ok I have now run the Malwarebytes scan.
Attached is the new OTLIST log:
OTListIt logfile created on: 4/12/2009 2:42:04 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
494.73 Mb Total Physical Memory | 189.13 Mb Available Physical Memory | 38.23% Memory free
1.86 Gb Paging File | 1.44 Gb Available in Paging File | 77.75% Paging File free
Paging file location(s): C:\pagefile.sys 1488 1488;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 7.13 Gb Free Space | 19.12% Space Free | Partition Type: NTFS
Drive D: | 37.26 Gb Total Space | 9.05 Gb Free Space | 24.29% Space Free | Partition Type: NTFS
Drive E: | 614.11 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: MOM
Current User Name: Owner
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On
========== Processes (SafeList) ==========
PRC - [2008/11/26 10:12:08 | 00,018,752 | —- | M] (ALWIL Software) – D:\avast\aswUpdSv.exe
PRC - [2008/11/26 10:18:46 | 00,155,160 | —- | M] (ALWIL Software) – D:\avast\ashServ.exe
PRC - [2002/04/12 00:00:00 | 00,057,344 | —- | M] (brother Industries Ltd) – C:\WINDOWS\System32\brsvc01a.exe
PRC - [2001/12/13 00:01:00 | 00,045,056 | —- | M] (brother Industries Ltd) – C:\WINDOWS\System32\brss01a.exe
PRC - [2007/09/10 15:12:44 | 00,069,632 | —- | M] (Software 2000 Limited) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
PRC - [2003/05/05 19:30:22 | 00,065,536 | —- | M] (Brother Industries, Ltd.) – C:\WINDOWS\system32\Brmfrmps.exe
PRC - [2002/09/04 14:11:04 | 00,073,728 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\System32\AppServices.exe
PRC - [2008/12/16 22:59:50 | 00,150,040 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2003/06/20 00:25:00 | 00,322,120 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
PRC - [2008/04/13 17:12:19 | 01,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Explorer.EXE
PRC - [2008/10/22 05:25:30 | 00,020,480 | —- | M] (Intuit) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2002/09/20 15:50:10 | 00,045,056 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2008/04/24 13:26:18 | 00,202,560 | —- | M] (SupportSoft, Inc.) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
PRC - [2007/01/04 14:38:08 | 00,024,652 | —- | M] (Viewpoint Corporation) – C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2003/01/07 11:22:08 | 01,212,416 | —- | M] () – C:\Program Files\Ahead\InCD\InCD.exe
PRC - [2004/04/14 14:46:50 | 00,057,393 | —- | M] (ScanSoft, Inc.) – C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
PRC - [2005/09/20 11:32:24 | 00,077,824 | —- | M] (Intel Corporation) – C:\WINDOWS\system32\hkcmd.exe
PRC - [2005/09/20 11:36:20 | 00,114,688 | —- | M] (Intel Corporation) – C:\WINDOWS\system32\igfxpers.exe
PRC - [2008/11/26 10:18:51 | 00,081,000 | —- | M] (ALWIL Software) – D:\avast\ashDisp.exe
PRC - [2008/04/24 13:25:22 | 00,202,560 | —- | M] (SupportSoft, Inc.) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
PRC - [2004/11/29 14:27:19 | 00,098,304 | —- | M] (Apple Computer, Inc.) – C:\Program Files\QuickTime\qttask.exe
PRC - [2007/10/14 21:17:32 | 00,049,152 | —- | M] (Hewlett-Packard) – C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
PRC - [2008/12/20 08:50:34 | 02,656,528 | —- | M] () – C:\Program Files\Logitech\QuickCam\Quickcam.exe
PRC - [2007/05/30 03:20:37 | 00,068,856 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2009/01/29 15:01:36 | 23,975,720 | R— | M] (Skype Technologies S.A.) – C:\Program Files\Skype\Phone\Skype.exe
PRC - [2007/10/14 20:38:52 | 00,214,360 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
PRC - [2009/02/16 20:53:11 | 00,066,864 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
PRC - [2005/05/25 02:40:00 | 00,450,560 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2008/12/20 08:46:58 | 00,558,864 | —- | M] () – C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
PRC - [2008/10/22 16:45:38 | 00,972,064 | —- | M] (Intuit Inc.) – C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
