14:39:28 | 00,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2005/11/15 14:32:22 | 00,003,638 | R--- | C] () -- C:\Program Files\Common Files\Altiris_Icon.ico
[2005/03/31 11:27:18 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\SGCleanLocalGPO.dll
[2004/08/04 05:00:00 | 00,000,564 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/04 05:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2004/03/06 02:30:52 | 00,000,173 | ---- | C] () -- C:\WINDOWS\SETSCAN.INI

========== LOP Check ==========

[2008/06/24 10:08:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ameriprise
[2008/07/28 08:15:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Brentmark
[2009/07/15 08:06:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco
[2007/04/04 17:00:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Dell
[2008/06/01 12:33:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
[2007/07/23 19:23:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Network Associates
[2007/12/20 11:59:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Prism Pack
[2007/12/20 09:46:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Utimaco
[2007/12/20 09:47:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2007/12/19 19:41:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\R103470\Application Data\ATI
[2008/07/30 14:44:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\R103470\Application Data\Brentmark
[2009/07/15 08:07:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\R103470\Application Data\Cisco
[2008/10/28 12:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\R103470\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/04/22 11:39:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\R103470\Application Data\E-Z Data
[2007/12/20 09:51:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\R103470\Application Data\ImagiSOFT
[2007/12/20 17:01:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\R103470\Application Data\LinkManager 4.0
[2009/07/29 08:49:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\R103470\Application Data\webex
[2004/08/04 05:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/11/02 09:48:11 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >

< HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions >
"{20a82645-c095-46ed-80e3-08825760534b}" = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ -- [2009/09/02 13:16:00 | 00,000,000 | ---D | M]

< %SYSTEMDRIVE%\eventlog.dll /s /md5 >
[2004/08/04 05:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2008/04/13 19:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 19:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

< %SYSTEMDRIVE%\scecli.dll /s /md5 >
[2004/08/04 05:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 19:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< %SYSTEMDRIVE%\netlogon.dll /s /md5 >
[2004/08/04 05:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2008/04/13 19:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 19:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

< %SYSTEMDRIVE%\cngaudit.dll /s /md5 >

< %SYSTEMDRIVE%\sceclt.dll /s /md5 >

< %SYSTEMDRIVE%\ntelogon.dll /s /md5 >

< %SYSTEMDRIVE%\logevent.dll /s /md5 >

< %SYSTEMDRIVE%\iaStor.sys /s /md5 >
[2006/05/11 11:30:52 | 00,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\WINDOWS\dell\iastor\iastor.sys

< %SYSTEMDRIVE%\nvstor.sys /s /md5 >

< %SYSTEMDRIVE%\atapi.sys /s /md5 >
[2004/08/03 22:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008/04/13 13:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 05:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys
[2004/08/03 22:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys

< %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 >

< %SYSTEMDRIVE%\viasraid.sys /s /md5 >

< %SYSTEMDRIVE%\AGP440.sys /s /md5 >
[2008/04/13 13:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 13:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< %SYSTEMDRIVE%\vaxscsi.sys /s /md5 >
< End of report >

[Advertisements]

extras.txt didn't open. I tried searching for it and couldn't find it. It should have been on the desktop. should I rerun otl?

[DaveRo]

extras.txt didn't open. I tried searching for it and couldn't find it. It should have been on the desktop. should I rerun otl?

[chamber]

Don't worry about the extras.txt for now. I'll look over this log.

[DaveRo]

OK thanks

[chamber]

Hi,

1) OTL

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  O3 - HKLM\..\Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
  O4 - HKLM..\Run: [] File not found
  O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab (Reg Error: Key error.)
  [2009/10/29 09:22:51 | 00,001,744 | -H-- | M] () -- C:\WINDOWS\System32\yezaradu
  
  :Services
  
  :Reg
  
  :Files
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

2) Malwarebytes

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

3) JavaRa

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

4) Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report... at the bottom.
• Click the Save report... button.
  
  
  
  
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

In your reply I would like to see copied and pasted,

1) OTL fix log
2) Malwarebytes scan
3) Kaspersky scan

[DaveRo]

otl log
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Starting removal of ActiveX control 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab\ not found.
C:\WINDOWS\system32\yezaradu moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: R103470
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 6134953 bytes
->Java cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 45109387 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 48.90 mb


OTL by OldTimer - Version 3.1.3.3 log created on 11032009_064140

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\WFVAB.tmp not found!

Registry entries deleted on Reboot...

[DaveRo]

MBAM log
Malwarebytes' Anti-Malware 1.41
Database version: 3092
Windows 5.1.2600 Service Pack 3

11/3/2009 10:31:18 AM
mbam-log-2009-11-03 (10-31-18).txt

Scan type: Quick Scan
Objects scanned: 108851
Time elapsed: 47 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[DaveRo]

I tried the Kapersky scan twice. both times at about 1 1/4 hours it vanished from the screen. There were no viruses found. Is there a way to access the log without starting it again?

[chamber]

Lets try an offline scanner then,

Please download AVP Tool by Kaspersky.

• Save it to your desktop.
  
• Reboot your computer into SafeMode.

You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.

• Double click the setup file to run it.
  
• Click Next to continue.
  
• It will by default install it to your desktop folder. Click Next.
  
• Hit ok at the prompt for scanning in Safe Mode.
  
• It will then open a box. There will be a tab that says Automatic scan.
  
• Under Automatic scan make sure these are checked.

• 
  
• System Memory
  
• Startup Objects
  
• Disk Boot Sectors.
  
