I just noticed a problem today and thought I would get on it asap. While browsing ebay, occasionally I get redirected to something like this : tags(dot)bluekai(dot)com. My connection is slow, so I never let it load to see what it might be exactly. I have ad and popup blockers, so I was surprised this got through and it made me think it is something malign. A quick search led me to another person using geekstogo to get it fixed.
Thanks,
D
Here is my OTL log:
eOTL logfile created on: 6/21/2011 4:06:06 PM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\Dave\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.20 Gb Available Physical Memory | 59.95% Memory free
3.85 Gb Paging File | 3.20 Gb Available in Paging File | 82.98% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.83 Gb Total Space | 13.63 Gb Free Space | 19.51% Space Free | Partition Type: NTFS
Drive E: | 483.50 Mb Total Space | 483.50 Mb Free Space | 100.00% Space Free | Partition Type: FAT
Drive G: | 42.34 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: HAL-9300 | User Name: Dave | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/06/21 16:04:27 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dave\My Documents\Downloads\OTL.exe
PRC - [2011/04/14 09:25:41 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/04/25 21:03:35 | 000,002,560 | ---- | M] () -- C:\WINDOWS\Runservice.exe
PRC - [2010/01/22 18:49:26 | 003,933,464 | ---- | M] (Smith Micro Software, Inc.) -- C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
PRC - [2009/03/12 18:18:48 | 000,602,624 | ---- | M] () -- C:\Program Files\Everything\Everything.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/05/17 14:45:33 | 000,271,720 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2007/04/10 14:46:43 | 000,996,712 | ---- | M] (Microsoft Corporation
) -- C:\WINDOWS\vVX6000.exe
PRC - [2007/02/21 11:19:58 | 000,819,200 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2007/02/21 11:19:40 | 000,294,912 | ---- | M] (Intel® Corporation) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2007/02/21 11:17:42 | 000,970,752 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2007/02/21 11:13:26 | 000,487,424 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2007/02/16 09:58:12 | 000,856,064 | ---- | M] (Christian Diefer) -- C:\Program Files\I8kfanGUI\I8kfanGUI.exe
PRC - [2006/06/29 13:13:32 | 001,032,192 | ---- | M] (Dell Inc) -- C:\Program Files\Dell\QuickSet\quickset.exe
PRC - [2006/06/29 13:12:34 | 000,376,832 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
PRC - [2005/10/07 15:13:38 | 000,176,128 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe
PRC - [2005/07/27 17:41:08 | 000,045,056 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApntEx.exe
PRC - [2005/05/12 01:33:52 | 000,479,232 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
PRC - [2004/09/03 01:58:48 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Ahead\ODD Toolkit\dvdtray.exe
PRC - [2004/06/29 00:56:12 | 000,045,056 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\hidfind.exe
========== Modules (SafeList) ==========
MOD - [2011/06/21 16:04:27 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dave\My Documents\Downloads\OTL.exe
MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2010/04/25 21:03:35 | 000,002,560 | ---- | M] () [Auto | Running] -- C:\WINDOWS\Runservice.exe -- (LicCtrlService)
SRV - [2007/05/17 14:45:33 | 000,271,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2007/02/21 11:19:40 | 000,294,912 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) Intel®
SRV - [2006/06/29 13:12:34 | 000,376,832 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe -- (NICCONFIGSVC)
========== Driver Services (SafeList) ==========
DRV - [2009/12/18 12:13:02 | 000,020,480 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NwUsbCdFil.sys -- (NWUSBCDFIL)
DRV - [2009/12/18 12:13:00 | 000,230,912 | ---- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NWADIenum.sys -- (NWADI)
DRV - [2009/12/18 12:12:58 | 000,174,720 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nwusbser2.sys -- (NWUSBPort2)
DRV - [2009/12/18 12:12:58 | 000,174,720 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nwusbser.sys -- (NWUSBPort)
DRV - [2009/12/18 12:12:58 | 000,174,720 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nwusbmdm.sys -- (NWUSBModem)
DRV - [2009/09/21 18:52:40 | 000,114,704 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PTDCWWAN.sys -- (PTDCWWAN)
