[Resolved] PLEASE HELP! Various pop-ups

* OK. I'm new here and this is the second forum i'm going to.
* Tech guy forums ignored me for a week so i was hoping to get a better response from you here.
* I will describe my problem then post a HijackThis log, then a ComboFix log.

I am having a pop-up problem. The whole of this week my computer would receive pop-ups from various sources including "sublimemedia.net", "searchme.com", "url.adtrgt.com", etc…and also those ones directing you to the fake "Registry Defender" and telling you your computer security is at risk. It stalls my browsing every now and then and has given me serious grief over the past week. I received no help from Tech guy forums and waited sooo long that I eventually tried to start fixing the problem myself. This obviously hasn't worked so I am here asking for your help.





******************************************************
HijackThis LOG:
******************************************************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:57:11, on 04/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {e77ec044-aa2f-4aae-8405-6e92c4a8dfcc} - C:\WINDOWS\system32\pipiwuhi.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [CPMfb4b91c1] Rundll32.exe "c:\windows\system32\hazafupe.dll",a
O4 - HKLM\..\Run: [gagobazami] Rundll32.exe "C:\WINDOWS\system32\pisiluvu.dll",s
O4 - HKLM\..\Run: [Dyuyamiwo] rundll32.exe "C:\WINDOWS\agefatufoqiwuhu.dll",e
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com (file missing)
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} - http://musicstore.connect.com/XSL/mb_us//h…ALStreaming.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1166410546828
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} (SopCore Control) - http://download.sopcast.com/download/SOPCORE.CAB
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O20 - AppInit_DLLs: c:\windows\system32\hazafupe.dll,C:\WINDOWS\system32\perokefu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\hazafupe.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\hazafupe.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sophos AutoUpdate Agent - Unknown owner - C:\Program Files\Sophos\Remote Management System\AutoUpdateAgentNT.exe (file missing)
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

–
End of file - 10830 bytes





******************************************************
ComboFix LOG:
******************************************************

ComboFix 09-04-01.01 - Oluwaseun A. Ojo 2009-04-04 12:00:13.2 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\dupefomu.dll

—– BITS: Possible infected sites —–

hxxp://82.98.235.205
hxxp://77.74.48.105
.
((((((((((((((((((((((((( Files Created from 2009-03-04 to 2009-04-04 )))))))))))))))))))))))))))))))
.

2009-04-04 11:58 . 2006-03-03 00:42 73,728 –a—— C:\pv.exe
2009-04-04 02:54 . 2009-04-04 02:54 2,718 —hs—- c:\windows\system32\zofowoda.dll
2009-04-04 02:54 . 2009-04-04 02:54 2,584 —hs—- c:\windows\system32\ribodapi.exe
2009-04-03 14:42 . 2009-04-03 14:46 d——– c:\program files\Mozilla Firefox_
2009-03-31 04:53 . 2009-03-31 04:53 2,584 —hs—- c:\windows\system32\wujeluhe.exe
2009-03-30 11:55 . 2009-04-04 05:32 97,792 –a—— c:\windows\system32\krbclick1.exe
2009-03-30 11:52 . 2009-03-30 11:52 158,720 –a—— c:\windows\agefatufoqiwuhu.dll
2009-03-30 11:40 . 2009-03-30 14:24 d——– c:\documents and settings\Oluwaseun A. Ojo\Application Data\nidle
2009-03-14 13:57 . 2009-03-14 13:57 d——– c:\documents and settings\Oluwaseun A. Ojo\LocalLow
2009-03-14 13:57 . 2009-03-14 13:57 d——– c:\documents and settings\All Users\Application Data\TVU Networks

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-04 11:17 ——— d—–w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-04 11:11 4,916 –sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-04 11:11 4,508,704 –sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-04 11:11 36,304 –sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-04 11:11 1,122,336 –sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-03 15:22 ——— d–h–w c:\program files\InstallShield Installation Information
2009-04-03 14:57 ——— d—–w c:\program files\Yahoo!
2009-04-03 14:54 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-03 11:01 ——— d—–w c:\program files\Opera
2009-03-31 04:14 ——— d—–w c:\program files\Java
2009-03-30 10:34 ——— d—–w c:\documents and settings\Oluwaseun A. Ojo\Application Data\uTorrent
2009-03-03 04:25 ——— d—–w c:\program files\Microsoft Silverlight
2009-03-02 06:52 ——— d—–w c:\program files\Analog Devices
2009-02-23 10:41 ——— d—–w c:\program files\Trend Micro
2009-02-14 22:01 ——— d—–w c:\program files\NetBeans 6.5
2009-02-14 21:56 ——— d—–w c:\program files\Sun
2009-02-13 01:03 ——— d—–w c:\documents and settings\Oluwaseun A. Ojo\Application Data\Lavasoft
2009-02-13 00:48 ——— d—–w c:\program files\RegGenie
2009-02-13 00:47 ——— d—–w c:\program files\CCleaner
2009-02-13 00:29 ——— d—–w c:\program files\Microchip
2009-02-13 00:16 ——— d—–w c:\program files\Max Registry Cleaner
2009-02-12 23:31 ——— d—–w c:\documents and settings\Oluwaseun A. Ojo\Application Data\Uniblue
2009-02-04 14:06 33,808 —-a-w c:\windows\system32\drivers\klbg.sys
2009-01-14 20:01 51,032 —-a-w c:\documents and settings\Oluwaseun A. Ojo\Application Data\GDIPFONTCACHEV1.DAT
2006-05-03 09:06 163,328 –sha-r c:\windows\system32\flvDX.dll
2007-02-21 10:47 31,232 –sha-r c:\windows\system32\msfDX.dll
2008-03-16 12:30 216,064 –sha-r c:\windows\system32\nbDX.dll
1601-01-01 00:12 49,152 –sha-w c:\windows\system32\pisiluvu.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-01_20.48.35.65 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-04-01 19:41:26 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-04-03 15:08:16 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-04-01 19:41:26 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-04-03 15:08:16 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-04-04 11:12:38 16,384 —-atw c:\windows\temp\Perflib_Perfdata_3c8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e77ec044-aa2f-4aae-8405-6e92c4a8dfcc}]
1601-01-01 01:12 49152 –ah—– c:\windows\system32\pipiwuhi.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-08 289576]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"CTSVolFE.exe"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-04 201992]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"NSLauncher"="c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-08-02 3096576]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"CPMfb4b91c1"="c:\windows\system32\hazafupe.dll" [2009-03-31 87552]
"gagobazami"="c:\windows\system32\pisiluvu.dll" [1601-01-01 49152]
"Dyuyamiwo"="c:\windows\agefatufoqiwuhu.dll" [2009-03-30 158720]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]
"NWTRAY"="NWTRAY.EXE" [2002-03-12 c:\windows\system32\nwtray.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-25 622653]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-08-03 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Sonic CinePlayer Quick Launch.lnk - c:\program files\Common Files\Sonic Shared\CineTray.exe [2006-07-25 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"CompatibleRUPSecurity"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"= "c:\windows\system32\hazafupe.dll" [2009-03-31 87552]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{B4870B70-F390-11d2-9FB9-F4ED725EA20D}"= "c:\windows\system32\NalExpEx.dll" [2002-10-18 131072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SSODL"= {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\hazafupe.dll [2009-03-31 87552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\hazafupe.dll,c:\windows\system32\perokefu.dll
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"vidc.iv41"= ir41_32.dll
"midi3"= xgusb.cpl