• My Computer.
  
• Also any other drives (Removable that you may have)

After that click on Security level then choose Customize, click on the tab that says Heuristic Analyzer then choose Enable Deep rootkit search then ok. Choose OK again to go back to the main screen.

• Click on Scan at the top right hand Corner.
  
• It will automatically Neutralize any objects found.
  
• If some objects are left un-neutralized then click the button that says Neutralize all
  
• If it says it cannot be Neutralized then choose the delete option when prompted.
  
• After that is done click on the reports button at the bottom and save it as Kas to the desktop
  
• Post only the detected Virus\malware in the report, it will be at the very top under Detected

Note: This tool will self uninstall when you close it so please remember to save the log before closing it.

[DaveRo]

Whew! that took a long time - 5hrs - here's the log.. hopefully we're on the home stretch of resolving this

Scan
----
Scanned: 368897
Detected: 6
Untreated: 0
Start time: 11/4/2009 11:39:32 AM
Duration: 05:21:47
Finish time: 11/4/2009 5:01:19 PM


Detected
--------
Status Object
------ ------
deleted: Trojan program Packed.Win32.Katusha.g File: C:\System Volume Information\_restore{CB5A4206-AA10-41B5-A190-F374E5D0C5BF}\RP777\A0090429.dll
deleted: Trojan program Packed.Win32.Katusha.g File: C:\System Volume Information\_restore{CB5A4206-AA10-41B5-A190-F374E5D0C5BF}\RP777\A0090430.dll
deleted: Trojan program Packed.Win32.Katusha.g File: C:\System Volume Information\_restore{CB5A4206-AA10-41B5-A190-F374E5D0C5BF}\RP777\A0090431.dll
deleted: Trojan program Trojan-Downloader.Win32.FraudLoad.wvel File: C:\_OTL\MovedFiles\10292009_102047\Documents and Settings\All Users\Application Data\5c132e2\WE5c13.exe
deleted: Trojan program Trojan.Win32.Monder.cuql File: C:\_OTL\MovedFiles\10292009_102047\WINDOWS\System32\hizapego.dll
deleted: Trojan program Packed.Win32.Katusha.g File: C:\_OTL\MovedFiles\10292009_102047\WINDOWS\System32\jutizowi.dll


Events
------
Time Name Status Reason
---- ---- ------ ------
11/4/2009 11:39:41 AM Running module: smss.exe\smss.exe ok scanned


Statistics
----------
Object Scanned Detected Untreated Deleted Moved to Quarantine Archives Packed files Password protected Corrupted
------ ------- -------- --------- ------- ------------------- -------- ------------ ------------------ ---------


Settings
--------
Parameter Value
--------- -----
Security Level Custom
Action Prompt for action when the scan is complete
Run mode Manually
File types Scan all files
Scan only new and changed files No
Scan archives All
Scan embedded OLE objects All
Skip if object is larger than No
Skip if scan takes longer than No
Parse email formats No
Scan password-protected archives No
Enable iChecker technology No
Enable iSwift technology No
Show detected threats on "Detected" tab Yes
Rootkits search Yes
Deep rootkits search Yes
Use heuristic analyzer Yes


Quarantine
----------
Status Object Size Added
------ ------ ---- -----


Backup
------
Status Object Size
------ ------ ----

[chamber]

Good stuff,

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

[DaveRo]

Results of screen317's Security Check version 0.99.0
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
McAfee VirusScan Enterprise
McAfee AntiSpyware Enterprise Module
McAfee Agent
Antivirus up to date!
``````````````````````````````
Anti-malware/Other Utilities Check:
McAfee AntiSpyware Enterprise Module
Java™ 6 Update 16
``````````````````````````````
Process Check:
objlist.exe by Laurent
McAfee VirusScan Enterprise Mcshield.exe
McAfee VirusScan Enterprise VsTskMgr.exe
McAfee VirusScan Enterprise SHSTAT.EXE
``````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````

[chamber]

How are things running now?

[DaveRo]

seems to be working fine. thanks... what are the clean up steps? also what additional software should be used to run to avoid this in the future?

[chamber]

These are the clean up steps.

Congratulations your logs appear clean!!

Clean up

Follow these steps to uninstall Combofix and tools used in the removal of malware

Uninstall ComboFix

Remove Combofix now that we're done with it.

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
  
• Please follow the prompts to uninstall Combofix.
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

This will uninstall Combofix and anything assoicated with it.

• Download OTC to your desktop and run it
• Click Yes to beginning the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Browsers

Just because your computer came loaded with Internet Explorer doesn't mean that you have to use it, there are other free alternatives, FIREFOX and OPERA, both are free to use and are more secure than IE.

If you are using firefox you can stay more secure by adding NoScript and WOT (Web Of Trust)

NoScript stops Java scripts from starting on a web page unless you give permission for them, and WOT (Web Of Trust) has a comprehensive list of ratings for different websites allowing you to easily see if a website that you are about to go to has a bad reputation; in fact it will warn you to check if you are sure that you want to continue to a bad website.

• Make your Internet Explorer more secure - This can be done by following these simple instructions:
• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

Additional Security Measures

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

SpywareBlaster- SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

You should have a good anti spyware program - We recommend MalwareBytes Anti-Malware and SUPERAntiSpyware

MVPS Hosts file The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer

Winpatrol Download and install the free version of Winpatrol. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.

Spring Cleaning

TFC - Temp File Cleaner by OldTimer - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders

Auslogics Disc Defrag or JKDefrag - Two good disc defragmenters for you to choose from.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place