DRV - [2009/09/21 18:52:22 | 000,160,400 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PTDCVsp.sys -- (PTDCVsp) PANTECH PC Card Diagnostic Serial Port (UDP)
DRV - [2009/09/21 18:52:22 | 000,160,400 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PTDCMdm.sys -- (PTDCMdm) PANTECH PC Card Drivers (UDP)
DRV - [2009/09/21 18:52:20 | 000,054,032 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PTDCBus.sys -- (PTDCBus) PANTECH PC Card Composite Device Driver (UDP)
DRV - [2009/05/25 15:43:58 | 000,032,408 | ---- | M] (Smith Micro Inc.) [Kernel | On_Demand | Running] -- C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys -- (SMSIVZAM5)
DRV - [2007/04/10 14:46:44 | 002,385,896 | ---- | M] (Microsoft Corporation
) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VX6000Xp.sys -- (VX6000)
DRV - [2007/02/21 11:16:12 | 000,012,416 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2007/02/16 02:05:48 | 000,014,464 | ---- | M] (Christian Diefer) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fanio.sys -- (fanio)
DRV - [2007/02/08 13:51:16 | 002,209,408 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel®
DRV - [2005/09/28 21:57:18 | 000,113,847 | R--- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2005/08/12 18:50:46 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
DRV - [2005/05/03 15:09:28 | 001,033,728 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.SYS -- (HSF_DPV)
DRV - [2005/05/03 15:08:50 | 000,208,384 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2005/05/03 15:08:44 | 000,705,408 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2005/03/10 17:56:06 | 000,273,168 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97)
DRV - [2004/05/26 15:18:18 | 000,044,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://www.gmail.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {1ced4832-f06e-413f-aa14-9eb63ad40ace}:1.0.2
FF - prefs.js..extensions.enabledItems: [email protected]:0.6.20100629
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/04 19:56:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/04 19:56:35 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/03/02 02:16:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010/03/02 02:45:00 | 000,000,000 | ---D | M]
[2010/03/01 18:15:08 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dave\Application Data\Mozilla\Extensions
[2010/03/01 18:15:08 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dave\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/03/01 18:13:22 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dave\Application Data\Mozilla\Extensions\[email protected]
[2011/06/11 22:06:05 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dave\Application Data\Mozilla\Firefox\Profiles\cbezqhu1.default\extensions
[2010/06/27 02:06:27 | 000,000,000 | ---D | M] (Nuke Anything Enhanced) -- C:\Documents and Settings\Dave\Application Data\Mozilla\Firefox\Profiles\cbezqhu1.default\extensions\{1ced4832-f06e-413f-aa14-9eb63ad40ace}
[2011/06/06 23:50:22 | 000,000,000 | ---D | M] (Remove It Permanently) -- C:\Documents and Settings\Dave\Application Data\Mozilla\Firefox\Profiles\cbezqhu1.default\extensions\{1dbc4a33-ea62-4330-966c-7bdad3455322}
[2010/10/18 23:31:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Dave\Application Data\Mozilla\Firefox\Profiles\cbezqhu1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/06/06 02:10:24 | 000,000,000 | ---D | M] (Flash and Video Download) -- C:\Documents and Settings\Dave\Application Data\Mozilla\Firefox\Profiles\cbezqhu1.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
[2011/06/06 23:50:20 | 000,000,000 | ---D | M] (Maximum AdBlock) -- C:\Documents and Settings\Dave\Application Data\Mozilla\Firefox\Profiles\cbezqhu1.default\extensions\[email protected]
[2011/06/04 22:16:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/04 22:16:38 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010/10/17 00:24:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/06/04 21:16:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) --
[2010/10/17 00:23:59 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/06/06 02:02:05 | 000,000,000 | ---D | M] (OneClick YouTube Downloader) -- C:\PROGRAM FILES\ORBITDOWNLOADER\ADDONS\ONECLICKYOUTUBEDOWNLOADER
[2011/04/14 09:26:02 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/02/02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/01 20:28:07 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
[2010/01/01 01:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
O1 HOSTS File: ([2004/08/10 04:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)