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwv1_0
Notification Packages REG_MULTI_SZ scecli c:\windows\system32\perokefu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 11:00 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWTRAY]
-ra—— 2002-03-12 10:37 28672 c:\windows\system32\nwtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mcupdmgr.exe"=2 (0x2)
"McTskshd.exe"=2 (0x2)
"McDetect.exe"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\Sonic Shared\\CineTray.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\S24EvMon.exe"=
"c:\\Program Files\\Dell\\QuickSet\\quickset.exe"=
"c:\\WINDOWS\\stsystra.exe"=
"c:\\WINDOWS\\explorer.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2009-01-20 8576]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592]
S3 EZKIT;Analog Devices, Inc. EZ-KIT USB Driver (WmUSBEz.sys);c:\windows\system32\drivers\WmUSBEz.sys [2008-10-28 35972]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2008-09-10 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2008-09-10 8320]
S3 SaiH5F0D;SaiH5F0D;c:\windows\system32\drivers\SaiH5F0D.sys [2006-10-27 176640]
S3 SaiU5F0D;SaiU5F0D;c:\windows\system32\drivers\SaiU5F0D.sys [2006-10-27 27264]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c2285e7-a8bf-11dd-8c5d-0015c5642d79}]
\Shell\Auto\command - RavMon.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e6c76cc-1152-11dc-b8d9-0015c5642d79}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e6c76ce-1152-11dc-b8d9-0015c5642d79}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d031482-d15a-11db-b8cf-0015c5642d79}]
\Shell\AutoRun\command - E:\RavMon.exe
\Shell\explore\Command - E:\RavMon.exe -e
\Shell\open\Command - E:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3ef167e3-a4dd-11dd-8c5a-0015c5642d79}]
\Shell\Auto\command - udisk.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL udisk.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3ef167e4-a4dd-11dd-8c5a-0015c5642d79}]
\Shell\Auto\command - F:\udisk.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL udisk.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{422d5fde-1bbc-11dc-b8df-0015c5642d79}]
\Shell\Auto\command - RavMon.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63e8e5a8-5a8e-11db-b890-00038a000015}]
\Shell\AutoRun\command - F:\RavMon.exe
\Shell\explore\Command - F:\RavMon.exe -e
\Shell\open\Command - F:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ed47b0c-37d0-11dd-8bff-0015c5642d79}]
\Shell\Auto\command - udisk.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL udisk.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{889e9dae-8782-11db-b8b2-0015c5642d79}]
\Shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ee4e99d-cc2b-11db-b8ce-0015c5642d79}]
\Shell\Auto\command - udisk.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL udisk.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a47e5175-b913-11dc-8bc0-0015c5642d79}]
\Shell\Auto\command - boot.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b001e42e-e99f-11dd-8c8c-0015c5642d79}]
\Shell\Auto\command - udisk.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL udisk.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d6dfddc0-3ea8-11dd-8c01-0015c5642d79}]
\Shell\AutoRun\command - f.exe
\Shell\explore\Command - f.exe
\Shell\open\Command - f.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da37e03c-244b-11dd-8bfa-0015c5642d79}]
\Shell\Auto\command - udisk.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL udisk.exe
.
Contents of the 'Scheduled Tasks' folder

2009-03-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
FF - ProfilePath - c:\documents and settings\Oluwaseun A. Ojo\Application Data\Mozilla\Firefox\Profiles\tu4ijz1v.default\
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-04 12:19:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Sophos Message Router]
"ImagePath"="\"c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-14675800-2490227912-3913231819-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6A64FCA9-ED0E-7067-7A26-BEADF91D77F1}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abjpifciooenpgjdaccfpghbghjelbhnnb"=hex:61,61,00,00
"bbjpifciooenpgjdaclegjcfbiamlihcbijl"=hex:61,61,00,00

[HKEY_USERS\S-1-5-21-14675800-2490227912-3913231819-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C074767A-350F-E2FC-C35B-263F0B0C72DC}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jabfhepaiiocncclacmi"=hex:6b,61,69,62,65,70,68,6b,68,69,62,68,6f,63,6f,61,67,
61,6b,6f,69,68,00,00
"iapdfiddaeihngjfgm"=hex:6b,61,69,62,65,70,68,6b,68,69,62,68,6f,63,6f,61,67,61,
6b,6f,69,68,00,7c
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1360)
c:\windows\system32\klogon.dll
.
———————— Other Running Processes ————————
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Completion time: 2009-04-04 12:24:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-04 11:24:46
ComboFix2.txt 2009-04-01 19:50:00
ComboFix3.txt 2009-03-30 11:36:11
ComboFix4.txt 2009-03-02 08:20:23
ComboFix5.txt 2009-04-04 10:59:08

Pre-Run: 12,130,430,976 bytes free
Post-Run: 12,237,053,952 bytes free

278 — E O F — 2009-04-04 11:15:17

Here are the logs you requested (copied and pasted) in this order:

1. Malwarebytes Anti-Malware LOG
2. OTListIt.txt
3. Extras.txt



*******************************************
Malwarebytes LOG
*******************************************

Malwarebytes' Anti-Malware 1.35
Database version: 1940
Windows 5.1.2600 Service Pack 2

05/04/2009 16:33:43
mbam-log-2009-04-05 (16-33-43).txt

Scan type: Quick Scan
Objects scanned: 74392
Time elapsed: 7 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 4
Registry Data Items Infected: 2
Folders Infected: 3
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e77ec044-aa2f-4aae-8405-6e92c4a8dfcc} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e77ec044-aa2f-4aae-8405-6e92c4a8dfcc} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpmfb4b91c1 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gagobazami (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\3wPlayer (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\nidle (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\live 64 math does (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
(No malicious items detected)



