This topic is locked
Description of Problem:
Green Desktop Background with text reading: "Your System Is Infected! System has been stopped due to a serious malfunction. Spyware activity has been detected. It is recommended to use spyware removal tool to prevent data loss. Do not use computer before all spyware removed."
Large red X in lower right tray, with popup reading "Click here to protect your compute from spyware! Your computer is infected! Windows has detected an infection of spyware! It is recommended to use special antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you."
Also seeing an "error" popup frequently when attempting to access files. "WARNING: Application cannot be executed. The file is infected. Please activate your antivirus software."
Finally, a series of popups was launched initially when the virus was seen, offering an "Advanced Virus Removal" software package to clean the system.
Steps Taken:
-When virus popups began, I immediately disconnected computer from internet and network.
-Attempted to run Microsoft Malicious Spyware Toolkit. Application encountered a serious error and failed approximately 50% of the way while scanning Windows Media Player 9's .exe.
-Downloaded and ran Malwarebytes' Anti-Malware Quick Scan per the suggestion of another site. Re-ran the quick scan again after restart. (12 problems found first time, 9 second time)
-Began running Malwarebyte's Full Scan.
-Discovered your forum while scan was running, read through Cleaning Guide, and noticed the instruction not to run a full scan. Aborted the Full Scan approximately 1 hour into scan.
-Followed steps 1-5 of Cleaning Guide.
MBAM Log:
Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 3
12/1/2009 12:51:25 PM
mbam-log-2009-12-01 (12-51-25).txt
Scan type: Quick Scan
Objects scanned: 132086
Time elapsed: 6 minute(s), 9 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 7
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\critical_warning.html (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Root Repeal Log:
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/12/01 19:01
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA9DE7000 Size: 49152 File Visible: No Signed: -
Status: -
SSDT
-------------------
#: 017 Function Name: NtAllocateVirtualMemory
Status: Hooked by "<unknown>" at address 0x8b0e8410
#: 041 Function Name: NtCreateKey
Status: Hooked by "Lbd.sys" at address 0xba12887e
#: 047 Function Name: NtCreateProcess
Status: Hooked by "<unknown>" at address 0x8b0e7930
#: 048 Function Name: NtCreateProcessEx
Status: Hooked by "<unknown>" at address 0x8b0e78b8
#: 053 Function Name: NtCreateThread
Status: Hooked by "<unknown>" at address 0x8b0e86e0
#: 063 Function Name: NtDeleteKey
Status: Hooked by "<unknown>" at address 0x8b0e7b88
#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "<unknown>" at address 0x8b0e79a8
#: 180 Function Name: NtQueueApcThread
Status: Hooked by "<unknown>" at address 0x8b0e8488
#: 186 Function Name: NtReadVirtualMemory
Status: Hooked by "<unknown>" at address 0x8b0e8320
#: 192 Function Name: NtRenameKey
Status: Hooked by "<unknown>" at address 0x8b0e7b10
#: 213 Function Name: NtSetContextThread
Status: Hooked by "<unknown>" at address 0x8b0e8578
#: 226 Function Name: NtSetInformationKey
Status: Hooked by "<unknown>" at address 0x8b0e7a98
#: 228 Function Name: NtSetInformationProcess
Status: Hooked by "<unknown>" at address 0x8b0e87d0
#: 229 Function Name: NtSetInformationThread
Status: Hooked by "<unknown>" at address 0x8b0e85f0
#: 247 Function Name: NtSetValueKey
Status: Hooked by "Lbd.sys" at address 0xba128bfe
#: 253 Function Name: NtSuspendProcess
Status: Hooked by "<unknown>" at address 0x8b0e8758
#: 254 Function Name: NtSuspendThread
Status: Hooked by "<unknown>" at address 0x8b0e8500
#: 257 Function Name: NtTerminateProcess
Status: Hooked by "<unknown>" at address 0x8b0e8848
#: 258 Function Name: NtTerminateThread
Status: Hooked by "<unknown>" at address 0x8b0e8668
#: 277 Function Name: NtWriteVirtualMemory
Status: Hooked by "<unknown>" at address 0x8b0e8398
Hidden Services
-------------------
Service Name: xmyxjh
Image Path: %SystemRoot%\system32\svchost.exe -k netsvcs
==EOF==
OTL Log:
OTL logfile created on: 12/1/2009 7:05:44 PM - Run 1
OTL by OldTimer - Version 3.1.11.4 Folder = C:\Documents and Settings\klausj.TRD\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 127.88 Gb Free Space | 54.91% Space Free | Partition Type: NTFS
Drive D: | 2.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: TRDPC27
Current User Name: klausj
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Processes (SafeList) ==========
PRC - [2009/12/01 13:41:50 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\klausj.TRD\Desktop\OTL.exe