O4 - HKLM..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\dvdtray.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [Everything] C:\Program Files\Everything\Everything.exe ()
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [VX6000] C:\WINDOWS\vVX6000.exe (Microsoft Corporation
)
O4 - HKCU..\Run: [i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe (Christian Diefer)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Dave\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Dave\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/27 04:37:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008/08/21 00:39:48 | 000,000,074 | R--- | M] () - G:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{5b7072c4-5b02-11df-b056-00123fe1c4ff}\Shell\AutoRun\command - "" = E:\wubi.exe --cdmenu
O33 - MountPoints2\{c0acba60-2a6e-11df-b019-7a8020000200}\Shell - "" = AutoRun
O33 - MountPoints2\{c0acba60-2a6e-11df-b019-7a8020000200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c0acba60-2a6e-11df-b019-7a8020000200}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{c19167d8-d9b1-11df-b097-00123fe1c4ff}\Shell - "" = AutoRun
O33 - MountPoints2\{c19167d8-d9b1-11df-b097-00123fe1c4ff}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c19167d8-d9b1-11df-b097-00123fe1c4ff}\Shell\AutoRun\command - "" = F:\VZAccess_Manager.exe /z detect
O33 - MountPoints2\{c57124ef-2598-11df-b014-7a8020000200}\Shell\AutoRun\command - "" = F:\Launch.exe
O33 - MountPoints2\{c57124fa-2598-11df-b014-7a8020000200}\Shell\AutoRun\command - "" = G:\InstallTomTomHOME.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/06/19 15:43:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Desktop\photo.php_files
[2011/06/16 21:25:58 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mup.sys
[2011/06/12 15:42:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Local Settings\Application Data\My Games
[2011/06/12 08:58:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Firaxis Games
[2011/06/12 08:39:15 | 000,000,000 | ---D | C] -- C:\Program Files\2K Games
[2011/06/10 23:36:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NVIDIA
[2011/06/09 03:13:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Spiderweb Software
[2011/06/09 03:13:30 | 000,000,000 | ---D | C] -- C:\Program Files\Spiderweb Software
[2011/06/08 18:05:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Desktop\EUROPEMOROCCO WIP
[2011/06/08 18:04:01 | 000,000,000 | ---D | C] -- C:\Programme
[2011/06/07 18:33:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Start Menu\Programs\Shrapnel Games
[2011/06/07 18:32:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\My Documents\HooNetMeter
[2011/06/07 18:32:11 | 000,000,000 | ---D | C] -- C:\Program Files\dominions3demo
[2011/06/07 17:31:27 | 000,000,000 | ---D | C] -- C:\Program Files\HooTech Net Meter
[2011/06/07 17:30:10 | 000,000,000 | ---D | C] -- C:\Program Files\ScallywagDemo
[2011/06/07 04:59:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Application Data\xVideoServiceThief
[2011/06/07 04:58:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\xVideoServiceThief
[2011/06/07 04:58:56 | 000,000,000 | ---D | C] -- C:\Program Files\Xesc & Technology
[2011/06/06 23:50:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Application Data\SecurityHeroes
[2011/06/06 14:04:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Application Data\uTorrent
[2011/06/06 02:10:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Application Data\GrabPro
[2011/06/06 02:02:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Application Data\ProgSense
[2011/06/06 02:02:24 | 000,000,000 | ---D | C] -- C:\Downloads
[2011/06/06 02:02:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Orbit
[2011/06/06 02:02:04 | 000,000,000 | ---D | C] -- C:\Program Files\Orbitdownloader
[2011/06/06 02:02:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Application Data\Orbit
[2011/06/05 23:49:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Local Settings\Application Data\PassMark
[2011/06/05 23:48:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\temp
[2011/06/05 23:48:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\BurnInTest
[2011/06/05 23:48:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\My Documents\PassMark
[2011/06/05 23:48:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PassMark
[2011/06/05 23:48:26 | 000,000,000 | ---D | C] -- C:\Program Files\BurnInTest
[2011/06/05 15:33:07 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Dave\My Documents\LifeCam Files
