Bloodhound.MalPE and Trojan.Gen [Closed]
Started by
Matasovsky
, Oct 13 2011 03:04 PM
-
This topic is locked
#61
Posted 30 November 2011 - 11:22 AM
Matasovsky
- Topic Starter
-
- Member
-
- 128 posts
Member
#62
Posted 30 November 2011 - 04:03 PM
Matasovsky
- Topic Starter
-
- Member
-
- 128 posts
Member
While unattended...appears Windows Media Player popped up in an attempt to play a file (show_2573521) and a message popped up from that:
"An audio codec is needed to play this file. To determine if this codec is available to download from the Web, click Web Help."
It then appears to have attempted downloading/installing a file (Microsoft ActiveSync 4.5) but stopped because "The feature you are trying to use is on a network resource that is unavailable."
Awaiting a user response to "OK", "Browse", or "Cancel", I clicked Cancel.
"An audio codec is needed to play this file. To determine if this codec is available to download from the Web, click Web Help."
It then appears to have attempted downloading/installing a file (Microsoft ActiveSync 4.5) but stopped because "The feature you are trying to use is on a network resource that is unavailable."
Awaiting a user response to "OK", "Browse", or "Cancel", I clicked Cancel.
#63
Posted 01 December 2011 - 12:42 AM
SweetTech
-
- Retired Staff
-
- 7,671 posts
Sir SpamAlot
Hi!
Thanks for that information.
First things first. Lets update your out of date programs to the latest version, as having outdated versions is leaving the system wide open to vulnerabilities.
From the looks of your SecurityCheck log, I can see that we have some outdated programs that need to be updated.
Lets address those programs that need updating now!
Your SecurityCheck log indicates that your version of Flash Player is outdated. This is a vulnerability that needs to be addressed. Please remove the outdated version of Flash Player and then install the latest version.
Java Outdated
Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.
> Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.
To disable the JQS service if you don't want to use it:
NEXT
Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
NEXT:
OTL Fix
We need to run an OTL Fix
NEXT:
Malwarebytes' Anti-Malware
I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:
NEXT:
OTL Custom Scan
We need to run an OTL Custom Scan
NEXT:
What outstanding issues (if any) are you still experiencing with your computer?
Thanks for that information.
First things first. Lets update your out of date programs to the latest version, as having outdated versions is leaving the system wide open to vulnerabilities.
From the looks of your SecurityCheck log, I can see that we have some outdated programs that need to be updated.
Lets address those programs that need updating now!
Your SecurityCheck log indicates that your version of Flash Player is outdated. This is a vulnerability that needs to be addressed. Please remove the outdated version of Flash Player and then install the latest version.
Java Outdated
Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.
- Microsoft: ‘Unprecedented Wave of Java Exploitation’
- Drive-by Trojan preying on out-of-date Java installations
- Ghosts of Java Haunt Users
- Download the latest version of Java Runtime Environment (JRE) Version 7 and save it to your desktop.
- Look for "Java Platform, Standard Edition".
- Click the "Download JRE" button to the right.
- Read the License Agreement, and then check the box that says: "Accept License Agreement".
- From the list, select your OS and Platform:
- 32-bit Select: Windows x86 Offline.
- 64-bit Select: Windows x64.
- If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
- Close any programs you may have running - especially your web browser.
> Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.- Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
- Repeat as many times as necessary to remove each Java versions.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on jre-7-windows-i586.exe to install the newest version.
- If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
- When the Java Setup - Welcome window opens, click the Install > button.
- If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
- The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.
To disable the JQS service if you don't want to use it:
- Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
- Click Ok and reboot your computer.
NEXT
Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
- Go to Start > Control Panel > Add/Remove Programs
- Remove ALL instances of Adobe Reader
- Re-boot your computer as required.
- Once ALL versions of Adobe Reader have been uninstalled, visit: <<here>> and download the latest version of Adobe Reader
NEXT:
OTL Fix
We need to run an OTL Fix
- Please reopen
on your desktop. - Copy and Paste the following code into the
textbox.
:Services :OTL :Reg :Files ipconfig /flushdns /c :Commands [purity] [resethosts] [CreateRestorePoint] [emptytemp] [EMPTYFLASH]
- Push
- OTL may ask to reboot the machine. Please do so if asked.
- Click the OK button.
- A report will open. Copy and Paste that report in your next reply.
- If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
NEXT:
Malwarebytes' Anti-Malware
I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:
- Open Malwarebytes' Anti-Malware
- Select the Update tab
- Click Check for Updates
- After the update have been completed, Select the Scanner tab.
- Select Perform quick scan, then click on Scan
- Leave the default options as it is and click on Start Scan
- When done, you will be prompted. Click OK, then click on Show Results
- Checked (ticked) all items and click on Remove Selected
- After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest
NEXT:
OTL Custom Scan
We need to run an OTL Custom Scan
- Please reopen on your desktop.
- Copy and Paste the following code into the textbox.
netsvcs
drivers32
hklm\software\clients\startmenuinternet|command /rs
%USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
- Push the
button. - A report will open. Copy and Paste that report in your next reply.
NEXT:
What outstanding issues (if any) are you still experiencing with your computer?
#64
Posted 01 December 2011 - 08:20 AM
Matasovsky
- Topic Starter
-
- Member
-
- 128 posts
Member
Two items up on the screen this morning:
1. A log-in box for "banner.missingkids.com". Log-in box I can only describe as what you'd expect when doing "remote log-ins". User name and Password and OK box, waiting for user input.
2. Windows Internet Explorer warning box.
"Internet Explorer cannot open the Internet site
http://www.movietick...t.asp?ShowDate= blah-blah-blah..
Operation aborted.
Will begin the instructions on updating out of date programs
.
1. A log-in box for "banner.missingkids.com". Log-in box I can only describe as what you'd expect when doing "remote log-ins". User name and Password and OK box, waiting for user input.
2. Windows Internet Explorer warning box.
"Internet Explorer cannot open the Internet site
http://www.movietick...t.asp?ShowDate= blah-blah-blah..
Operation aborted.
Will begin the instructions on updating out of date programs
.
#65
Posted 01 December 2011 - 01:21 PM
Matasovsky
- Topic Starter
-
- Member
-
- 128 posts
Member
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Unable to start service SrService!