PRC - [2009/12/01 08:19:44 | 00,027,136 | ---- | M] () -- C:\WINDOWS\system32\winupdate86.exe
PRC - [2009/09/21 10:00:51 | 01,028,432 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009/05/07 04:09:48 | 01,597,608 | ---- | M] (Euro Plus d.o.o.) -- C:\Program Files\Common Files\EuroPlus Shared\LblServices.exe
PRC - [2009/03/27 23:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2008/11/24 21:31:12 | 00,087,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2008/11/24 21:31:10 | 29,263,712 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
PRC - [2008/11/24 21:31:08 | 00,239,968 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2008/04/13 18:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/01/11 18:54:31 | 00,623,992 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
PRC - [2007/12/03 15:28:27 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
PRC - [2007/10/12 08:34:56 | 00,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe
PRC - [2007/02/05 17:52:10 | 00,849,280 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliPoint\ipoint.exe
PRC - [2007/01/30 04:54:36 | 16,116,224 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.exe
PRC - [2007/01/15 16:00:58 | 00,403,520 | ---- | M] (Webroot Software, Inc.) -- C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.exe
PRC - [2007/01/15 16:00:56 | 00,879,680 | ---- | M] (Webroot Software, Inc.) -- C:\Program Files\Webroot\Enterprise\Spy Sweeper\CommAgent.exe
PRC - [2007/01/15 16:00:22 | 03,086,400 | ---- | M] (Webroot Software, Inc.) -- C:\Program Files\Webroot\Enterprise\Spy Sweeper\SPYSWEEPER.EXE
PRC - [2007/01/04 15:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2006/11/21 19:08:52 | 00,813,912 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe
PRC - [2006/03/17 10:30:26 | 00,102,400 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
PRC - [2006/02/28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2006/02/28 07:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
PRC - [2005/09/09 03:24:30 | 00,102,400 | ---- | M] () -- C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
PRC - [2005/09/09 01:18:10 | 00,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
PRC - [2005/02/16 16:15:20 | 00,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
========== Modules (SafeList) ==========
MOD - [2009/12/01 13:41:50 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\klausj.TRD\Desktop\OTL.exe
========== Win32 Services (SafeList) ==========
SRV - [2009/09/21 10:00:51 | 01,028,432 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009/05/07 04:09:48 | 01,597,608 | ---- | M] (Euro Plus d.o.o.) -- C:\Program Files\Common Files\EuroPlus Shared\LblServices.exe -- (LabelServices)
SRV - [2009/03/27 23:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
SRV - [2008/11/24 21:31:12 | 00,087,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2008/11/24 21:31:10 | 29,263,712 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS)
SRV - [2008/11/24 21:31:08 | 00,239,968 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2008/11/24 21:31:08 | 00,045,408 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2007/12/05 15:29:41 | 00,085,096 | ---- | M] (Autodesk) -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)
SRV - [2007/12/03 15:28:27 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2007/10/12 08:34:56 | 00,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2007/02/12 00:15:08 | 00,902,760 | ---- | M] (Autodesk, Inc.) -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe -- (Autodesk Network Licensing Service)
SRV - [2007/01/15 16:00:56 | 00,879,680 | ---- | M] (Webroot Software, Inc.) -- C:\Program Files\Webroot\Enterprise\Spy Sweeper\CommAgent.exe -- (WebrootCommAgentService)
SRV - [2007/01/15 16:00:22 | 03,086,400 | ---- | M] (Webroot Software, Inc.) -- C:\Program Files\Webroot\Enterprise\Spy Sweeper\spysweeper.exe -- (WebrootSpySweeperService)
SRV - [2007/01/04 15:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)
SRV - [2006/12/02 05:17:54 | 02,805,000 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)
SRV - [2006/10/26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006/02/28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2005/09/09 03:24:30 | 00,102,400 | ---- | M] () -- C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor4.0)
SRV - [2004/10/22 05:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D0 FB 02 D8 48 E5 C9 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = trd2:8080
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20090920.2
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/10/28 12:00:24 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/10/28 12:00:24 | 00,000,000 | ---D | M]
