I have a ghost audio virus playing the most annoying 8 bit music on my computer since this morning. Closed all my browser windows and it still continues. For two days now, my computer has been making Windows sounds for no apparent reason - like the clicking sound you get when you open a new page or start a new application - and I have those sounds disabled normally. Since yesterday I've also had Internet Explorer launch itself (even though firefox is my default browser) and open to spam/ad pages.
A Symantec full scan found 4 Trojan files: Fzv.exe, Fxw.exe, Fzs.exe, and Fzt.exe. I deleted them all but Fzv.exe was a partial delete (non critical failure). I downloaded Windows Malicious Software Removal Tool but couldn't actually run it; I think the virus is blocking it.
I ran OTL, and got two files: OTL.txt, and Extras.txt. I'm posting both logs below. Your help would be greatly appreciated.
UPDATE: I just ran MBAM and rebooted and it seems to have worked. MBAM log below, followed by OTL logs, just in case you notice anything that still needs fixing.
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6902
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
6/20/2011 12:17:24 PM
mbam-log-2011-06-20 (12-17-24).txt
Scan type: Quick scan
Objects scanned: 200390
Time elapsed: 14 minute(s), 57 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 3
Registry Values Infected: 2
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
c:\WINDOWS\imgkbd.dll (Trojan.Hiloti) -> Delete on reboot.
c:\WINDOWS\egedaxubig.dll (Trojan.Hiloti) -> Delete on reboot.
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\W1WIWQ1NPG (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\YDZ1QVAGOJ (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Byoteh (Trojan.Hiloti) -> Value: Byoteh -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ncijobakamod (Trojan.Hiloti) -> Value: Ncijobakamod -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\egedaxubig.dll (Trojan.Hiloti) -> Delete on reboot.
c:\documents and settings\azi2ts\local settings\Temp\wmxocnares.tmp (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\WINDOWS\imgkbd.dll (Trojan.Hiloti) -> Delete on reboot.
OTL.txt:
OTL logfile created on: 6/20/2011 11:25:21 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\azi2ts\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.91 Gb Total Physical Memory | 0.54 Gb Available Physical Memory | 28.34% Memory free
3.68 Gb Paging File | 1.87 Gb Available in Paging File | 50.80% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 55.87 Gb Free Space | 37.49% Space Free | Partition Type: NTFS
Drive E: | 232.88 Gb Total Space | 31.69 Gb Free Space | 13.61% Space Free | Partition Type: NTFS
Computer Name: P09-8768 | User Name: AZI2TS | NOT logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/06/20 11:25:08 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\azi2ts\My Documents\Downloads\OTL.exe
PRC - [2011/04/29 12:55:57 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Documents and Settings\azi2ts\Local Settings\Application Data\Mozilla Firefox\firefox.exe
PRC - [2011/03/21 17:10:00 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/11/11 13:57:04 | 000,268,528 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Zune\WMZuneComm.exe
PRC - [2010/11/11 13:57:02 | 000,444,656 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Zune\ZuneWlanCfgSvc.exe
PRC - [2010/11/11 13:55:56 | 000,057,072 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Zune\ZuneBusEnum.exe
PRC - [2010/11/11 13:55:46 | 000,159,472 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Zune\ZuneLauncher.exe
PRC - [2010/05/06 10:58:04 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2010/05/06 10:58:04 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2010/05/06 10:58:03 | 001,881,368 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
PRC - [2010/05/06 10:58:03 | 001,459,528 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
PRC - [2010/05/06 10:58:03 | 000,644,464 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SymCorpUI.exe
PRC - [2010/05/06 10:58:03 | 000,349,512 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
PRC - [2010/05/06 10:58:02 | 001,831,024 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
PRC - [2010/05/06 10:58:02 | 000,181,616 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SavUI.exe
PRC - [2009/09/18 04:00:00 | 000,764,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\CCM\CcmExec.exe
PRC - [2009/09/12 23:09:04 | 000,550,232 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\Citrix\ICA Client\wfcrun32.exe
PRC - [2009/09/12 23:08:00 | 000,071,000 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\Citrix\ICA Client\ssonsvr.exe
PRC - [2009/03/27 18:10:56 | 000,014,336 | ---- | M] (LSI Corporation) -- C:\Program Files\LSI SoftModem\agrsmsvc.exe
PRC - [2008/06/12 12:21:06 | 001,164,536 | ---- | M] (AuthenTec, Inc.) -- C:\Program Files\Fingerprint Sensor\AtService.exe
PRC - [2008/05/12 14:55:10 | 001,440,384 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2008/05/12 14:55:10 | 000,576,104 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/08/21 14:26:28 | 000,356,352 | ---- | M] (Credant Technologies, Inc.) -- C:\Program Files\Credant\CMG Shield\CMGShieldUI.exe
