[thetallnathan]

Some kind of nasty malware has bitten my computer.

I'm running Windows XP, SP2. Firefox is my primary browser, though I also have IE8 and Opera installed.

Periodically, I get pop-up ads in IE windows. Occasionally I get really obnoxious audio and/or clicking, even though I can't see anything opening.

System resources are really running high and bogging down my computer.

Also, whatever malware it is has blocked my ability to run Ad-Aware and to install a newer version of the same. In fact, I'm unable to uninstall Ad-Aware because Windows can't configure it correctly to then uninstall it.

I already ran Spyware Doctor and Spybot Search & Destroy. Both found a couple dozen issues and/or infections and fixed them. For example, I was getting redirect problems with my google searches. But Spybot seems to have caught whatever was causing that problem. The other problems I described above are AFTER these two softwares did their system scan/fixes.

My OTL log is pasted below, as is the "Extras" file it generated. I have also attached them.

Thanks for any and all help!!!

~Nathan


- - - - - - - -

- - - - - - - -

- - - - - - - -

- - - - - - - -

- - - - - - - -

- - - - - - - -

OTL.txt

OTL logfile created on: 11/17/2010 1:51:33 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Pacifica Foundation\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 199.00 Mb Available Physical Memory | 20.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 27.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 106.97 Gb Total Space | 33.02 Gb Free Space | 30.87% Space Free | Partition Type: NTFS
Drive D: | 38.37 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: UNIVAC | User Name: Pacifica Foundation | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/17 13:46:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pacifica Foundation\Desktop\OTL.exe
PRC - [2010/11/16 09:49:33 | 000,348,672 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Local Settings\Temp\Ibm.exe
PRC - [2010/11/16 09:49:24 | 000,355,840 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Local Settings\Temp\Ibl.exe
PRC - [2010/11/16 09:49:22 | 000,204,800 | ---- | M] (Opera Software) -- C:\WINDOWS\Icevoa.exe
PRC - [2010/11/11 12:00:11 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/11/11 12:00:05 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/09/21 10:33:36 | 000,083,440 | ---- | M] (Google) -- C:\Documents and Settings\Pacifica Foundation\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
PRC - [2010/05/11 11:51:52 | 001,287,120 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsTray.exe
PRC - [2010/03/15 11:50:36 | 001,142,224 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsSvc.exe
PRC - [2010/03/11 11:09:22 | 000,366,840 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsAuxs.exe
PRC - [2009/10/06 21:45:04 | 000,323,392 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\DNA\btdna.exe
PRC - [2008/10/07 14:25:48 | 000,095,744 | ---- | M] (j2 Global Communications, Inc.) -- C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe
PRC - [2008/07/07 08:15:18 | 000,611,664 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/12/22 14:33:10 | 000,109,344 | ---- | M] (Logitech Inc.) -- c:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2006/12/22 14:31:28 | 000,244,512 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
PRC - [2006/12/22 14:28:26 | 000,756,248 | ---- | M] () -- C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
PRC - [2006/12/22 14:27:28 | 000,497,176 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
PRC - [2006/12/22 14:26:54 | 000,173,080 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2006/11/13 12:39:52 | 001,289,000 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\wcescomm.exe
PRC - [2006/11/13 12:39:34 | 000,199,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\rapimgr.exe
PRC - [2006/08/22 00:54:08 | 000,033,128 | ---- | M] (Lenovo) -- C:\Program Files\Lenovo\PM Driver\PMHandler.exe
PRC - [2006/08/15 06:16:50 | 000,692,224 | ---- | M] () -- C:\Program Files\ABBYY FormReader 6.5 Desktop Edition\DongleManager.exe
PRC - [2006/08/02 01:39:20 | 000,434,176 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2006/08/02 01:31:22 | 000,937,984 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2006/08/02 01:24:22 | 000,327,680 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2006/07/14 19:13:14 | 002,341,632 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
PRC - [2006/07/14 19:05:32 | 000,503,808 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
PRC - [2006/07/14 19:01:00 | 001,974,272 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
PRC - [2006/07/14 18:24:52 | 000,629,504 | ---- | M] () -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
PRC - [2006/05/24 14:33:32 | 000,057,344 | ---- | M] (Lenovo) -- C:\Program Files\Lenovo\PM Driver\PMSveH.exe
PRC - [2006/05/07 19:34:06 | 000,094,208 | ---- | M] () -- C:\Program Files\Lenovo\HOTKEY\TPHKMGR.exe
PRC - [2006/04/19 16:29:44 | 000,024,576 | ---- | M] () -- C:\Program Files\Lenovo\HOTKEY\TpWAudAp.exe
PRC - [2006/01/17 11:45:32 | 000,618,557 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
PRC - [2006/01/17 11:43:58 | 001,396,820 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
PRC - [2006/01/17 11:37:24 | 000,266,295 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe
PRC - [2005/06/10 11:44:02 | 000,618,496 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\Installshield\UpdateService\agent.exe
PRC - [2005/06/10 11:44:02 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\Installshield\UpdateService\issch.exe
PRC - [2004/08/09 07:03:58 | 000,221,184 | ---- | M] (InstallShield Software Corporation) -- c:\Program Files\Common Files\Installshield\UpdateService\ISUSPM.exe
PRC - [2004/07/01 15:20:20 | 000,212,992 | ---- | M] (Moodlogic) -- C:\Updater.exe
PRC - [2003/10/13 16:24:14 | 001,732,608 | ---- | M] (Adobe Sytems) -- C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
PRC - [2003/05/15 01:19:50 | 000,217,193 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
PRC - [2002/08/21 05:13:12 | 000,189,952 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WISPTIS.EXE