[2009/01/09 15:27:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Mozilla\Extensions
[2008/05/07 14:43:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Mozilla\Firefox\Profiles\06f6kspi.default\extensions
[2009/11/30 11:44:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Mozilla\Firefox\Profiles\8792pi9w.default\extensions
[2009/09/28 07:37:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Mozilla\Firefox\Profiles\8792pi9w.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009/11/30 11:44:36 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2007/04/16 11:07:12 | 00,180,293 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
O1 HOSTS File: (734 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Seagull Drivers] C:\WINDOWS\ssdal_nc.exe ()
O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SpySweeperEnterprise] C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.EXE (Webroot Software, Inc.)
O4 - HKLM..\Run: [Synchronization Manager] C:\WINDOWS\System32\mobsync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\winhelper86.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\System32\winhelper86.dll ()
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {22945A69-1191-4DCF-9E6F-409BDE94D101} http://www.3dpublish...ingsEnglish.cab (EModelNonVersionSpecificViewControl Class)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = trd.corp.bimba.com
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\WRNotifier: DllName - WRLogonNtf.DLL - C:\WINDOWS\System32\WRLogonNtf.DLL (Webroot Software, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/21 06:41:20 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{2f212fb2-dea0-11de-b62e-001d605b0a0f}\Shell\AutoRun\command - "" = J:\Install FreeAgent Tools.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2007/11/20 22:20:01 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: xmyxjh - C:\WINDOWS\system32\dlawzm.dll ()
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17736372391510016)
========== Files/Folders - Created Within 14 Days ==========
[2009/12/01 18:58:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/12/01 18:57:46 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/12/01 18:50:42 | 00,341,504 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\klausj.TRD\Desktop\TFC.exe
[2009/12/01 18:50:42 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\klausj.TRD\Desktop\SysRestorePoint.exe
[2009/12/01 18:50:41 | 00,535,552 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\klausj.TRD\Desktop\OTL.exe
[2009/12/01 18:50:41 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\klausj.TRD\Desktop\RootRepeal.exe
[2009/12/01 18:50:38 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\klausj.TRD\Desktop\erunt_setup.exe
[2009/12/01 12:30:21 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Visual Studio 2005Projects
[2009/12/01 08:58:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\klausj.TRD\Application Data\Malwarebytes
[2009/12/01 08:58:19 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/01 08:58:18 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/01 08:58:18 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/12/01 08:58:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/11/19 15:22:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\klausj.TRD\Desktop\Carolina Print Ad
[2009/11/19 11:33:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\klausj.TRD\Desktop\ERP
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
========== Files - Modified Within 14 Days ==========
[2009/12/01 19:00:01 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\settings.dat
[2009/12/01 18:56:24 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\AVR10.exe
[2009/12/01 18:56:24 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\41.exe
[2009/12/01 18:56:17 | 00,195,547 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009/12/01 18:56:17 | 00,002,854 | ---- | M] () -- C:\WINDOWS\System32\critical_warning.html
[2009/12/01 18:55:57 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/12/01 18:53:09 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/12/01 18:53:08 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/12/01 18:52:23 | 09,961,472 | -H-- | M] () -- C:\Documents and Settings\klausj.TRD\NTUSER.DAT
[2009/12/01 18:52:20 | 00,000,278 | -HS- | M] () -- C:\Documents and Settings\klausj.TRD\ntuser.ini
[2009/12/01 18:35:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\11942.exe
[2009/12/01 18:15:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\2995.exe
[2009/12/01 17:55:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\491.exe
[2009/12/01 17:35:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\9961.exe
[2009/12/01 17:15:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\16827.exe