PRC - [2007/08/21 14:21:52 | 001,384,448 | ---- | M] (Credant Technologies, Inc.) -- C:\WINDOWS\system32\CmgShieldSvc.exe
========== Modules (SafeList) ==========
MOD - [2011/06/20 11:25:08 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\azi2ts\My Documents\Downloads\OTL.exe
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2008/05/12 14:51:24 | 000,073,728 | ---- | M] (Broadcom Corporation.) -- C:\WINDOWS\system32\BtMmHook.dll
MOD - [2008/04/14 08:00:00 | 000,278,528 | ---- | M] () -- C:\WINDOWS\egedaxubig.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2011/04/07 17:40:44 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/11/11 13:57:04 | 000,268,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Zune\WMZuneComm.exe -- (WMZuneComm)
SRV - [2010/11/11 13:57:02 | 000,444,656 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Zune\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2010/11/11 13:55:56 | 006,351,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2010/11/11 13:55:56 | 000,057,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Zune\ZuneBusEnum.exe -- (ZuneBusEnum)
SRV - [2010/05/06 10:58:04 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2010/05/06 10:58:04 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2010/05/06 10:58:03 | 001,881,368 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2010/05/06 10:58:03 | 000,349,512 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)
SRV - [2010/05/06 10:58:02 | 001,831,024 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2010/02/17 10:53:18 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2009/09/18 04:00:00 | 000,764,768 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\CCM\CcmExec.exe -- (CcmExec)
SRV - [2009/09/18 04:00:00 | 000,246,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\CCM\TSManager.exe -- (smstsmgr)
SRV - [2009/03/27 18:10:56 | 000,014,336 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008/06/12 12:21:06 | 001,164,536 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- C:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService)
SRV - [2007/08/21 14:21:52 | 001,384,448 | ---- | M] (Credant Technologies, Inc.) [Unknown | Running] -- C:\WINDOWS\system32\CmgShieldSvc.exe -- (CMGShield)
========== Driver Services (SafeList) ==========
DRV - [2011/06/16 08:03:54 | 001,542,392 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20110619.002\NAVEX15.SYS -- (NAVEX15)
DRV - [2011/06/16 08:03:54 | 000,086,008 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20110619.002\NAVENG.SYS -- (NAVENG)
DRV - [2011/05/10 09:05:39 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/05/10 09:05:39 | 000,105,592 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/03/28 11:10:18 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2011/03/28 11:10:17 | 000,879,624 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2011/03/28 11:06:33 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/09/10 22:32:20 | 000,167,936 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wpshelper.sys -- (WpsHelper)
DRV - [2010/05/06 10:58:08 | 000,043,336 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\WPSDRVnt.sys -- (WPS)
DRV - [2010/05/06 10:58:05 | 000,320,944 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2010/05/06 10:58:05 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2010/05/06 10:58:04 | 000,283,184 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)
DRV - [2010/05/06 10:58:03 | 000,097,096 | ---- | M] (Symantec Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\SysPlant.sys -- (SysPlant)
DRV - [2010/05/06 10:58:03 | 000,067,472 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Teefer2.sys -- (Teefer2)
DRV - [2010/05/06 10:57:56 | 000,421,424 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2010/05/06 10:57:53 | 000,023,888 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\COH_Mon.sys -- (COH_Mon)
DRV - [2010/04/05 10:44:28 | 006,601,216 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32) Intel®
DRV - [2009/09/18 04:00:00 | 000,020,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\CCM\PrepDrv.sys -- (prepdrvr)
DRV - [2009/09/08 18:13:16 | 000,065,584 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ctxusbm.sys -- (ctxusbm)
DRV - [2009/08/04 15:56:28 | 000,240,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1y5132.sys -- (e1yexpress) Intel®
DRV - [2009/07/21 14:18:58 | 001,161,760 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009/07/20 15:05:16 | 000,049,152 | ---- | M] (RICOH Company, Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rismc32.sys -- (rismc32)
DRV - [2009/06/25 16:58:10 | 000,048,128 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2009/06/23 12:49:58 | 000,040,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI) Intel®
DRV - [2009/03/19 10:40:10 | 000,009,216 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2008/10/20 20:08:06 | 000,012,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smsmdm.sys -- (smsmdd)
DRV - [2008/07/23 11:31:38 | 000,044,800 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM)
DRV - [2008/06/12 14:40:50 | 000,477,696 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATSwpWDF.sys -- (ATSwpWDF)
DRV - [2008/05/23 13:51:02 | 000,024,624 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys -- (hpdskflt)