[2011/06/04 23:16:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Application Data\skypePM
[2011/06/04 23:16:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Skype Extras
[2011/06/04 23:16:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dave\Application Data\Skype
[2011/06/04 22:14:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2011/06/04 22:14:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2011/06/04 22:14:00 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2011/06/04 22:13:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Skype
[2011/06/04 21:16:03 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011/06/04 21:16:03 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011/06/04 21:16:03 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011/06/04 20:04:34 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/06/04 19:35:24 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/06/21 15:12:03 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/21 14:37:36 | 000,039,291 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/06/21 14:37:28 | 000,000,878 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/21 14:37:20 | 000,002,001 | -HS- | M] () -- C:\WINDOWS\System32\mmf.sys
[2011/06/21 14:37:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/20 17:41:18 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/06/19 15:43:06 | 000,147,740 | ---- | M] () -- C:\Documents and Settings\Dave\Desktop\photo.php.htm
[2011/06/19 15:00:21 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/16 23:38:59 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/06/15 22:17:28 | 000,002,169 | ---- | M] () -- C:\Documents and Settings\Dave\Application Data\Microsoft\Internet Explorer\Quick Launch\FfH2.lnk
[2011/06/15 22:17:24 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\Dave\Application Data\Microsoft\Internet Explorer\Quick Launch\D3 demo.lnk
[2011/06/13 03:36:56 | 000,000,382 | ---- | M] () -- C:\WINDOWS\tasks\SmartDefrag.job
[2011/06/11 04:37:30 | 000,000,780 | ---- | M] () -- C:\Documents and Settings\Dave\Application Data\Microsoft\Internet Explorer\Quick Launch\GOM Player.lnk
[2011/06/09 19:07:30 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\.1
[2011/06/08 18:30:38 | 000,000,037 | ---- | M] () -- C:\WINDOWS\iltwain.ini
[2011/06/07 16:18:38 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/06/07 04:06:47 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dave\.1
[2011/06/05 15:28:50 | 000,460,824 | ---- | M] () -- C:\DC6810xp-001.raw
[2011/06/05 02:42:20 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2011/06/05 02:42:20 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
[2011/06/04 23:16:44 | 000,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011/06/04 21:05:50 | 000,130,096 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/06/04 20:57:57 | 000,441,692 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/04 20:57:57 | 000,071,462 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/06/04 20:04:34 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/05/30 15:19:48 | 005,964,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/06/19 15:43:04 | 000,147,740 | ---- | C] () -- C:\Documents and Settings\Dave\Desktop\photo.php.htm
[2011/06/15 22:17:28 | 000,002,169 | ---- | C] () -- C:\Documents and Settings\Dave\Application Data\Microsoft\Internet Explorer\Quick Launch\FfH2.lnk
[2011/06/15 22:17:24 | 000,001,620 | ---- | C] () -- C:\Documents and Settings\Dave\Application Data\Microsoft\Internet Explorer\Quick Launch\D3 demo.lnk
[2011/06/12 16:00:07 | 405,631,672 | ---- | C] () -- C:\Documents and Settings\Dave\My Documents\FallfromHeaven2.exe
[2011/06/09 19:07:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\.1
[2011/06/08 18:03:42 | 000,000,037 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2011/06/07 04:06:47 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dave\.1
[2011/06/05 02:42:20 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
[2011/06/05 02:42:20 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
[2011/06/04 23:16:44 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011/06/04 22:14:03 | 000,002,265 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/06/14 22:12:12 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat
[2010/05/25 19:20:40 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2010/05/08 17:31:23 | 000,002,459 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010/05/08 17:31:21 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010/05/08 14:06:34 | 000,704,282 | ---- | C] () -- C:\Program Files\unins000.exe
