This topic is locked
First off, I'd like to acknowledge how much of an awesome concept this is. I did not realize there was a site that existed that help people STEP STEP with Mal ware problems. Really cool.
Firstly,the main symptoms are :
-Whenever i click on a site in Google search, i get re-directed to an advertisement or spam. (using mozilla)
-Mozilla would frequently shutdown (close browser) and would show a "Send a report to mozilla page"
-Computer seems to be running a little slower than usual. For instance, when i play warcraft 3 on battle.net it would crash. Thus, i have to restart the computer or alt control delete.
Also, this problem occurred this week, starting Tuesday or Wednesday. I first realized this problem when my anti-virus(f-secure) gave me a prompt of Packed.Win32.PolyCyrpt.d accessing my computer. F Secure was not able to heal the infection, so it decided to quarantine instead.
This got me worried, so i did a full scan with my anti virus (shaw f-secure) and it found 3 viruses.
These are all in quarantine right now. These are
-Packed.Win32.PolyCyrpt.d
-Trojan.Win32.Agent
While the last virus is categorized as spyware and is a tracking cookie.
I did not want to delete any of them, since I'm unsure if the file could be important to my PC.
Furthermore, i did a Malwarebytes Anti-Malware scan
It found the following
-Trojan.Vundo.H
-Trojan.Vundo.H (yeah there is 2 of them)
Both are in quarantine right now. (as of from yesterday)
There are other viruses in quarantine, but those were in January.
After this, i realized the symptoms were still occurring. eg, re-directed to ads, mozilla still closes etc.
So i did some research in google, and did used "FixED" which was a removal of some Trojan. It did not really do anything.
i also did a system restore, and no changes were made...
I got frustrated, and decided to do like a 3 hour research to solving this problem and voila found this resourceful site.
The first thing i did i was followed the Malware and Spyware Cleaning guide.
-I did the ATF
-I did the SYSTEM restore point
-I saved a registry, using ERUNT
-I scan using Malwarebytes Anti-Mal ware (i already did this before) but did it again. Log will be posted below. (found nothing this time)
-i did a full scan with my anti virus using f secure, (i already did this before) but did it again.
(found nothing this time). I could post a report of this if you guys want me to.
-My windows update, were all up to date.
-Rebooted, and yet the symptoms were still showing.
-I did the ROOKIT but i think its incomplete. I ran rootkit and after an hour or so. It still stayed at the same place. So i canceled it. I can let it go longer if you guys want me to. I'll put up the logs.
-Did the Old timer list 2, i'll post up the logs.
The following LOGS"
Malawarebytes, ANTI-MALWARE (latest log)
Malwarebytes' Anti-Malware 1.33
Database version: 1705
Windows 5.1.2600 Service Pack 3
4/19/2009 2:00:51 AM
mbam-log-2009-04-19 (02-00-51).txt
Scan type: Quick Scan
Objects scanned: 69618
Time elapsed: 11 minute(s), 52 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
----------------------------------------------
The following is the ROOTKIT LOG (did not say ROOKIT! at the end :S)
Sun 04/19/2009|18:38
----------------------\\ Processes..
--Locked-- [System Process]
---------- System
---------- \SystemRoot\System32\smss.exe
---------- \??\C:\WINDOWS\system32\csrss.exe
---------- \??\C:\WINDOWS\system32\winlogon.exe
---------- C:\WINDOWS\system32\services.exe
---------- C:\WINDOWS\system32\lsass.exe
---------- C:\WINDOWS\system32\Ati2evxx.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\spoolsv.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
---------- C:\Program Files\Bonjour\mDNSResponder.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\CTsvcCDA.EXE
---------- C:\Program Files\Shaw Secure\Anti-Virus\fsgk32st.exe
---------- C:\Program Files\Shaw Secure\Common\FSMA32.EXE
---------- C:\Program Files\Shaw Secure\Anti-Virus\FSGK32.EXE
---------- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdiserv.exe
---------- C:\Program Files\Shaw Secure\Common\FSMB32.EXE
---------- C:\WINDOWS\system32\lxdicoms.exe
---------- C:\Program Files\Shaw Secure\Common\FCH32.EXE
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\Program Files\Shaw Secure\Common\FAMEH32.EXE
---------- C:\Program Files\Shaw Secure\Anti-Virus\fsqh.exe
---------- C:\Program Files\Shaw Secure\ORSP Client\fsorsp.exe
---------- C:\Program Files\Shaw Secure\Anti-Virus\fssm32.exe
---------- C:\Program Files\Shaw Secure\FSAUA\program\fsaua.exe
---------- C:\Program Files\Shaw Secure\FWES\Program\fsdfwd.exe
---------- C:\WINDOWS\System32\alg.exe
---------- C:\Program Files\Shaw Secure\FSAUA\program\fsus.exe
---------- C:\Program Files\Shaw Secure\Anti-Virus\fsav32.exe
---------- C:\Program Files\iPod\bin\iPodService.exe
---------- C:\Program Files\Windows Live\Messenger\usnsvc.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\system32\Ati2evxx.exe
---------- C:\WINDOWS\Explorer.EXE
---------- C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
---------- C:\WINDOWS\system32\rundll32.exe
---------- C:\WINDOWS\system32\Rundll32.exe
---------- C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
---------- C:\WINDOWS\VM_STI.EXE
---------- C:\Program Files\Microsoft IntelliType Pro\type32.exe
---------- C:\Program Files\Microsoft IntelliPoint\point32.exe
---------- C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
---------- C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe
---------- C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe
---------- C:\Program Files\QTTask.exe
---------- C:\Program Files\iTunes\iTunesHelper.exe
---------- C:\Program Files\Shaw Secure\Common\FSM32.EXE
---------- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
---------- C:\WINDOWS\system32\ctfmon.exe
---------- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
---------- C:\Program Files\Shaw Secure\FSGUI\fsguidll.exe
---------- C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
---------- C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
---------- C:\Program Files\Mozilla Firefox\firefox.exe
---------- C:\Documents and Settings\Lenie\My Documents\OTListIt2.exe
---------- C:\WINDOWS\system32\notepad.exe
---------- C:\WINDOWS\system32\NOTEPAD.EXE
---------- C:\WINDOWS\system32\NOTEPAD.EXE
---------- C:\WINDOWS\system32\wuauclt.exe
---------- C:\WINDOWS\system32\cmd.exe
---------- C:\Rooter$\RK.exe
----------------------\\ Search..