DRV - [2008/05/23 13:50:16 | 000,028,592 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Accelerometer.sys -- (Accelerometer)
DRV - [2008/04/08 22:36:46 | 000,106,112 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symmpi.sys -- (Symmpi)
DRV - [2008/03/28 12:14:02 | 000,024,064 | ---- | M] (Sonic Focus, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO)
DRV - [2007/08/21 14:23:50 | 000,145,920 | ---- | M] (Credant Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\CmgShREG.sys -- (CMGShieldReg)
DRV - [2007/08/21 14:15:58 | 000,211,456 | ---- | M] (Credant Technologies, Inc.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\CMGShCEF.sys -- (CmgShieldCEF)
DRV - [2007/06/18 16:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2006/11/02 07:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB)
DRV - [2006/01/09 20:37:56 | 000,011,113 | ---- | M] (Nortel Networks) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\eacfilt.sys -- (Eacfilt)
DRV - [2006/01/09 20:37:40 | 000,150,016 | ---- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ipsecw2k.sys -- (IPSECSHM)
DRV - [2006/01/09 20:37:40 | 000,150,016 | ---- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ipsecw2k.sys -- (IPSECEXT)
DRV - [2005/11/30 14:30:14 | 000,010,880 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\vmscsi.sys -- (vmscsi)
DRV - [2001/08/17 08:12:02 | 000,063,208 | ---- | M] (Intel Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\dc21x4.sys -- (DC21x4)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://CenterLink
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
========== FireFox ==========
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/31 19:39:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/31 19:39:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{21AC9DBF-4917-45D7-AB85-790B608FF4CC}: C:\Documents and Settings\azi2ts\Local Settings\Application Data\{21AC9DBF-4917-45D7-AB85-790B608FF4CC}\ [2011/06/18 01:50:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ED71E3DC-D1BA-4422-B794-9C64761CEFB8}: C:\Documents and Settings\azi2ts\Local Settings\Application Data\{ED71E3DC-D1BA-4422-B794-9C64761CEFB8}\ [2011/06/18 15:07:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{E3F0F4EC-6799-4A07-AA20-0C288070503F}: C:\Documents and Settings\azi2ts\Local Settings\Application Data\{E3F0F4EC-6799-4A07-AA20-0C288070503F}\ [2011/06/19 20:15:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Documents and Settings\azi2ts\Local Settings\Application Data\Mozilla Firefox\components [2011/05/09 10:35:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Documents and Settings\azi2ts\Local Settings\Application Data\Mozilla Firefox\plugins
[2011/04/07 23:42:57 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\azi2ts\Application Data\Mozilla\Extensions
[2011/04/07 23:42:57 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\azi2ts\Application Data\Mozilla\Extensions\[email protected]
[2011/06/18 12:22:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\azi2ts\Application Data\Mozilla\Firefox\Profiles\a52vxgb7.default\extensions
[2011/05/29 23:25:27 | 000,000,000 | ---D | M] (FireShot) -- C:\Documents and Settings\azi2ts\Application Data\Mozilla\Firefox\Profiles\a52vxgb7.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2011/03/28 15:16:31 | 000,000,000 | ---D | M] (AddThis) -- C:\Documents and Settings\azi2ts\Application Data\Mozilla\Firefox\Profiles\a52vxgb7.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2011/05/22 10:59:55 | 000,000,000 | ---D | M] (EPUBReader) -- C:\Documents and Settings\azi2ts\Application Data\Mozilla\Firefox\Profiles\a52vxgb7.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2011/06/18 12:22:32 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Documents and Settings\azi2ts\Application Data\Mozilla\Firefox\Profiles\a52vxgb7.default\extensions\[email protected]
[2011/05/25 08:37:03 | 000,000,000 | ---D | M] (Echofon) -- C:\Documents and Settings\azi2ts\Application Data\Mozilla\Firefox\Profiles\a52vxgb7.default\extensions\[email protected]
O1 HOSTS File: ([2011/04/07 20:02:47 | 000,001,216 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Documents and Settings\azi2ts\Application Data\Mozilla\Firefox\Profiles\a52vxgb7.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\FSAddin-0.90.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Byoteh] C:\WINDOWS\egedaxubig.dll ()
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CMGShieldUI] C:\Program Files\Credant\CMG Shield\CMGShieldUI.exe (Credant Technologies, Inc.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Zune Launcher] c:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Ncijobakamod] C:\WINDOWS\imgkbd.dll (madshi.net)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\New Windows present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoMSAppLogo5ChannelNotify = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoToolbarCustomize = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoBandCustomize = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 16