[2010/05/08 14:06:34 | 000,009,183 | ---- | C] () -- C:\Program Files\unins000.dat
[2010/04/25 21:03:38 | 000,002,001 | -HS- | C] () -- C:\WINDOWS\System32\mmf.sys
[2010/04/25 21:03:35 | 000,048,640 | ---- | C] () -- C:\WINDOWS\mmfs.dll
[2010/04/25 21:03:35 | 000,002,560 | ---- | C] () -- C:\WINDOWS\Runservice.exe
[2010/04/25 19:52:18 | 000,678,746 | ---- | C] () -- C:\WINDOWS\unins000.exe
[2010/04/25 19:52:17 | 000,000,740 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2010/03/15 19:20:15 | 000,102,006 | ---- | C] () -- C:\WINDOWS\hpoins04.dat
[2010/03/15 19:20:15 | 000,017,218 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat
[2010/03/09 15:31:17 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010/02/28 03:29:37 | 000,015,497 | ---- | C] () -- C:\WINDOWS\VX6KStd.ini
[2010/02/27 18:57:03 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2010/02/27 18:57:03 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2010/02/27 18:57:03 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2010/02/27 18:57:03 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2010/02/27 18:57:03 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2010/02/27 18:57:03 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2010/02/27 18:57:03 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2010/02/27 18:57:03 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2010/02/27 18:41:30 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2010/02/27 18:41:29 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2010/02/27 18:41:29 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2010/02/27 15:42:02 | 000,076,406 | ---- | C] () -- C:\WINDOWS\hpgins06.dat
[2010/02/27 15:42:02 | 000,000,713 | ---- | C] () -- C:\WINDOWS\hpgmdl06.dat
[2010/02/27 09:22:28 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2010/02/27 09:17:21 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\stac97co.dll
[2010/02/27 06:46:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/02/27 05:48:35 | 000,010,752 | ---- | C] () -- C:\Documents and Settings\Dave\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/27 05:11:42 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/02/27 04:54:11 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Dave\Local Settings\Application Data\fusioncache.dat
[2010/02/27 04:41:28 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/02/27 04:33:22 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/02/26 20:23:12 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/02/26 20:21:52 | 000,130,096 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/06/02 01:16:28 | 000,528,384 | ---- | C] () -- C:\WINDOWS\System32\hpgt4850.dll
[2005/03/22 15:38:24 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/03/22 15:38:24 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 04:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 04:00:00 | 000,441,692 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 04:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 04:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 04:00:00 | 000,071,462 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 04:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 04:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 04:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 04:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 04:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/03/21 15:39:02 | 000,073,728 | R--- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2002/03/21 13:51:52 | 000,503,808 | R--- | C] () -- C:\WINDOWS\System32\lt_xtrans.dll
[2002/03/21 13:51:52 | 000,286,720 | R--- | C] () -- C:\WINDOWS\System32\MrSIDD.dll
[2002/03/21 13:51:52 | 000,163,840 | R--- | C] () -- C:\WINDOWS\System32\lt_common.dll
[2002/03/21 13:51:52 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\lt_trans.dll
[2002/03/21 13:51:52 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\lt_meta.dll
[2002/03/21 13:51:52 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\lt_encrypt.dll
[2002/03/21 13:51:52 | 000,020,480 | R--- | C] () -- C:\WINDOWS\System32\lt_messagetext.dll
[2002/03/20 22:01:06 | 000,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys
[2002/03/20 22:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2002/03/20 22:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2002/03/20 22:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2002/03/20 22:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll
< End of report >
Sign In
Create Account