*******************************************
OTListIt.txt
*******************************************

OTListIt logfile created on: 05/04/2009 16:55:58 - Run 1
OTListIt2 by OldTimer - Version 2.0.11.0 Folder = C:\Documents and Settings\Oluwaseun A. Ojo\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.37 Mb Total Physical Memory | 531.22 Mb Available Physical Memory | 52.37% Memory free
2.38 Gb Paging File | 2.06 Gb Available in Paging File | 86.21% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.55 Gb Total Space | 10.71 Gb Free Space | 15.40% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: STEALTH
Current User Name: Oluwaseun A. Ojo
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe (Dell Inc.)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Program Files\Creative\Mixer\CTSVolFE.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
PRC - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
PRC - C:\WINDOWS\system32\igfxsrvc.exe (Intel Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
PRC - C:\Program Files\Dell\Media Experience\PCMService.exe (CyberLink Corp.)
PRC - C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
PRC - C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)
PRC - C:\WINDOWS\system32\NWTRAY.EXE (Novell, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
PRC - C:\Program Files\Common Files\Sonic Shared\CineTray.exe (Sonic Solutions)
PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (AVP [Auto | Running]) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
SRV - (Bonjour Service [Auto | Running]) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (btwdins [Auto | Running]) – C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
SRV - (cusrvc [On_Demand | Stopped]) – C:\WINDOWS\system32\cusrvc.exe (Novell, Inc.)
SRV - (EvtEng [Auto | Running]) – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (GameConsoleService [On_Demand | Stopped]) – C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe (WildTangent, Inc.)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) – C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (iPod Service [On_Demand | Running]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (MSCSPTISRV [On_Demand | Stopped]) – C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (NICCONFIGSVC [Auto | Running]) – C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe (Dell Inc.)
SRV - (PACSPTISVR [On_Demand | Stopped]) – C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe (Sony Corporation)
SRV - (Pml Driver HPZ12 [On_Demand | Stopped]) – C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (RegSrvc [Auto | Running]) – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (S24EventMonitor [Auto | Running]) – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (ServiceLayer [On_Demand | Stopped]) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (SPTISRV [On_Demand | Stopped]) – C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (WLANKEEPER [Auto | Running]) – C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (Intel® Corporation)
SRV - (WMPNetworkSvc [Auto | Running]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (61883 [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\61883.sys (Microsoft Corporation)
DRV - (AegisP [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\AegisP.sys (Meetinghouse Data Communications)
DRV - (AliIde [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (amdagp [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (APPDRV [System | Running]) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (asc [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (Aspi32 [Auto | Running]) – C:\WINDOWS\System32\drivers\aspi32.sys (Adaptec)
DRV - (Avc [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\avc.sys (Microsoft Corporation)
DRV - (bcm4sbxp [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (btaudio [On_Demand | Running]) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTDriver [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\btport.sys (Broadcom Corporation.)
DRV - (BTKRNL [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\btkrnl.sys (Broadcom Corporation.)
DRV - (BTSERIAL [Auto | Running]) – C:\WINDOWS\system32\drivers\btserial.sys (Broadcom Corporation.)
DRV - (BTWDNDIS [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\btwdndis.sys (Broadcom Corporation.)
DRV - (btwhid [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\btwhid.sys (Broadcom Corporation.)
DRV - (btwmodem [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\btwmodem.sys (Broadcom Corporation.)
DRV - (BTWUSB [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\btwusb.sys (Broadcom Corporation.)
DRV - (CmdIde [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (dac2w2k [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (DLABOIOM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLACDBHM [System | Running]) – C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLADResN [Auto | Running]) – C:\WINDOWS\System32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLAIFS_M [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLAOPIOM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLARTL_N [System | Running]) – C:\WINDOWS\System32\Drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DLAUDFAM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DRVMCDB [Boot | Running]) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DRVNDDM [Auto | Running]) – C:\WINDOWS\System32\Drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (E100B [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (EZKIT [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\WmUSBEz.sys (Analog Devices Inc.)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (HPZid412 [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\HPZid412.sys (HP)
DRV - (HPZipr12 [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (HP)
DRV - (HPZius12 [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\HPZius12.sys (HP)
DRV - (HSF_DPV [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (kl1 [Boot | Running]) – C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (klbg [Boot | Running]) – C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (KLFLTDEV [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\klfltdev.sys (Kaspersky Lab)
DRV - (KLIF [System | Running]) – C:\WINDOWS\system32\DRIVERS\klif.sys (Kaspersky Lab)
DRV - (klim5 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\klim5.sys (Kaspersky Lab)
DRV - (mdmxsdk [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (mraid35x [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (MSDV [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\msdv.sys (Microsoft Corporation)
DRV - (NetwareWorkstation [Auto | Running]) – C:\WINDOWS\system32\NetWare\nwfs.sys (Novell, Inc.)
DRV - (NICM [Boot | Running]) – C:\WINDOWS\system32\drivers\nicm.sys (Novell, Inc.)
DRV - (nmwcd [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdc [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcdnsu [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (nv [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (NWDHCP [Auto | Running]) – C:\WINDOWS\system32\NetWare\nwdhcp.sys (Novell, Inc.)
DRV - (NWDNS [On_Demand | Stopped]) – C:\WINDOWS\system32\NetWare\nwdns.sys (Novell, Inc.)
DRV - (NWFILTER [Boot | Running]) – C:\WINDOWS\system32\NetWare\nwfilter.sys (Novell, Inc.)
DRV - (NWHOST [On_Demand | Running]) – C:\WINDOWS\system32\NetWare\NWHOST.sys ()
DRV - (NWSAP [On_Demand | Stopped]) – C:\WINDOWS\system32\NetWare\NWSAP.sys ()
DRV - (NWSIPX32 [Auto | Stopped]) – C:\WINDOWS\system32\NetWare\nwsipx32.sys (Novell, Inc.)
DRV - (NWSLP [On_Demand | Running]) – C:\WINDOWS\system32\NetWare\nwslp.sys (Novell, Inc.)
DRV - (NWSNS [On_Demand | Stopped]) – C:\WINDOWS\system32\NetWare\NWSNS.sys ()
DRV - (pfc [On_Demand | Running]) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ql1080 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql12160 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1280 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (RESMGR [Auto | Running]) – C:\WINDOWS\system32\NetWare\resmgr.sys (Novell, Inc.)
DRV - (rimmptsk [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\rimmptsk.sys (REDC)
DRV - (rimsptsk [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\rimsptsk.sys (REDC)
DRV - (rismxdp [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\rixdptsk.sys (REDC)
DRV - (s24trans [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\s24trans.sys (Intel Corporation)
DRV - (SaiH5F0D [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\SaiH5F0D.sys (Saitek)
DRV - (SaiU5F0D [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\SaiU5F0D.sys (Saitek)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (sisagp [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (Sparrow [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (SRVLOC [Auto | Running]) – C:\WINDOWS\system32\NetWare\srvloc.sys (Novell, Inc.)
DRV - (STHDA [On_Demand | Running]) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (symc810 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (symc8xx [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (sym_hi [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (sym_u3 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (SynTP [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\SynTP.sys (Synaptics, Inc.)
DRV - (ultra [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (upperdev [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys (Windows ® Codename Longhorn DDK provider)
DRV - (USBAAPL [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbser [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\usbser.sys (Microsoft Corporation)
DRV - (UsbserFilt [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys (Windows ® Codename Longhorn DDK provider)
DRV - (vcdrom [System | Running]) – C:\WINDOWS\system32\drivers\VCdRom.sys (Microsoft Corporation)
DRV - (w300bus [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\w300bus.sys (MCCI)
DRV - (w39n51 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\w39n51.sys (Intel® Corporation)
DRV - (winachsf [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (YMIDUSB [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\ymidusb.sys (YAMAHA Corporation)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client;=dell-usuk&channel;=us

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {51FB8BD7-8C5A-4EEA-A7AA-2BF7939BAD07}:1.0
FF - prefs.js..extensions.enabledItems: {886A5090-29C8-4187-B8CD-08FDC59EDC0F}:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: {AD697EF3-C0B1-45D8-AF8C-AB116344875C}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8

FF - HKLM\software\mozilla\Firefox\Extensions\\{AD697EF3-C0B1-45D8-AF8C-AB116344875C}: C:\DOCUMENTS AND SETTINGS\OLUWASEUN A. OJO\LOCAL SETTINGS\APPLICATION DATA\{AD697EF3-C0B1-45D8-AF8C-AB116344875C} [2009/03/30 11:52:53 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/01/13 12:45:17 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/03 16:22:12 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/03 16:22:12 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2009\THBEXT [2009/01/10 01:20:09 | 00,000,000 | —D | M]