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: administrator.GIBRALTARDESIGN
->Temp folder emptied: 38556 bytes
->Temporary Internet Files folder emptied: 7126562 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 18777 bytes
User: ADMINI~1~GIB
User: All Users
->Temp folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: dodle
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: dodle.GIBRALTARDESIGN
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: dwagner
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: hheaddy
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: hheaddy.IN012
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: mmatasovsky
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: MWService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: n2ntech
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: NetworkService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6082274 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 20197256 bytes
Total Files Cleaned = 32.00 mb
[EMPTYFLASH]
User: Administrator
->Flash cache emptied: 0 bytes
User: administrator.GIBRALTARDESIGN
->Flash cache emptied: 0 bytes
User: ADMINI~1~GIB
User: All Users
User: Default User
User: dodle
->Flash cache emptied: 0 bytes
User: dodle.GIBRALTARDESIGN
->Flash cache emptied: 0 bytes
User: dwagner
->Flash cache emptied: 0 bytes
User: hheaddy
->Flash cache emptied: 0 bytes
User: hheaddy.IN012
->Flash cache emptied: 0 bytes
User: LocalService
User: mmatasovsky
->Flash cache emptied: 0 bytes
User: MWService
User: n2ntech
User: NetworkService
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 12012011_125827
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
========== SERVICES/DRIVERS ==========
========== OTL ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Unable to start service SrService!
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: administrator.GIBRALTARDESIGN
->Temp folder emptied: 38556 bytes
->Temporary Internet Files folder emptied: 7126562 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 18777 bytes
User: ADMINI~1~GIB
User: All Users
->Temp folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: dodle
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: dodle.GIBRALTARDESIGN
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: dwagner
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: hheaddy
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: hheaddy.IN012
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: mmatasovsky
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: MWService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: n2ntech
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: NetworkService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6082274 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 20197256 bytes
Total Files Cleaned = 32.00 mb
[EMPTYFLASH]
User: Administrator
->Flash cache emptied: 0 bytes
User: administrator.GIBRALTARDESIGN
->Flash cache emptied: 0 bytes
User: ADMINI~1~GIB
User: All Users
User: Default User
User: dodle
->Flash cache emptied: 0 bytes
User: dodle.GIBRALTARDESIGN
->Flash cache emptied: 0 bytes
User: dwagner
->Flash cache emptied: 0 bytes
User: hheaddy
->Flash cache emptied: 0 bytes
User: hheaddy.IN012
->Flash cache emptied: 0 bytes
User: LocalService
User: mmatasovsky
->Flash cache emptied: 0 bytes
User: MWService
User: n2ntech
User: NetworkService
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 12012011_125827
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
#66
Posted 01 December 2011 - 02:37 PM
Matasovsky
- Topic Starter
-
- Member
-
- 128 posts
Member
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Database version: 8286
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
12/1/2011 3:35:50 PM
mbam-log-2011-12-01 (15-35-50).txt
Scan type: Quick scan
Objects scanned: 319711
Time elapsed: 14 minute(s), 40 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig (Windows.Tool.Disabled) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
www.malwarebytes.org
Database version: 8286
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
12/1/2011 3:35:50 PM
mbam-log-2011-12-01 (15-35-50).txt
Scan type: Quick scan
Objects scanned: 319711
Time elapsed: 14 minute(s), 40 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig (Windows.Tool.Disabled) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
#67
Posted 01 December 2011 - 03:17 PM
Matasovsky
- Topic Starter
-
- Member
-
- 128 posts
Member
OTL logfile created on: 12/1/2011 4:00:59 PM - Run 4
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1021.13 Mb Total Physical Memory | 234.80 Mb Available Physical Memory | 22.99% Memory free
2.40 Gb Paging File | 1.70 Gb Available in Paging File | 70.68% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 10.01 Gb Free Space | 26.87% Space Free | Partition Type: NTFS
Drive G: | 599.99 Gb Total Space | 131.97 Gb Free Space | 22.00% Space Free | Partition Type: NTFS
Drive I: | 12.00 Gb Total Space | 4.09 Gb Free Space | 34.06% Space Free | Partition Type: NTFS
Drive K: | 34.18 Gb Total Space | 18.82 Gb Free Space | 55.06% Space Free | Partition Type: NTFS
Drive P: | 39.07 Gb Total Space | 6.81 Gb Free Space | 17.43% Space Free | Partition Type: NTFS
Drive Q: | 399.99 Gb Total Space | 29.12 Gb Free Space | 7.28% Space Free | Partition Type: NTFS
Drive U: | 19.99 Gb Total Space | 9.37 Gb Free Space | 46.86% Space Free | Partition Type: NTFS
Drive W: | 4.88 Gb Total Space | 1.75 Gb Free Space | 35.85% Space Free | Partition Type: NTFS
Drive X: | 300.00 Gb Total Space | 96.60 Gb Free Space | 32.20% Space Free | Partition Type: NTFS
Drive Y: | 399.99 Gb Total Space | 29.12 Gb Free Space | 7.28% Space Free | Partition Type: NTFS
Drive Z: | 399.99 Gb Total Space | 29.12 Gb Free Space | 7.28% Space Free | Partition Type: NTFS
Computer Name: IN012 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/12/01 10:53:34 | 000,161,664 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2011/11/17 11:02:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\OTL.exe
PRC - [2011/09/16 10:28:42 | 000,019,968 | ---- | M] () -- C:\Program Files\N-able Technologies\NRM\RSMWinService.exe
PRC - [2011/08/18 18:21:22 | 000,204,800 | ---- | M] (N-able Technologies) -- C:\Program Files\N-able Technologies\Windows Agent\bin\agent.exe
PRC - [2011/08/18 18:21:20 | 000,028,672 | ---- | M] (N-able Technologies) -- C:\Program Files\N-able Technologies\Windows Agent\bin\AgentMaint.exe
PRC - [2011/04/01 21:54:18 | 000,166,216 | ---- | M] (Microsoft Corporation) -- C:\Program Files\IIS Express\iisexpress.exe
PRC - [2009/07/09 20:43:40 | 001,830,856 | ---- | M] (UltraVNC) -- C:\Program Files\UltraVNC\winvnc.exe
PRC - [2009/03/03 10:50:56 | 001,795,400 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
PRC - [2009/03/03 10:50:56 | 001,443,144 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
PRC - [2009/03/03 10:50:53 | 002,440,120 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
PRC - [2008/09/11 18:47:40 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2008/09/11 18:47:38 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2008/08/13 15:12:12 | 000,165,888 | ---- | M] (Numara Software, Inc.) -- C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe
PRC - [2008/08/13 15:12:08 | 000,213,504 | ---- | M] (Numara Software, Inc.) -- C:\WINDOWS\TIREMOTE\TIRemoteService.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/01/04 17:03:34 | 000,079,360 | ---- | M] (Autodesk) -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
PRC - [2007/11/14 19:49:12 | 000,206,216 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Ghost\ngtray.exe
PRC - [2007/11/14 19:49:10 | 000,660,872 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Ghost\ngctw32.exe
PRC - [2007/04/03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2006/06/23 12:39:27 | 000,172,032 | ---- | M] (New Boundary Technologies, Inc.) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