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplaylLastUsername = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Home = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Fullscreen = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Tools = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Print = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Edit = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Cut = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Copy = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Paste = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Encoding = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: cchmc.org ([]* in Local intranet)
O15 - HKLM\..Trusted Domains: smed.com ([www11] http in Trusted sites)
O15 - HKLM\..Trusted Ranges: Range1 ([*] in Local intranet)
O15 - HKCU\..Trusted Domains: cchmc.org ([]* in My Computer)
O15 - HKCU\..Trusted Domains: smed.com ([www11] http in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in My Computer)
O16 - DPF: {2AB1C516-6654-4D3A-B3D6-2185BBCEB409} https://extranet.cch...svrloader32.cab (Cisco SSL VPN Relay Loader)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1263491801890 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1263491999734 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {A8B3A7FE-9C8D-4F15-9B01-8805BDF43B1B} http://chmcpacs/ami/...l/amiviewer.cab (AMI Pictorial Control CWeb 2.1 SPa06)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.200.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = chmccorp.cchmc.org
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\CMGShieldNP: DllName - C:\Program Files\Credant\CMG Shield\CMGShieldNP.dll - C:\Program Files\Credant\CMG Shield\CMGShieldNP.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\azi2ts\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\azi2ts\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/01/14 12:13:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/06/19 20:15:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Local Settings\Application Data\{E3F0F4EC-6799-4A07-AA20-0C288070503F}
[2011/06/18 15:53:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Picasa 3
[2011/06/18 15:51:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Local Settings\Application Data\Google
[2011/06/18 15:51:07 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2011/06/18 15:07:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Local Settings\Application Data\{ED71E3DC-D1BA-4422-B794-9C64761CEFB8}
[2011/06/18 01:50:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Local Settings\Application Data\{21AC9DBF-4917-45D7-AB85-790B608FF4CC}
[2011/06/08 02:38:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\My Documents\My Media
[2011/06/08 02:38:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Application Data\OverDrive
[2011/06/08 02:38:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\OverDrive Media Console
[2011/06/08 02:38:11 | 000,000,000 | ---D | C] -- C:\Program Files\OverDrive Media Console
[2011/06/07 19:26:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/06/07 19:26:06 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/06/07 19:25:49 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011/06/04 18:13:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Desktop\mnt.forms
[2011/06/04 17:51:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Application Data\Amazon
[2011/06/04 17:51:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\My Documents\My Kindle Content
[2011/06/04 17:50:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Start Menu\Programs\Amazon
[2011/06/04 17:50:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Local Settings\Application Data\Amazon
[2011/06/04 17:50:45 | 000,000,000 | ---D | C] -- C:\Program Files\Amazon
[2011/06/01 08:54:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Application Data\FireShot
[2011/06/01 08:36:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\My Documents\Bluetooth Exchange Folder
[2011/05/27 01:07:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN
[2011/05/26 21:50:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Desktop\taxes
[2011/05/26 21:06:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\My Documents\personal
[2011/05/22 12:05:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NCH Software
[2011/05/22 12:05:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Video Related Programs
[2011/05/22 12:05:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\NCH Software Suite
[2011/05/22 12:05:00 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Software
[2011/05/22 12:04:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\Application Data\NCH Software
[2011/05/21 20:53:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\azi2ts\My Documents\My Digital Editions
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/06/20 11:03:52 | 000,176,640 | ---- | M] () -- C:\Documents and Settings\azi2ts\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/20 11:03:21 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Jnupirakipejox.dat
[2011/06/20 04:49:52 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/06/20 02:40:20 | 104,891,106 | ---- | M] () -- C:\Documents and Settings\azi2ts\Desktop\childrens.hospital.us.s03e03.avi
[2011/06/20 00:46:33 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Vzidus.bin
[2011/06/19 20:17:33 | 000,000,473 | ---- | M] () -- C:\WINDOWS\smscfg.ini