========== Modules (SafeList) ==========

MOD - [2010/11/17 13:46:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pacifica Foundation\Desktop\OTL.exe
MOD - [2010/08/23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2006/06/26 12:33:42 | 000,091,696 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\SoundTaxi Media Suite\STSService.exe -- (STSService)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\PsaSrv.exe -- (PsaSrv)
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/03/15 11:50:36 | 001,142,224 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2010/03/11 11:09:22 | 000,366,840 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2010/02/01 10:10:50 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008/07/07 08:15:18 | 000,611,664 | ---- | M] (Lavasoft) [Auto | Start_Pending] -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice)
SRV - [2006/12/22 14:34:52 | 000,105,248 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2006/12/22 14:33:10 | 000,109,344 | ---- | M] (Logitech Inc.) [Auto | Running] -- c:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2006/08/15 06:16:50 | 000,692,224 | ---- | M] () [Auto | Running] -- C:\Program Files\ABBYY FormReader 6.5 Desktop Edition\DongleManager.exe -- (FormReader65DongleManagerService)
SRV - [2006/08/02 01:39:20 | 000,434,176 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng) Intel®
SRV - [2006/08/02 01:31:22 | 000,937,984 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor) Intel®
SRV - [2006/08/02 01:24:22 | 000,327,680 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc) Intel®
SRV - [2006/07/14 19:05:24 | 000,950,272 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe -- (TVT Scheduler)
SRV - [2006/07/14 19:01:00 | 001,974,272 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe -- (TVT Backup Service)
SRV - [2006/07/14 18:24:52 | 000,629,504 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service)
SRV - [2006/05/24 14:33:32 | 000,057,344 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files\Lenovo\PM Driver\PMSveH.exe -- (PMSveH)
SRV - [2006/01/17 11:37:24 | 000,266,295 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe -- (btwdins)
SRV - [2005/11/14 02:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003/10/13 16:24:14 | 000,061,440 | ---- | M] (Adobe Sytems) [On_Demand | Stopped] -- C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe -- (AdobeVersionCue)
SRV - [2002/08/01 13:22:40 | 000,065,536 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\psadd.sys -- (psadd)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\kdsmm.sys -- (KdsMm)
DRV - File not found [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\drivers\ifp700.sys -- (IFP700)
DRV - [2010/11/14 00:00:01 | 000,005,427 | ---- | M] (IBM Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\EGATHDRV.SYS -- (EGATHDRV)
DRV - [2010/10/14 10:05:20 | 000,091,216 | ---- | M] (High Criteria inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TotRec8.sys -- (TotRec8)
DRV - [2010/09/14 13:38:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys -- (WsAudio_DeviceS(5)) WsAudio_DeviceS(5)
DRV - [2010/09/14 13:38:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys -- (WsAudio_DeviceS(4)) WsAudio_DeviceS(4)
DRV - [2010/09/14 13:38:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys -- (WsAudio_DeviceS(3)) WsAudio_DeviceS(3)
DRV - [2010/09/14 13:38:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys -- (WsAudio_DeviceS(2)) WsAudio_DeviceS(2)
DRV - [2010/09/14 13:38:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys -- (WsAudio_DeviceS(1)) WsAudio_DeviceS(1)
DRV - [2010/09/11 08:21:30 | 000,005,688 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SndTVideo.sys -- (SndTVideo)
DRV - [2010/09/11 08:21:26 | 000,023,608 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SndTAudio.sys -- (SndTAudio)
DRV - [2010/09/08 11:20:01 | 000,037,920 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2010/03/29 10:06:14 | 000,218,592 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2009/03/27 13:23:12 | 000,023,064 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER)
DRV - [2008/04/13 12:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008/04/13 12:46:20 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\61883.sys -- (61883)
DRV - [2008/04/13 12:46:20 | 000,038,912 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avc.sys -- (Avc)
DRV - [2008/04/13 12:46:09 | 000,051,200 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\msdv.sys -- (MSDV)
DRV - [2008/04/13 12:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 12:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 12:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 10:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/09/25 08:59:46 | 000,015,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\MediaCoder\SysInfo.sys -- (CrystalSysInfo)
DRV - [2007/05/09 20:51:34 | 000,041,888 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/05/09 20:47:00 | 001,276,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2006/12/22 14:32:48 | 000,025,632 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2006/12/22 14:32:24 | 001,963,680 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)
DRV - [2006/12/22 14:30:42 | 001,683,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (LVcKap)
DRV - [2006/12/14 23:36:26 | 000,014,240 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter)
DRV - [2006/10/11 15:03:12 | 000,007,012 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pmemnt.sys -- (pmem)
DRV - [2006/09/08 18:01:20 | 000,051,328 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/08/02 02:27:48 | 000,012,544 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2006/07/26 11:39:32 | 001,707,776 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw3x32.sys -- (NETw3x32) Intel®
DRV - [2006/07/17 11:54:00 | 000,007,168 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TSMAPIP.SYS -- (TSMAPIP)
DRV - [2006/07/14 18:27:22 | 000,012,544 | ---- | M] (Lenovo) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\tvtfilter.sys -- (tvtfilter)
DRV - [2006/07/14 18:03:04 | 000,017,664 | ---- | M] (Lenovo Group Limited) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tvtpktfilter.sys -- (TVTPktFilter)
DRV - [2006/07/14 16:55:12 | 000,003,968 | ---- | M] (IBM Corp.) [Kernel | Auto | Running] -- C:\Program Files\SMI2\smi2.sys -- (smi2)
DRV - [2006/06/28 22:13:08 | 001,160,320 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/06/22 16:29:28 | 000,720,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302AV.SYS -- (PID_08A0) Logitech QuickCam IM(PID_08A0)
DRV - [2006/05/24 12:48:14 | 000,010,240 | ---- | M] (Lenovo ) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\PMHler.sys -- (PMHler)
DRV - [2006/05/18 23:24:00 | 000,193,088 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2006/02/27 20:23:58 | 000,018,101 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\TPHKDRV.sys -- (TPHKDRV)
DRV - [2006/02/26 14:46:00 | 000,081,408 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2006/01/17 11:21:52 | 000,328,061 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2006/01/17 11:18:22 | 000,850,474 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2006/01/17 11:15:36 | 000,030,459 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2006/01/17 11:14:52 | 000,065,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2006/01/17 11:11:56 | 000,148,900 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2005/11/16 21:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2005/11/01 19:08:00 | 000,308,992 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/10/11 18:07:12 | 000,874,240 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2005/08/18 00:26:14 | 000,138,752 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV - [2005/03/29 19:02:22 | 000,116,594 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATSwpDrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500)
DRV - [2004/04/13 19:20:08 | 000,015,781 | R--- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x)
DRV - [2004/03/16 05:04:06 | 000,018,536 | ---- | M] (Rainbow Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RNBTOKEN.SYS -- (RnbToken)
DRV - [2004/03/16 05:04:06 | 000,017,928 | ---- | M] (Rainbow Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IKEYIFD.SYS -- (iKeyIFD)
DRV - [2004/03/16 05:04:06 | 000,011,464 | ---- | M] (Rainbow Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IKEYENUM.SYS -- (iKeyEnum)
DRV - [2003/09/11 00:36:54 | 000,021,060 | ---- | M] (InterVideo, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iviaspi.sys -- (Iviaspi)
DRV - [2001/08/17 15:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 15:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 15:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 15:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 15:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 14:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 14:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 14:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 14:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 14:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 14:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 14:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 14:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 14:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 14:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 06:49:42 | 000,322,432 | ---- | M] (Matrox Graphics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\G400m.sys -- (G400)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig"
FF - prefs.js..extensions.enabledItems: [email protected]:1.5.7
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe41}:1.0.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:7
FF - prefs.js..extensions.enabledItems: [email protected]:1.1.1
FF - prefs.js..extensions.enabledItems: [email protected]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/11 12:00:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/11 12:00:22 | 000,000,000 | ---D | M]