PRC - [2006/03/03 20:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2004/09/28 08:35:44 | 000,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2001/11/27 08:10:00 | 000,106,560 | ---- | M] (WinZip Computing, Inc.) -- C:\Program Files\WinZip\WZQKPICK.EXE
========== Modules (No Company Name) ==========
MOD - [2011/10/09 00:36:12 | 000,221,696 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\e5e480c7ee8c4e0e0a08bb9d809da311\System.ServiceProcess.ni.dll
MOD - [2011/10/09 00:33:57 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\6e563a58e6fc0117070d5b8fd59e4e1b\System.Management.ni.dll
MOD - [2011/10/09 00:28:59 | 001,840,640 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\a2392c995b1bb6b63079091259222357\System.Web.Services.ni.dll
MOD - [2011/10/09 00:28:40 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b7e0214a811f81e09041864081139641\System.Runtime.Remoting.ni.dll
MOD - [2011/10/09 00:21:21 | 000,679,936 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\de9cd25ccb24bcf8a0316756e766721f\System.Security.ni.dll
MOD - [2011/10/09 00:21:12 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\10154dcad2d62f226af2fd4211460a4b\System.Xml.ni.dll
MOD - [2011/10/09 00:21:04 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\77df2cd21a5b85a1605b335aa9ad9d44\System.Configuration.ni.dll
MOD - [2011/10/09 00:21:02 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\70a1400affdc775d7c7398e036359286\System.ServiceProcess.ni.dll
MOD - [2011/10/09 00:20:44 | 007,950,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e6c79e1d71b0c9000afd7e5e439b5c54\System.ni.dll
MOD - [2011/10/09 00:06:00 | 005,618,176 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\bbcb0d5e67db5452b3ba77fd71ea182d\System.Xml.ni.dll
MOD - [2011/10/09 00:05:53 | 000,980,480 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\adeec723413d77446d6606813c050048\System.Configuration.ni.dll
MOD - [2011/10/09 00:05:45 | 013,137,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\f72ff4e603cc8879eb7b18841bfa9c0c\System.Windows.Forms.ni.dll
MOD - [2011/10/09 00:05:29 | 001,652,736 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c3b1fb3982b305452a4c7c8cdcb1934\System.Drawing.ni.dll
MOD - [2011/10/09 00:05:26 | 007,054,336 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\2adac0cd51859321437cc684331a3b45\System.Core.ni.dll
MOD - [2011/10/09 00:05:08 | 009,085,952 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\b13a0678a604588bfb6a4ebfadc32cb0\System.ni.dll
MOD - [2011/10/09 00:04:56 | 014,407,680 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\74353039393f68f4c068cc37f759e5be\mscorlib.ni.dll
MOD - [2011/10/09 00:02:21 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2011/09/16 10:28:42 | 000,019,968 | ---- | M] () -- C:\Program Files\N-able Technologies\NRM\RSMWinService.exe
MOD - [2011/04/19 14:19:40 | 000,065,536 | ---- | M] () -- C:\Program Files\N-able Technologies\Windows Agent\bin\SISRepository.dll
MOD - [2011/04/19 14:19:40 | 000,036,864 | ---- | M] () -- C:\Program Files\N-able Technologies\Windows Agent\bin\SISRepositoryCommon.dll
MOD - [2008/04/07 06:29:55 | 000,051,716 | ---- | M] () -- C:\WINDOWS\system32\pdf995mon.dll
MOD - [2007/04/03 16:18:26 | 000,197,672 | ---- | M] () -- C:\WINDOWS\system32\vpnapi.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [On_Demand | Stopped] -- -- (Smcinst)
SRV - [2011/12/01 10:53:34 | 000,161,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2011/09/16 10:28:42 | 000,019,968 | ---- | M] () [Auto | Running] -- C:\Program Files\N-able Technologies\NRM\RSMWinService.exe -- (RSMWebServer)
SRV - [2011/08/18 18:21:22 | 000,204,800 | ---- | M] (N-able Technologies) [Auto | Running] -- C:\Program Files\N-able Technologies\Windows Agent\bin\agent.exe -- (Windows Agent Service)
SRV - [2011/08/18 18:21:20 | 000,028,672 | ---- | M] (N-able Technologies) [Auto | Running] -- C:\Program Files\N-able Technologies\Windows Agent\bin\AgentMaint.exe -- (Windows Agent Maintenance Service)
SRV - [2011/07/13 11:29:52 | 001,642,496 | ---- | M] (WCCS) [On_Demand | Stopped] -- C:\Program Files\N-able Technologies\NRM\UltraVNCServer\winrdp.exe -- (winrdp_service)
SRV - [2009/07/09 20:43:40 | 001,830,856 | ---- | M] (UltraVNC) [Auto | Running] -- C:\Program Files\UltraVNC\WinVNC.exe -- (uvnc_service)
SRV - [2009/03/03 10:50:56 | 001,795,400 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2009/03/03 10:50:55 | 000,320,840 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)
SRV - [2009/03/03 10:50:53 | 002,440,120 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2008/09/11 18:47:40 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2008/09/11 18:47:40 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2008/08/13 15:12:08 | 000,213,504 | ---- | M] (Numara Software, Inc.) [Auto | Running] -- C:\WINDOWS\TIREMOTE\TIRemoteService.exe -- (TIRmtSvc)
SRV - [2008/06/30 15:36:35 | 003,093,872 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2008/01/04 17:03:34 | 000,079,360 | ---- | M] (Autodesk) [Auto | Running] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)
SRV - [2007/11/14 19:49:10 | 000,660,872 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Ghost\ngctw32.exe -- (NGCLIENT)
SRV - [2007/04/03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2006/08/12 00:51:40 | 000,902,760 | ---- | M] (Autodesk, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe -- (Autodesk Network Licensing Service)
SRV - [2006/06/23 12:39:27 | 000,172,032 | ---- | M] (New Boundary Technologies, Inc.) [Auto | Running] -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- (PrismXL)
SRV - [2006/03/03 20:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
========== Driver Services (SafeList) ==========
DRV - [2011/11/28 08:32:28 | 001,576,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20111130.033\NAVEX15.SYS -- (NAVEX15)
DRV - [2011/11/28 08:32:26 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20111130.033\NAVENG.SYS -- (NAVENG)
DRV - [2011/11/09 04:07:43 | 000,106,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/11/09 04:07:39 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2009/03/03 10:54:58 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2009/03/03 10:51:05 | 000,043,824 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2009/03/03 10:51:04 | 000,319,664 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2009/03/03 10:51:04 | 000,279,600 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)
DRV - [2008/09/11 18:47:32 | 000,420,400 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2008/09/11 18:47:32 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2008/09/11 18:47:32 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2008/02/29 02:13:46 | 000,028,944 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2008/02/29 02:13:36 | 000,079,120 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2008/02/29 02:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008/02/29 02:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008/02/29 02:12:56 | 000,063,120 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2008/02/29 02:12:48 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/08/15 07:27:18 | 000,009,600 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\n558.sys -- (n558)
DRV - [2007/04/03 16:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007/01/24 00:23:16 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2007/01/18 14:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005/08/23 08:39:00 | 000,240,896 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2005/07/20 13:37:22 | 000,035,712 | ---- | M] (Sonic Focus, Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sfng32.sys -- (sfng32)