PRC - [2005/05/25 02:40:00 | 00,028,160 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
PRC - [2007/01/04 14:38:18 | 00,112,336 | —- | M] (Viewpoint Corporation) – C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
PRC - [2008/11/26 10:18:32 | 00,254,040 | —- | M] (ALWIL Software) – D:\avast\ashMaiSv.exe
PRC - [2008/11/26 10:16:23 | 00,352,920 | —- | M] (ALWIL Software) – D:\avast\ashWebSv.exe
PRC - [2009/01/29 15:01:36 | 00,077,360 | R— | M] (Skype Technologies) – C:\Program Files\Skype\Plugin Manager\skypePM.exe
PRC - [2007/10/19 20:46:08 | 00,184,320 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
PRC - [2007/10/19 20:46:08 | 00,610,304 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
PRC - [2007/11/02 20:12:50 | 00,262,144 | —- | M] (Hewlett-Packard) – C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
PRC - [2009/04/12 13:18:16 | 00,501,248 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
========== Win32 Services (SafeList) ==========
SRV - [2005/09/23 07:28:32 | 00,029,896 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe – (aspnet_state [On_Demand | Stopped])
SRV - [2008/11/26 10:12:08 | 00,018,752 | —- | M] (ALWIL Software) – D:\avast\aswUpdSv.exe – (aswUpdSv [Auto | Running])
SRV - [2005/06/21 18:51:06 | 00,077,944 | —- | M] (Autodesk) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe – (Autodesk Licensing Service [On_Demand | Stopped])
SRV - [2008/11/26 10:18:46 | 00,155,160 | —- | M] (ALWIL Software) – D:\avast\ashServ.exe – (avast! Antivirus [Auto | Running])
SRV - [2008/11/26 10:18:32 | 00,254,040 | —- | M] (ALWIL Software) – D:\avast\ashMaiSv.exe – (avast! Mail Scanner [On_Demand | Running])
SRV - [2008/11/26 10:16:23 | 00,352,920 | —- | M] (ALWIL Software) – D:\avast\ashWebSv.exe – (avast! Web Scanner [On_Demand | Stopped])
SRV - [2003/05/05 19:30:22 | 00,065,536 | —- | M] (Brother Industries, Ltd.) – C:\WINDOWS\system32\Brmfrmps.exe – (brmfrmps [Auto | Running])
SRV - [2002/04/12 00:00:00 | 00,057,344 | —- | M] (brother Industries Ltd) – C:\WINDOWS\System32\brsvc01a.exe – (Brother XP spl Service [Auto | Running])
SRV - [2005/09/23 07:28:56 | 00,066,240 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2009/03/27 07:10:50 | 00,137,200 | —- | M] (Google) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe – (gusvc [On_Demand | Stopped])
SRV - [2008/04/13 17:12:02 | 00,038,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll – (helpsvc [Auto | Running])
SRV - [2007/11/06 21:16:54 | 00,217,088 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll – (hpqcxs08 [On_Demand | Running])
SRV - [2007/11/06 21:16:54 | 00,139,264 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll – (hpqddsvc [Auto | Running])
SRV - File not found – – (Iomega Activity Disk2 [Disabled | Stopped])
SRV - [2002/09/04 14:11:04 | 00,073,728 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\System32\AppServices.exe – (Iomega App Services [Auto | Running])
SRV - [2008/12/16 22:59:50 | 00,150,040 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe – (LVPrcSrv [Auto | Running])
SRV - [2003/06/20 00:25:00 | 00,322,120 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe – (MDM [Auto | Running])
SRV - [2006/11/08 16:35:36 | 00,043,520 | —- | M] (Hewlett-Packard) – C:\WINDOWS\system32\HPZinw12.dll – (Net Driver HPZ12 [Auto | Running])
SRV - [2006/11/08 16:35:38 | 00,053,248 | —- | M] (Hewlett-Packard) – C:\WINDOWS\system32\HPZipm12.dll – (Pml Driver HPZ12 [Auto | Running])
SRV - [2008/10/22 05:25:30 | 00,020,480 | —- | M] (Intuit) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe – (QBCFMonitorService [Auto | Running])
SRV - [2007/05/24 07:08:44 | 00,061,440 | —- | M] (Intuit Inc.) – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe – (QBFCService [On_Demand | Stopped])
SRV - [2002/09/20 15:50:10 | 00,045,056 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe – (SoundMAX Agent Service (default) [Auto | Running])