[2008/09/01 21:56:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Mozilla\Extensions
[2010/11/17 11:11:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Mozilla\Firefox\Profiles\zhxzwpy0.default\extensions
[2009/08/12 09:36:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pacifica Foundation\Application Data\Mozilla\Firefox\Profiles\zhxzwpy0.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe41}
[2009/09/10 06:34:54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Pacifica Foundation\Application Data\Mozilla\Firefox\Profiles\zhxzwpy0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/10/05 07:18:35 | 000,000,000 | ---D | M] (New Tab King) -- C:\Documents and Settings\Pacifica Foundation\Application Data\Mozilla\Firefox\Profiles\zhxzwpy0.default\extensions\{FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}
[2010/11/15 21:04:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Mozilla\Firefox\Profiles\zhxzwpy0.default\extensions\[email protected]
[2010/05/27 14:00:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Mozilla\Firefox\Profiles\zhxzwpy0.default\extensions\[email protected]
[2010/09/07 09:39:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Mozilla\Firefox\Profiles\zhxzwpy0.default\extensions\[email protected]
[2008/10/04 16:57:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Mozilla\Firefox\Profiles\zhxzwpy0.default\extensions\[email protected]
[2010/11/17 11:11:59 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/05/13 19:58:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/03 09:56:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2007/01/21 18:00:52 | 000,013,386 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\atgpcdec.dll
[2007/01/21 18:01:07 | 000,092,746 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\atgpcext.dll
[2007/01/21 18:00:52 | 000,046,665 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll
[2010/07/17 04:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2005/12/05 20:31:00 | 000,114,688 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npmozax.dll