[2009/04/03 15:11:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\mozilla\Extensions
[2009/04/03 15:11:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/04/03 15:11:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\mozilla\Firefox\Profiles\tu4ijz1v.default\extensions
[2009/04/04 21:38:55 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/02/20 09:21:03 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{51FB8BD7-8C5A-4EEA-A7AA-2BF7939BAD07}
[2009/03/30 11:25:29 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{886A5090-29C8-4187-B8CD-08FDC59EDC0F}
[2009/04/03 15:11:47 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/01/13 12:45:45 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009/03/31 05:15:10 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/03/27 02:21:37 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/03/27 02:21:37 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2008/01/04 16:36:50 | 00,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2006/07/05 19:47:38 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/01/04 16:36:50 | 00,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2008/03/08 10:35:22 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/09/22 20:14:04 | 00,000,759 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2008/04/16 05:08:20 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/03/28 19:11:14 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/01/04 16:36:50 | 00,000,831 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (698 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" (Kaspersky Lab)
O4 - HKLM..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r (Creative Technology Ltd)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start (InstallShield Software Corporation)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup ()
O4 - HKLM..\Run: [NWTRAY] NWTRAY.EXE (Novell, Inc.)
O4 - HKLM..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" (CyberLink Corp.)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r (Sonic Solutions)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe (Sonic Solutions)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: CompatibleRUPSecurity = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm ()
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 (Microsoft Corporation)
O8 - Extra context menu item: Send to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - File not found
O9 - Extra Button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O9 - Extra 'Tools' menuitem : Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [Novell Directory Services Name Provider] - C:\WINDOWS\system32\netware\NWWS2NDS.DLL (Novell, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [Novell IPX/SPX SAP Name Provider] - C:\WINDOWS\system32\netware\NWWS2SAP.DLL (Novell, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [Novell SLP Provider] - C:\WINDOWS\system32\netware\NWWS2SLP.DLL (Novell, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/pub/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} http://musicstore.connect.com/XSL/mb_us//h…ALStreaming.cab (Reg Error: Key error.)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1166410546828 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} http://download.sopcast.com/download/SOPCORE.CAB (SopCore Control)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/…tiveXPlugin.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (\windows\sygs\windows\s E(YN -> Reset Hosts ->]
??) - File not found
O20 - AppInit_DLLs: (C:\WINDOWS\system32\perokefu.dll c:\windows\system32\hazafupe.dll c:\windows\system32\nufifini.dll c:\windows\system32\palifomu.dll) - C:\WINDOWS\system32\perokefu.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (NWGINA.DLL) - C:\WINDOWS\system32\NWGINA.DLL (Novell, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {B4870B70-F390-11d2-9FB9-F4ED725EA20D} - C:\WINDOWS\system32\NalExpEx.dll (Novell, Inc)
O30 - LSA: Authentication Packages - (nwv1_0) - C:\WINDOWS\System32\nwv1_0.dll (Novell, Inc.)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - C:\autorun.inf [2009/04/05 00:42:47 | 00,000,000 | RHSD | M] - [ NTFS ]
O33 - MountPoints2\{67d4c8cc-2117-11de-8ccb-0015c5642d79}\Shell - "" = AutoRun
O33 - MountPoints2\{67d4c8cc-2117-11de-8ccb-0015c5642d79}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{67d4c8cc-2117-11de-8ccb-0015c5642d79}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found