[2009/12/01 16:55:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\23281.exe
[2009/12/01 16:35:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\28145.exe
[2009/12/01 16:15:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\5705.exe
[2009/12/01 15:55:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\24464.exe
[2009/12/01 15:35:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\26962.exe
[2009/12/01 15:15:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\29358.exe
[2009/12/01 14:55:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\11478.exe
[2009/12/01 14:35:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\15724.exe
[2009/12/01 14:15:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\19169.exe
[2009/12/01 13:55:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\26500.exe
[2009/12/01 13:41:50 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\klausj.TRD\Desktop\OTL.exe
[2009/12/01 13:37:23 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\klausj.TRD\Desktop\RootRepeal.exe
[2009/12/01 13:35:57 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\klausj.TRD\Desktop\erunt_setup.exe
[2009/12/01 13:35:36 | 00,021,504 | ---- | M] (Doug Knox) -- C:\Documents and Settings\klausj.TRD\Desktop\SysRestorePoint.exe
[2009/12/01 13:35:14 | 00,341,504 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\klausj.TRD\Desktop\TFC.exe
[2009/12/01 13:35:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\6334.exe
[2009/12/01 13:15:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\18467.exe
[2009/12/01 13:14:01 | 03,574,016 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\svchost.exe
[2009/12/01 13:09:31 | 00,292,352 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\e5s8zybl.exe
[2009/12/01 12:31:28 | 00,277,374 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\CurrentSettings-2009-12-01.vssettings
[2009/12/01 12:31:14 | 00,281,543 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\Exported-2009-12-01.vssettings
[2009/12/01 08:58:22 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/12/01 08:20:00 | 00,022,528 | ---- | M] () -- C:\WINDOWS\System32\winhelper86.dll
[2009/12/01 08:19:44 | 00,027,136 | ---- | M] () -- C:\WINDOWS\System32\winupdate86.exe
[2009/12/01 08:19:44 | 00,027,136 | ---- | M] () -- C:\WINDOWS\System32\winlogon86.exe
[2009/11/30 16:13:40 | 00,048,652 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\82-0000000018085E2EF038274F95197952BFD4E22F0700D7250C.pdf
[2009/11/30 15:26:51 | 00,004,096 | -H-- | M] () -- C:\Documents and Settings\klausj.TRD\Local Settings\Application Data\keyfile3.drm
[2009/11/30 11:00:48 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/11/30 09:55:35 | 04,928,000 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\TRD_Master_Data_Load_TA (CRP1 Data Load).xls
[2009/11/23 16:16:42 | 09,572,352 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\Excel_Multiple_Array_Lookup.xls
[2009/11/23 11:07:15 | 00,000,751 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/11/20 22:23:33 | 00,000,224 | ---- | M] () -- C:\WINDOWS\QScreenCapt.ini
[2009/11/19 15:21:57 | 13,847,040 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\TRD_Master_Data_Load_TA.xls
[2009/11/19 08:26:57 | 01,460,025 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\Pricing_Binder1.pdf
[2009/11/18 12:11:33 | 00,054,209 | ---- | M] () -- C:\Documents and Settings\klausj.TRD\Desktop\SPEC61001 Model (1).pdf
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
========== Files Created - No Company Name ==========
[2009/12/01 19:00:01 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\settings.dat
[2009/12/01 18:56:17 | 00,002,854 | ---- | C] () -- C:\WINDOWS\System32\critical_warning.html
[2009/12/01 18:35:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\11942.exe
[2009/12/01 18:15:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\2995.exe
[2009/12/01 17:55:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\491.exe
[2009/12/01 17:35:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\9961.exe
[2009/12/01 17:15:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\16827.exe
[2009/12/01 16:55:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\23281.exe
[2009/12/01 16:35:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\28145.exe
[2009/12/01 16:15:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\5705.exe
[2009/12/01 15:55:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\24464.exe
[2009/12/01 15:35:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\26962.exe
[2009/12/01 15:15:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\29358.exe
[2009/12/01 14:55:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\11478.exe