O1 HOSTS File: ([2010/11/16 13:04:18 | 000,425,401 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14658 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (CPwmIEBrowserHelper Object) - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O4 - HKLM..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe (Adobe Sytems)
O4 - HKLM..\Run: [cssauth] C:\Program Files\Lenovo\Client Security Solution\cssauth.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [EarthLink Installer] File not found
O4 - HKLM..\Run: [iRiver Updater] \Updater.exe ()
O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\Installshield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [kds_i30_i40] C:\Program Files\Kodak\Document Imaging\KDSEvents.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam10\QuickCam10.exe ()
O4 - HKLM..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe (MediaCodec.Org)
O4 - HKLM..\Run: [PMHandler] C:\Program Files\Lenovo\PM Driver\PMHandler.exe (Lenovo)
O4 - HKLM..\Run: [PRISMSVR.EXE] C:\WINDOWS\System32\PRISMSVR.EXE File not found
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPHKMGR.exe ()
O4 - HKLM..\Run: [TPWAUDAP] C:\Program Files\Lenovo\HOTKEY\TpWAudAp.exe ()
O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [eFax 4.4] C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe (j2 Global Communications, Inc.)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
O4 - HKCU..\Run: [HJRUDZ5DT2] C:\Documents and Settings\Pacifica Foundation\Local Settings\Temp\Ibl.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\Pacifica Foundation\Start Menu\Programs\Startup\eFax 4.4.lnk = C:\Program Files\eFax Messenger 4.4\J2GTray.exe (j2 Global Communications, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra 'Tools' menuitem : ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: System Update - {DA320635-F48C-4613-8325-D75A933C549E} - C:\Program Files\Lenovo\System Update\sulauncher.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\tphotkey: DllName - tphklock.dll - C:\WINDOWS\System32\tphklock.dll ()
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Pacifica Foundation\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Pacifica Foundation\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/04/29 23:36:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/02/19 10:44:03 | 000,000,090 | RH-- | M] () - D:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{0deef0e2-245d-11dc-8ad4-0016cee57c46}\Shell - "" = AutoRun
O33 - MountPoints2\{0deef0e2-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0deef0e2-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{0deef0e4-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun\command - "" = F:\CA_Install.exe -- File not found
O33 - MountPoints2\{0deef0e6-245d-11dc-8ad4-0016cee57c46}\Shell - "" = AutoRun
O33 - MountPoints2\{0deef0e6-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0deef0e6-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{2833f7f2-2669-11dc-8ad5-0016cee57c46}\Shell - "" = AutoRun
O33 - MountPoints2\{2833f7f2-2669-11dc-8ad5-0016cee57c46}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2833f7f2-2669-11dc-8ad5-0016cee57c46}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\AutoRun\command - "" = F:\Autorun.exe -- File not found
O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\Shell00\Command - "" = F:\Autorun.exe -- File not found
O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\Shell01\Command - "" = F:\Autorun.exe -- File not found
O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\Shell02\Command - "" = F:\Autorun.exe -- File not found
O33 - MountPoints2\{b9975ae2-7844-11db-8a93-000fb0ccf224}\Shell - "" = AutoRun
O33 - MountPoints2\{b9975ae2-7844-11db-8a93-000fb0ccf224}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b9975ae2-7844-11db-8a93-000fb0ccf224}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/17 13:46:18 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Pacifica Foundation\Desktop\OTL.exe
[2010/11/16 11:05:17 | 000,233,136 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys
[2010/11/16 11:05:11 | 000,218,592 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys
[2010/11/16 11:05:11 | 000,088,040 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2010/11/16 11:04:59 | 000,063,360 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys
[2010/11/16 11:03:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2010/11/16 11:03:53 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/11/16 11:03:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pacifica Foundation\Application Data\PC Tools
[2010/11/16 11:03:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools
[2010/11/16 10:59:19 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{E961CE1B-C3EA-4882-9F67-F859B555D097}
[2010/11/16 10:57:58 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/11/16 10:57:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/11/16 10:54:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Google Updater
[2010/11/16 10:52:16 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Pacifica Foundation\Desktop\HijackThis.exe
[2010/11/16 09:49:29 | 000,204,800 | ---- | C] (Opera Software) -- C:\WINDOWS\Icevoa.exe
[2010/11/16 09:45:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pacifica Foundation\Application Data\TotalRecorder
[2010/11/16 09:44:48 | 000,091,216 | ---- | C] (High Criteria inc.) -- C:\WINDOWS\System32\drivers\TotRec8.sys
[2010/11/16 09:44:48 | 000,000,000 | ---D | C] -- C:\Program Files\HighCriteria
[2010/11/07 13:32:39 | 000,000,000 | ---D | C] -- C:\Program Files\WMCap
[2010/11/07 11:16:48 | 000,000,000 | ---D | C] -- C:\Converted
[2010/11/07 11:10:46 | 000,023,608 | ---- | C] (Windows ® Codename Longhorn DDK provider) -- C:\WINDOWS\System32\drivers\SndTAudio.sys
[2010/11/07 11:10:46 | 000,005,688 | ---- | C] (Windows ® Codename Longhorn DDK provider) -- C:\WINDOWS\System32\drivers\SndTVideo.sys
[2010/11/07 10:44:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pacifica Foundation\Local Settings\Application Data\PCHealth
[2009/08/11 16:04:26 | 000,028,160 | ---- | C] (WhitSoft Development) -- C:\Program Files\UnFREEz.exe
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/17 13:49:24 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010/11/17 13:47:50 | 000,000,041 | ---- | M] () -- C:\WINDOWS\Filzip.ini
[2010/11/17 13:46:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pacifica Foundation\Desktop\OTL.exe
[2010/11/17 13:44:44 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/11/17 13:35:59 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/11/17 13:25:18 | 000,000,274 | -H-- | M] () -- C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010/11/17 13:21:55 | 000,897,080 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\20101116hifi.pk
[2010/11/17 13:13:50 | 000,145,450 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Danny_2-way-voice.mp3
[2010/11/17 13:06:01 | 004,938,188 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\201117_dw_2way_Coal.mp3
[2010/11/17 12:56:30 | 000,473,548 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Danny_story-lede.mp3
[2010/11/17 12:56:26 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/17 09:47:18 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word.lnk
[2010/11/17 09:32:07 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\eFax_4_4_Port
[2010/11/17 08:02:41 | 027,866,491 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\20101116hifi.mp3
[2010/11/17 04:31:00 | 000,001,034 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1316859335-516220515-764952747-1006UA.job
[2010/11/17 02:33:00 | 000,000,912 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/16 15:33:06 | 000,000,908 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/16 14:31:01 | 000,000,982 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1316859335-516220515-764952747-1006Core.job
[2010/11/16 13:04:18 | 000,425,401 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/11/16 13:02:19 | 000,068,003 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\ResumeJohnFowler.pdf
[2010/11/16 10:52:17 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Pacifica Foundation\Desktop\HijackThis.exe
[2010/11/16 10:21:49 | 000,000,602 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\tvt_userinfo.ini
[2010/11/16 10:16:13 | 000,000,328 | -HS- | M] () -- C:\WINDOWS\tasks\kflivwcsc.job
[2010/11/16 10:14:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/16 10:14:37 | 1063,440,384 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/16 09:50:17 | 000,105,984 | RHS- | M] () -- C:\WINDOWS\System32\brgmtel.dll
[2010/11/16 09:49:22 | 000,204,800 | ---- | M] (Opera Software) -- C:\WINDOWS\Icevoa.exe
[2010/11/15 10:33:37 | 000,032,768 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Premiums to mail.xls
[2010/11/15 09:36:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/11/13 15:11:17 | 000,485,760 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/11 12:24:26 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/11/11 12:15:59 | 000,445,044 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/11 12:15:59 | 000,072,754 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/11/08 10:30:52 | 000,116,299 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\AlterNet - 10 Rules of Populist Power.pdf
[2010/11/05 12:19:42 | 022,372,872 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\radiolab100909b.mp3
[2010/11/04 13:00:24 | 000,072,080 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\g2mdlhlpx.exe
[2010/11/04 11:10:01 | 000,085,307 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Glaser_funding_guidelines.pdf
[2010/11/04 11:09:57 | 000,020,942 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Glaser_application_info.pdf
[2010/11/03 10:38:31 | 000,382,905 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Elevation_Proposal_Free Speech Radio News.pdf
[2010/11/02 11:56:50 | 000,053,248 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\FSRN web copy editing guide - draft1.doc
[2010/10/31 11:22:15 | 000,002,339 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\MP3 Skype Recorder.lnk
[2010/10/28 10:41:42 | 001,701,376 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\HindenburgBasic.msi
[2010/10/27 12:06:11 | 000,000,542 | ---- | M] () -- C:\Documents and Settings\Pacifica Foundation\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to Show Desktop.lnk
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/17 13:21:55 | 000,897,080 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\20101116hifi.pk
[2010/11/17 13:13:50 | 000,145,450 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Danny_2-way-voice.mp3
[2010/11/17 13:05:33 | 004,938,188 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\201117_dw_2way_Coal.mp3
[2010/11/17 12:56:29 | 000,473,548 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Danny_story-lede.mp3
[2010/11/17 08:01:01 | 027,866,491 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\20101116hifi.mp3
[2010/11/16 13:02:04 | 000,068,003 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\ResumeJohnFowler.pdf
[2010/11/16 11:05:17 | 000,007,387 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctgntdi.cat
[2010/11/16 11:05:11 | 000,007,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\PCTAppEvent.cat