========== Files/Folders - Created Within 30 Days ==========

[1 C:\Documents and Settings\Oluwaseun A. Ojo\My Documents\*.tmp files]
[2009/04/05 16:24:10 | 00,000,000 | —D | C] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Malwarebytes
[2009/04/05 16:24:04 | 00,015,504 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/05 16:24:01 | 00,038,496 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/05 16:23:59 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/04/05 16:23:59 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/04/05 16:22:14 | 00,499,200 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\OTListIt2.exe
[2009/04/05 16:19:31 | 02,906,240 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\mbam-setup.exe
[2009/04/05 16:13:36 | 00,000,000 | —D | C] – C:\Documents and Settings\Oluwaseun A. Ojo\My Documents\HostsXpert
[2009/04/05 03:44:41 | 00,000,048 | —- | C] () – C:\plug_in.ini
[2009/04/05 02:35:55 | 00,000,000 | —D | C] – C:\Program Files\VirtualDJ
[2009/04/05 00:42:47 | 00,000,000 | RHSD | C] – C:\autorun.inf
[2009/04/05 00:24:18 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/04/05 00:23:17 | 00,001,744 | -H– | C] () – C:\WINDOWS\System32\kisusafe
[2009/04/05 00:21:24 | 00,000,000 | —D | C] – C:\_OTScanIt
[2009/04/05 00:14:59 | 00,132,597 | —- | C] () – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\Flash_Disinfector.exe
[2009/04/04 20:54:15 | 00,000,000 | —D | C] – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\OTScanIt2
[2009/04/04 14:56:57 | 00,000,000 | —D | C] – C:\Program Files\UltraMixer
[2009/04/04 14:43:22 | 16,248,861 | —- | C] (UltraMixer Digitial Audio Solutions ) – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\UltraMixer-2.3.7.1-win.exe
[2009/04/04 14:25:57 | 00,000,000 | —D | C] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\NCH Software
[2009/04/04 14:23:22 | 00,272,528 | —- | C] (NCH Software) – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\zulusetup.exe
[2009/04/03 15:26:32 | 10,637,14816 | -HS- | C] () – C:\hiberfil.sys
[2009/04/03 15:11:54 | 00,000,000 | —D | C] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Mozilla
[2009/04/03 15:11:50 | 00,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/04/03 14:42:51 | 00,000,000 | —D | C] – C:\Program Files\Mozilla Firefox_
[2009/04/02 13:51:07 | 06,227,114 | —- | C] () – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\k-Drama - Air Jordan Remix feat. Thisl Json Young Josh J. Johnson Pro.mp3
[2009/03/30 14:15:46 | 00,001,734 | —- | C] () – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\HijackThis.lnk
[2009/03/30 12:01:25 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/03/30 12:01:25 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/03/30 12:01:25 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/03/30 12:01:25 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/03/30 12:01:25 | 00,089,504 | —- | C] (Smallfrogs Studio) – C:\WINDOWS\fdsv.exe
[2009/03/30 12:01:25 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/03/30 12:01:25 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/03/30 12:01:25 | 00,049,152 | —- | C] () – C:\WINDOWS\VFIND.exe
[2009/03/30 12:01:25 | 00,029,696 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/03/30 11:52:53 | 00,000,000 | —D | C] – C:\Documents and Settings\Oluwaseun A. Ojo\Local Settings\Application Data\{AD697EF3-C0B1-45D8-AF8C-AB116344875C}
[2009/03/14 13:57:47 | 00,000,000 | —D | C] – C:\Documents and Settings\Oluwaseun A. Ojo\Local Settings\Application Data\TVU Networks
[2009/03/14 13:57:47 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TVU Networks
[2009/02/13 01:42:02 | 00,000,620 | —- | C] () – C:\WINDOWS\RegGenie.ini
[2008/11/27 02:31:34 | 00,027,648 | —- | C] () – C:\WINDOWS\System32\AVSredirect.dll
[2008/11/25 06:11:17 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\svEditor.ini
[2008/11/25 03:38:05 | 00,000,011 | —- | C] () – C:\WINDOWS\NetWare.INI
[2008/07/23 17:50:52 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/07/23 17:47:34 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/07/23 17:47:34 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/07/23 17:46:38 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/04/21 01:55:15 | 01,287,680 | —- | C] () – C:\WINDOWS\System32\drivers\quartz.dll
[2008/04/10 10:42:22 | 00,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2008/04/09 12:39:40 | 00,081,920 | —- | C] () – C:\WINDOWS\System32\MPMapTrace.dll
[2008/04/09 12:10:42 | 00,364,544 | —- | C] () – C:\WINDOWS\System32\mpPathan.dll
[2007/11/26 01:33:47 | 00,288,768 | —- | C] () – C:\WINDOWS\System32\DBLGEN6.DLL
[2007/11/26 01:33:46 | 00,409,088 | —- | C] () – C:\WINDOWS\System32\DBODBC6.DLL
[2007/11/26 01:33:46 | 00,198,144 | —- | C] () – C:\WINDOWS\System32\DBPORT6.DLL
[2007/11/26 01:33:46 | 00,152,576 | —- | C] () – C:\WINDOWS\System32\NLSAPI32.DLL
[2007/11/26 01:33:45 | 00,088,064 | —- | C] () – C:\WINDOWS\System32\NLS32.DLL
[2007/06/29 15:53:09 | 00,000,050 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/05/17 14:58:10 | 00,143,360 | —- | C] () – C:\WINDOWS\System32\libexpatw.dll
[2006/12/30 17:12:01 | 00,000,076 | —- | C] () – C:\WINDOWS\mix-fx.ini
[2006/12/13 17:03:14 | 00,074,240 | —- | C] () – C:\WINDOWS\System32\zlibwapi.dll
[2006/10/28 10:11:06 | 00,520,192 | —- | C] () – C:\WINDOWS\System32\CddbPlaylist2Sony.dll
[2006/10/27 02:36:16 | 00,000,113 | —- | C] () – C:\WINDOWS\System32\NemuAudio08.ini
[2006/10/25 14:17:50 | 00,000,082 | —- | C] () – C:\WINDOWS\sdbg.ini
[2006/10/22 04:11:16 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2006/10/21 06:19:28 | 00,000,112 | —- | C] () – C:\WINDOWS\ActiveSkin.INI
[2006/10/16 08:10:01 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/10/14 20:02:30 | 00,045,119 | R— | C] () – C:\WINDOWS\System32\dprpcw32.dll
[2006/10/14 20:01:54 | 00,002,757 | R— | C] () – C:\WINDOWS\System32\rdrstats.ini
[2006/10/14 20:01:47 | 00,226,304 | R— | C] () – C:\WINDOWS\System32\lgnwnt32.dll
[2006/10/14 20:01:45 | 00,245,839 | R— | C] () – C:\WINDOWS\System32\nwshlxnt.dll
[2006/10/14 20:01:40 | 00,053,248 | R— | C] () – C:\WINDOWS\System32\setupw2k.dll
[2006/10/14 20:01:40 | 00,040,960 | R— | C] () – C:\WINDOWS\System32\nwslog32.dll