--------------------------------------------------------------
THESE ARE OTLIST2
OTListIt logfile created on: 4/19/2009 5:47:04 PM - Run 2
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Lenie\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1023.48 Mb Total Physical Memory | 473.80 Mb Available Physical Memory | 46.29% Memory free
2.40 Gb Paging File | 1.83 Gb Available in Paging File | 75.91% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 16.48 Gb Free Space | 22.12% Space Free | Partition Type: NTFS
Drive D: | 19.53 Gb Total Space | 1.10 Gb Free Space | 5.61% Space Free | Partition Type: NTFS
Drive E: | 70.91 Gb Total Space | 26.18 Gb Free Space | 36.91% Space Free | Partition Type: NTFS
Drive F: | 58.59 Gb Total Space | 32.50 Gb Free Space | 55.46% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: XXXXXXX(private)
Current User Name: XXXXXXXXXXX (private)
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On
========== Processes (SafeList) ==========
PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\system32\CTsvcCDA.EXE (Creative Technology Ltd)
PRC - C:\Program Files\Shaw Secure\Anti-Virus\fsgk32st.exe (F-Secure Corporation)
PRC - C:\Program Files\Shaw Secure\Common\FSMA32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Shaw Secure\Anti-Virus\FSGK32.EXE (F-Secure Corp.)
PRC - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdiserv.exe (Lexmark International, Inc.)
PRC - C:\Program Files\Shaw Secure\Common\FSMB32.EXE (F-Secure Corporation)
PRC - C:\WINDOWS\system32\lxdicoms.exe ( )
PRC - C:\Program Files\Shaw Secure\Common\FCH32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Shaw Secure\Common\FAMEH32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Shaw Secure\Anti-Virus\fsqh.exe (F-Secure Corporation)
PRC - C:\Program Files\Shaw Secure\ORSP Client\fsorsp.exe (F-Secure Corporation)
PRC - C:\Program Files\Shaw Secure\Anti-Virus\fssm32.exe (F-Secure Corp.)
PRC - C:\Program Files\Shaw Secure\FSAUA\program\fsaua.exe (F-Secure Corporation)
PRC - C:\Program Files\Shaw Secure\FWES\Program\fsdfwd.exe (F-Secure Corporation)
PRC - C:\Program Files\Shaw Secure\FSAUA\program\fsus.exe (F-Secure Corporation)
PRC - C:\Program Files\Shaw Secure\Anti-Virus\fsav32.exe (F-Secure Corporation)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\VM_STI.EXE (BIGDOG)
PRC - C:\Program Files\Microsoft IntelliType Pro\type32.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft IntelliPoint\point32.exe (Microsoft Corporation)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe ()
PRC - C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe (Lexmark)
PRC - C:\Program Files\QTTask.exe (Apple Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\Shaw Secure\Common\FSM32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (Microsoft Corporation)
PRC - C:\Program Files\Shaw Secure\FSGUI\fsguidll.exe (F-Secure Corporation)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Documents and Settings\Lenie\My Documents\OTListIt2.exe (OldTimer Tools)
========== Win32 Services (SafeList) ==========
SRV - (Adobe LM Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Running]) -- C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (ATI Smart [Auto | Stopped]) -- C:\WINDOWS\system32\ati2sgag.exe ()
SRV - (Bonjour Service [Auto | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Creative Service for CDROM Access [Auto | Running]) -- C:\WINDOWS\system32\CTsvcCDA.EXE (Creative Technology Ltd)
SRV - (F-Secure Gatekeeper Handler Starter [Auto | Running]) -- C:\Program Files\Shaw Secure\Anti-Virus\fsgk32st.exe (F-Secure Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (FSAUA [On_Demand | Running]) -- C:\Program Files\Shaw Secure\FSAUA\program\fsaua.exe (F-Secure Corporation)
SRV - (FSDFWD [On_Demand | Running]) -- C:\Program Files\Shaw Secure\FWES\Program\fsdfwd.exe (F-Secure Corporation)
SRV - (FSMA [Auto | Running]) -- C:\Program Files\Shaw Secure\Common\FSMA32.EXE (F-Secure Corporation)
SRV - (FSORSPClient [On_Demand | Running]) -- C:\Program Files\Shaw Secure\ORSP Client\fsorsp.exe (F-Secure Corporation)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (lxdiCATSCustConnectService [Auto | Running]) -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdiserv.exe (Lexmark International, Inc.)
SRV - (lxdi_device [Auto | Running]) -- C:\WINDOWS\system32\lxdicoms.exe ( )
SRV - (LxrSG20s [On_Demand | Stopped]) -- C:\WINDOWS\system32\LxrSG20s.exe ()
SRV - (MSSQL$ACCPAC53CGA [Auto | Stopped]) -- C:\Program Files\Microsoft SQL Server\MSSQL$ACCPAC53CGA\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper [On_Demand | Stopped]) -- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (SQLAgent$ACCPAC53CGA [On_Demand | Stopped]) -- C:\Program Files\Microsoft SQL Server\MSSQL$ACCPAC53CGA\Binn\sqlagent.EXE (Microsoft Corporation)
SRV - (UMWdf [On_Demand | Stopped]) -- C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation)
SRV - (usnjsvc [On_Demand | Running]) -- C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (WLSetupSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (ati2mtag [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ctljystk [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ctljystk.sys (Creative Technology Ltd.)
DRV - (ctsfm2k [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys (Creative Technology Ltd)
DRV - (DM9102 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\DM9PCI5.SYS (CNet Technology, Inc. )
DRV - (emu10k [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (emu10k1 [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (F-Secure Filter [Disabled | Stopped]) -- C:\Program Files\Shaw Secure\Anti-Virus\Win2K\FSfilter.sys ()
DRV - (F-Secure Gatekeeper [On_Demand | Running]) -- C:\Program Files\Shaw Secure\Anti-Virus\minifilter\fsgk.sys ()
DRV - (F-Secure HIPS [System | Running]) -- C:\Program Files\Shaw Secure\HIPS\drivers\fshs.sys (F-Secure Corporation)
DRV - (F-Secure Recognizer [Disabled | Stopped]) -- C:\Program Files\Shaw Secure\Anti-Virus\Win2K\FSrec.sys ()
DRV - (fsbts [Boot | Running]) -- C:\WINDOWS\system32\Drivers\fsbts.sys ()
DRV - (FSFW [Boot | Running]) -- C:\WINDOWS\System32\drivers\fsdfw.sys (F-Secure Corporation)
DRV - (FTDIBUS [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (gameenum [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (LxrSG20d [On_Demand | Stopped]) -- C:\WINDOWS\system32\Drivers\LxrSG20d.sys ()
DRV - (ossrv [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ctoss2k.sys (Creative Technology Ltd.)