DRV - [2005/07/18 18:40:40 | 001,019,064 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005/04/05 11:38:32 | 000,132,352 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2004/09/28 08:33:58 | 002,241,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/08/12 17:45:52 | 000,113,664 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/07/17 23:11:26 | 000,768,512 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2001/08/17 12:11:02 | 000,153,631 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\el90xnd5.sys -- (EL90X)
DRV - [2001/08/17 07:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
O1 HOSTS File: ([2011/12/01 12:58:39 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [IntelAudioStudio] C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe (Intel Corporation)
O4 - HKLM..\Run: [NGTray] C:\Program Files\Symantec\Ghost\ngtray.exe (Symantec Corporation)
O4 - HKLM..\Run: [NgTUiSAcmhn.exe] C:\Documents and Settings\All Users\Application Data\NgTUiSAcmhn.exe File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [ShowWnd] C:\WINDOWS\ShowWnd.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Track-It! Workstation Manager Service Monitor] C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe (Numara Software, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNTSecurity = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O15 - HKLM\..Trusted Domains: aol.com ([free] http in Trusted sites)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.micros...ontent/opuc.cab (Office Update Installation Engine)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.aka...vex-2.2.4.1.cab (DLM Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.mi...b?1233852403215 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1151414561311 (MUWebControl Class)
O16 - DPF: {6E704581-CCAE-46D2-9C64-20D724B3624E} http://radaol-prod-w...agi3.0.84.2.cab (UnagiAx Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn...ro.cab53083.cab (ZoneIntro Class)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.10.10.11 10.10.10.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = gibraltardesign.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B6615CE-0961-46B0-9959-37AFF6EBB151}: DhcpNameServer = 10.10.10.6 10.10.10.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C148A023-9056-47F0-898E-A633A66AC711}: DhcpNameServer = 10.10.10.11 10.10.10.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C148A023-9056-47F0-898E-A633A66AC711}: Domain = gibraltardesign.local
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/02/12 11:17:00 | 000,000,000 | ---D | M] - C:\Autodesk VIZ 2006 -- [ NTFS ]
O32 - AutoRun File - [2004/02/03 14:55:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/05/10 14:57:54 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010 - ARCH.lnk -- [ NTFS ]
O32 - AutoRun File - [2010/05/06 09:44:20 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010-ELEC.lnk -- [ NTFS ]
O32 - AutoRun File - [2010/05/06 09:47:12 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010-MECH.lnk -- [ NTFS ]
O32 - AutoRun File - [2010/05/06 09:48:44 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010-PLUM.lnk -- [ NTFS ]
O32 - AutoRun File - [2010/05/19 12:37:56 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010-STRC.lnk -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm File not found
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
========== Files/Folders - Created Within 30 Days ==========
[2011/12/01 15:43:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2011/12/01 14:05:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Local Settings\Application Data\Sun
[2011/12/01 11:26:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2011/12/01 11:26:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011/12/01 10:53:30 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2011/11/09 16:50:24 | 000,000,000 | R--D | C] -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Recent
[2011/11/07 14:34:37 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011/11/07 13:29:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Sun
[2011/11/07 10:27:49 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2004/07/18 00:55:20 | 000,135,168 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll
========== Files - Modified Within 30 Days ==========
[2011/12/01 15:58:48 | 000,043,805 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/12/01 15:40:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/01 15:38:47 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
[2011/12/01 13:58:20 | 000,014,874 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2011/12/01 12:58:39 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2011/12/01 11:43:59 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/12/01 10:36:20 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/11/30 10:23:05 | 000,879,649 | ---- | M] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\SecurityCheck.exe
[2011/11/17 12:44:22 | 000,684,297 | ---- | M] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\unhide.exe
[2011/11/17 11:02:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\OTL.exe
[2011/11/07 10:10:19 | 004,285,527 | R--- | M] (Swearware) -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\ComboFix.exe
[2011/11/07 08:43:22 | 000,534,538 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/11/07 08:43:22 | 000,099,988 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/11/05 02:00:00 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\defrag.job
[2011/11/04 15:54:10 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\Microsoft Office Outlook 2003.lnk
========== Files Created - No Company Name ==========
[2011/12/01 11:43:59 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/12/01 11:43:58 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/11/17 12:54:48 | 000,002,497 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Office Word 2003.lnk
[2011/11/17 12:54:48 | 000,002,483 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Office PowerPoint 2003.lnk
[2011/11/17 12:54:48 | 000,000,972 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Excel.lnk
[2011/11/17 12:54:48 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/17 12:54:48 | 000,000,762 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ATT.exe.lnk
[2011/11/17 12:54:48 | 000,000,736 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
[2011/11/17 12:54:48 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/11/17 12:54:45 | 000,002,605 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook 2003.lnk
[2011/11/17 12:54:45 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/11/17 12:54:45 | 000,000,800 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/11/17 12:54:45 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/11/17 12:54:41 | 000,001,762 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk
[2011/11/17 12:54:41 | 000,001,518 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2011/11/17 12:54:40 | 000,002,209 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft ActiveSync.lnk
[2011/11/17 12:54:40 | 000,001,844 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN Explorer.lnk
[2011/11/17 12:54:40 | 000,000,769 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2011/11/17 12:50:13 | 000,684,297 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\unhide.exe
[2011/10/27 13:09:08 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/10/27 13:09:08 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/10/27 13:09:08 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/10/27 13:09:08 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/10/27 13:09:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/04/24 11:13:58 | 000,110,413 | ---- | C] () -- C:\WINDOWS\hpoins11.dat
[2009/04/24 11:13:24 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll
[2009/04/24 11:13:10 | 000,006,947 | ---- | C] () -- C:\WINDOWS\hpomdl11.dat
[2009/04/24 08:52:28 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\$_hpcst$.hpc
[2009/03/03 09:04:37 | 000,029,744 | ---- | C] () -- C:\WINDOWS\System32\InstHelper.dll