[2006/10/13 08:59:12 | 00,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/08/03 23:38:55 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/08/03 23:31:29 | 00,000,211 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/08/03 22:48:53 | 00,016,480 | —- | C] () – C:\WINDOWS\System32\rixdicon.dll
[2006/08/03 22:46:38 | 00,000,392 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2006/06/08 14:52:24 | 00,157,696 | —- | C] () – C:\WINDOWS\System32\NALNRD95.DLL
[2006/06/08 14:52:24 | 00,143,872 | —- | C] () – C:\WINDOWS\System32\NALNRD32.DLL
[2006/05/25 00:16:22 | 00,090,112 | —- | C] () – C:\WINDOWS\System32\btprn2k.dll
[2005/12/07 13:31:00 | 00,202,752 | R— | C] () – C:\WINDOWS\System32\CddbCdda.dll
[2005/11/10 07:56:34 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/02/17 18:41:32 | 00,000,603 | —- | C] () – C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 18:41:30 | 00,000,593 | —- | C] () – C:\WINDOWS\System32\btcss.dll.manifest
[2004/08/10 19:12:05 | 00,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 19:04:07 | 00,000,000 | —- | C] () – C:\WINDOWS\control.ini
[2004/08/10 19:02:33 | 00,000,002 | —- | C] () – C:\WINDOWS\System32\desktop.ini
[2004/08/10 19:02:33 | 00,000,002 | —- | C] () – C:\WINDOWS\desktop.ini
[2004/08/10 19:02:05 | 00,000,037 | —- | C] () – C:\WINDOWS\vbaddin.ini
[2004/08/10 19:02:05 | 00,000,036 | —- | C] () – C:\WINDOWS\vb.ini
[2004/08/10 19:01:18 | 00,013,223 | —- | C] () – C:\WINDOWS\System32\tslabels.ini
[2004/08/10 19:01:18 | 00,001,931 | —- | C] () – C:\WINDOWS\System32\msdtcprf.ini
[2004/08/10 19:01:18 | 00,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 18:57:53 | 00,443,072 | —- | C] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2004/08/10 18:57:52 | 00,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 18:51:43 | 00,004,126 | —- | C] () – C:\WINDOWS\System32\msdxmlc.dll
[2004/08/10 18:51:42 | 00,498,742 | —- | C] () – C:\WINDOWS\System32\dxmasf.dll
[2004/08/10 18:51:28 | 00,013,312 | —- | C] () – C:\WINDOWS\System32\win87em.dll
[2004/08/10 18:51:28 | 00,000,995 | —- | C] () – C:\WINDOWS\win.ini
[2004/08/10 18:51:27 | 00,015,360 | —- | C] () – C:\WINDOWS\System32\tsd32.dll
[2004/08/10 18:51:26 | 00,053,478 | —- | C] () – C:\WINDOWS\System32\tcpmon.ini
[2004/08/10 18:51:26 | 00,000,289 | —- | C] () – C:\WINDOWS\system.ini
[2004/08/10 18:51:21 | 00,270,848 | —- | C] () – C:\WINDOWS\System32\sbe.dll
[2004/08/10 18:51:21 | 00,012,082 | —- | C] () – C:\WINDOWS\System32\rsvp.ini
[2004/08/10 18:51:20 | 01,287,680 | —- | C] () – C:\WINDOWS\System32\quartz.dll
[2004/08/10 18:51:20 | 00,733,696 | —- | C] () – C:\WINDOWS\System32\qedwipes.dll
[2004/08/10 18:51:20 | 00,562,176 | —- | C] () – C:\WINDOWS\System32\qedit.dll
[2004/08/10 18:51:20 | 00,385,024 | —- | C] () – C:\WINDOWS\System32\qdvd.dll
[2004/08/10 18:51:20 | 00,279,040 | —- | C] () – C:\WINDOWS\System32\qdv.dll
[2004/08/10 18:51:20 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\qcap.dll
[2004/08/10 18:51:20 | 00,006,877 | —- | C] () – C:\WINDOWS\System32\pschdprf.ini
[2004/08/10 18:51:20 | 00,003,458 | —- | C] () – C:\WINDOWS\System32\rasctrs.ini
[2004/08/10 18:51:20 | 00,002,891 | —- | C] () – C:\WINDOWS\System32\perfci.ini
[2004/08/10 18:51:20 | 00,002,732 | —- | C] () – C:\WINDOWS\System32\perfwci.ini
[2004/08/10 18:51:20 | 00,001,152 | —- | C] () – C:\WINDOWS\System32\perffilt.ini
[2004/08/10 18:51:20 | 00,000,343 | —- | C] () – C:\WINDOWS\System32\prodspec.ini
[2004/08/10 18:51:17 | 00,035,648 | —- | C] () – C:\WINDOWS\System32\ntio411.sys
[2004/08/10 18:51:17 | 00,035,424 | —- | C] () – C:\WINDOWS\System32\ntio412.sys
[2004/08/10 18:51:17 | 00,034,560 | —- | C] () – C:\WINDOWS\System32\ntio804.sys
[2004/08/10 18:51:17 | 00,034,560 | —- | C] () – C:\WINDOWS\System32\ntio404.sys
[2004/08/10 18:51:17 | 00,033,840 | —- | C] () – C:\WINDOWS\System32\ntio.sys
[2004/08/10 18:51:16 | 00,029,370 | —- | C] () – C:\WINDOWS\System32\ntdos411.sys
[2004/08/10 18:51:16 | 00,029,274 | —- | C] () – C:\WINDOWS\System32\ntdos412.sys
[2004/08/10 18:51:16 | 00,029,146 | —- | C] () – C:\WINDOWS\System32\ntdos804.sys
[2004/08/10 18:51:16 | 00,029,146 | —- | C] () – C:\WINDOWS\System32\ntdos404.sys
[2004/08/10 18:51:16 | 00,027,866 | —- | C] () – C:\WINDOWS\System32\ntdos.sys
[2004/08/10 18:51:13 | 00,094,282 | —- | C] () – C:\WINDOWS\System32\msencode.dll
[2004/08/10 18:51:13 | 00,014,336 | —- | C] () – C:\WINDOWS\System32\msdmo.dll
[2004/08/10 18:51:13 | 00,001,405 | —- | C] () – C:\WINDOWS\msdfmap.ini
[2004/08/10 18:51:11 | 00,035,328 | —- | C] () – C:\WINDOWS\System32\mciqtz32.dll
[2004/08/10 18:51:10 | 00,042,809 | —- | C] () – C:\WINDOWS\System32\key01.sys
[2004/08/10 18:51:10 | 00,042,537 | —- | C] () – C:\WINDOWS\System32\keyboard.sys
[2004/08/10 18:51:09 | 00,199,168 | —- | C] () – C:\WINDOWS\System32\ir32_32.dll
[2004/08/10 18:51:08 | 00,004,768 | —- | C] () – C:\WINDOWS\System32\himem.sys
[2004/08/10 18:51:06 | 01,015,477 | —- | C] () – C:\WINDOWS\System32\esentprf.ini
[2004/08/10 18:51:06 | 00,186,368 | —- | C] () – C:\WINDOWS\System32\encdec.dll
[2004/08/10 18:50:56 | 00,059,904 | —- | C] () – C:\WINDOWS\System32\devenum.dll
[2004/08/10 18:50:55 | 00,355,112 | —- | C] () – C:\WINDOWS\System32\msjetoledb40.dll
[2004/08/10 18:50:55 | 00,252,928 | —- | C] () – C:\WINDOWS\System32\compatUI.dll
[2004/08/10 18:50:55 | 00,027,097 | —- | C] () – C:\WINDOWS\System32\country.sys
[2004/08/10 18:50:53 | 00,070,656 | —- | C] () – C:\WINDOWS\System32\amstream.dll
[2004/08/10 18:50:53 | 00,009,029 | —- | C] () – C:\WINDOWS\System32\ansi.sys
[2003/03/09 21:31:04 | 00,561,152 | —- | C] () – C:\WINDOWS\System32\hpotscl.dll
[2002/12/01 10:04:42 | 00,001,024 | —- | C] () – C:\WINDOWS\System32\atsdrve.dll
[2002/08/20 12:01:00 | 00,592,384 | —- | C] () – C:\WINDOWS\System32\lmgr327b.dll
[2001/11/14 19:56:00 | 01,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll
[2001/08/18 04:36:28 | 00,157,696 | —- | C] () – C:\WINDOWS\System32\paqsp.dll
[2000/01/20 09:15:14 | 00,051,200 | —- | C] () – C:\WINDOWS\System32\lgncon32.dll
[1996/05/14 09:50:22 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\prtwin32.dll
[1995/08/22 08:36:12 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\nwpsrv32.dll