DRV - (P17 [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\P17.sys (Creative Technology Ltd.)
DRV - (p17filt [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\p17filt.sys (Sensaura)
DRV - (Point32 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\point32.sys (Microsoft Corporation)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (s616bus [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\s616bus.sys (MCCI Corporation)
DRV - (s616mdfl [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\s616mdfl.sys (MCCI Corporation)
DRV - (s616mdm [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\s616mdm.sys (MCCI Corporation)
DRV - (s616mgmt [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\s616mgmt.sys (MCCI Corporation)
DRV - (s616obex [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\s616obex.sys (MCCI Corporation)
DRV - (s616unic [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\s616unic.sys (MCCI Corporation)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (sfman [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (SMCWPCIT [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\SMCWPCIT.sys (SMC Networks, Inc.)
DRV - (sonypvs1 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sonypvs1.sys (Sony Corporation)
DRV - (SONYPVU1 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (sptd [Boot | Running]) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (tmcomm [Auto | Running]) -- C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (USBAAPL [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbaudio [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (vaxscsi [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\vaxscsi.sys ()
DRV - (ZSMC302 [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usbVM31b.sys (VM)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.c...rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com/?p=us
IE - URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://www.timeandda...om/worldclock/"
FF - prefs.js..extensions.enabledItems: {33E804CE-C0C7-446F-9AEA-AE992A2A68D7}:1.0
FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/10 03:12:13 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/08 17:39:54 | 00,000,000 | ---D | M]
[2008/07/09 00:23:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Lenie\Application Data\mozilla\Extensions
[2008/07/09 00:23:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Lenie\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/04/18 23:09:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Lenie\Application Data\mozilla\Firefox\Profiles\x4sf8vps.default\extensions
[2007/05/06 13:43:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Lenie\Application Data\mozilla\Firefox\Profiles\x4sf8vps.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2007/08/13 22:10:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Lenie\Application Data\mozilla\Firefox\Profiles\x4sf8vps.default\extensions\{c17127b0-af04-11db-abbd-0800200c9a66}(2)
[2008/07/09 01:22:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Lenie\Application Data\mozilla\Firefox\Profiles\x4sf8vps.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2007/08/14 22:48:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Lenie\Application Data\mozilla\Firefox\Profiles\x4sf8vps.default\extensions\[email protected]
[2009/04/19 13:50:11 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/04/15 22:18:33 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{33E804CE-C0C7-446F-9AEA-AE992A2A68D7}
[2009/04/08 17:39:54 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/04/08 17:39:33 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/08 17:39:33 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/04/08 17:39:44 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/04/08 17:39:44 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/04/08 17:39:44 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/04/08 17:39:44 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/04/08 17:39:44 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/04/08 17:39:44 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/04/08 17:39:44 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml
O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - Reg Error: Key error. File not found
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay (ATI Technologies Inc.)
O4 - HKLM..\Run: [BigDogPath] "C:\WINDOWS\VM_STI.EXE" VIMICRO USB PC Camera (BIGDOG)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent (Microsoft Corporation)
O4 - HKLM..\Run: [CTSysVol] "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" /r (Creative Technology Ltd)
O4 - HKLM..\Run: [FaxCenterServer] "C:\Program Files\\Lexmark Fax Solutions\fm3032.exe" /s ()
O4 - HKLM..\Run: [F-Secure Manager] "C:\Program Files\Shaw Secure\Common\FSM32.EXE" /splash (F-Secure Corporation)
O4 - HKLM..\Run: [F-Secure TNB] "C:\Program Files\Shaw Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW (F-Secure Corporation)
O4 - HKLM..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe" (Lexmark)
O4 - HKLM..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe" ()
O4 - HKLM..\Run: [P17Helper] Rundll32 P17.dll,P17Helper ()
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe" (Microsoft Corporation)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE (Creative Technology Ltd.)
O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe File not found
O4 - HKCU..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm (Microsoft Corporation)
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.liv...m/quickadd.aspx File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [Bluetooth Namespace] - C:\WINDOWS\system32\wshbth.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Program Files\Shaw Secure\FSPS\program\fslsp.dll (F-Secure Corporation)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} file:///H:/setup/RiffLick.cab (WaveTab Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zon...kr.cab56986.cab (Checkers Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.ma...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zon...1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} http://atv.disney.go...y/OTOYAX29b.cab (Groove Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} http://messenger.zon...nt.cab31267.cab (MessengerStatsClient Class)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zon...ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zon...nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
========== Files/Folders - Created Within 30 Days ==========
[4 C:\WINDOWS\*.tmp files]
[2009/04/19 03:32:10 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Lenie\My Documents\OTListIt2.exe