[2011/06/19 20:14:56 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/19 20:14:40 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2011/06/19 20:14:15 | 000,000,352 | -HS- | M] () -- C:\WINDOWS\tasks\BKFJJATFJM.job
[2011/06/19 20:14:15 | 000,000,328 | -HS- | M] () -- C:\WINDOWS\tasks\Nfnpu.job
[2011/06/19 20:14:15 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\tasks\SMGNTRZ.job
[2011/06/19 20:13:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/19 19:51:18 | 000,132,771 | ---- | M] () -- C:\Documents and Settings\azi2ts\Desktop\nctax.png
[2011/06/18 16:22:53 | 000,300,978 | ---- | M] () -- C:\Documents and Settings\azi2ts\My Documents\db.jpg
[2011/06/18 16:21:41 | 000,142,749 | ---- | M] () -- C:\Documents and Settings\azi2ts\Desktop\db.jpg
[2011/06/18 01:48:10 | 000,110,592 | RHS- | M] () -- C:\WINDOWS\System32\msdtcprx8.dll
[2011/06/17 08:22:40 | 000,000,086 | ---- | M] () -- C:\WINDOWS\WPCMAPI.INI
[2011/06/17 08:22:21 | 000,029,217 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2011/06/14 18:37:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/01 08:58:35 | 000,377,210 | ---- | M] () -- C:\Documents and Settings\azi2ts\Desktop\anb.png
[2011/05/31 09:59:11 | 000,067,129 | ---- | M] () -- C:\Documents and Settings\azi2ts\Desktop\worksheet_2000_18.pdf
[2011/05/31 09:57:57 | 000,067,135 | ---- | M] () -- C:\Documents and Settings\azi2ts\Desktop\worksheet_1800_18.pdf
[2011/05/25 18:28:01 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\videopadShakeIcon.job
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/06/20 01:07:25 | 104,891,106 | ---- | C] () -- C:\Documents and Settings\azi2ts\Desktop\childrens.hospital.us.s03e03.avi
[2011/06/19 19:51:18 | 000,132,771 | ---- | C] () -- C:\Documents and Settings\azi2ts\Desktop\nctax.png
[2011/06/18 16:22:52 | 000,300,978 | ---- | C] () -- C:\Documents and Settings\azi2ts\My Documents\db.jpg
[2011/06/18 16:21:40 | 000,142,749 | ---- | C] () -- C:\Documents and Settings\azi2ts\Desktop\db.jpg
[2011/06/18 01:50:23 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Jnupirakipejox.dat
[2011/06/18 01:50:23 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Vzidus.bin
[2011/06/18 01:48:10 | 000,000,352 | -HS- | C] () -- C:\WINDOWS\tasks\BKFJJATFJM.job
[2011/06/18 01:48:10 | 000,000,328 | -HS- | C] () -- C:\WINDOWS\tasks\Nfnpu.job
[2011/06/18 01:48:10 | 000,000,314 | -HS- | C] () -- C:\WINDOWS\tasks\SMGNTRZ.job
[2011/06/18 01:48:09 | 000,110,592 | RHS- | C] () -- C:\WINDOWS\System32\msdtcprx8.dll
[2011/06/01 08:54:33 | 000,377,210 | ---- | C] () -- C:\Documents and Settings\azi2ts\Desktop\anb.png
[2011/05/31 09:59:11 | 000,067,129 | ---- | C] () -- C:\Documents and Settings\azi2ts\Desktop\worksheet_2000_18.pdf
[2011/05/31 09:57:57 | 000,067,135 | ---- | C] () -- C:\Documents and Settings\azi2ts\Desktop\worksheet_1800_18.pdf
[2011/05/22 18:28:11 | 000,000,282 | ---- | C] () -- C:\WINDOWS\tasks\videopadShakeIcon.job
[2011/05/22 12:05:01 | 000,000,811 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\VideoPad Video Editor.lnk
[2011/05/21 20:52:48 | 000,001,831 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Digital Editions.lnk
[2011/05/18 21:22:17 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011/04/18 16:55:53 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/31 22:12:32 | 000,000,540 | ---- | C] () -- C:\Documents and Settings\azi2ts\Application Data\AutoGK.ini
[2011/03/29 15:42:53 | 000,000,086 | ---- | C] () -- C:\WINDOWS\WPCMAPI.INI
[2011/03/29 15:02:25 | 000,002,251 | ---- | C] () -- C:\WINDOWS\cmwf.ini
[2011/03/29 15:02:03 | 000,031,232 | ---- | C] () -- C:\WINDOWS\System32\bcfont32.dll
[2011/03/29 14:01:24 | 000,000,109 | ---- | C] () -- C:\WINDOWS\IMGBASIC.INI
[2011/03/29 14:01:24 | 000,000,072 | ---- | C] () -- C:\WINDOWS\dhsdebug.ini
[2011/03/29 14:01:10 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\tx32.dll
[2011/03/29 14:01:08 | 000,000,478 | ---- | C] () -- C:\WINDOWS\System32\ic32.ini
[2011/03/28 18:41:16 | 000,176,640 | ---- | C] () -- C:\Documents and Settings\azi2ts\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/28 15:48:30 | 000,982,192 | ---- | C] () -- C:\WINDOWS\System32\igkrng500.bin
[2011/03/28 15:48:27 | 000,417,344 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin
[2011/03/28 14:40:23 | 000,011,920 | R--- | C] () -- C:\WINDOWS\System32\SETUP.INI
[2011/03/28 12:04:24 | 000,004,764 | ---- | C] () -- C:\WINDOWS\System32\CcmFramework.ini
[2011/01/07 23:13:06 | 000,155,700 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.DLL
[2010/01/14 15:01:35 | 000,000,473 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/01/14 14:59:01 | 000,278,528 | ---- | C] () -- C:\WINDOWS\egedaxubig.dll
[2010/01/14 14:58:56 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010/01/14 14:58:54 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010/01/14 14:58:54 | 000,444,756 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2010/01/14 14:58:54 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2010/01/14 14:58:54 | 000,072,710 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2010/01/14 14:58:54 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2010/01/14 14:58:54 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010/01/14 14:58:53 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2010/01/14 14:58:53 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2010/01/14 14:58:53 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2010/01/14 14:58:48 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2010/01/14 14:58:48 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2010/01/14 12:52:23 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/01/14 12:24:53 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\QRes.exe