========== Files - Modified Within 30 Days ==========

[45 C:\WINDOWS\System32\*.tmp files]
[1 C:\Documents and Settings\Oluwaseun A. Ojo\My Documents\*.tmp files]
[2009/04/05 16:39:22 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/04/05 16:39:19 | 10,637,14816 | -HS- | M] () – C:\hiberfil.sys
[2009/04/05 16:39:19 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/04/05 16:38:16 | 04,508,704 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.dat
[2009/04/05 16:38:16 | 01,122,336 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox2.dat
[2009/04/05 16:38:16 | 00,036,304 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.idx
[2009/04/05 16:38:16 | 00,004,916 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox2.idx
[2009/04/05 16:22:25 | 00,499,200 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\OTListIt2.exe
[2009/04/05 16:19:51 | 02,906,240 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\mbam-setup.exe
[2009/04/05 16:18:54 | 00,000,698 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/04/05 14:12:42 | 00,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/04/05 11:36:32 | 00,000,048 | —- | M] () – C:\plug_in.ini
[2009/04/05 00:24:52 | 00,001,744 | -H– | M] () – C:\WINDOWS\System32\kisusafe
[2009/04/05 00:15:00 | 00,132,597 | —- | M] () – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\Flash_Disinfector.exe
[2009/04/04 19:41:02 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/04/04 14:44:23 | 16,248,861 | —- | M] (UltraMixer Digitial Audio Solutions ) – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\UltraMixer-2.3.7.1-win.exe
[2009/04/04 14:23:28 | 00,272,528 | —- | M] (NCH Software) – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\zulusetup.exe
[2009/04/04 12:19:29 | 00,000,289 | —- | M] () – C:\WINDOWS\system.ini
[2009/04/03 15:11:50 | 00,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/04/02 14:46:09 | 06,227,114 | —- | M] () – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\k-Drama - Air Jordan Remix feat. Thisl Json Young Josh J. Johnson Pro.mp3
[2009/04/01 19:52:38 | 03,067,000 | R— | M] () – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\ComboFix.exe
[2009/03/31 05:35:44 | 00,171,520 | —- | M] () – C:\Documents and Settings\Oluwaseun A. Ojo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/30 14:25:41 | 00,001,734 | —- | M] () – C:\Documents and Settings\Oluwaseun A. Ojo\Desktop\HijackThis.lnk
[2009/03/29 02:39:10 | 00,383,136 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/03/29 02:39:09 | 00,443,072 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/03/29 02:39:09 | 00,054,356 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/03/26 16:49:56 | 00,038,496 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/03/26 16:49:50 | 00,015,504 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/03/20 23:42:04 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/03/12 04:10:23 | 00,185,816 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2009/04/05 16:33:43 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2008/09/11 04:32:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2006/12/02 06:21:59 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2006/10/13 08:59:32 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AOL
[2008/01/05 14:00:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple
[2006/11/10 07:09:32 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2008/09/12 03:26:55 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2006/08/03 23:17:35 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CyberLink
[2007/07/17 15:40:45 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameTap
[2008/12/08 04:14:09 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Google
[2006/08/03 23:26:12 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GTek
[2008/09/10 02:44:04 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Installations
[2006/08/03 23:32:53 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallShield
[2006/08/03 23:12:11 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Intel
[2006/08/03 23:23:33 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Intuit
[2009/04/05 16:45:38 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
[2009/04/05 16:23:59 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/01/10 01:18:44 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\McAfee.com
[2008/09/17 02:38:14 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\McAfee.com Personal Firewall
[2009/02/13 02:03:22 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/04/04 14:25:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Software
[2008/09/10 02:56:33 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nokia
[2008/03/10 01:25:15 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Suite
[2009/01/20 21:33:34 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Propellerhead Software
[2006/10/17 01:28:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuickTime
[2007/09/05 00:23:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\River Past G5
[2004/08/10 19:13:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBSI
[2006/08/03 23:17:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sonic
[2006/10/28 04:00:08 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sony Corporation
[2009/04/03 15:54:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2008/01/11 16:57:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trymedia
[2009/03/14 13:57:47 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TVU Networks
[2009/01/07 23:20:23 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/05/21 18:30:43 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2006/10/14 02:24:59 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2006/10/14 21:57:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Yahoo!
[2009/01/23 23:29:47 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\YAMAHA
[2009/04/05 16:33:43 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data
[2008/07/29 14:13:47 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Adobe
[2006/10/24 19:39:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\AdobeUM
[2009/01/09 02:41:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Apple Computer
[2008/09/12 03:27:02 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\AVS4YOU
[2007/07/20 18:19:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\BearShare
[2008/01/10 13:55:11 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\BitTorrent
[2007/05/16 19:28:50 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\CoreFTP
[2006/10/14 21:12:59 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Corel
[2006/10/22 14:03:43 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\CyberLink
[2006/12/09 13:40:01 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\DivX
[2008/09/12 06:30:11 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\FMZilla
[2008/12/08 04:15:59 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Google
[2008/09/12 04:54:34 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\GrabPro
[2007/04/12 17:10:37 | 00,000,000 | -H-D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Gtek
[2007/04/05 01:42:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Help
[2007/12/02 12:05:27 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Hewlett-Packard
[2004/08/10 19:08:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Identities
[2008/03/10 01:26:51 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\InstallShield
[2006/08/03 23:12:34 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Intel
[2009/02/13 02:03:22 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Lavasoft
[2006/10/15 22:26:19 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Leadertech
[2007/04/19 15:51:22 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Learn2.com
[2006/10/17 21:26:20 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Macromedia
[2009/04/05 16:24:10 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Malwarebytes
[2009/01/08 06:52:53 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\McAfee
[2008/03/19 12:33:23 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\McAfee.com Personal Firewall
[2008/12/21 00:35:41 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Microchip
[2007/10/24 15:59:16 | 00,000,000 | –SD | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Microsoft
[2008/01/24 04:38:45 | 00,000,000 | -H-D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Move Networks
[2009/04/03 15:11:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Mozilla
[2009/04/04 14:25:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\NCH Software
[2008/03/10 01:25:15 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Nokia
[2008/02/09 06:56:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Nokia Multimedia Player
[2008/02/09 07:03:09 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\NSeries
[2009/01/09 04:15:22 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Opera
[2008/09/12 04:55:02 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Orbit
[2008/09/10 04:15:23 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\PC Suite
[2008/12/21 01:01:43 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\PPMate
[2008/12/21 01:08:34 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\ppStream
[2009/01/20 22:07:38 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Propellerhead Software
[2007/03/06 23:47:21 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Real
[2007/09/04 22:24:43 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\River Past G5
[2007/12/09 15:32:30 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\SecuROM
[2007/12/01 10:04:41 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Sibelius Software
[2007/12/12 00:02:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Sonic
[2006/10/28 09:51:23 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Sony Corporation
[2008/12/24 01:34:18 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\SopCast
[2006/08/03 23:09:34 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Sun
[2006/11/11 13:54:40 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Syntrillium
[2007/10/28 17:20:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\TVU Networks
[2007/01/12 02:19:17 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\U3
[2009/02/13 00:31:50 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Uniblue
[2009/04/05 02:35:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\uTorrent
[2007/11/26 12:28:14 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\Viewpoint
[2008/05/21 18:30:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Oluwaseun A. Ojo\Application Data\WildTangent
[2009/04/04 19:41:02 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2004/08/04 11:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/04/05 16:39:22 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========


========== Alternate Data Streams ==========

@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B174FAE
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
< End of report >