[2009/04/19 02:52:33 | 00,000,000 | ---D | C] -- C:\Rooter$
[2009/04/19 02:51:07 | 00,267,612 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\Rooter.exe
[2009/04/19 01:39:40 | 00,000,611 | ---- | C] () -- C:\Documents and Settings\Lenie\Desktop\NTREGOPT.lnk
[2009/04/19 01:39:40 | 00,000,592 | ---- | C] () -- C:\Documents and Settings\Lenie\Desktop\ERUNT.lnk
[2009/04/19 01:39:39 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/04/19 01:39:12 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Lenie\My Documents\erunt_setup.exe
[2009/04/19 01:38:03 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\Lenie\My Documents\SysRestorePoint.exe
[2009/04/19 00:34:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Lenie\My Documents\KILLLALLHACKERS
[2009/04/19 00:05:27 | 00,000,000 | ---D | C] -- C:\ERDNT
[2009/04/19 00:05:23 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2009/04/17 23:46:58 | 00,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/04/17 23:43:02 | 24,921,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/04/16 22:19:43 | 00,284,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pdh.dll
[2009/04/16 22:19:42 | 00,401,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rpcss.dll
[2009/04/16 22:19:42 | 00,110,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\services.exe
[2009/04/16 22:19:41 | 00,473,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fastprox.dll
[2009/04/16 22:19:41 | 00,227,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvse.exe
[2009/04/16 22:19:40 | 00,729,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lsasrv.dll
[2009/04/16 22:19:40 | 00,453,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvsd.dll
[2009/04/16 22:19:39 | 00,714,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntdll.dll
[2009/04/16 22:19:39 | 00,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\advapi32.dll
[2009/04/16 21:28:27 | 00,000,508 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\The_Dating_Solution_109.pdf.torrent
[2009/04/16 18:05:34 | 00,000,328 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\Captain Jack - Mystery Method eClass Lesson 5.doc.torrent
[2009/04/16 17:35:33 | 00,000,432 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\MM daygame notes.doc.torrent
[2009/04/16 16:36:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Lenie\Application Data\mIRC
[2009/04/15 22:23:45 | 00,041,984 | ---- | C] (MainConcept AG) -- C:\WINDOWS\Ggatuyirogo.dll
[2009/04/15 22:19:35 | 00,000,043 | ---- | C] () -- C:\WINDOWS\System32\ovfsthfrunhygcrogmqngqvpnavbosmcopaldk.dat
[2009/04/15 22:18:32 | 00,018,944 | ---- | C] () -- C:\WINDOWS\System32\ovfsthtjlkkxhwrdepeixswwaplqyokedevnps.dll
[2009/04/15 22:18:32 | 00,018,432 | ---- | C] () -- C:\WINDOWS\System32\ovfsthycdcggiguqtjdxsvanvcxtwekxcnncmp.dll
[2009/04/15 22:18:31 | 00,002,176 | ---- | C] () -- C:\WINDOWS\System32\ovfsthmquhwvgrbaghbjvmpsejmojcuuahohbq.dat
[2009/04/15 22:18:27 | 00,060,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ovfsthbdapxlpnewumytxrpnpdouglitqwovod.dll
[2009/04/14 21:35:29 | 00,028,112 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\Psycho Cybernetics.torrent
[2009/04/14 21:29:00 | 00,032,131 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\Psycho_Cybernetics_by_Maxwell_Maltz_M_D_-(Demonoid.com).torrent
[2009/04/13 22:35:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Lenie\My Documents\AtRt_AtGtWt
[2009/04/13 16:38:52 | 00,047,104 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\Wake u.doc
[2009/04/13 15:22:22 | 00,016,122 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\The_Essence_of_Bodyweight_Training-((Demonoid.com)).torrent
[2009/04/11 22:35:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Lenie\My Documents\Building the Gymnastic Body
[2009/04/11 22:33:40 | 00,004,192 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\Building_the_Gymnastic_Body_by_Coach_Christopher_Sommer-(Demonoid.com).torrent
[2009/04/11 01:06:43 | 00,147,548 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\(new Repick)Footmen Frenzy v5.4 - AR!.w3x
[2009/04/11 00:03:11 | 00,000,781 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Warcraft III - The Frozen Throne.lnk
[2009/04/10 23:57:12 | 00,000,736 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Warcraft III.lnk
[2009/04/10 23:57:12 | 00,000,000 | ---D | C] -- C:\Program Files\Warcraft III
[2009/04/02 02:50:13 | 00,114,176 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\DVD 11.doc
[2009/03/31 23:46:26 | 00,043,520 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\Being a man.doc
[2009/03/30 14:43:48 | 00,051,712 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\DVD 1.doc
[2009/03/28 01:08:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Lenie\My Documents\Bonus
[2009/03/28 00:59:34 | 75,593,752 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\Chapter01.rar.part
[2009/03/27 18:29:44 | 00,050,688 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\framecontrol.doc
[2009/03/24 22:26:02 | 03,281,874 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\FLOSSED-OUT.mp3
[2009/03/24 20:25:49 | 02,890,244 | ---- | C] () -- C:\Documents and Settings\Lenie\My Documents\mrright.mp3
[2009/03/21 09:06:58 | 00,989,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kernel32.dll
[2009/01/30 16:58:17 | 00,033,408 | ---- | C] () -- C:\WINDOWS\System32\drivers\fsbts.sys
[2009/01/15 22:23:44 | 00,087,552 | -HS- | C] () -- C:\WINDOWS\System32\sovagejo.dll
[2008/02/03 18:34:11 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdivs.dll
[2008/02/03 18:34:08 | 00,344,064 | ---- | C] () -- C:\WINDOWS\System32\lxdicoin.dll
[2008/02/03 18:33:10 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdicaps.dll
[2008/02/03 18:33:09 | 00,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdidrs.dll
[2008/02/03 18:33:09 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdicnv4.dll
[2008/02/03 18:32:14 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL
[2008/02/03 18:32:14 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL
[2008/02/03 18:31:54 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll
[2008/02/03 18:31:54 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL
[2008/02/03 18:22:23 | 00,000,060 | -H-- | C] () -- C:\WINDOWS\System32\lxdirwrd.ini
[2008/02/03 18:21:50 | 00,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiinpa.dll
[2008/02/03 18:21:50 | 00,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiiesc.dll
[2008/02/03 18:21:50 | 00,311,296 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdihcp.dll
[2008/02/03 18:21:50 | 00,294,912 | ---- | C] () -- C:\WINDOWS\System32\lxdiinst.dll
[2008/02/03 18:21:49 | 01,187,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiserv.dll