[2010/11/16 11:05:11 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctcore.cat
[2010/11/16 11:04:59 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctplsg.cat
[2010/11/16 10:54:39 | 000,000,868 | ---- | C] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/16 09:50:17 | 000,105,984 | RHS- | C] () -- C:\WINDOWS\System32\brgmtel.dll
[2010/11/16 09:50:17 | 000,000,328 | -HS- | C] () -- C:\WINDOWS\tasks\kflivwcsc.job
[2010/11/16 09:49:37 | 000,000,316 | -H-- | C] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010/11/16 09:49:26 | 000,000,316 | -H-- | C] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/11/16 09:49:24 | 000,000,274 | -H-- | C] () -- C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010/11/08 10:30:42 | 000,116,299 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\AlterNet - 10 Rules of Populist Power.pdf
[2010/11/05 12:18:30 | 022,372,872 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\radiolab100909b.mp3
[2010/11/04 11:10:01 | 000,085,307 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Glaser_funding_guidelines.pdf
[2010/11/04 11:09:53 | 000,020,942 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Glaser_application_info.pdf
[2010/11/03 10:38:30 | 000,382,905 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\Elevation_Proposal_Free Speech Radio News.pdf
[2010/11/02 11:56:50 | 000,053,248 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\FSRN web copy editing guide - draft1.doc
[2010/10/28 10:41:33 | 001,701,376 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Desktop\HindenburgBasic.msi
[2010/10/27 12:06:11 | 000,000,542 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to Show Desktop.lnk
[2010/10/03 12:29:00 | 000,153,600 | ---- | C] () -- C:\WINDOWS\System32\WS_ATLMovie.dll
[2010/10/02 22:06:02 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\$_hpcst$.hpc
[2010/05/26 13:55:22 | 000,000,041 | ---- | C] () -- C:\WINDOWS\System32\Filzip.ini
[2009/11/25 12:40:50 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009/08/12 09:32:30 | 000,000,535 | ---- | C] () -- C:\Program Files\UnFREEz Gif maker.lnk
[2009/07/29 13:18:49 | 000,001,337 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2009/07/22 09:17:46 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\epe2000.dll
[2009/07/02 10:36:46 | 000,000,061 | ---- | C] () -- C:\WINDOWS\System32\SYSVCPDRV.SYS
[2009/01/31 10:17:51 | 000,000,396 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Application Data\hexplorer.dat
[2009/01/31 10:17:51 | 000,000,037 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Application Data\mclip.dat
[2009/01/22 21:25:20 | 000,594,160 | ---- | C] () -- C:\WINDOWS\System32\wodCertificate.dll
[2009/01/22 21:25:16 | 000,589,960 | ---- | C] () -- C:\WINDOWS\System32\brgrt.dll
[2009/01/13 10:37:15 | 000,001,261 | ---- | C] () -- C:\WINDOWS\entpack.ini
[2008/04/12 09:20:06 | 000,000,041 | ---- | C] () -- C:\WINDOWS\Filzip.ini
[2008/02/26 14:15:15 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Application Data\$_hpcst$.hpc
[2008/01/17 10:57:54 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini
[2008/01/02 17:10:03 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2007/12/25 22:44:33 | 000,001,076 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Catalog.LiveSubscribe
[2007/06/28 13:41:28 | 000,000,145 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI
[2007/06/28 13:41:28 | 000,000,040 | ---- | C] () -- C:\WINDOWS\BRDIAG.INI
[2007/06/28 13:41:28 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Brownie.ini
[2007/06/28 13:41:18 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\BROSNMP.DLL
[2007/06/28 13:41:18 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC32.DLL
[2007/06/28 13:41:18 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC16.DLL
[2007/06/28 13:41:17 | 000,008,975 | ---- | C] () -- C:\WINDOWS\HL-2040.INI
[2007/06/28 13:40:57 | 000,000,426 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2007/03/27 22:09:05 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wpd99.drv
[2007/03/27 22:08:43 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll
[2007/03/15 15:17:36 | 000,000,171 | ---- | C] () -- C:\WINDOWS\icecast2.ini
[2007/03/05 10:50:45 | 000,401,408 | ---- | C] () -- C:\WINDOWS\System32\StepButtonS.dll
[2007/03/05 07:25:27 | 000,491,520 | ---- | C] () -- C:\WINDOWS\System32\mp3lib.dll
[2007/02/08 08:45:28 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/01/22 21:58:28 | 000,022,528 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/01/17 19:58:12 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHealr.dll
[2007/01/16 20:27:38 | 000,057,126 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2006/12/22 14:32:48 | 000,025,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2006/12/22 14:30:42 | 001,683,232 | ---- | C] () -- C:\WINDOWS\System32\drivers\Lvckap.sys
[2006/12/17 23:56:17 | 000,000,008 | RHS- | C] () -- C:\WINDOWS\System32\78BCDF5555.sys
[2006/12/03 15:30:52 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Application Data\PFP120JPR.{PB
[2006/12/03 15:30:52 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Pacifica Foundation\Application Data\PFP120JCM.{PB
[2006/11/28 14:57:46 | 000,000,124 | ---- | C] () -- C:\WINDOWS\setscan.ini
[2006/11/28 14:57:45 | 000,004,553 | ---- | C] () -- C:\WINDOWS\pixcache.ini
[2006/11/19 21:11:12 | 000,007,100 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/11/19 21:11:12 | 000,000,088 | RHS- | C] () -- C:\WINDOWS\System32\9945E509FA.sys
[2006/11/10 16:30:42 | 001,701,888 | ---- | C] () -- C:\WINDOWS\System32\kdssti.dll
[2006/11/08 22:55:37 | 000,000,602 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tvt_userinfo.ini
[2006/10/11 15:12:43 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/10/11 14:46:52 | 000,000,040 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/10/11 14:45:14 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2006/10/11 14:45:14 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2006/10/11 14:45:14 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2006/10/11 14:45:14 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2006/10/11 14:45:14 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2006/10/11 14:45:14 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2006/10/11 14:35:26 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSMAPIP.SYS
[2006/10/11 14:24:23 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2006/09/14 01:21:00 | 000,013,824 | ---- | C] () -- C:\WINDOWS\System32\tphklock.dll
[2006/06/19 09:36:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2006/04/30 00:05:41 | 000,004,670 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/04/29 23:48:13 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006/04/29 16:24:50 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/01/17 11:31:30 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2010/11/11 11:51:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Amazon
[2010/07/07 15:31:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Borland
[2009/06/23 09:50:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.4 Output
[2006/10/11 15:11:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lenovo
[2008/06/25 07:46:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LiveSubscribe
[2009/08/13 16:10:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MySQL
[2008/09/15 17:31:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/01/17 10:58:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pdf995
[2010/05/12 07:23:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PGP Corporation
[2010/10/03 08:07:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RapidSolution
[2009/07/02 10:26:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Screaming Bee
[2007/09/05 16:16:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2009/04/11 20:33:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TaxCut
[2010/11/17 13:01:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2006/11/27 11:48:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/08/12 10:06:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/11/16 10:59:19 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{E961CE1B-C3EA-4882-9F67-F859B555D097}
[2007/02/02 11:05:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Aim
[2007/01/18 20:21:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Audacity
[2009/11/09 13:38:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Broad Intelligence
[2007/02/12 09:42:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\COWON
[2009/01/22 21:31:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Diploma
[2010/11/17 13:52:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\DNA
[2009/06/23 09:50:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\eFax Messenger
[2010/11/07 11:10:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\GetRightToGo
[2006/11/03 23:02:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\InterVideo
[2008/03/07 16:15:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\iPodder
[2009/06/23 10:01:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\j2 Global
[2007/04/25 12:38:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Leadertech
[2006/10/11 15:11:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Lenovo
[2009/07/22 09:22:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\MessageViewer
[2010/04/24 08:36:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\MP3SkypeRecorder
[2008/04/26 13:25:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\My Games
[2008/09/15 17:31:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\NCH Swift Sound
[2007/06/14 13:40:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\NetMedia Providers
[2006/12/20 01:00:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Nikon
[2010/09/16 10:57:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Nvu
[2009/07/22 09:18:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\OPE2000
[2007/01/16 21:01:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Opera
[2010/05/13 19:54:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Pamela
[2009/03/18 10:09:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Participatory Culture Foundation
[2008/01/17 10:57:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\pdf995
[2010/05/17 12:38:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\PGP Corporation
[2007/06/14 13:40:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Publish Providers
[2009/07/02 10:26:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\Screaming Bee
[2009/08/31 15:31:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\SQLyog
[2009/04/11 20:36:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\TaxCut
[2006/10/11 15:11:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\ThinkVantage
[2010/11/16 09:46:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pacifica Foundation\Application Data\TotalRecorder
[2010/11/16 10:16:13 | 000,000,328 | -HS- | M] () -- C:\WINDOWS\Tasks\kflivwcsc.job
[2010/11/17 13:44:44 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/11/17 13:25:18 | 000,000,274 | -H-- | M] () -- C:\WINDOWS\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010/11/17 13:49:24 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2FD2AC7E
@Alternate Data Stream - 170 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >



- - - - - - - -

- - - - - - - -

- - - - - - - -

- - - - - - - -

- - - - - - - -

- - - - - - - -


OTL Extras logfile created on: 11/17/2010 1:51:33 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Pacifica Foundation\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 199.00 Mb Available Physical Memory | 20.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 27.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 106.97 Gb Total Space | 33.02 Gb Free Space | 30.87% Space Free | Partition Type: NTFS
Drive D: | 38.37 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: UNIVAC | User Name: Pacifica Foundation | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
.js [@ = JSFile] -- C:\Program Files\Aptana\Aptana Studio 1.5\AptanaStudio.exe ()

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Opera\Opera.exe" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" (Opera Software)
jsfile [open] -- "C:\Program Files\Aptana\Aptana Studio 1.5\AptanaStudio.exe" "%1" ()
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Directory [WinVorbis] -- C:\Program Files\WinVorbis\WinVorbis.exe "%1" (StationPlaylist.com)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3306:TCP" = 3306:TCP:*:Enabled:MySQL

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Installers\ftpserver.exe" = C:\Installers\ftpserver.exe:*:Enabled:Quick 'n Easy FTP Server 3.1 -- File not found
"C:\Installers\FTP Wanderer\FTPWanderer.exe" = C:\Installers\FTP Wanderer\FTPWanderer.exe:*:Enabled:FTP Wanderer -- (Pablo Software Solutions)
"C:\Program Files\BearShare Applications\BearShare\BearShare.exe" = C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare -- File not found
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)
"C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- File not found
"C:\Documents and Settings\Pacifica Foundation\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe" = C:\Documents and Settings\Pacifica Foundation\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe:*:Enabled:Octoshape add-in for Adobe Flash Player -- (Octoshape ApS)
"C:\Program Files\Hasbro Interactive\RollerCoaster Tycoon\rct.exe" = C:\Program Files\Hasbro Interactive\RollerCoaster Tycoon\rct.exe:*:Enabled:rct -- ()
"C:\Documents and Settings\Pacifica Foundation\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll" = C:\Documents and Settings\Pacifica Foundation\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin -- (Google)
"C:\Documents and Settings\Pacifica Foundation\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Pacifica Foundation\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\Aptana\Aptana Studio 1.5\AptanaStudio.exe" = C:\Program Files\Aptana\Aptana Studio 1.5\AptanaStudio.exe:*:Enabled:AptanaStudio -- ()
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\MP3 Skype Recorder\MP3 Skype Recorder.exe" = C:\Program Files\MP3 Skype Recorder\MP3 Skype Recorder.exe:*:Enabled:MP3 Skype Recorder -- (Alexander Nikiforov)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\WS_FTP\WS_FTP95.exe" = C:\Program Files\WS_FTP\WS_FTP95.exe:*:Enabled:WS_FTP 95 -- (Ipswitch, Inc. 10 Maguire Road. Lexington, MA 02421)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{03944364-4B11-45E2-AE5A-8C5C8240CE49}" = Brother HL-2040
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data
"{0763E426-FB61-4CD3-B8C7-01A0F37CAAEB}" = Fingerprint Sensor Minimum Install
"{0E2EE98E-17AE-4798-8F8C-64E49CA86D20}" = MySQL Server 5.1
"{1007F41F-7D69-468E-8017-3849A5A973C2}" = ThinkVantage Technologies Welcome Message
"{171E6C1E-B5FC-11DF-B115-005056C00008}" = Google Earth Plug-in
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{1F1C4668-7767-4109-9B5E-19AD056F2CA0}" = MP3 Skype Recorder
"{1F85CAAA-B786-4E5B-AADD-638856992EF3}" = Opera 10.53
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java™ 6 Update 21
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{31C50740-FC5A-4C6C-B91B-E3B5DFADC824}" = Logitech QuickCam
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
"{3D5E9312-608F-40B7-9EEE-95124CD62414}" = Sonic Foundry Vegas Video 3.0
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = Lenovo Bluetooth with Enhanced Data Rate Software
"{463064A1-3605-11D4-A705-0050DA1F1BF7}" = Sonic Foundry Video Capture 2.0
"{48227AEB-DC8E-4A90-A274-0B4A39D699B1}" = Client Security Solution
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F93ABBE-5A1D-4D56-94CB-022F109FDE4D}" = Adobe Presenter 7
"{58F58158-8DFE-31DA-AC1F-7E5D89A0F74F}" = Google Talk Plugin
"{6230F503-51D7-4BA2-9007-34ACDD31D182}" = TaxCut Virginia 2007
"{6257E290-5E8E-11D4-9B8D-00D0B72459DD}" = Rainbow iKey Driver v3.4.7.118
"{62715632-A555-4D9E-9CEC-4F84EB55B07B}" = PM Driver
"{65706020-7B6F-41F2-8047-FC69579E386A}" = Presentation Director
"{663E217E-FC26-4249-9E8E-F190CD63E737}" = TaxCut Premium + State 2007
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75852F49-2CAF-443F-B7C2-53DE5847DE56}" = OpenOffice.org 2.0
"{7726CF62-7B45-4E6D-9266-615346816BCA}" = Rescue and Recovery
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7FC3BBEC-5A91-41B0-9CB8-960EC4421411}" = InterVideo WinDVD Creator 3
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8AC049F7-1383-45C3-9E7D-F93CA667F9E1}" = UMVPLStandalone
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A14F7508-B784-40B8-B11A-E0E2EEB7229F}" = Adobe Premiere Pro 1.5
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3BC5D37-30F9-4CF7-BD5C-0DFF063E4B6D}" = 2Wire Wireless Client
"{A52A504E-18BE-4821-9A2A-BFB4542DA0BD}" = Lenovo PM Driver
"{A5F68DC8-0278-4AD8-B413-861509B5F25B}" = ArcSoft Panorama Maker 3
"{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}" = PixiePack Codec Pack
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A973071E-0979-4E23-A0BD-9009450E63FF}" = TaxCut Wisconsin 2007
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy
"{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo
"{B3A31EEE-7C65-4EE6-BB0D-5549FD2D67B9}" = Ipswitch WS_FTP LE
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BBB33AD6-BCF7-4002-B6A0-6DC679AE5C18}" = TaxCut Premium + State + Efile 2008
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{BEF726DD-4037-4214-8C6A-E625C02D2870}" = Logitech Audio Echo Cancellation Component
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C54ED2B6-1AF2-416F-BBA8-5E2B8CDCB5C4}" = XP Themes
"{C6FA39A7-26B1-480A-BC74-6D17531AC222}" = Access Help
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBA2E782-C278-4B81-008D-4703FCBC1A2E}" = SimCity 4
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D52ECEBC-9B20-41A5-81C4-A62DE2367419}" = Adobe Creative Suite
"{D55D73C4-E4D1-4EC2-9BA9-3068AE2006D8}" = TaxCut Virginia 2008
"{DA320635-F48C-4613-8325-D75A933C549E}" = Lenovo Care System Update Toolbar Button for IE
"{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}" = Wallpapers
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DF654BB0-0833-497B-82D5-4D9A5613AC2C}" = Small Business Center
"{DF6DA606-904D-4C18-823F-A4CFC3035E53}" = eFax Messenger
"{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}" = Message Center
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{EA516024-D84D-41F1-814F-83175A6188F2}" = Logitech Video Enumerator
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FD650000-0000-0000-0000-000000004465}" = ABBYY FormReader 6.5
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Presenter 7" = Adobe Presenter 7
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Aptana Studio 1.5" = Aptana Studio 1.5
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.2 (Unicode)
"Audacity_is1" = Audacity 1.2.6
"AudioStreamer Pro" = AudioStreamer Pro
"BigSpeed Zipper" = BigSpeed Zipper
"Blogg-X 2.13" = Blogg-X 2.13
"BREE5" = Brownstone Equation Editor 5
"burnatonce_is1" = burnatonce
"ChoicePlus Pro" = ChoicePlus Pro
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Cool Edit Pro 2.1" = Cool Edit Pro 2.1
"Daniusoft DRM Converter_is1" = Daniusoft DRM Converter(Build 2.6.7.1)
"Digital Media LE" = Roxio Digital Media LE
"Diploma" = Diploma
"Express" = Express Dictate
"FastImageResizer" = FastImageResizer (remove only)
"FeedStation_is1" = FeedStation
"Filzip 3.0.1.44_is1" = Filzip 3.01
"Free RM to MP3 Converter_is1" = Free RM to MP3 Converter 1.12
"Free Video to Flash Converter_is1" = Free Video to Flash Converter version 4.2
"Free YouTube Download_is1" = Free YouTube Download 2.3
"Google Updater" = Google Updater
"Hexplorer" = ICY Hexplorer (remove only)
"hp LaserJet 2300 Uninstaller" = hp LaserJet 2300 Uninstaller
"IconEdit32" = IconEdit32
"ie8" = Windows Internet Explorer 8
"InstallShield_{62715632-A555-4D9E-9CEC-4F84EB55B07B}" = PM Driver
"Kodak i30/i40 Scanner" = Kodak i30/i40 Scanner
"LADSPA_plugins-win_is1" = LADSPA_plugins-win-0.4.15
"ListenerPC" = ListenerPC
"Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281)
"MarketPC" = MarketPC
"MediaCoder" = MediaCoder 0.7.2.4535
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Miro" = Miro
"MLUpdater" = iRiver Updater
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"MP3 Plug-in" = Sonic Foundry MP3 Plug-In
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nvu_is1" = Nvu 1.0
"OnScreenDisplay" = On Screen Display
"Oregon Trail II" = Oregon Trail II
"PCMCIAPW" = ThinkPad PC Card Power Policy
"PhotoScape" = PhotoScape
"ProInst" = Intel® PROSet/Wireless Software
"PRX Member Tools_is1" = PRX Member Tools v2.0
"PSPad editor_is1" = PSPad editor
"QcDrv" = Logitech® Camera Driver
"RealAlt_is1" = Real Alternative 1.60 Lite
"RollerCoaster Tycoon Setup" = Roll
"Ruby-186-26" = Ruby-186-26
"Scribe" = Express Scribe
"SHOUTcastDSP" = SHOUTcast Source DSP 1.9.0 (remove only)
"Shuangs Audio Joiner_is1" = Shuangs Audio Joiner 1.0
"SimCity 3000" = SimCity 3000
"Soundslides" = Soundslides
"Spyware Doctor" = Spyware Doctor 7.0
"SQLyog Community" = SQLyog Community 8.12
"ST5UNST #1" = SimCity 3000 Terrain Editor
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TotalRecorder" = Total Recorder 8.2
"Uninstall_is1" = Uninstall 1.0.0.1
"Vector Magic" = Vector Magic
"vixy converter BETA_is1" = vixy converter uninstall
"Winamp" = Winamp (remove only)
"Windows Essentials Media Codec Pack" = Windows Essentials Media Codec Pack 1.0
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows Mobile Device Handbook" = Windows Mobile® Device Handbook
"Windows XP Service Pack" = Windows XP Service Pack 3
"winscp3_is1" = WinSCP 3.7.1
"WinVorbis_is1" = WinVorbis v1.60
"WinZip" = WinZip
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"ZaraRadio_is1" = ZaraRadio 1.6.1
"ZaraRDS_is1" = ZaraRDS 1.1