[2009/03/03 09:03:45 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2009/03/03 09:03:44 | 000,193,576 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2009/03/02 17:21:54 | 000,000,012 | ---- | C] () -- C:\WINDOWS\bthservsdp.dat
[2008/04/30 09:50:09 | 000,094,208 | ---- | C] () -- C:\WINDOWS\TIRHService.exe
[2008/04/12 10:30:51 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini
[2008/04/09 08:32:23 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\KmRemove.exe
[2008/04/07 06:29:55 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll
[2008/04/07 06:29:55 | 000,000,059 | ---- | C] () -- C:\WINDOWS\wpd99.drv
[2008/03/05 16:06:54 | 000,000,768 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2008/01/04 17:03:05 | 000,000,231 | ---- | C] () -- C:\WINDOWS\System32\3dsviz.ini
[2008/01/04 17:03:04 | 000,000,043 | ---- | C] () -- C:\WINDOWS\System32\InstallSettings.ini
[2007/08/15 07:27:18 | 000,009,600 | ---- | C] () -- C:\WINDOWS\System32\drivers\n558.sys
[2006/08/10 11:46:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mtstack16.INI
[2006/07/07 05:58:45 | 000,000,044 | ---- | C] () -- C:\WINDOWS\STRATIS.INI
[2006/06/28 10:07:11 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/06/23 12:39:28 | 000,543,232 | ---- | C] () -- C:\WINDOWS\zHotkey.exe
[2006/06/23 12:39:28 | 000,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2006/06/23 12:39:28 | 000,036,864 | ---- | C] () -- C:\WINDOWS\ShowWnd.exe
[2006/06/23 12:39:28 | 000,024,576 | ---- | C] () -- C:\WINDOWS\HKNTDLL.dll
[2006/06/23 10:10:58 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/23 10:10:58 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/06/23 10:10:58 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/06/23 10:10:58 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/06/23 10:10:58 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/06/23 10:10:58 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/06/23 10:10:58 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/06/23 10:10:58 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2005/09/14 13:47:41 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\RTCOMDLL.dll
[2005/09/14 13:47:40 | 000,156,160 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/07/17 23:07:42 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2004/07/17 23:06:20 | 000,389,120 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[2004/02/27 09:01:14 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/02/05 10:04:43 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/02/04 13:49:48 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/02/03 14:57:53 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/02/03 14:52:33 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/02/03 14:51:24 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\sol.exe
[2004/02/03 14:51:23 | 000,119,808 | ---- | C] () -- C:\WINDOWS\System32\winmine.exe
[2004/02/03 14:51:23 | 000,055,296 | ---- | C] () -- C:\WINDOWS\System32\freecell.exe
[2004/02/03 09:36:40 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/02/03 09:35:43 | 000,304,416 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/08/23 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 07:00:00 | 000,534,538 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 07:00:00 | 000,099,988 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 07:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
========== LOP Check ==========
[2009/02/12 11:22:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
[2007/06/27 08:26:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2009/02/05 10:19:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2009/03/04 09:51:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pdf995
[2011/11/05 02:00:00 | 000,000,278 | ---- | M] () -- C:\WINDOWS\Tasks\defrag.job
========== Purity Check ==========
========== Custom Scans ==========
< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/06/23 07:05:37 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/06/23 07:05:37 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/06/23 07:05:37 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 13:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2009/03/08 13:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\MSN Explorer\shell\open\command\\: "C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE" [2002/06/27 18:38:40 | 000,094,208 | ---- | M] (Microsoft Corporation)
< %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"EnableFeaturedSoftware" = 0
"NoAUShutdownOption" = 0
"RebootWarningTimeoutEnabled" = 0
"RebootWarningTimeout" = 5
"RebootRelaunchTimeout" = 30
"RebootRelaunchTimeoutEnabled" = 1
"NoAutoRebootWithLoggedOnUsers" = 1
"AutoInstallMinorUpdates" = 1
"NoAutoUpdate" = 0
"AUOptions" = 4
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 1
"AUPowerManagement" = 1
"NoAUAsDefaultShutdownOption" = 1
"RescheduleWaitTimeEnabled" = 0
"RescheduleWaitTime" = 1
"DetectionFrequencyEnabled" = 1
"DetectionFrequency" = 8
"UseWUServer" = 1
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-12-01 20:50:10
< >
< >
< >
< End of report >
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1021.13 Mb Total Physical Memory | 234.80 Mb Available Physical Memory | 22.99% Memory free
2.40 Gb Paging File | 1.70 Gb Available in Paging File | 70.68% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 10.01 Gb Free Space | 26.87% Space Free | Partition Type: NTFS
Drive G: | 599.99 Gb Total Space | 131.97 Gb Free Space | 22.00% Space Free | Partition Type: NTFS
Drive I: | 12.00 Gb Total Space | 4.09 Gb Free Space | 34.06% Space Free | Partition Type: NTFS
Drive K: | 34.18 Gb Total Space | 18.82 Gb Free Space | 55.06% Space Free | Partition Type: NTFS
Drive P: | 39.07 Gb Total Space | 6.81 Gb Free Space | 17.43% Space Free | Partition Type: NTFS
Drive Q: | 399.99 Gb Total Space | 29.12 Gb Free Space | 7.28% Space Free | Partition Type: NTFS
Drive U: | 19.99 Gb Total Space | 9.37 Gb Free Space | 46.86% Space Free | Partition Type: NTFS
Drive W: | 4.88 Gb Total Space | 1.75 Gb Free Space | 35.85% Space Free | Partition Type: NTFS
Drive X: | 300.00 Gb Total Space | 96.60 Gb Free Space | 32.20% Space Free | Partition Type: NTFS
Drive Y: | 399.99 Gb Total Space | 29.12 Gb Free Space | 7.28% Space Free | Partition Type: NTFS
Drive Z: | 399.99 Gb Total Space | 29.12 Gb Free Space | 7.28% Space Free | Partition Type: NTFS
Computer Name: IN012 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/12/01 10:53:34 | 000,161,664 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2011/11/17 11:02:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\OTL.exe
PRC - [2011/09/16 10:28:42 | 000,019,968 | ---- | M] () -- C:\Program Files\N-able Technologies\NRM\RSMWinService.exe
PRC - [2011/08/18 18:21:22 | 000,204,800 | ---- | M] (N-able Technologies) -- C:\Program Files\N-able Technologies\Windows Agent\bin\agent.exe
PRC - [2011/08/18 18:21:20 | 000,028,672 | ---- | M] (N-able Technologies) -- C:\Program Files\N-able Technologies\Windows Agent\bin\AgentMaint.exe
PRC - [2011/04/01 21:54:18 | 000,166,216 | ---- | M] (Microsoft Corporation) -- C:\Program Files\IIS Express\iisexpress.exe
PRC - [2009/07/09 20:43:40 | 001,830,856 | ---- | M] (UltraVNC) -- C:\Program Files\UltraVNC\winvnc.exe
PRC - [2009/03/03 10:50:56 | 001,795,400 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
PRC - [2009/03/03 10:50:56 | 001,443,144 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
PRC - [2009/03/03 10:50:53 | 002,440,120 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
PRC - [2008/09/11 18:47:40 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2008/09/11 18:47:38 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2008/08/13 15:12:12 | 000,165,888 | ---- | M] (Numara Software, Inc.) -- C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe
PRC - [2008/08/13 15:12:08 | 000,213,504 | ---- | M] (Numara Software, Inc.) -- C:\WINDOWS\TIREMOTE\TIRemoteService.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/01/04 17:03:34 | 000,079,360 | ---- | M] (Autodesk) -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
PRC - [2007/11/14 19:49:12 | 000,206,216 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Ghost\ngtray.exe
PRC - [2007/11/14 19:49:10 | 000,660,872 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Ghost\ngctw32.exe
PRC - [2007/04/03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2006/06/23 12:39:27 | 000,172,032 | ---- | M] (New Boundary Technologies, Inc.) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
PRC - [2006/03/03 20:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2004/09/28 08:35:44 | 000,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2001/11/27 08:10:00 | 000,106,560 | ---- | M] (WinZip Computing, Inc.) -- C:\Program Files\WinZip\WZQKPICK.EXE
========== Modules (No Company Name) ==========
MOD - [2011/10/09 00:36:12 | 000,221,696 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\e5e480c7ee8c4e0e0a08bb9d809da311\System.ServiceProcess.ni.dll
MOD - [2011/10/09 00:33:57 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\6e563a58e6fc0117070d5b8fd59e4e1b\System.Management.ni.dll
MOD - [2011/10/09 00:28:59 | 001,840,640 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\a2392c995b1bb6b63079091259222357\System.Web.Services.ni.dll
MOD - [2011/10/09 00:28:40 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b7e0214a811f81e09041864081139641\System.Runtime.Remoting.ni.dll
MOD - [2011/10/09 00:21:21 | 000,679,936 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\de9cd25ccb24bcf8a0316756e766721f\System.Security.ni.dll
MOD - [2011/10/09 00:21:12 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\10154dcad2d62f226af2fd4211460a4b\System.Xml.ni.dll
MOD - [2011/10/09 00:21:04 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\77df2cd21a5b85a1605b335aa9ad9d44\System.Configuration.ni.dll
MOD - [2011/10/09 00:21:02 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\70a1400affdc775d7c7398e036359286\System.ServiceProcess.ni.dll
MOD - [2011/10/09 00:20:44 | 007,950,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e6c79e1d71b0c9000afd7e5e439b5c54\System.ni.dll
MOD - [2011/10/09 00:06:00 | 005,618,176 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\bbcb0d5e67db5452b3ba77fd71ea182d\System.Xml.ni.dll
MOD - [2011/10/09 00:05:53 | 000,980,480 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\adeec723413d77446d6606813c050048\System.Configuration.ni.dll
MOD - [2011/10/09 00:05:45 | 013,137,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\f72ff4e603cc8879eb7b18841bfa9c0c\System.Windows.Forms.ni.dll
MOD - [2011/10/09 00:05:29 | 001,652,736 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c3b1fb3982b305452a4c7c8cdcb1934\System.Drawing.ni.dll
MOD - [2011/10/09 00:05:26 | 007,054,336 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\2adac0cd51859321437cc684331a3b45\System.Core.ni.dll
MOD - [2011/10/09 00:05:08 | 009,085,952 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\b13a0678a604588bfb6a4ebfadc32cb0\System.ni.dll
MOD - [2011/10/09 00:04:56 | 014,407,680 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\74353039393f68f4c068cc37f759e5be\mscorlib.ni.dll
MOD - [2011/10/09 00:02:21 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2011/09/16 10:28:42 | 000,019,968 | ---- | M] () -- C:\Program Files\N-able Technologies\NRM\RSMWinService.exe
MOD - [2011/04/19 14:19:40 | 000,065,536 | ---- | M] () -- C:\Program Files\N-able Technologies\Windows Agent\bin\SISRepository.dll
MOD - [2011/04/19 14:19:40 | 000,036,864 | ---- | M] () -- C:\Program Files\N-able Technologies\Windows Agent\bin\SISRepositoryCommon.dll
MOD - [2008/04/07 06:29:55 | 000,051,716 | ---- | M] () -- C:\WINDOWS\system32\pdf995mon.dll
MOD - [2007/04/03 16:18:26 | 000,197,672 | ---- | M] () -- C:\WINDOWS\system32\vpnapi.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [On_Demand | Stopped] -- -- (Smcinst)
SRV - [2011/12/01 10:53:34 | 000,161,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2011/09/16 10:28:42 | 000,019,968 | ---- | M] () [Auto | Running] -- C:\Program Files\N-able Technologies\NRM\RSMWinService.exe -- (RSMWebServer)
SRV - [2011/08/18 18:21:22 | 000,204,800 | ---- | M] (N-able Technologies) [Auto | Running] -- C:\Program Files\N-able Technologies\Windows Agent\bin\agent.exe -- (Windows Agent Service)
SRV - [2011/08/18 18:21:20 | 000,028,672 | ---- | M] (N-able Technologies) [Auto | Running] -- C:\Program Files\N-able Technologies\Windows Agent\bin\AgentMaint.exe -- (Windows Agent Maintenance Service)
SRV - [2011/07/13 11:29:52 | 001,642,496 | ---- | M] (WCCS) [On_Demand | Stopped] -- C:\Program Files\N-able Technologies\NRM\UltraVNCServer\winrdp.exe -- (winrdp_service)
SRV - [2009/07/09 20:43:40 | 001,830,856 | ---- | M] (UltraVNC) [Auto | Running] -- C:\Program Files\UltraVNC\WinVNC.exe -- (uvnc_service)
SRV - [2009/03/03 10:50:56 | 001,795,400 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2009/03/03 10:50:55 | 000,320,840 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)
SRV - [2009/03/03 10:50:53 | 002,440,120 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2008/09/11 18:47:40 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2008/09/11 18:47:40 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2008/08/13 15:12:08 | 000,213,504 | ---- | M] (Numara Software, Inc.) [Auto | Running] -- C:\WINDOWS\TIREMOTE\TIRemoteService.exe -- (TIRmtSvc)
SRV - [2008/06/30 15:36:35 | 003,093,872 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2008/01/04 17:03:34 | 000,079,360 | ---- | M] (Autodesk) [Auto | Running] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)
SRV - [2007/11/14 19:49:10 | 000,660,872 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Ghost\ngctw32.exe -- (NGCLIENT)
SRV - [2007/04/03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2006/08/12 00:51:40 | 000,902,760 | ---- | M] (Autodesk, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe -- (Autodesk Network Licensing Service)
SRV - [2006/06/23 12:39:27 | 000,172,032 | ---- | M] (New Boundary Technologies, Inc.) [Auto | Running] -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- (PrismXL)
SRV - [2006/03/03 20:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
========== Driver Services (SafeList) ==========
DRV - [2011/11/28 08:32:28 | 001,576,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20111130.033\NAVEX15.SYS -- (NAVEX15)
DRV - [2011/11/28 08:32:26 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20111130.033\NAVENG.SYS -- (NAVENG)
DRV - [2011/11/09 04:07:43 | 000,106,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/11/09 04:07:39 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2009/03/03 10:54:58 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2009/03/03 10:51:05 | 000,043,824 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2009/03/03 10:51:04 | 000,319,664 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2009/03/03 10:51:04 | 000,279,600 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)
DRV - [2008/09/11 18:47:32 | 000,420,400 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2008/09/11 18:47:32 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2008/09/11 18:47:32 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2008/02/29 02:13:46 | 000,028,944 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2008/02/29 02:13:36 | 000,079,120 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2008/02/29 02:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008/02/29 02:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008/02/29 02:12:56 | 000,063,120 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2008/02/29 02:12:48 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/08/15 07:27:18 | 000,009,600 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\n558.sys -- (n558)