SRV - [2008/04/24 13:26:18 | 00,202,560 | —- | M] (SupportSoft, Inc.) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe – (sprtsvc_ddoctorv2 [Auto | Running])
SRV - [2007/01/04 14:38:08 | 00,024,652 | —- | M] (Viewpoint Corporation) – C:\Program Files\Viewpoint\Common\ViewpointService.exe – (Viewpoint Manager Service [Auto | Running])
SRV - [2006/10/18 20:05:24 | 00,913,408 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Media Player\WMPNetwk.exe – (WMPNetworkSvc [On_Demand | Stopped])
========== Driver Services (SafeList) ==========
DRV - [2008/11/26 10:15:35 | 00,026,944 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys – (Aavmker4 [System | Running])
DRV - [2003/02/26 13:01:40 | 00,100,032 | —- | M] (Andrea Electronics Corporation) – C:\WINDOWS\system32\drivers\aeaudio.sys – (aeaudio [On_Demand | Running])
DRV - [2004/10/07 18:16:04 | 00,035,840 | —- | M] (Oak Technology Inc.) – C:\WINDOWS\System32\drivers\AFS2K.SYS – (AFS2K [System | Running])
DRV - [2002/08/14 15:03:36 | 00,017,005 | —- | M] (Adaptec) – C:\WINDOWS\System32\drivers\ASPI32.SYS – (Aspi32 [Auto | Running])
DRV - [2008/11/26 10:17:25 | 00,020,560 | —- | M] (ALWIL Software) – C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys – (aswFsBlk [Auto | Running])
DRV - [2008/11/26 10:18:18 | 00,094,032 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys – (aswMon2 [Auto | Running])
DRV - [2008/11/26 10:16:29 | 00,023,152 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys – (aswRdr [On_Demand | Running])
DRV - [2008/11/26 10:17:36 | 00,111,184 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys – (aswSP [System | Running])
DRV - [2008/11/26 10:16:38 | 00,050,864 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys – (aswTdi [System | Running])
DRV - [2003/12/19 21:15:50 | 00,015,263 | —- | M] (Brother Industries Ltd.) – C:\WINDOWS\System32\Drivers\BrScnUsb.sys – (BrScnUsb [On_Demand | Stopped])
DRV - [2004/06/12 05:27:18 | 00,051,712 | —- | M] (Brother Industries Ltd.) – C:\WINDOWS\System32\Drivers\BrSerIf.sys – (BrSerIf [On_Demand | Stopped])
DRV - [2004/01/10 04:28:18 | 00,011,648 | —- | M] (Brother Industries Ltd.) – C:\WINDOWS\System32\Drivers\BrUsbSer.sys – (BrUsbSer [On_Demand | Stopped])
DRV - [2002/06/05 16:07:00 | 00,009,344 | —- | M] (B.H.A Co.,Ltd.) – C:\WINDOWS\System32\DRIVERS\bsstor.sys – (BsStor [Boot | Running])
DRV - [2002/12/24 09:38:36 | 00,462,464 | —- | M] (ahead software) – C:\WINDOWS\System32\drivers\bsudf.sys – (BsUDF [Auto | Running])
DRV - [2007/12/16 21:52:25 | 00,024,600 | —- | M] () – C:\WINDOWS\system32\drivers\DVDHelp.sys – (DVDHelp [System | Running])
DRV - [2003/03/04 12:56:26 | 00,145,408 | R— | M] (Intel Corporation) – C:\WINDOWS\System32\DRIVERS\e100b325.sys – (E100B [On_Demand | Running])
DRV - [2008/12/16 23:02:06 | 00,023,832 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys – (FilterService [On_Demand | Stopped])
DRV - [2007/10/30 02:25:53 | 00,049,920 | R— | M] (HP) – C:\WINDOWS\system32\DRIVERS\HPZid412.sys – (HPZid412 [On_Demand | Running])
DRV - [2007/10/30 02:25:54 | 00,016,496 | R— | M] (HP) – C:\WINDOWS\system32\DRIVERS\HPZipr12.sys – (HPZipr12 [On_Demand | Running])
DRV - [2007/10/30 02:25:55 | 00,021,568 | R— | M] (HP) – C:\WINDOWS\system32\DRIVERS\HPZius12.sys – (HPZius12 [On_Demand | Running])
DRV - [2005/09/20 12:00:54 | 01,302,332 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys – (ialm [On_Demand | Running])
DRV - [2002/10/08 03:03:15 | 00,007,582 | —- | M] (Ahead Software AG) – C:\WINDOWS\System32\drivers\incdrm.sys – (incdrm [System | Running])
DRV - [2002/09/04 14:11:08 | 00,030,258 | —- | M] (Iomega Corporation) – C:\WINDOWS\System32\DRIVERS\iomdisk.sys – (iomdisk [Boot | Running])
DRV - [2005/05/20 15:00:36 | 00,013,056 | —- | M] (Logitech, Inc.) – C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys – (L8042Kbd [On_Demand | Running])