[2008/02/03 18:21:49 | 00,942,080 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiusb1.dll
[2008/02/03 18:21:49 | 00,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiprox.dll
[2008/02/03 18:21:48 | 00,614,400 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdipmui.dll
[2008/02/03 18:21:48 | 00,532,480 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdilmpm.dll
[2008/02/03 18:21:48 | 00,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdipplc.dll
[2008/02/03 18:21:47 | 00,671,744 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdihbn3.dll
[2008/02/03 18:21:46 | 00,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdigrd.dll
[2008/02/03 18:21:45 | 00,360,448 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdicomm.dll
[2008/02/03 18:21:44 | 00,765,952 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdicomc.dll
[2008/01/17 22:55:36 | 00,000,000 | ---- | C] () -- C:\WINDOWS\LxrConfig.INI
[2008/01/17 22:32:10 | 00,000,000 | ---- | C] () -- C:\WINDOWS\JDSecure20.INI
[2008/01/17 22:32:04 | 00,274,432 | ---- | C] () -- C:\WINDOWS\System32\LxrSG20.dll
[2008/01/17 22:32:04 | 00,068,672 | ---- | C] () -- C:\WINDOWS\System32\drivers\LxrSG20d.sys
[2007/07/17 18:43:38 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Game.INI
[2007/06/04 21:43:02 | 00,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2007/06/04 21:43:01 | 00,471,552 | ---- | C] () -- C:\WINDOWS\System32\Smab.dll
[2006/12/30 00:52:52 | 00,000,019 | ---- | C] () -- C:\WINDOWS\rrver.ini
[2006/12/06 22:52:18 | 00,013,312 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2006/10/25 16:30:30 | 00,223,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\vaxscsi.sys
[2006/10/25 16:27:38 | 00,611,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2006/09/23 10:28:17 | 00,000,015 | ---- | C] () -- C:\WINDOWS\DBLOAD.INI
[2006/09/20 23:55:27 | 00,017,920 | ---- | C] () -- C:\WINDOWS\System32\Implode.dll
[2006/09/20 23:55:25 | 00,299,008 | ---- | C] () -- C:\WINDOWS\System32\Crutl14.dll
[2006/09/20 23:55:24 | 00,100,352 | ---- | C] () -- C:\WINDOWS\System32\pg32conv.dll
[2006/07/22 00:51:11 | 00,421,888 | ---- | C] () -- C:\WINDOWS\System32\OpenQuicktimeLib.dll
[2006/07/22 00:51:11 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/07/22 00:51:11 | 00,157,696 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2006/07/22 00:51:10 | 00,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/07/22 00:51:09 | 00,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2006/06/16 23:36:46 | 00,000,000 | ---- | C] () -- C:\WINDOWS\VM.INI
[2006/06/05 14:45:49 | 00,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS7K.DLL
[2006/06/02 21:40:07 | 00,024,576 | ---- | C] () -- C:\WINDOWS\RunSetup.dll
[2006/05/29 17:42:59 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\RunSetup.dll
[2006/05/28 13:30:17 | 00,081,408 | ---- | C] () -- C:\WINDOWS\System32\P17.dll
[2006/05/20 07:07:02 | 00,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll
[2006/05/11 22:30:35 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2006/05/11 22:30:35 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2006/05/11 22:30:35 | 00,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2006/05/11 22:30:34 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2006/05/11 22:30:34 | 00,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2006/04/25 18:15:55 | 00,000,408 | ---- | C] () -- C:\WINDOWS\MP3trt.ini
[2006/04/25 02:53:20 | 00,000,157 | ---- | C] () -- C:\WINDOWS\DMmvHost.ini
[2006/04/25 02:28:19 | 00,000,123 | ---- | C] () -- C:\WINDOWS\multiview.ini
[2006/04/15 06:13:45 | 00,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2006/03/28 20:13:15 | 00,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2006/03/28 20:13:15 | 00,262,144 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2006/03/28 20:13:15 | 00,112,640 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2006/03/28 20:13:14 | 02,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2006/02/01 03:13:33 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2005/12/26 04:24:45 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005/12/25 19:38:33 | 00,000,528 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/07/07 04:26:56 | 00,005,781 | ---- | C] () -- C:\WINDOWS\System32\Ludap17.ini
[2005/03/08 01:17:08 | 00,000,039 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2004/08/04 07:00:00 | 00,096,256 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptddrv1.sys
[2004/08/04 07:00:00 | 00,000,956 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/04 07:00:00 | 00,000,253 | ---- | C] () -- C:\WINDOWS\system.ini
[2003/10/02 18:48:18 | 00,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll
[2003/01/06 21:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/19 21:11:10 | 00,000,092 | ---- | C] () -- C:\WINDOWS\System32\ftdiun2k.ini
[2002/04/11 01:41:06 | 00,065,536 | R--- | C] ( ) -- C:\WINDOWS\System32\A3d.dll
========== Files - Modified Within 30 Days ==========
[2 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/04/19 17:38:01 | 00,000,256 | ---- | M] () -- C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
[2009/04/19 17:13:06 | 00,114,176 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\DVD 11.doc
[2009/04/19 16:44:03 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/04/19 13:45:48 | 00,614,610 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/04/19 13:45:48 | 00,504,208 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/04/19 13:45:48 | 00,097,736 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/04/19 13:40:50 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/04/19 13:35:28 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/04/19 03:32:10 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Lenie\My Documents\OTListIt2.exe
[2009/04/19 02:51:08 | 00,267,612 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\Rooter.exe
[2009/04/19 01:39:40 | 00,000,611 | ---- | M] () -- C:\Documents and Settings\Lenie\Desktop\NTREGOPT.lnk
[2009/04/19 01:39:40 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\Lenie\Desktop\ERUNT.lnk
[2009/04/19 01:39:13 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Lenie\My Documents\erunt_setup.exe
[2009/04/19 01:38:03 | 00,021,504 | ---- | M] (Doug Knox) -- C:\Documents and Settings\Lenie\My Documents\SysRestorePoint.exe
[2009/04/19 01:01:14 | 04,240,744 | -H-- | M] () -- C:\Documents and Settings\Lenie\Local Settings\Application Data\IconCache.db
[2009/04/19 00:08:34 | 00,000,589 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\My Sharing Folders.lnk
[2009/04/17 23:46:58 | 00,000,118 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI
[2009/04/17 18:43:32 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/04/16 23:44:49 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/04/16 23:41:07 | 00,000,956 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/04/16 21:28:28 | 00,000,508 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\The_Dating_Solution_109.pdf.torrent
[2009/04/16 18:05:34 | 00,000,328 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\Captain Jack - Mystery Method eClass Lesson 5.doc.torrent
[2009/04/16 17:35:33 | 00,000,432 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\MM daygame notes.doc.torrent
[2009/04/15 22:33:50 | 00,002,176 | ---- | M] () -- C:\WINDOWS\System32\ovfsthmquhwvgrbaghbjvmpsejmojcuuahohbq.dat
[2009/04/15 22:32:20 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\satuneno
[2009/04/15 22:23:45 | 00,087,552 | -HS- | M] () -- C:\WINDOWS\System32\sovagejo.dll
[2009/04/15 22:23:45 | 00,041,984 | ---- | M] (MainConcept AG) -- C:\WINDOWS\Ggatuyirogo.dll
[2009/04/15 22:23:44 | 00,041,984 | -HS- | M] (MainConcept AG) -- C:\WINDOWS\System32\minimogo.exe
[2009/04/15 22:19:35 | 00,000,043 | ---- | M] () -- C:\WINDOWS\System32\ovfsthfrunhygcrogmqngqvpnavbosmcopaldk.dat
[2009/04/15 22:18:32 | 00,018,944 | ---- | M] () -- C:\WINDOWS\System32\ovfsthtjlkkxhwrdepeixswwaplqyokedevnps.dll
[2009/04/15 22:18:32 | 00,018,432 | ---- | M] () -- C:\WINDOWS\System32\ovfsthycdcggiguqtjdxsvanvcxtwekxcnncmp.dll
[2009/04/15 22:18:27 | 00,060,928 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ovfsthbdapxlpnewumytxrpnpdouglitqwovod.dll
[2009/04/15 18:44:53 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/04/14 21:35:29 | 00,028,112 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\Psycho Cybernetics.torrent
[2009/04/14 21:29:00 | 00,032,131 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\Psycho_Cybernetics_by_Maxwell_Maltz_M_D_-(Demonoid.com).torrent
[2009/04/13 16:39:02 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/04/13 16:38:52 | 00,047,104 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\Wake u.doc
[2009/04/13 15:22:22 | 00,016,122 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\The_Essence_of_Bodyweight_Training-((Demonoid.com)).torrent
[2009/04/11 22:33:42 | 00,004,192 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\Building_the_Gymnastic_Body_by_Coach_Christopher_Sommer-(Demonoid.com).torrent
[2009/04/11 20:15:41 | 10,732,99456 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2009/04/11 01:06:43 | 00,147,548 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\(new Repick)Footmen Frenzy v5.4 - AR!.w3x
[2009/04/11 00:05:48 | 00,000,781 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Warcraft III - The Frozen Throne.lnk
[2009/04/10 23:59:05 | 00,000,736 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Warcraft III.lnk
[2009/04/06 16:43:39 | 03,281,874 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\FLOSSED-OUT.mp3
[2009/04/06 07:57:26 | 24,921,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/03/31 23:52:01 | 00,043,520 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\Being a man.doc
[2009/03/30 14:43:49 | 00,051,712 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\DVD 1.doc
[2009/03/28 01:09:10 | 75,593,752 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\Chapter01.rar.part
[2009/03/27 18:29:44 | 00,050,688 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\framecontrol.doc
[2009/03/24 20:28:31 | 05,376,238 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\Save A Prayer - Duran Duran .mp3
[2009/03/24 20:28:22 | 02,890,244 | ---- | M] () -- C:\Documents and Settings\Lenie\My Documents\mrright.mp3
[2009/03/21 09:06:58 | 00,989,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\kernel32.dll
[2009/03/21 09:06:58 | 00,989,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kernel32.dll
[2009/03/21 09:06:58 | 00,001,323 | ---- | M] () -- C:\WINDOWS\System32\sqlsodbc.chm
[2009/03/21 01:09:30 | 00,154,624 | ---- | M] () -- C:\Documents and Settings\Lenie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
========== Alternate Data Streams ==========
@Alternate Data Stream - 965 bytes -> C:\Found.009:UVeOaKOHW0wisJiofHOhBAQNz
< End of report >
THESE ARE THE EXTRA REPORT WITH OTLIST2
OTListIt Extras logfile created on: 4/19/2009 3:46:29 AM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Lenie\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1023.48 Mb Total Physical Memory | 484.07 Mb Available Physical Memory | 47.30% Memory free
2.40 Gb Paging File | 1.82 Gb Available in Paging File | 75.74% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 16.29 Gb Free Space | 21.86% Space Free | Partition Type: NTFS
Drive D: | 19.53 Gb Total Space | 1.10 Gb Free Space | 5.61% Space Free | Partition Type: NTFS
Drive E: | 70.91 Gb Total Space | 26.18 Gb Free Space | 36.91% Space Free | Partition Type: NTFS
Drive F: | 58.59 Gb Total Space | 32.50 Gb Free Space | 55.46% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: JDRCHAN-DEED659
Current User Name: Lenie
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"2300:UDP" = 2300:UDP:*:Enabled:AOE3
"2400:UDP" = 2400:UDP:*:Enabled:AOE3
"28800:TCP" = 28800:TCP:*:Enabled:aoe3tcp
"28805:TCP" = 28805:TCP:*:Enabled:aoe3tcp
"6112:TCP" = 6112:TCP:*:Enabled:WC3
"4000:TCP" = 4000:TCP:*:Enabled:wchost
"6113:TCP" = 6113:TCP:*:Enabled:TCKH
"6119:TCP" = 6119:TCP:*:Enabled:TKCn
"32459:TCP" = 32459:TCP:*:Enabled:utorrentc
"32459:UDP" = 32459:UDP:*:Enabled:utorrentupd
"6879:TCP" = 6879:TCP:*:Enabled:ut
"6879:UDP" = 6879:UDP:*:Enabled:utt
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"18857:TCP" = 18857:TCP:*:Disabled:SolidNetworkManager
"18857:UDP" = 18857:UDP:*:Disabled:SolidNetworkManager
"50254:TCP" = 50254:TCP:*:Disabled:SolidNetworkManager
"50254:UDP" = 50254:UDP:*:Disabled:SolidNetworkManager
"6081:TCP" = 6081:TCP:*:Enabled:RPC
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\Lexmark 3500-4500 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio ()
C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger (Microsoft Corporation)
C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\WINDOWS\system32\java.exe:*:Enabled:Java™ 2 Platform Standard Edition binary (Sun Microsystems, Inc.)
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger File not found
C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server File not found
C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test (Microsoft Corporation)
C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox (Mozilla Corporation)
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\ijji\ENGLISH\u_sf\soldierfront.exe:*:Enabled:soldierfront File not found
C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent (BitTorrent, Inc.)