[2009/12/01 14:35:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\15724.exe
[2009/12/01 14:15:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\19169.exe
[2009/12/01 13:14:34 | 03,574,016 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\svchost.exe
[2009/12/01 13:14:34 | 00,292,352 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\e5s8zybl.exe
[2009/12/01 12:31:28 | 00,277,374 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\CurrentSettings-2009-12-01.vssettings
[2009/12/01 12:31:14 | 00,281,543 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\Exported-2009-12-01.vssettings
[2009/12/01 10:07:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\26500.exe
[2009/12/01 09:47:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\6334.exe
[2009/12/01 09:27:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\18467.exe
[2009/12/01 09:07:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\AVR10.exe
[2009/12/01 08:58:22 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/12/01 08:20:08 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\41.exe
[2009/12/01 08:19:59 | 00,022,528 | ---- | C] () -- C:\WINDOWS\System32\winhelper86.dll
[2009/12/01 08:19:47 | 00,027,136 | ---- | C] () -- C:\WINDOWS\System32\winupdate86.exe
[2009/12/01 08:19:47 | 00,027,136 | ---- | C] () -- C:\WINDOWS\System32\winlogon86.exe
[2009/11/30 16:13:40 | 00,048,652 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\82-0000000018085E2EF038274F95197952BFD4E22F0700D7250C.pdf
[2009/11/30 09:31:26 | 04,928,000 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\TRD_Master_Data_Load_TA (CRP1 Data Load).xls
[2009/11/23 16:16:41 | 09,572,352 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\Excel_Multiple_Array_Lookup.xls
[2009/11/19 08:26:57 | 01,460,025 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\Pricing_Binder1.pdf
[2009/11/18 12:11:33 | 00,054,209 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Desktop\SPEC61001 Model (1).pdf
[2009/10/15 16:08:58 | 00,004,096 | -H-- | C] () -- C:\Documents and Settings\klausj.TRD\Local Settings\Application Data\keyfile3.drm
[2009/08/27 09:03:41 | 00,182,580 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Application Data\debuggee.mdmp
[2009/03/03 12:45:38 | 00,000,031 | ---- | C] () -- C:\WINDOWS\bluevoda.ini
[2008/05/07 15:13:06 | 00,026,624 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/05/07 15:13:06 | 00,000,133 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Local Settings\Application Data\fusioncache.dat
[2008/05/07 14:43:10 | 00,012,800 | ---- | C] () -- C:\Documents and Settings\klausj.TRD\Application Data\Settings.cfg
[2008/02/14 09:47:26 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\cdTextCtl.dll
[2008/01/07 11:56:51 | 00,000,224 | ---- | C] () -- C:\WINDOWS\QScreenCapt.ini
[2007/12/03 16:36:00 | 00,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2007/12/03 16:10:38 | 00,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2007/12/03 16:07:50 | 00,000,025 | ---- | C] () -- C:\WINDOWS\PERF4490.ini
[2007/12/03 15:51:19 | 00,000,520 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/11/21 07:08:20 | 00,015,924 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2007/11/21 07:08:20 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2007/11/21 07:08:08 | 00,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2007/10/04 19:14:00 | 01,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007/10/04 19:14:00 | 01,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007/10/04 19:14:00 | 01,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007/10/04 19:14:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007/10/04 19:14:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007/09/13 02:06:04 | 00,159,590 | RHS- | C] () -- C:\WINDOWS\System32\dlawzm.dll
[2007/01/12 04:14:56 | 00,022,720 | ---- | C] () -- C:\WINDOWS\System32\haspds_msi.dll
[2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[1996/04/03 13:33:26 | 00,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys
========== LOP Check ==========
[2008/03/24 13:51:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
[2009/10/02 15:17:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2009/07/29 10:41:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EuroPlus
[2009/07/29 10:41:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Font Downloader
[2007/12/05 08:21:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PreEmptive Solutions
[2009/02/13 10:16:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PTI
[2007/12/03 14:48:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Quark
[2008/03/25 09:56:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/08/19 10:57:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZipSE
[2009/07/29 10:42:39 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{5AA6E508-1A21-48C7-82CA-3E8E1188D6C5}
[2009/09/18 09:59:28 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
[2008/08/05 10:09:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Autodesk
[2009/03/23 13:14:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Canneverbe_Limited
[2008/05/07 14:43:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Dynamic
[2009/05/29 13:48:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\EDrawings
[2008/05/07 14:43:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\EPSON
[2008/05/07 14:43:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Opera
[2008/05/07 14:43:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Quark
[2009/11/05 14:47:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\SiteClasses
[2009/11/05 14:47:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Sites
[2008/05/07 14:43:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\Viewpoint
[2008/05/07 14:43:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\klausj.TRD\Application Data\vmntoolbar
[2009/11/30 11:00:48 | 00,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
< MD5 for: AGP440.SYS >
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
< MD5 for: ATAPI.SYS >
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2006/02/28 07:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
< MD5 for: EVENTLOG.DLL >
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2006/02/28 07:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
< MD5 for: NETLOGON.DLL >
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2007/09/13 02:09:28 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=5FD8684F1C5DD26509383F6CCDAEE3A3 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
< MD5 for: SCECLI.DLL >
[2006/02/28 07:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll
< End of report >
OTL Extras:
OTL Extras logfile created on: 12/1/2009 7:05:44 PM - Run 1
OTL by OldTimer - Version 3.1.11.4 Folder = C:\Documents and Settings\klausj.TRD\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 127.88 Gb Free Space | 54.91% Space Free | Partition Type: NTFS
Drive D: | 2.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: TRDPC27
Current User Name: klausj
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.scr [@ = AutoCADScriptFile] -- C:\WINNT\system32\NOTEPAD.EXE File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1796:TCP" = 1796:TCP:*:Enabled:qukab
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"1796:TCP" = 1796:TCP:*:Enabled:qukab
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Visicom Media\AceFTP 3 Freeware\Aceftp3free.exe" = C:\Program Files\Visicom Media\AceFTP 3 Freeware\Aceftp3free.exe:*:Enabled:AceFTP v3 -- (Visicom Media Inc.)
"C:\Program Files\Internet Explorer\iexplore.exe" = C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer -- (Microsoft Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Program Files\Common Files\EuroPlus Shared\LblServices.exe" = C:\Program Files\Common Files\EuroPlus Shared\LblServices.exe:*:Enabled:Label Services -- (Euro Plus d.o.o.)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour -- (Apple Computer, Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}" = CorelDRAW Graphics Suite X3
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{0650BB10-BCF4-400A-85EE-04097E3046C6}" = Adobe Setup
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0E4BC542-9CFD-4E97-B586-9F1E5516E7B9}" = Microsoft IntelliPoint 6.1
"{11C98E1A-EC91-4B38-B44C-C562292D8453}" = Adobe Premiere Elements 2.0
"{1389C6A4-4965-4AEC-9175-08B54A10FA48}" = Microsoft SQL Server 2005 Mobile [ENU] Developer Tools
"{15EFEBF6-E414-33EB-8710-A04AD1302BF8}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Web - enu
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{1BCEA516-B4C5-4B2D-BFA0-AB7910BAD862}" = Adobe ExtendScript Toolkit 2
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{2274624C-5B38-41AD-AD27-CEC0924EB628}" = Adobe Setup
"{23959E96-A80F-4172-A655-210E9BB7BFBE}" = MSDN Library for Visual Studio 2005
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{32A72502-BC2C-4C39-ACEA-BC3D463F0697}" = EN
"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{437AB8E0-FB69-4222-B280-A64F3DE22591}" = Microsoft Visual Studio 2005 Professional Edition - ENU
"{44D4AF75-6870-41F5-9181-662EA05507E1}" = Microsoft Document Explorer 2005
"{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = EPSON Event Manager
"{4E98F23B-1328-4322-A6EC-2EDC8FC3A4FE}" = FontNav
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)
"{55CD7DFE-1A9C-4C67-813B-FDABDBF75064}" = Webroot Spy Sweeper Enterprise Client