DRV - [2005/05/20 15:00:48 | 00,054,528 | —- | M] (Logitech, Inc.) – C:\WINDOWS\system32\DRIVERS\L8042mou.Sys – (L8042mou [On_Demand | Running])
DRV - [2005/05/20 15:01:26 | 00,068,352 | —- | M] (Logitech, Inc.) – C:\WINDOWS\system32\DRIVERS\LMouKE.Sys – (LMouKE [On_Demand | Running])
DRV - [2008/12/16 22:58:54 | 00,025,624 | —- | M] () – C:\WINDOWS\system32\Drivers\LVPr2Mon.sys – (LVPr2Mon [On_Demand | Running])
DRV - [2008/12/16 23:00:12 | 00,768,024 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\DRIVERS\lvrs.sys – (LVRS [On_Demand | Stopped])
DRV - [2008/12/16 23:01:20 | 00,041,752 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\drivers\LVUSBSta.sys – (LVUSBSta [On_Demand | Running])
DRV - [2008/12/16 23:01:42 | 06,364,440 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\DRIVERS\lvuvc.sys – (LVUVC [On_Demand | Stopped])
DRV - [2002/09/20 11:53:34 | 00,235,100 | —- | M] (Analog Devices Inc) – C:\WINDOWS\system32\drivers\MidiSyn.sys – (MidiSyn [On_Demand | Stopped])
DRV - [2003/01/07 10:32:26 | 00,015,400 | R— | M] (Motorola Inc.) – C:\WINDOWS\System32\DRIVERS\NetMotCM.sys – (ndiscm [On_Demand | Stopped])
DRV - [2007/11/20 18:54:30 | 00,016,624 | —- | M] (Pepstyle International Limited.) – C:\WINDOWS\system32\DRIVERS\pepbus.sys – (pepbus [Boot | Running])
DRV - [2007/11/20 18:54:16 | 00,101,192 | —- | M] (Pepstyle International Limited.) – C:\WINDOWS\system32\DRIVERS\pepscsi.sys – (pepscsi [On_Demand | Running])
DRV - [2007/11/12 17:19:44 | 00,015,040 | —- | M] (Pepstyle International Limited.) – C:\WINDOWS\system32\Drivers\PEP_HKA.SYS – (PEP_HKA [Boot | Running])
DRV - [2008/04/13 11:41:00 | 00,017,664 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\DRIVERS\ppa3.sys – (ppa3 [Boot | Stopped])
DRV - [2002/08/29 05:00:00 | 00,017,792 | —- | M] (Parallel Technologies, Inc.) – C:\WINDOWS\System32\DRIVERS\ptilink.sys – (Ptilink [On_Demand | Running])
DRV - [2003/07/22 18:50:10 | 00,018,088 | —- | M] (HaSoInTech) – C:\WINDOWS\System32\Drivers\SDVC05.sys – (SDVC05 [On_Demand | Stopped])
DRV - [2007/11/13 03:25:53 | 00,020,480 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) – C:\WINDOWS\System32\DRIVERS\secdrv.sys – (Secdrv [Auto | Running])
DRV - [2003/02/06 23:13:58 | 00,032,197 | —- | M] (Sonic Focus, Inc) – C:\WINDOWS\system32\drivers\sf.sys – (sf [System | Running])
DRV - [2003/02/12 09:39:30 | 00,034,978 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\DRIVERS\SMBios.sys – (SMBios [On_Demand | Running])
DRV - [2003/03/19 16:32:36 | 00,555,264 | —- | M] (Analog Devices, Inc.) – C:\WINDOWS\system32\drivers\smwdm.sys – (smwdm [On_Demand | Running])
DRV - [2001/08/17 13:56:16 | 00,007,552 | —- | M] (Sony Corporation) – C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS – (SONYPVU1 [On_Demand | Stopped])
DRV - [2006/06/04 12:11:32 | 00,010,344 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\symlcbrd.sys – (symlcbrd [Auto | Running])
DRV - [2008/04/13 11:45:12 | 00,060,032 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\usbaudio.sys – (usbaudio [On_Demand | Stopped])
DRV - [2006/02/20 08:59:28 | 00,058,288 | R— | M] (MCCI) – C:\WINDOWS\system32\DRIVERS\w810bus.sys – (w810bus [On_Demand | Stopped])
DRV - [2006/02/20 18:59:32 | 00,008,336 | R— | M] (MCCI) – C:\WINDOWS\system32\DRIVERS\w810mdfl.sys – (w810mdfl [On_Demand | Stopped])
DRV - [2006/02/20 18:59:34 | 00,094,064 | R— | M] (MCCI) – C:\WINDOWS\system32\DRIVERS\w810mdm.sys – (w810mdm [On_Demand | Stopped])
DRV - [2006/02/20 18:59:34 | 00,085,408 | R— | M] (MCCI) – C:\WINDOWS\system32\DRIVERS\w810mgmt.sys – (w810mgmt [On_Demand | Stopped])
DRV - [2006/02/20 18:59:36 | 00,083,344 | R— | M] (MCCI) – C:\WINDOWS\system32\DRIVERS\w810obex.sys – (w810obex [On_Demand | Stopped])
DRV - [2003/03/13 19:14:28 | 00,112,288 | R— | M] (Intel Corporation) – C:\WINDOWS\system32\drivers\ialmsbw.sys – ({6080A529-897E-4629-A488-ABA0C29B635E} [On_Demand | Stopped])