C:\WINDOWS\system32\lxdicoms.exe:*:Enabled:Lexmark Communications System ( )
C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe:*:Enabled:Lexmark Device Monitor (Lexmark)
C:\Program Files\Lexmark 3500-4500 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio ()
C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:*:Enabled:ABBYY FineReader (ABBYY (BIT Software))
C:\Program Files\Lexmark Fax Solutions\FaxCtr.exe:*:Enabled:Fax software ()
C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe:*:Enabled:Device Monitor ()
C:\WINDOWS\system32\lxdicfg.exe:*:Enabled:Printer Communication System ( )
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdipswx.exe:*:Enabled:Printer Status Window Interface ()
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxditime.exe:*:Enabled:Lexmark Connect Time Executable (Lexmark International, Inc.)
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdijswx.exe:*:Enabled:Job Status Window Interface ()
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdiwbgw.exe:*:Enabled:Lexmark Web Gateway ()
C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger (Microsoft Corporation)
C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger (Microsoft Corporation)
C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) (Microsoft Corporation)
C:\WINDOWS\Downloaded Program Files\PurpleBean.exe:*:Enabled:PurpleBean.exe ()
C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour (Apple Inc.)
C:\Program Files\Garena\Garena.exe:*:Enabled:Garena (Garena Interactive PTE LTD)
C:\Program Files\Lexmark 3500-4500 Series\Wireless\lxdiwpss.exe:*:Enabled: (Lexmark International, Inc.)
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{11B8C79D-B6EB-4A52-B8B6-8391B810AC55}" = Sage Accpac ERP CGA Educational Version 5.3A
"{1B1DDAD2-C704-49F8-8FC2-18DAAD9A87C5}" = Sound Blaster Audigy
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E1A8C8-6646-4101-B0AA-42D1EB2AB3AE}" = Windows Live Outlook Toolbar (Windows Live Toolbar)
"{3CDC3396-0169-41FC-B7E8-C7AE080DB3E8}" = Jamorama Software
"{3D047C15-C859-45F7-81CE-F2681778069B}" = iPod for Windows 2006-01-10
"{41E496B5-47F4-11D6-9BBB-00E0987BB2CD}" = Vimicro USB PC Camera
"{47813E93-F2A0-484A-838E-47EC1B28D190}" = Adobe Stock Photos 1.0
"{508CE775-4BA4-4748-82DF-FE28DA9F03B0}" = Windows Live Messenger
"{53B2CFE9-A508-4457-B2CA-5D253536BFB7}" = OneCare Advisor (Windows Live Toolbar)
"{548B3DC6-2300-47E1-BA7B-74AD25F8DEBF}" = Form Fill (Windows Live Toolbar)
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{66A7A386-6F35-41A7-A731-101F0C0153C8}" = Popup Blocker (Windows Live Toolbar)
"{68108E66-D13A-4EE8-A6F4-40E4B90C2A26}" = Windows Live Toolbar Feed Detector (Windows Live Toolbar)
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7745B7A9-F323-4BB9-9811-01BF57A028DA}" = Map Button (Windows Live Toolbar)
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites for Windows Live Toolbar
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{81463B08-A929-4125-A5F4-1B053AC35A09}" = Microsoft IntelliType Pro 5.0
"{83073C45-3003-4671-9A86-243AAADD915A}" = Microsoft Calculator Plus
"{89C89156-A70F-4C6D-9CAE-2EA71F1396FE}" = Garena
"{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour
"{8AB8D458-939E-403F-0097-9BA1C1F013D5}" = The Sims 2
"{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{8FD3F4BA-A4A6-4380-00A6-CC6853AB2DC2}" = The Sims 2 University
"{8FFC924C-ED06-44CB-8867-3CA778ECE903}" = Adobe Help Center 2.0
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}" = Apple Mobile Device Support
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{AC76BA86-7AD7-5464-3428-7050000000A7}" = Adobe Reader 7.0.5 Language Support
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
"{BC467935-A9A5-4D0F-BD89-94F36CDF0524}" = Adobe Stock Photos 1.0
"{BD57EA4D-026E-4F08-9B93-080E282B81FE}" = iPod for Windows 2006-06-28
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF6E7481-4487-46D3-810A-F73EEA232CE0}" = Microsoft IntelliPoint 5.0
"{D5A145FC-D00C-4F1A-9119-EB4D9D659750}" = Windows Live Toolbar
"{D84E40A2-380A-46E9-A750-6F55D398D973}" = ATI Catalyst Control Center
"{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}" = iTunes
"{E09B48B5-E141-427A-AB0C-D3605127224A}" = Microsoft SQL Server Desktop Engine (ACCPAC53CGA)
"{F084395C-40FB-4DB3-981C-B51E74E1E83D}" = Smart Menus (Windows Live Toolbar)
"3DGroove" = OTOY
"AbiWord2" = AbiWord 2.6.4
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"Audacity_is1" = Audacity 1.2.6
"Collab" = Collab
"Device Control" = Device Control
"EAX" = Creative EAX Console
"ERUNT_is1" = ERUNT 1.1j
"foobar2000" = foobar2000 v0.9.4.3
"F-Secure Product 444" = Shaw Secure
"FTDICOMM" = SEMC DSS-20 SyncStation Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{3D047C15-C859-45F7-81CE-F2681778069B}" = iPod for Windows 2006-01-10
"InstallShield_{BD57EA4D-026E-4F08-9B93-080E282B81FE}" = iPod for Windows 2006-06-28
"InstallShield_{C21D5524-A970-42FA-AC8A-59B8C7CDCA31}" = QuickTime
"KLiteCodecPack_is1" = K-Lite Codec Pack 2.88 Full
"Lexmark 3500-4500 Series" = Lexmark 3500-4500 Series
"Lexmark Fax Solutions" = Lexmark Fax Solutions
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.8)" = Mozilla Firefox (3.0.8)
"MSN Music Assistant" = MSN Music Assistant
"MSNINST" = MSN
"Nero - Burning Rom!UninstallKey" = Nero 6 Enterprise Edition
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"SPEAKER" = Creative Speaker Settings
"TreeSize Professional_is1" = TreeSize Professional 4.1.1
"VLC media player" = VideoLAN VLC media player 0.8.6c
"Warcraft III" = Warcraft III
"Windows Live Toolbar" = Windows Live Toolbar
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"Yahoo! Internet Mail" = Yahoo! Internet Mail
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ijji FireFox Launcher" = ijji FireFox Launcher 1.0
"ijji.com" = ijji
"uTorrent" = µTorrent
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 4/18/2009 5:53:57 AM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure Anti-Virus | ID = 103
Description = 8 2009-04-18 04:53:56-05:00 jdrchan-deed659 JDRCHAN-DEED659\Lenie
F-Secure Anti-Virus Malicious code found in file C:\System Volume Information\_restore{B2B3AA35-414B-4865-AE1E-63596EDAA85D}\RP83\A0033668.exe.