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{5783F2D6-7028-0409-0000-0060B0CE6BBA}" = DWG TrueView 2009
"{5783F2D7-6001-0409-0002-0060B0CE6BBA}" = AutoCAD 2008 - English
"{625386A4-B6B6-4911-A6E8-23189C3F2D15}" = Microsoft .NET Compact Framework 2.0
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6C531060-84FB-4F96-8F33-29DF020632EB}" = Microsoft .NET Compact Framework 1.0 SP3 Developer
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75CC3CEC-171F-4AAE-98D1-C82435E42174}" = NiceLabel 5
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78B75C6D-E53C-424C-BF83-4B63BD4A6682}" = Microsoft Device Emulator version 1.0 - ENU
"{7C10F5C7-F00F-4BD3-A110-C7D240D2DD25}" = Adobe Dreamweaver CS3
"{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}" = CorelDRAW Graphics Suite X3
"{7CCEBC24-62DB-4280-A8EC-BFA49F167920}" = Software Update for Web Folders
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7EC003A3-51E9-4019-BEC0-DF99B0DF5CCF}" = NVDVD
"{896D642C-7125-44F0-AC49-A23ABF82209C}" = CDBurnerXP Pro 3
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8EDBA74D-0686-4C99-BFDD-F894678E5102}" = Adobe Common File Installer
"{8FFC924C-ED06-44CB-8867-3CA778ECE903}" = Adobe Help Center 2.0
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-0021-0000-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer 2007
"{90120000-0021-0409-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}" = Microsoft SQL Server Database Publishing Wizard 1.3
"{9A346205-EA92-4406-B1AB-50379DA3F057}" = Autodesk DWF Viewer 7
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A38048C6-89D1-44EC-BC95-E95DD4A19B5E}" = QuarkXPress 7.31
"{AC76BA86-1033-0000-7760-000000000003}" = Adobe Acrobat 8 Professional
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB65C393-C76E-4F06-9B0C-2124AA8AF97B}" = Adobe Flash Player 9 ActiveX
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C314764F-2C47-44DA-BE37-F48BB7322BE4}_is1" = Screen Video Recorder 1.5
"{C40ECA0A-90C4-4B11-A28D-0F81A99C5A74}" = Data Dynamics ActiveReports for .NET 3.0
"{C6DB11F1-EBD1-3AA4-A44D-55630E1E6FDA}" = Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU
"{C73A3AB4-99A4-45E5-B77F-09A3065E0D6A}" = Microsoft IntelliType Pro 6.1
"{C94E45B0-6AA6-4FB9-9AAE-22085F631880}" = VBA
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 SP1 with KB886903 Hotfix
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D504303A-717D-414C-BA9F-FE01093E2EF8}" = Adobe Setup
"{D88857C8-B36B-42CE-AC26-9FFFEEDB181A}" = RssReader
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E86BC406-944E-41F6-ADE6-2C136734C96B}" = EPSON File Manager
"{EBB7C1C1-D439-4D9B-9FDC-954C10F266B0}" = Adobe Photoshop Elements 4.0
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"AceFTP 3 Freeware" = AceFTP 3 Freeware
"Ad-Aware" = Ad-Aware
"Adobe Acrobat 8 Professional" = Adobe Acrobat 8.1.2 Professional
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 4" = Adobe Photoshop Elements 4.0
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Adobe_5bc0f8414ec36c555a3e7e5ec2e225e" = Adobe ExtendScript Toolkit 2
"Adobe_7328fdfcb73660ec8b11d5a3d5c6232" = Adobe Dreamweaver CS3
"Adobe_cbb2ea61da9c780bd7e47a5230a9ed7" = Adobe Stock Photos CS3
"Audacity_is1" = Audacity 1.2.6
"AutoCAD 2008 - English" = AutoCAD 2008 - English
"Autodesk Express Viewer" = Autodesk Express Viewer
"BlueVoda_Website_Builder_1.0" = BlueVoda Website Builder 10.2
"CamStudio" = CamStudio
"Click'N Design 3D (V5)" = Click'N Design 3D (V5)
"DWG TrueView 2009" = DWG TrueView 2009
"EPSON Scanner" = EPSON Scan
"ERUNT_is1" = ERUNT 1.1j
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Document Explorer 2005" = Microsoft Document Explorer 2005
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Microsoft Visual Studio 2005 Professional Edition - ENU" = Microsoft Visual Studio 2005 Professional Edition - ENU
"Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU" = Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU
"Mozilla Firefox (3.0.15)" = Mozilla Firefox (3.0.15)
"MSDN Library for Visual Studio 2005" = MSDN Library for Visual Studio 2005
"NiceLabel 5" = NiceLabel 5
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PremElem20" = Adobe Premiere Elements 2.0
"ViewpointMediaPlayer" = Viewpoint Media Player
"VisualWebDeveloper" = Microsoft Visual Studio Web Authoring Component
"vmntoolbar" = VMN Toolbar
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinZip Self-Extractor" = WinZip Self-Extractor
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ESPN Java Check" = ESPN Java Check
"GoToMeeting" = GoToMeeting 4.0.0.320
"JFreeChart 1.0.8 Demo" = JFreeChart 1.0.8 Demo
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 12/1/2009 1:14:33 PM | Computer Name = TRDPC27 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.