DRV - [2007/04/03 16:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007/01/24 00:23:16 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2007/01/18 14:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005/08/23 08:39:00 | 000,240,896 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2005/07/20 13:37:22 | 000,035,712 | ---- | M] (Sonic Focus, Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sfng32.sys -- (sfng32)
DRV - [2005/07/18 18:40:40 | 001,019,064 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005/04/05 11:38:32 | 000,132,352 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2004/09/28 08:33:58 | 002,241,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/08/12 17:45:52 | 000,113,664 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/07/17 23:11:26 | 000,768,512 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2001/08/17 12:11:02 | 000,153,631 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\el90xnd5.sys -- (EL90X)
DRV - [2001/08/17 07:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
O1 HOSTS File: ([2011/12/01 12:58:39 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [IntelAudioStudio] C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe (Intel Corporation)
O4 - HKLM..\Run: [NGTray] C:\Program Files\Symantec\Ghost\ngtray.exe (Symantec Corporation)
O4 - HKLM..\Run: [NgTUiSAcmhn.exe] C:\Documents and Settings\All Users\Application Data\NgTUiSAcmhn.exe File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [ShowWnd] C:\WINDOWS\ShowWnd.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Track-It! Workstation Manager Service Monitor] C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe (Numara Software, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNTSecurity = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O15 - HKLM\..Trusted Domains: aol.com ([free] http in Trusted sites)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.micros...ontent/opuc.cab (Office Update Installation Engine)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.aka...vex-2.2.4.1.cab (DLM Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.mi...b?1233852403215 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1151414561311 (MUWebControl Class)
O16 - DPF: {6E704581-CCAE-46D2-9C64-20D724B3624E} http://radaol-prod-w...agi3.0.84.2.cab (UnagiAx Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn...ro.cab53083.cab (ZoneIntro Class)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.10.10.11 10.10.10.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = gibraltardesign.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B6615CE-0961-46B0-9959-37AFF6EBB151}: DhcpNameServer = 10.10.10.6 10.10.10.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C148A023-9056-47F0-898E-A633A66AC711}: DhcpNameServer = 10.10.10.11 10.10.10.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C148A023-9056-47F0-898E-A633A66AC711}: Domain = gibraltardesign.local
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/02/12 11:17:00 | 000,000,000 | ---D | M] - C:\Autodesk VIZ 2006 -- [ NTFS ]
O32 - AutoRun File - [2004/02/03 14:55:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/05/10 14:57:54 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010 - ARCH.lnk -- [ NTFS ]
O32 - AutoRun File - [2010/05/06 09:44:20 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010-ELEC.lnk -- [ NTFS ]
O32 - AutoRun File - [2010/05/06 09:47:12 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010-MECH.lnk -- [ NTFS ]
O32 - AutoRun File - [2010/05/06 09:48:44 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010-PLUM.lnk -- [ NTFS ]
O32 - AutoRun File - [2010/05/19 12:37:56 | 000,001,870 | ---- | M] () - U:\AutoCAD MEP 2010-STRC.lnk -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm File not found
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
========== Files/Folders - Created Within 30 Days ==========
[2011/12/01 15:43:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2011/12/01 14:05:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Local Settings\Application Data\Sun
[2011/12/01 11:26:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2011/12/01 11:26:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011/12/01 10:53:30 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2011/11/09 16:50:24 | 000,000,000 | R--D | C] -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Recent
[2011/11/07 14:34:37 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011/11/07 13:29:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Sun
[2011/11/07 10:27:49 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2004/07/18 00:55:20 | 000,135,168 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll
========== Files - Modified Within 30 Days ==========
[2011/12/01 15:58:48 | 000,043,805 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/12/01 15:40:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/01 15:38:47 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
[2011/12/01 13:58:20 | 000,014,874 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2011/12/01 12:58:39 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2011/12/01 11:43:59 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/12/01 10:36:20 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/11/30 10:23:05 | 000,879,649 | ---- | M] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\SecurityCheck.exe
[2011/11/17 12:44:22 | 000,684,297 | ---- | M] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\unhide.exe
[2011/11/17 11:02:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\OTL.exe
[2011/11/07 10:10:19 | 004,285,527 | R--- | M] (Swearware) -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\ComboFix.exe
[2011/11/07 08:43:22 | 000,534,538 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/11/07 08:43:22 | 000,099,988 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/11/05 02:00:00 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\defrag.job
[2011/11/04 15:54:10 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\Microsoft Office Outlook 2003.lnk
========== Files Created - No Company Name ==========
[2011/12/01 11:43:59 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/12/01 11:43:58 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/11/17 12:54:48 | 000,002,497 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Office Word 2003.lnk
[2011/11/17 12:54:48 | 000,002,483 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Office PowerPoint 2003.lnk
[2011/11/17 12:54:48 | 000,000,972 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Excel.lnk
[2011/11/17 12:54:48 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/17 12:54:48 | 000,000,762 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ATT.exe.lnk
[2011/11/17 12:54:48 | 000,000,736 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
[2011/11/17 12:54:48 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/11/17 12:54:45 | 000,002,605 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook 2003.lnk
[2011/11/17 12:54:45 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/11/17 12:54:45 | 000,000,800 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/11/17 12:54:45 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/11/17 12:54:41 | 000,001,762 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk
[2011/11/17 12:54:41 | 000,001,518 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2011/11/17 12:54:40 | 000,002,209 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft ActiveSync.lnk
[2011/11/17 12:54:40 | 000,001,844 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN Explorer.lnk
[2011/11/17 12:54:40 | 000,000,769 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2011/11/17 12:50:13 | 000,684,297 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Desktop\unhide.exe
[2011/10/27 13:09:08 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/10/27 13:09:08 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/10/27 13:09:08 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/10/27 13:09:08 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/10/27 13:09:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/04/24 11:13:58 | 000,110,413 | ---- | C] () -- C:\WINDOWS\hpoins11.dat