DRV - [2003/03/13 19:14:16 | 00,078,496 | R— | M] (Intel Corporation) – C:\WINDOWS\system32\drivers\ialmkchw.sys – ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91} [On_Demand | Stopped])
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL =
http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://www.comcast.net/"
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/09 20:38:16 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/03/28 20:56:33 | 00,000,000 | —D | M]
[2008/12/07 11:27:10 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Extensions
[2008/12/07 11:27:10 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2008/03/26 19:42:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\175lc1py.default\extensions
[2009/04/12 13:46:42 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/03/28 20:56:33 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/02/16 21:07:18 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
[2009/03/28 20:56:19 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/03/28 20:56:19 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2008/12/07 11:26:01 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2008/12/07 11:26:01 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/12/07 11:26:01 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/12/07 11:26:02 | 00,002,343 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2008/12/07 11:26:02 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/12/07 11:26:02 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/12/07 11:26:02 | 00,000,792 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo.xml
O1 HOSTS File: (1248 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.igetnet.com
O1 - Hosts: 127.0.0.1 code.ignphrases.com
O1 - Hosts: 127.0.0.1 clear-search.com
O1 - Hosts: 127.0.0.1 r1.clrsch.com
O1 - Hosts: 127.0.0.1 sds.clrsch.com
O1 - Hosts: 127.0.0.1 status.clrsch.com
O1 - Hosts: 127.0.0.1 www.clrsch.com
O1 - Hosts: 127.0.0.1 clr-sch.com
O1 - Hosts: 127.0.0.1 sds-qckads.com
O1 - Hosts: 127.0.0.1 status.qckads.com
O1 - Hosts: 127.0.0.1 status.qckads.com
O1 - Hosts: 127.0.0.1 status.qckads.com
O1 - Hosts: 127.0.0.1 status.qckads.com
O1 - Hosts: 127.0.0.1 status.qckads.com
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: () - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
O3 - HKLM\..\Toolbar: (no name) - SITEguard - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast!] D:\avast\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2 (SupportSoft, Inc.)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe (Hewlett-Packard)
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe ()
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide ()
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Computer, Inc.)
O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKLM..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot (Scansoft, Inc.)
O4 - HKCU..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (Skype Technologies S.A.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\RunOnce: [] C:\Program Files\Mozilla Firefox\firefox.exe
http://www.symantec.com/techsupp/servlet/P…00002C.000000E2 (Mozilla Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk.disabled ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF 03 [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm (America Online, Inc)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll (Sun Microsystems, Inc.)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Sites: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.windowsupdate] * in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3}
http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab (StagingUI Object)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=48835 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} https://support.microsoft.com/OAS/ActiveX/odc.cab (Microsoft Data Collection Control)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/wmv9dmo.cab (Reg Error: Key error.)