Infection: Packed.Win32.PolyCrypt.d
Error - 4/18/2009 7:50:06 PM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure Anti-Virus | ID = 103
Description = 1 2009-04-18 18:50:05-05:00 jdrchan-deed659 JDRCHAN-DEED659\Lenie
F-Secure Anti-Virus Scanning of \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SHAW SECURE\FSAUA\SUBSCRIPTIONS\AVH_AVPE
was aborted due to exceeded scanning time limit. The file may be in use or reading
it was too slow (e.g. network connection was under stress).
Error - 4/18/2009 8:02:40 PM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure Anti-Virus | ID = 103
Description = 2 2009-04-18 19:02:39-05:00 jdrchan-deed659 JDRCHAN-DEED659\Lenie
F-Secure Anti-Virus Scanning of \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SHAW SECURE\FSAUA\SUBSCRIPTIONS\AVH_AVPE
was aborted due to exceeded scanning time limit. The file may be in use or reading
it was too slow (e.g. network connection was under stress).
Error - 4/18/2009 8:30:20 PM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure Anti-Virus | ID = 103
Description = 3 2009-04-18 19:30:19-05:00 jdrchan-deed659 JDRCHAN-DEED659\Lenie
F-Secure Anti-Virus Malicious code found in file C:\System Volume Information\_restore{B2B3AA35-414B-4865-AE1E-63596EDAA85D}\RP83\A0033668.exe.
Infection: Packed.Win32.PolyCrypt.d
Error - 4/18/2009 11:55:06 PM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure Anti-Virus | ID = 103
Description = 1 2009-04-18 22:53:56-05:00 jdrchan-deed659 SYSTEM F-Secure Anti-Virus
Malicious code found in file C:\System Volume Information\_restore{B2B3AA35-414B-4865-AE1E-63596EDAA85D}\RP83\A0033668.exe.
Infection: Packed.Win32.PolyCrypt.d Action: failed.
Error - 4/19/2009 12:59:04 AM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure Anti-Virus | ID = 103
Description = 2 2009-04-18 23:59:04-05:00 jdrchan-deed659 JDRCHAN-DEED659\Lenie
F-Secure Anti-Virus Scanning of \DEVICE\HARDDISKVOLUME1\RECYCLER\S-1-5-21-746137067-287218729-839522115-1004\INFO2
was aborted due to exceeded scanning time limit. The file may be in use or reading
it was too slow (e.g. network connection was under stress).
Error - 4/19/2009 3:35:04 AM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure Anti-Virus | ID = 103
Description = 1 2009-04-19 02:35:03-05:00 jdrchan-deed659 JDRCHAN-DEED659\Lenie
F-Secure Anti-Virus Scanning of \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\SHAW SECURE\FSAUA\SUBSCRIPTIONS\AVH_AVPE
was aborted due to exceeded scanning time limit. The file may be in use or reading
it was too slow (e.g. network connection was under stress).
Error - 4/19/2009 3:43:17 AM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure Anti-Virus | ID = 103
Description = 2 2009-04-19 02:43:17-05:00 jdrchan-deed659 JDRCHAN-DEED659\Lenie
F-Secure Anti-Virus Crash detected.
Error - 4/19/2009 3:51:41 AM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure System Control | ID = 103
Description = 3 2009-04-19 02:51:41-05:00 jdrchan-deed659 JDRCHAN-DEED659\Lenie
F-Secure System Control Application was blocked. This was determined to be a high-risk
application by system control heuristics. Application path: \\?\C:\Documents and
Settings\Lenie\My Documents\Rooter.exe File hash: 0f3cc7905d490476445a4db11df9da76021538af
Error - 4/19/2009 4:33:14 AM | Computer Name = JDRCHAN-DEED659 | Source = F-Secure Anti-Virus | ID = 103
Description = 4 2009-04-19 03:33:14-05:00 jdrchan-deed659 JDRCHAN-DEED659\Lenie
F-Secure Anti-Virus Scanning of \DEVICE\HARDDISKVOLUME1\DOCUMENTS AND SETTINGS\LENIE\MY
DOCUMENTS\OTLISTIT2(2).EXE was aborted due to exceeded scanning time limit. The
file may be in use or reading it was too slow (e.g. network connection was under
stress).
[ System Events ]
Error - 4/19/2009 1:45:34 AM | Computer Name = JDRCHAN-DEED659 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error - 4/19/2009 1:45:38 AM | Computer Name = JDRCHAN-DEED659 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error - 4/19/2009 2:01:15 AM | Computer Name = JDRCHAN-DEED659 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
Error - 4/19/2009 2:02:31 AM | Computer Name = JDRCHAN-DEED659 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
TPkd
Error - 4/19/2009 2:02:51 AM | Computer Name = JDRCHAN-DEED659 | Source = ati2mtag | ID = 45062
Description = CRT invalid display type
Error - 4/19/2009 2:04:51 AM | Computer Name = JDRCHAN-DEED659 | Source = ati2mtag | ID = 45062
Description = CRT invalid display type
Error - 4/19/2009 3:28:29 AM | Computer Name = JDRCHAN-DEED659 | Source = PlugPlayManager | ID = 11
Description = The device Root\LEGACY_FSBL\0000 disappeared from the system without
first being prepared for removal.
Error - 4/19/2009 4:36:22 AM | Computer Name = JDRCHAN-DEED659 | Source = ati2mtag | ID = 45062
Description = CRT invalid display type
Error - 4/19/2009 4:36:38 AM | Computer Name = JDRCHAN-DEED659 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
TPkd
Error - 4/19/2009 4:38:58 AM | Computer Name = JDRCHAN-DEED659 | Source = ati2mtag | ID = 45062
Description = CRT invalid display type
< End of report >
If im missing anything out you guys want, then do let me know.
Anyways, i guess thats it, and i totally appreciate you guys help. I'll be checking up on this page regulary to follow instructions.
Thanks.
Sign In
Create Account