*******************************************
Extras.txt
*******************************************

OTListIt Extras logfile created on: 05/04/2009 16:55:58 - Run 1
OTListIt2 by OldTimer - Version 2.0.11.0 Folder = C:\Documents and Settings\Oluwaseun A. Ojo\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.37 Mb Total Physical Memory | 531.22 Mb Available Physical Memory | 52.37% Memory free
2.38 Gb Paging File | 2.06 Gb Available in Paging File | 86.21% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.55 Gb Total Space | 10.71 Gb Free Space | 15.40% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: STEALTH
Current User Name: Oluwaseun A. Ojo
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = SafariHTML] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL File not found
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL File not found
C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL File not found
C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0 (Microsoft Corporation)
C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) File not found
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire File not found
C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent (BitTorrent, Inc.)
C:\Program Files\Common Files\Sonic Shared\CineTray.exe:*:Enabled:CineTray (Sonic Solutions)
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe:*:Enabled:S24EvMon (Intel Corporation )
C:\Program Files\Dell\QuickSet\quickset.exe:*:Enabled:quickset (Dell Inc)
C:\WINDOWS\stsystra.exe:*:Enabled:stsystra (SigmaTel, Inc.)
C:\Program Files\Digital Line Detect\DLG.exe:*:Enabled:DLG (BVRP Software)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
"{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}" = mSSO
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{14218194-F762-424E-A2DD-FACF4A0C138B}" = VisualDSP++ 3.5 for 32-Bit Processors
"{14C35072-D7D0-4B29-B5BF-C94E426D77E9}" = Sky Broadband
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Roxio MyDVD LE
"{21F5098D-0C9E-4637-AD49-F037F6275990}" = NMAS Client ([removed])
"{23BE930B-6AC4-4D0D-B5C3-03062A2BF2A3}" = OpenMG AAC Add-on Module 1.0.00
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Dell Media Experience
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 13
"{26E1BFB0-E87E-4696-9F89-B467F01F81E5}" = Broadcom Management Programs
"{2A0A6470-FD0F-4F45-9B11-85F3167DB943}" = Nokia Flashing Cable Driver
"{3248F0A8-6813-11D6-A77B-00B0D0150080}" = J2SE Runtime Environment 5.0 Update 8
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{32A3A4F4-B792-11D6-A78A-00B0D0160110}" = Java™ SE Development Kit 6 Update 11
"{32E2F180-247C-4077-B06A-20F9868568E0}_is1" = UltraMixer [removed]
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3633BA28-67CE-4AC8-A677-3406CA84C3D8}" = OpenMG Secure Module 4.5.01
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = WIDCOMM Bluetooth Software
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{48110A46-A3A4-481E-8230-7873B7F4C696}" = Nokia Software Updater
"{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}" = mHlpDell
"{548EEA8E-8299-497F-8057-811D2D7097DC}" = Dell Support 3.1
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{6094AB91-4CC8-498E-9DFF-134CC0B159DE}" = PC Connectivity Solution
"{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
"{636625C2-A43F-4149-8E0D-DC01F8280DD8}" = Salford FTN95
"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
"{67E158AF-8856-4337-B483-EA21930786AF}" = GameTap
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D3C6846-CDB6-418F-8FDB-DA21FE064F86}" = YAMAHA Musicsoft Downloader 5
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{7FF1F7CF-5CD2-4FFE-950F-71B4EC1C2B97}" = USB GAME PAD
"{86EF9FC4-F209-4520-B7E1-C7FF0EEBDFFF}" = Adobe Audition 1.5
"{87791AF4-4D4C-43DC-97BF-05EEEE5187F2}" = e-Sword
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009
"{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{998D6972-F58E-479D-9248-8F179E55AE38}" = Java DB 10.4.1.3
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio
"{AC76BA86-0000-0000-0000-6028747ADE01}" = Adobe Acrobat - Reader 6.0.2 Update
"{AC76BA86-7AD7-1033-7B44-A00000000001}" = Adobe Reader 6.0.1
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B53F4598-B3D9-41DF-911E-523FA91EE464}" = Nokia Software Launcher
"{B702CCCE-3176-4DBF-B932-D1B8F402F330}" = Digital Content Portal
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C3F19A5F-35A8-4FDB-A6ED-0F4CE398DA48}" = Nokia Connectivity Cable Driver
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{C7C895CA-331B-4D7D-A0FB-D3BC637949F9}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{D4576E0D-2295-4B8E-B663-B68086B00EE5}" = Sonic CinePlayer DVD Pack
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{E94603CA-2996-4154-8EE2-A5FCD4BFB500}" = Nokia Lifeblog 2.5
"{EA418519-2160-43A0-AABD-6608DDD8D87F}" = iTunes
"{F02DBC5D-33E3-45E9-B0F8-B7745229ED1C}" = NICI (Shared) U.S./Worldwide (128 bit) (2.6.6-1)
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F1932E56-8A95-40E0-A15B-E06B45969845}" = Nokia NSeries System Utilities
"{F4EE8763-EAA8-4BC1-8594-8501F5F00414}" = Nokia NSeries One Touch Access
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{F779EC8D-6703-4C4A-817C-37B07898E647}" = Nokia NSeries Content Copier
"{F89E5AD8-AE47-49B5-B9F9-C498791E6255}" = Nokia NSeries Music Manager
"{FA25FAF6-3097-43C9-BBB2-A77CE8AF1881}" = Nokia NSeries Multimedia Player
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FCE50DB8-C610-4C42-BE5C-193F46C6F812}" = Windows Live Messenger
"{FD349381-D79C-4E5C-8980-015DFFB962D5}" = Nokia NSeries Application Installer
"{FF11005D-CBC8-45D5-A288-25C7BB304121}" = Sophos Remote Management System
"{FFFDEC7F-B24F-4C40-8639-7702671B8D67}_is1" = NS Virtual DJ 6.0 Full
"AC3Filter" = AC3Filter (remove only)
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"BearShare" = BearShare
"CCleaner" = CCleaner (remove only)
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV;_2BFA&SUBSYS;_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"CTMBDemo_Audigy" = Sound Blaster Audigy ADVANCED MB Demo
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"E65D3748-C6CC-439D-B113-ADD93EE5040F" = Blackhawk Striker 2 from WildTangent (remove only)
"F064B256B4A20996EA9E333B5E0F14B61AB3333D" = Windows Driver Package - Nokia (WUDFRd) WPD (03/19/2007 6.83.31.1)
"FL Studio_is1" = FL Studio v7.0
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{23BE930B-6AC4-4D0D-B5C3-03062A2BF2A3}" = OpenMG AAC Add-on Module 1.0.00
"InstallShield_{3633BA28-67CE-4AC8-A677-3406CA84C3D8}" = OpenMG Secure Module 4.5.01
"InstallWIX_{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MIXERLITE" = Mixer
"Mozilla Firefox (3.0.8)" = Mozilla Firefox (3.0.8)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"nbi-nb-base-[removed].200811100001" = NetBeans IDE 6.5
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Novell Client for Windows" = Novell Client for Windows
"OpenMG HotFix4.5-06-05-10-01" = OpenMG Limited Patch 4.5-06-05-12-01
"PICC 9.60PL1" = HI-TECH PICC-Lite V9.60PL1
"PoiZone" = PoiZone
"ProInst" = Intel® PROSet/Wireless Software
"RealPlayer 6.0" = RealPlayer
"Reason4_is1" = Reason 4.0
"SampleTank 2 Free" = SampleTank 2 Free
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SopCast" = SopCast 3.0.3
"StreetPlugin" = Learn2 Player (Uninstall Only)
"SUPER ©" = SUPER © Version 2008.bld.33 (Sep 2, 2008)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Toxic Biohazard" = Toxic Biohazard
"Tweak UI 2.10" = Tweak UI
"VisualDSP_{CF43F842-AA5B-428C-9A63-9991E739581E}" = VisualDSP++ 4.5 (C:\Program Files\Analog Devices\VisualDSP 4.5)
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WebCyberCoach_wtrb" = WebCyberCoach 3.2 Dell
"WildTangent CDA" = WildTangent Web Driver
"WildTangent wildgames Master Uninstall" = WildGames
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5
"Yahoo! Customizations" = Yahoo! Extras
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger with BT Communicator" = Yahoo! Messenger with BT Communicator

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 01/04/2009 05:15:10 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5145, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 01/04/2009 16:47:00 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 01/04/2009 16:51:00 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 01/04/2009 19:46:39 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 01/04/2009 19:48:09 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 02/04/2009 08:09:00 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2009 07:08:21 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application Au_.exe, version 1.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2009 07:27:24 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application Au_.exe, version 1.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2009 08:35:34 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application Au_.exe, version 1.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2009 10:50:51 | Computer Name = STEALTH | Source = pctsSvc.exe | ID = 0
Description =

[ Application Events ]
Error - 01/04/2009 05:15:10 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5145, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 01/04/2009 16:47:00 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 01/04/2009 16:51:00 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 01/04/2009 19:46:39 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 01/04/2009 19:48:09 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 02/04/2009 08:09:00 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3372, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2009 07:08:21 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application Au_.exe, version 1.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2009 07:27:24 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application Au_.exe, version 1.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2009 08:35:34 | Computer Name = STEALTH | Source = Application Hang | ID = 1002
Description = Hanging application Au_.exe, version 1.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2009 10:50:51 | Computer Name = STEALTH | Source = pctsSvc.exe | ID = 0
Description =

[ System Events ]
Error - 04/04/2009 07:12:40 | Computer Name = STEALTH | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2711'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 04/04/2009 19:26:31 | Computer Name = STEALTH | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2711'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 04/04/2009 19:26:31 | Computer Name = STEALTH | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2711'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 04/04/2009 19:59:22 | Computer Name = STEALTH | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2711'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 04/04/2009 19:59:23 | Computer Name = STEALTH | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2711'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 05/04/2009 01:50:33 | Computer Name = STEALTH | Source = ipnathlp | ID = 32003
Description = The Network Address Translator (NAT) was unable to request an operation
of
the kernel-mode translation module. This may indicate misconfiguration, insufficient
resources, or an internal error. The data is the error code.

Error - 05/04/2009 11:09:24 | Computer Name = STEALTH | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 05/04/2009 11:37:06 | Computer Name = STEALTH | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

Error - 05/04/2009 11:39:33 | Computer Name = STEALTH | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2711'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 05/04/2009 11:39:33 | Computer Name = STEALTH | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2711'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.


< End of report >