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab (MSN Games – Buddy Invite)
O16 - DPF: {42D06124-98A2-47EC-8098-3778B58CE7D5}
https://actsvr.comcastonline.com/techtools/…%20Controls.cab (SupportSoft External Control)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1005.cab (MySpace Uploader Control)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3}
http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab (ZonePAChat Object)
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE}
http://a1540.g.akamai.net/7/1540/52/200411…meInstaller.exe (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
http://update.microsoft.com/windowsupdate/…b?1120317897959 (WUWebControl Class)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Reg Error: Value error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
http://update.microsoft.com/microsoftupdat…b?1135437924031 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303}
http://zone.msn.com/bingame/zpagames/zpa_txhe.cab60231.cab (MSN Games – Texas Holdem Poker)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F}
http://v4.windowsupdate.microsoft.com/CAB/…7799.5239467593 (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab (Reg Error: Key error.)
O16 - DPF: {C432C4BD-3566-411C-8F3C-E5E0D3AE5D33} http://msltv.multicastmedia.com/common/mbr…MINIBrowser.CAB (CBrowser Class)
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.4.2_05)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}
http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} http://zone.msn.com/binframework/v10/StProxy.cab55579.cab (MSN Games – Game Communicator)
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D}
http://h30043.www3.hp.com/aio/eng/check/qdiagh.cab?316 (QDiagHUpdateObj Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\intu-help-qb1 {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks Pro\HelpAsyncPluggableProtocol.dll (TODO: )
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 () -
http://img.xmradio.com/images/spacer.gif
O24 - Desktop Components:1 () -
http://www.comcast.net/images/global/nav2.gif
O24 - Desktop Components:2 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/06/27 11:46:18 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2006/02/06 18:58:47 | 00,700,416 | R— | M] (Electronic Arts Inc.) - E:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2006/02/06 18:58:47 | 00,700,416 | R— | M] (Electronic Arts Inc.) - E:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2006/02/06 17:46:43 | 00,630,784 | R— | M] (Electronic Arts Inc.) - E:\AutoRunGUI.dll – [ CDFS ]
O32 - AutoRun File - [2006/02/06 19:02:28 | 00,000,159 | R— | M] () - E:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
========== Files/Folders - Created Within 30 Days ==========
[2009/04/12 13:56:27 | 00,015,504 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/12 13:56:27 | 00,000,484 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/12 13:56:25 | 00,038,496 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/12 13:54:17 | 02,967,800 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2009/04/12 13:23:44 | 00,000,000 | —D | C] – C:\_OTListIt
[2009/04/12 13:18:15 | 00,501,248 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/04/12 10:35:12 | 03,063,218 | —- | C] (Symantec Corporation) – C:\Documents and Settings\Owner\Desktop\Norton_Removal_Tool.exe
[2009/04/08 10:13:39 | 00,001,729 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 8.lnk
[2009/04/07 22:26:15 | 00,001,734 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2009/04/07 22:26:11 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/04/07 22:25:34 | 00,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HJTInstall.exe
[2009/04/05 21:45:23 | 00,025,088 | —- | C] () – C:\Documents and Settings\Owner\My Documents\classification lab.doc
[2009/04/05 21:30:22 | 00,024,064 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Group found poem.doc
[2009/04/02 20:19:22 | 00,025,088 | —- | C] () – C:\Documents and Settings\Owner\My Documents\sight notes week 3.doc
[2009/04/02 20:06:54 | 00,024,576 | —- | C] () – C:\Documents and Settings\Owner\My Documents\foucus questiond week 3.doc