[2010/01/14 12:24:39 | 000,000,051 | ---- | C] () -- C:\WINDOWS\smsts.ini
[2010/01/14 12:22:41 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/01/14 12:13:49 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2010/01/14 12:09:48 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/01/14 12:09:20 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2010/01/14 07:06:25 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/01/14 07:05:24 | 002,148,928 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/01/25 17:10:48 | 000,179,200 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009/01/08 19:01:22 | 000,629,760 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/05/12 14:51:50 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2002/10/15 18:54:04 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
========== LOP Check ==========
[2011/03/28 11:48:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix
[2011/06/05 15:46:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Credant
[2011/05/09 10:37:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/06/14 16:41:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\.oit
[2011/06/04 17:51:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\Amazon
[2011/04/19 16:06:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\AMICAS
[2011/03/31 22:07:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\avidemux
[2011/04/14 21:13:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\DDMSettings
[2011/03/30 23:13:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\Digiarty
[2011/03/28 19:33:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\Esha Research
[2011/06/01 08:54:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\FireShot
[2011/04/07 23:42:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\Flickr
[2011/03/30 21:12:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\HandBrake
[2011/03/28 16:24:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\ICAClient
[2010/01/14 13:44:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\iScreensaver
[2011/06/08 02:38:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\OverDrive
[2011/06/15 02:23:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\azi2ts\Application Data\uTorrent
[2011/06/19 20:14:15 | 000,000,352 | -HS- | M] () -- C:\WINDOWS\Tasks\BKFJJATFJM.job
[2011/06/19 20:14:15 | 000,000,328 | -HS- | M] () -- C:\WINDOWS\Tasks\Nfnpu.job
[2011/06/19 20:14:40 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job
[2011/06/19 20:14:15 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\Tasks\SMGNTRZ.job
[2011/05/25 18:28:01 | 000,000,282 | ---- | M] () -- C:\WINDOWS\Tasks\videopadShakeIcon.job
========== Purity Check ==========
< End of report >
Extras.txt:
OTL Extras logfile created on: 6/20/2011 11:25:21 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\azi2ts\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.91 Gb Total Physical Memory | 0.54 Gb Available Physical Memory | 28.34% Memory free
3.68 Gb Paging File | 1.87 Gb Available in Paging File | 50.80% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 55.87 Gb Free Space | 37.49% Space Free | Partition Type: NTFS
Drive E: | 232.88 Gb Total Space | 31.69 Gb Free Space | 13.61% Space Free | Partition Type: NTFS
Computer Name: P09-8768 | User Name: AZI2TS | NOT logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Documents and Settings\azi2ts\Local Settings\Application Data\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 0
"AllAlertsDisabled" = 1
"TermService" = 1
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
"80:TCP" = 80:TCP:*:Disabled:Windows Remote Management - Compatibility Mode (HTTP-In)
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4
"1900:TCP" = 1900:TCP:LocalSubNet:Enabled:UDP 1900
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe" = C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe:*:Enabled:SMC Service -- (Symantec Corporation)
"C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE" = C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE:*:Enabled:SNAC Service -- (Symantec Corporation)
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe" = C:\Program Files\Common Files\Symantec Shared\ccApp.exe:*:Enabled:Symantec Email -- (Symantec Corporation)
"C:\Novell\GroupWise\grpwise.exe" = C:\Novell\GroupWise\grpwise.exe:*:Enabled:Novell GroupWise -- (Novell, Inc.)
"C:\Novell\GroupWise\notify.exe" = C:\Novell\GroupWise\notify.exe:*:Enabled:Novell Notify -- (Novell, Inc.)
"C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Novell\GroupWise\grpwise.exe" = C:\Novell\GroupWise\grpwise.exe:*:Enabled:Novell GroupWise -- (Novell, Inc.)
"C:\Novell\GroupWise\notify.exe" = C:\Novell\GroupWise\notify.exe:*:Enabled:Novell Notify -- (Novell, Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 -- (Adobe Systems Incorporated)
"C:\Program Files\ChartMaxx41\bin\cmaxmain41.exe" = C:\Program Files\ChartMaxx41\bin\cmaxmain41.exe:*:Enabled:cmaxmain41 -- (MedPlus, Inc.)