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Adobe Acrobat Connect Add-in" = Adobe Acrobat Connect Add-in
"BitTorrent DNA" = DNA
"GoToMeeting" = GoToMeeting 4.5.0.457
"Move Media Player" = Move Media Player
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"SC4Mapper" = SC4Mapper

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

Error - 11/7/2010 1:40:37 PM | Computer Name = UNIVAC | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3615 - Fatal Execution Engine Error
(7A0979AE) (80131506)

[ System Events ]
Error - 11/16/2010 12:41:54 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/16/2010 12:41:54 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/16/2010 12:41:54 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/16/2010 12:41:54 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/16/2010 12:41:54 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/16/2010 12:41:54 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/16/2010 12:41:54 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/16/2010 12:41:55 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/16/2010 12:41:55 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/16/2010 12:41:55 PM | Computer Name = UNIVAC | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126


< End of report >

Attached Files

•  OTL.Txt   124.67KB   85 downloads
•  Extras.Txt   51.7KB   198 downloads

[Advertisements]

Hello,

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
• Please make sure to carefully read any instruction that I give you.
  Reading too lightly will cause you to miss important steps, which could have destructive effects.
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
• Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 3 days) and you need an explanation. If that's the case, just send me a message to me on here.
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox. Do not include the word "Code"
  
  

  :Services
  :OTL
  O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  O4 - HKLM..\Run: [EarthLink Installer]  File not found
  O4 - HKLM..\Run: [PRISMSVR.EXE] C:\WINDOWS\System32\PRISMSVR.EXE File not found
  O9 - Extra Button: System Update - {DA320635-F48C-4613-8325-D75A933C549E} - C:\Program Files\Lenovo\System Update\sulauncher.exe File not found
  O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
  O33 - MountPoints2\{0deef0e2-245d-11dc-8ad4-0016cee57c46}\Shell - "" = AutoRun
  O33 - MountPoints2\{0deef0e2-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{0deef0e2-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
  O33 - MountPoints2\{0deef0e4-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun\command - "" = F:\CA_Install.exe -- File not found
  O33 - MountPoints2\{0deef0e6-245d-11dc-8ad4-0016cee57c46}\Shell - "" = AutoRun
  O33 - MountPoints2\{0deef0e6-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{0deef0e6-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
  O33 - MountPoints2\{2833f7f2-2669-11dc-8ad5-0016cee57c46}\Shell - "" = AutoRun
  O33 - MountPoints2\{2833f7f2-2669-11dc-8ad5-0016cee57c46}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{2833f7f2-2669-11dc-8ad5-0016cee57c46}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
  O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\AutoRun\command - "" = F:\Autorun.exe -- File not found
  O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\Shell00\Command - "" = F:\Autorun.exe -- File not found
  O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\Shell01\Command - "" = F:\Autorun.exe -- File not found
  O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\Shell02\Command - "" = F:\Autorun.exe -- File not found
  O33 - MountPoints2\{b9975ae2-7844-11db-8a93-000fb0ccf224}\Shell - "" = AutoRun
  O33 - MountPoints2\{b9975ae2-7844-11db-8a93-000fb0ccf224}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{b9975ae2-7844-11db-8a93-000fb0ccf224}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
  [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  [2010/11/17 13:49:24 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
  [2010/11/17 13:44:44 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
  [2010/11/17 13:25:18 | 000,000,274 | -H-- | M] () -- C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
  [2010/11/16 10:16:13 | 000,000,328 | -HS- | M] () -- C:\WINDOWS\tasks\kflivwcsc.job
  [2010/11/16 09:50:17 | 000,105,984 | RHS- | M] () -- C:\WINDOWS\System32\brgmtel.dll
  [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  [2010/11/16 09:50:17 | 000,105,984 | RHS- | C] () -- C:\WINDOWS\System32\brgmtel.dll
  [2010/11/16 09:50:17 | 000,000,328 | -HS- | C] () -- C:\WINDOWS\tasks\kflivwcsc.job
  [2010/11/16 09:49:37 | 000,000,316 | -H-- | C] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
  [2010/11/16 09:49:26 | 000,000,316 | -H-- | C] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
  [2010/11/16 09:49:24 | 000,000,274 | -H-- | C] () -- C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
  [2010/11/16 10:16:13 | 000,000,328 | -HS- | M] () -- C:\WINDOWS\Tasks\kflivwcsc.job
  [2010/11/17 13:44:44 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
  [2010/11/17 13:25:18 | 000,000,274 | -H-- | M] () -- C:\WINDOWS\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
  
  :Reg
  
  :Files
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click .
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



Rootkit UnHooker (RkU)
Please download Rootkit Unhooker ... Save it to your Desktop.
Note: The log can be very long, you may need to post it separately.