Error - 12/1/2009 1:35:03 PM | Computer Name = TRDPC27 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.
Error - 12/1/2009 1:35:04 PM | Computer Name = TRDPC27 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.
Error - 12/1/2009 1:36:07 PM | Computer Name = TRDPC27 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.
Error - 12/1/2009 2:52:51 PM | Computer Name = TRDPC27 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.
Error - 12/1/2009 2:52:51 PM | Computer Name = TRDPC27 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.
Error - 12/1/2009 2:54:46 PM | Computer Name = TRDPC27 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.
Error - 12/1/2009 8:53:10 PM | Computer Name = TRDPC27 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.
Error - 12/1/2009 8:53:10 PM | Computer Name = TRDPC27 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.
Error - 12/1/2009 8:55:53 PM | Computer Name = TRDPC27 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.
[ System Events ]
Error - 12/1/2009 8:51:19 PM | Computer Name = TRDPC27 | Source = Service Control Manager | ID = 7034
Description = The SQL Server VSS Writer service terminated unexpectedly. It has
done this 1 time(s).
Error - 12/1/2009 8:51:19 PM | Computer Name = TRDPC27 | Source = Service Control Manager | ID = 7034
Description = The Viewpoint Manager Service service terminated unexpectedly. It
has done this 1 time(s).
Error - 12/1/2009 8:51:19 PM | Computer Name = TRDPC27 | Source = Service Control Manager | ID = 7034
Description = The Webroot CommAgent Service service terminated unexpectedly. It
has done this 1 time(s).
Error - 12/1/2009 8:51:20 PM | Computer Name = TRDPC27 | Source = Service Control Manager | ID = 7034
Description = The FLEXnet Licensing Service service terminated unexpectedly. It
has done this 1 time(s).
Error - 12/1/2009 8:51:21 PM | Computer Name = TRDPC27 | Source = Service Control Manager | ID = 7034
Description = The Webroot Spy Sweeper Engine service terminated unexpectedly. It
has done this 2 time(s).
Error - 12/1/2009 8:53:10 PM | Computer Name = TRDPC27 | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain TRD due to the following:
%%1311. Make sure that the computer is connected to the network and try again. If
the problem persists, please contact your domain administrator.
Error - 12/1/2009 8:53:17 PM | Computer Name = TRDPC27 | Source = Service Control Manager | ID = 7023
Description = The Center Security service terminated with the following error: %%1114
Error - 12/1/2009 8:53:17 PM | Computer Name = TRDPC27 | Source = Service Control Manager | ID = 7034
Description = The Webroot Spy Sweeper Engine service terminated unexpectedly. It
has done this 1 time(s).
Error - 12/1/2009 8:53:33 PM | Computer Name = TRDPC27 | Source = Ftdisk | ID = 262189
Description = The system could not sucessfully load the crash dump driver.
Error - 12/1/2009 8:53:33 PM | Computer Name = TRDPC27 | Source = Ftdisk | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.
< End of report >
Thank you very much for taking the time to assist me with this issue!
Sign In
Create Account