"C:\Program Files\bitRipper\bitRipper.exe" = C:\Program Files\bitRipper\bitRipper.exe:*:Enabled:bitRipper -- ()
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07EEE598-5F21-4B57-B40B-46592625B3D9}" = Zune Language Pack (PTB)
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0BCA9EFD-F2D6-4638-B053-8693BA0404BE}" = Citrix online plug-in (Web)
"{0C56786C-EF32-49BB-A975-C201F79D3049}" = The Food Processor SQL
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{2609EDF1-34C4-4B03-B634-55F3B3BC4931}" = Configuration Manager Client
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{2C4E2E4E-A7C9-4CCB-BF03-FE6EBD5D4AB7}" = Windows Mobile Device Updater Component
"{328C3AB0-0506-46C2-83BF-B517F4FF8D7F}" = GroupWise - VC8
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3C1AE512-3C37-44FA-BA42-ABB721EC5B1D}" = Symantec Endpoint Protection
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows Journal Viewer
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A79DC02-A3A8-461A-81F6-82CD98CC2EDC}" = CMG Windows Shield
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{55392E52-1AAD-44C4-BE49-258FFE72434F}" = Citrix online plug-in (USB)
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{5665D670-84A2-4D5A-8888-357FE48D8CB3}" = Adobe Photoshop Lightroom 3.4 RC
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5C93E291-A1CC-4E51-85C6-E194209FCDB4}" = Zune Language Pack (PTG)
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{6740BCB0-5863-47F4-80F4-44F394DE4FE2}" = Zune Language Pack (NLD)
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{69DAC00A-7665-4E9B-B441-093D40736429}" = HP BatteryCheck 2.10 A2
"{6B33492E-FBBC-4EC3-8738-09E16E395A10}" = Zune Language Pack (ESP)
"{7006ED29-58F2-40C3-AE87-039287AD20B6}" = Zune
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{721ABC3B-5F12-4332-9C0C-C11424EF666C}" = WIMGAPI
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{78DB4478-B919-4F64-9208-D6D7AF485710}" = IsmCommonComponents
"{7C84DDDF-DEC9-4E02-8222-D86E73531CEB}" = Citrix online plug-in (SSON)
"{812424AC-A8B5-44E6-8D48-07E939D1AD9A}" = Citrix online plug-in (HDX)
"{81FADFBE-3B56-47FC-A122-3C69D1708089}" = GroupWise
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = HP Integrated Module with Bluetooth wireless technology
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 14
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{0F055EC7-E0EE-444A-8377-8B0EDB350FEC}" =
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{92317FD2-8A6B-4CEE-B03D-18CA3244E157}" = Windows Phone Intro Video (ENU)
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{93627D6E-82EB-4A16-8602-2DC4AF722B2E}" = IsmVipComponents
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{A08AEEC6-79E2-4090-917F-5A1C8B0BF071}" = Merge PACS AS Workstation V6 MR4
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B8A2256E-6225-4D9E-B1C9-C26CA1E22FEB}" = Citrix online plug-in (PNA)
"{BA2CD2E5-FBAF-4F58-8CF4-AE1E5E873A07}" = LearningGuide Assistant
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BE236D9A-52EC-4A17-82DA-84B5EAD31E3E}" = Zune Language Pack (DEU)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2CDE75C-CA51-4335-9C13-84C00E6093A5}" = Windows Media Player Enterprise Deployment
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C5D37FFA-7483-410B-982B-91E93FD3B7DA}" = Zune Language Pack (ITA)
"{C68D33B1-0204-4EBE-BC45-A6E432B1D13A}" = Zune Language Pack (FRA)
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF53CF7C-D996-43EB-9904-DBED57C25625}" = Citrix online plug-in (DV)
"{D4AFC7AD-F637-4EDD-BC76-767E4AF78CE1}" = OverDrive Media Console
"{D6B5B017-7643-46A5-AC4D-E58A7B4798A0}" = iTunes
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}" = Microsoft .NET Framework SDK (English) 1.1
"{EF964A78-078C-11D1-B7A7-0000C0134CE6}" = Nortel Networks Contivity VPN Client
"{F0A55445-B637-4CEA-A580-A8FC6954130D}" = HP Client Management Interface Providers
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL
"{F3CA9611-CD42-4562-ADAB-A554CF8E17F1}" = Microsoft WSE 2.0 SP3 Runtime
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FA1D6742-0515-4A94-AD5D-F0484026E4A2}" = Adobe Flash Player 10 ActiveX
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FECEF9D2-9D3D-449B-9EA4-CFA775C99464}" = AuthenTec Fingerprint System
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Amazon Kindle" = Amazon Kindle
"AudibleManager" = AudibleManager
"AutoGK" = Auto Gordian Knot 2.55
"Avidemux 2.5" = Avidemux 2.5
"AviSynth" = AviSynth 2.5
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"AVS4YOU Video Converter 7_is1" = AVS Video Converter 7
"bitRipper" = bitRipper
"C2EAA141-9893-42FD-BD44-685EA6E2F588" = FreeStar Free DVD Ripper
"ChartMaxx 4.1" = ChartMaxx 4.1
"ChartMaxx 4.1 Web Client" = ChartMaxx 4.1 Web Client
"CitrixOnlinePluginFull" = Citrix online plug-in