• Right click on the .rar and Extract the files.
• Double-click on RKUnhookerLE.exe to execute it.
  Vista - W7 users: Right click RKUnhookerLE.exe, choose "Run As Administrator" to execute it. If UAC prompts, please allow it.
• Click the Report tab, then click Scan.
• Check Drivers, Stealth Code, Files and Code Hooks. Uncheck the rest. then Click OK. (See image below...)
  
  The scanning will toggle through the checked items "tabs" ... it will take a while, so please be patient.
• When the scanner is finished... click File, Save Report.
• Save the file "Report.txt" to your Desktop... Press Close... then press Yes
• Copy the entire contents of the Report.txt file in you're next reply.

Please Note:
You may get this warning, it is ok, just ignore it:
"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"



NEXT:



Please download MBRCheck.exe to your Desktop. Run the application.

If no infection is found, it will produce a report on the desktop. Post that report in your next reply.

If an infection is found, you will be presented with the following dialog:

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Type N and press Enter. A report will be produced on the desktop. Post that report in your next reply.

[SweetTech]

Hello,

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
• Please make sure to carefully read any instruction that I give you.
  Reading too lightly will cause you to miss important steps, which could have destructive effects.
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
• Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 3 days) and you need an explanation. If that's the case, just send me a message to me on here.
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox. Do not include the word "Code"
  
  

  :Services
  :OTL
  O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  O4 - HKLM..\Run: [EarthLink Installer]  File not found
  O4 - HKLM..\Run: [PRISMSVR.EXE] C:\WINDOWS\System32\PRISMSVR.EXE File not found
  O9 - Extra Button: System Update - {DA320635-F48C-4613-8325-D75A933C549E} - C:\Program Files\Lenovo\System Update\sulauncher.exe File not found
  O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
  O33 - MountPoints2\{0deef0e2-245d-11dc-8ad4-0016cee57c46}\Shell - "" = AutoRun
  O33 - MountPoints2\{0deef0e2-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{0deef0e2-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
  O33 - MountPoints2\{0deef0e4-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun\command - "" = F:\CA_Install.exe -- File not found
  O33 - MountPoints2\{0deef0e6-245d-11dc-8ad4-0016cee57c46}\Shell - "" = AutoRun
  O33 - MountPoints2\{0deef0e6-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{0deef0e6-245d-11dc-8ad4-0016cee57c46}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
  O33 - MountPoints2\{2833f7f2-2669-11dc-8ad5-0016cee57c46}\Shell - "" = AutoRun
  O33 - MountPoints2\{2833f7f2-2669-11dc-8ad5-0016cee57c46}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{2833f7f2-2669-11dc-8ad5-0016cee57c46}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
  O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\AutoRun\command - "" = F:\Autorun.exe -- File not found
  O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\Shell00\Command - "" = F:\Autorun.exe -- File not found
  O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\Shell01\Command - "" = F:\Autorun.exe -- File not found
  O33 - MountPoints2\{6e3d8c5f-a35d-11db-8aad-0016cee57c46}\Shell\Shell02\Command - "" = F:\Autorun.exe -- File not found
  O33 - MountPoints2\{b9975ae2-7844-11db-8a93-000fb0ccf224}\Shell - "" = AutoRun
  O33 - MountPoints2\{b9975ae2-7844-11db-8a93-000fb0ccf224}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{b9975ae2-7844-11db-8a93-000fb0ccf224}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
  [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  [2010/11/17 13:49:24 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
  [2010/11/17 13:44:44 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
  [2010/11/17 13:25:18 | 000,000,274 | -H-- | M] () -- C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
  [2010/11/16 10:16:13 | 000,000,328 | -HS- | M] () -- C:\WINDOWS\tasks\kflivwcsc.job
  [2010/11/16 09:50:17 | 000,105,984 | RHS- | M] () -- C:\WINDOWS\System32\brgmtel.dll
  [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  [2010/11/16 09:50:17 | 000,105,984 | RHS- | C] () -- C:\WINDOWS\System32\brgmtel.dll
  [2010/11/16 09:50:17 | 000,000,328 | -HS- | C] () -- C:\WINDOWS\tasks\kflivwcsc.job
  [2010/11/16 09:49:37 | 000,000,316 | -H-- | C] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
  [2010/11/16 09:49:26 | 000,000,316 | -H-- | C] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
  [2010/11/16 09:49:24 | 000,000,274 | -H-- | C] () -- C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
  [2010/11/16 10:16:13 | 000,000,328 | -HS- | M] () -- C:\WINDOWS\Tasks\kflivwcsc.job
  [2010/11/17 13:44:44 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
  [2010/11/17 13:25:18 | 000,000,274 | -H-- | M] () -- C:\WINDOWS\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
  
  :Reg
  
  :Files
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click .
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



Rootkit UnHooker (RkU)
Please download Rootkit Unhooker ... Save it to your Desktop.
Note: The log can be very long, you may need to post it separately.

• Right click on the .rar and Extract the files.
• Double-click on RKUnhookerLE.exe to execute it.
  Vista - W7 users: Right click RKUnhookerLE.exe, choose "Run As Administrator" to execute it. If UAC prompts, please allow it.
• Click the Report tab, then click Scan.
• Check Drivers, Stealth Code, Files and Code Hooks. Uncheck the rest. then Click OK. (See image below...)
  
  The scanning will toggle through the checked items "tabs" ... it will take a while, so please be patient.
• When the scanner is finished... click File, Save Report.
• Save the file "Report.txt" to your Desktop... Press Close... then press Yes
• Copy the entire contents of the Report.txt file in you're next reply.

Please Note:
You may get this warning, it is ok, just ignore it:
"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"



NEXT:



Please download MBRCheck.exe to your Desktop. Run the application.

If no infection is found, it will produce a report on the desktop. Post that report in your next reply.

If an infection is found, you will be presented with the following dialog:

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Type N and press Enter. A report will be produced on the desktop. Post that report in your next reply.

[thetallnathan]

Hi there,

Really appreciate the help.

So this morning, I spent some time examining all the processes running on my computer, doing a ton of google searches to see what belonged there and what didn't. Plus a little investigation via msconfig to see where the root exe files lived. Ended the processes that didn't belong there, deleted the exe files at the root of the processes, and emptied the recycling bin.

I know it's not the recommended course of action and real damage could be done if such an approach was not handled properly. But so far so good. My CPU usage was at 60-80% and it's now down to 2-8%.

Methinks we can close this thread. But if sh*t hits the fan again, I'll drop by again. You all are a terrific resource.

~Nathan

[SweetTech]

Well I still suggest you run the instructions in my previous post, as you could still very likely be infected.

However, if you'd still like for me to close this thread, please let me know, and I will mark it as resolved, and close it.

[SweetTech]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.