[2009/04/24 11:13:24 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll
[2009/04/24 11:13:10 | 000,006,947 | ---- | C] () -- C:\WINDOWS\hpomdl11.dat
[2009/04/24 08:52:28 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\administrator.GIBRALTARDESIGN\Application Data\$_hpcst$.hpc
[2009/03/03 09:04:37 | 000,029,744 | ---- | C] () -- C:\WINDOWS\System32\InstHelper.dll
[2009/03/03 09:03:45 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2009/03/03 09:03:44 | 000,193,576 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2009/03/02 17:21:54 | 000,000,012 | ---- | C] () -- C:\WINDOWS\bthservsdp.dat
[2008/04/30 09:50:09 | 000,094,208 | ---- | C] () -- C:\WINDOWS\TIRHService.exe
[2008/04/12 10:30:51 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini
[2008/04/09 08:32:23 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\KmRemove.exe
[2008/04/07 06:29:55 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll
[2008/04/07 06:29:55 | 000,000,059 | ---- | C] () -- C:\WINDOWS\wpd99.drv
[2008/03/05 16:06:54 | 000,000,768 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2008/01/04 17:03:05 | 000,000,231 | ---- | C] () -- C:\WINDOWS\System32\3dsviz.ini
[2008/01/04 17:03:04 | 000,000,043 | ---- | C] () -- C:\WINDOWS\System32\InstallSettings.ini
[2007/08/15 07:27:18 | 000,009,600 | ---- | C] () -- C:\WINDOWS\System32\drivers\n558.sys
[2006/08/10 11:46:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mtstack16.INI
[2006/07/07 05:58:45 | 000,000,044 | ---- | C] () -- C:\WINDOWS\STRATIS.INI
[2006/06/28 10:07:11 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/06/23 12:39:28 | 000,543,232 | ---- | C] () -- C:\WINDOWS\zHotkey.exe
[2006/06/23 12:39:28 | 000,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2006/06/23 12:39:28 | 000,036,864 | ---- | C] () -- C:\WINDOWS\ShowWnd.exe
[2006/06/23 12:39:28 | 000,024,576 | ---- | C] () -- C:\WINDOWS\HKNTDLL.dll
[2006/06/23 10:10:58 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/23 10:10:58 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/06/23 10:10:58 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/06/23 10:10:58 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/06/23 10:10:58 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/06/23 10:10:58 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/06/23 10:10:58 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/06/23 10:10:58 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2005/09/14 13:47:41 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\RTCOMDLL.dll
[2005/09/14 13:47:40 | 000,156,160 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/07/17 23:07:42 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2004/07/17 23:06:20 | 000,389,120 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[2004/02/27 09:01:14 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/02/05 10:04:43 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/02/04 13:49:48 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/02/03 14:57:53 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/02/03 14:52:33 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/02/03 14:51:24 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\sol.exe
[2004/02/03 14:51:23 | 000,119,808 | ---- | C] () -- C:\WINDOWS\System32\winmine.exe
[2004/02/03 14:51:23 | 000,055,296 | ---- | C] () -- C:\WINDOWS\System32\freecell.exe
[2004/02/03 09:36:40 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/02/03 09:35:43 | 000,304,416 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/08/23 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 07:00:00 | 000,534,538 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 07:00:00 | 000,099,988 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 07:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
========== LOP Check ==========
[2009/02/12 11:22:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
[2007/06/27 08:26:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2009/02/05 10:19:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2009/03/04 09:51:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pdf995
[2011/11/05 02:00:00 | 000,000,278 | ---- | M] () -- C:\WINDOWS\Tasks\defrag.job
========== Purity Check ==========
========== Custom Scans ==========
< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/06/23 07:05:37 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/06/23 07:05:37 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/06/23 07:05:37 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 13:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2009/03/08 13:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\MSN Explorer\shell\open\command\\: "C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE" [2002/06/27 18:38:40 | 000,094,208 | ---- | M] (Microsoft Corporation)
< %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"EnableFeaturedSoftware" = 0
"NoAUShutdownOption" = 0
"RebootWarningTimeoutEnabled" = 0
"RebootWarningTimeout" = 5
"RebootRelaunchTimeout" = 30
"RebootRelaunchTimeoutEnabled" = 1
"NoAutoRebootWithLoggedOnUsers" = 1
"AutoInstallMinorUpdates" = 1
"NoAutoUpdate" = 0
"AUOptions" = 4
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 1
"AUPowerManagement" = 1
"NoAUAsDefaultShutdownOption" = 1
"RescheduleWaitTimeEnabled" = 0
"RescheduleWaitTime" = 1
"DetectionFrequencyEnabled" = 1
"DetectionFrequency" = 8
"UseWUServer" = 1
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-12-01 20:50:10
< >
< >
< >
< End of report >
#68
Posted 01 December 2011 - 03:19 PM
Matasovsky
- Topic Starter
-
- Member
-
- 128 posts
Member
Keep seeing attempts to load this Microsoft ActiveSync 4.5
#69
Posted 01 December 2011 - 07:50 PM
SweetTech
-
- Retired Staff
-
- 7,671 posts
Sir SpamAlot
Hello,
I'm starting to think that the best thing to do with this computer is to nuke an reformat. As I'm not really seeing any signs of malicious entries in your logs, but it's possible malware has done some damage that I'm not able to see. A reformat and re-install would also help clear up these issues that you're describing and would also be a much quicker solution to getting this computer back up and running like it should be.
Let me know your thoughts,
ST.
I'm starting to think that the best thing to do with this computer is to nuke an reformat. As I'm not really seeing any signs of malicious entries in your logs, but it's possible malware has done some damage that I'm not able to see. A reformat and re-install would also help clear up these issues that you're describing and would also be a much quicker solution to getting this computer back up and running like it should be.
Let me know your thoughts,
ST.
#70
Posted 02 December 2011 - 09:39 AM
Matasovsky
- Topic Starter
-
- Member
-
- 128 posts
Member
You're not quiting on me NOW are you?
If you're not seeing anything at this point and declare it clean, or we have some steps to wrap it up...that's fine w/ me.
If it flares up or comes back we'll re-image it here.
If you're not seeing anything at this point and declare it clean, or we have some steps to wrap it up...that's fine w/ me.
If it flares up or comes back we'll re-image it here.
#71
Posted 03 December 2011 - 01:44 AM
SweetTech
-
- Retired Staff
-
- 7,671 posts
Sir SpamAlot
Yeah, I mean i'm not seeing anything apparently obvious in your logs. I'd like to have you take it for a test drive for a few days and post back then letting me if any issues arose during that time.If you're not seeing anything at this point and declare it clean, or we have some steps to wrap it up...that's fine w/ me.
#72
Posted 18 December 2011 - 07:00 AM
SweetTech
-
- Retired Staff
-
- 7,671 posts
Sir SpamAlot
Due to lack of feedback, this topic has been closed.
If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