"Clinical Links Desktop Icon" = Clinical Links Desktop Icon
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"Credant2Go" = Credant2Go
"Digital Editions" = Adobe Digital Editions
"DipStych" = DipStych 0.6
"DivX Setup.divx.com" = DivX Setup
"DVD Shrink_is1" = DVD Shrink 3.2
"Flickr Uploadr" = Flickr Uploadr 3.2.1
"HandBrake" = HandBrake 0.9.5
"HDMI" = Intel® Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"LiveUpdate" = LiveUpdate 3.3 (Symantec Corporation)
"LSI Soft Modem" = LSI HDA Modem
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"novaPDF_is1" = novaPDF (novaPDF 6.3 printer)
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Picasa 3" = Picasa 3
"RDC" = RDC
"ST6UNST #1" = TPN
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"uTorrent" = µTorrent
"VideoPad" = VideoPad Video Editor
"VLC media player" = VLC media player 1.1.9
"VobSub" = VobSub v2.23 (Remove Only)
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR 4.00 (32-bit)
"winusb0100" = Microsoft WinUsb 1.0
"WinX Free DVD Ripper_is1" = WinX Free DVD Ripper 4.5.12
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WMS" = Windows NT Messaging
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"XviD MPEG4 Video Codec" = XviD MPEG4 Video Codec (remove only)
"Zune" = Zune
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 5/5/2011 4:50:24 PM | Computer Name = P09-8768 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.
Error - 5/5/2011 4:50:33 PM | Computer Name = P09-8768 | Source = Microsoft Fax | ID = 32060
Description = Fax Service failed to initialize Activity Logging because it did not
succeed in opening the activity logging files. Note that the service will remain
running without activity logging. Verify that the log directory is valid and writable.
Restart the service. Win32 error code: 5. This error code indicates the cause of
the error.
Error - 5/5/2011 4:50:49 PM | Computer Name = P09-8768 | Source = UserInit | ID = 1000
Description = Could not execute the following script SetLocalAdminPassword.vbe.
The system cannot find the file specified. .
Error - 5/5/2011 4:50:49 PM | Computer Name = P09-8768 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.
Error - 5/5/2011 4:50:49 PM | Computer Name = P09-8768 | Source = UserInit | ID = 1000
Description = Could not execute the following script PrinterMigrate.vbs. The system
cannot find the file specified. .
Error - 5/5/2011 4:50:49 PM | Computer Name = P09-8768 | Source = UserInit | ID = 1000
Description = Could not execute the following script login.vbs. The system cannot
find the file specified. .
Error - 5/6/2011 12:50:00 AM | Computer Name = P09-8768 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.
Error - 5/6/2011 8:50:00 AM | Computer Name = P09-8768 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.
Error - 5/6/2011 2:15:46 PM | Computer Name = P09-8768 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x04159290.
Error - 5/6/2011 3:00:24 PM | Computer Name = P09-8768 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x04349290.
[ System Events ]
Error - 6/20/2011 10:43:27 AM | Computer Name = P09-8768 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.
Error - 6/20/2011 10:43:27 AM | Computer Name = P09-8768 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.
Error - 6/20/2011 10:43:30 AM | Computer Name = P09-8768 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.
Error - 6/20/2011 10:43:38 AM | Computer Name = P09-8768 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.
Error - 6/20/2011 10:58:40 AM | Computer Name = P09-8768 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 29 minutes. NtpClient has no source of accurate
time.
Error - 6/20/2011 11:02:02 AM | Computer Name = P09-8768 | Source = Service Control Manager | ID = 7034
Description = The Com4QLBEx service terminated unexpectedly. It has done this 1
time(s).
Error - 6/20/2011 11:02:14 AM | Computer Name = P09-8768 | Source = Service Control Manager | ID = 7031
Description = The Symantec Network Access Control service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
10000 milliseconds: Restart the service.
Error - 6/20/2011 11:02:18 AM | Computer Name = P09-8768 | Source = Service Control Manager | ID = 7034
Description = The Machine Debug Manager service terminated unexpectedly. It has
done this 1 time(s).
Error - 6/20/2011 11:02:20 AM | Computer Name = P09-8768 | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).
Error - 6/20/2011 11:02:30 AM | Computer Name = P09-8768 | Source = Service Control Manager | ID = 7031
Description = The Symantec Network Access Control service terminated unexpectedly.
It has done this 2 time(s). The following corrective action will be taken in
10000 milliseconds: Restart the service.
< End of report >
Edited by bpym, 20 June 2011 - 10:27 AM.
Sign In
Create Account