[2009/03/30 21:06:18 | 01,635,328 | —- | C] () – C:\Documents and Settings\Owner\My Documents\week 2.ppt
[2009/03/30 21:03:39 | 03,601,920 | —- | C] () – C:\Documents and Settings\Owner\My Documents\weeks 2.ppt
[2009/03/30 20:58:59 | 03,304,448 | —- | C] () – C:\Documents and Settings\Owner\My Documents\feild study week 2.ppt
[2009/03/30 20:37:20 | 00,031,232 | —- | C] () – C:\Documents and Settings\Owner\My Documents\population density lab.doc
[2009/03/26 10:50:16 | 00,027,136 | —- | C] () – C:\Documents and Settings\Owner\My Documents\ryancraves contract doc..doc
[2009/03/26 09:58:16 | 00,000,162 | -H– | C] () – C:\Documents and Settings\Owner\My Documents\~$e sky is green poem.doc
[2009/03/24 23:47:04 | 00,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Music
[2009/03/22 11:57:09 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\lacrosse pics
[2009/03/19 21:41:44 | 00,027,136 | —- | C] () – C:\Documents and Settings\Owner\My Documents\week 1 foucas questions.doc
[2009/03/15 21:50:04 | 00,033,280 | —- | C] () – C:\Documents and Settings\Owner\My Documents\feild study data.doc
[2009/03/15 21:46:06 | 01,833,472 | —- | C] () – C:\Documents and Settings\Owner\My Documents\feild study3.ppt
[2009/03/15 21:42:36 | 03,303,424 | —- | C] () – C:\Documents and Settings\Owner\My Documents\feild study2.ppt
[2009/03/15 21:36:10 | 03,517,440 | —- | C] () – C:\Documents and Settings\Owner\My Documents\feild study.ppt
[2009/03/15 21:13:58 | 00,029,696 | —- | C] () – C:\Documents and Settings\Owner\My Documents\feild study intro.doc
[2009/03/15 20:53:12 | 00,024,064 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Page 2.doc
[2009/03/15 17:30:17 | 00,844,288 | —- | C] () – C:\Documents and Settings\Owner\My Documents\alis.ppt
[2009/02/16 20:49:04 | 00,081,110 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/12/16 22:58:54 | 00,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2008/12/16 22:50:56 | 00,013,584 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLgFT.dll
[2008/07/23 19:25:22 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\HPPLVS.dll
[2008/07/22 10:05:05 | 00,005,632 | —- | C] () – C:\WINDOWS\System32\CNMVS3k.DLL
[2008/02/24 10:44:06 | 00,000,026 | —- | C] () – C:\WINDOWS\Brmfcmon.ini
[2007/12/16 21:52:25 | 00,024,600 | —- | C] () – C:\WINDOWS\System32\drivers\DVDHelp.sys
[2007/08/06 08:31:58 | 00,000,952 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2007/02/13 21:49:50 | 00,000,046 | —- | C] () – C:\WINDOWS\TOPO.INI
[2007/02/13 18:44:52 | 00,000,000 | —- | C] () – C:\WINDOWS\PROTOCOL.INI
[2006/09/18 14:37:50 | 00,000,530 | —- | C] () – C:\WINDOWS\System32\tx12_ic.ini
[2006/09/18 14:37:48 | 00,667,280 | —- | C] () – C:\WINDOWS\System32\tx12.dll
[2006/04/05 22:33:03 | 00,063,488 | —- | C] () – C:\WINDOWS\xobglu16.dll
[2006/04/05 22:33:03 | 00,023,552 | —- | C] () – C:\WINDOWS\xobglu32.dll
[2005/12/24 12:07:04 | 00,000,437 | —- | C] () – C:\WINDOWS\PARSONS.INI
[2005/12/16 21:24:40 | 00,000,037 | —- | C] () – C:\WINDOWS\System32\remote.ini
[2005/12/16 21:24:14 | 00,003,219 | —- | C] () – C:\WINDOWS\System32\mirc.ini
[2005/12/04 19:36:37 | 00,000,029 | —- | C] () – C:\WINDOWS\atid.ini
[2005/11/13 13:23:52 | 00,082,432 | —- | C] () – C:\WINDOWS\System32\enflib.dll
[2005/11/13 13:23:52 | 00,081,920 | —- | C] () – C:\WINDOWS\System32\enph.dll
[2005/09/07 19:27:51 | 00,000,000 | —- | C] () – C:\WINDOWS\Brownie.ini
[2005/09/04 18:14:46 | 00,000,040 | —- | C] () – C:\WINDOWS\opt_2460.ini
[2005/09/04 18:03:31 | 00,000,051 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2005/09/04 17:53:37 | 00,000,030 | —- | C] () – C:\WINDOWS\System32\brss01a.ini
[2005/09/04 17:46:12 | 00,001,322 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2005/09/04 17:46:12 | 00,000,152 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2005/09/04 17:46:10 | 00,000,508 | —- | C] () – C:\WINDOWS\brwmark.ini
[2005/09/04 17:46:10 | 00,000,079 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2005/09/04 17:44:01 | 00,027,019 | —- | C] () – C:\WINDOWS\maxlink.ini
[2005/06/04 16:20:57 | 00,073,728 | —- | C] () – C:\WINDOWS\System32\SDVC03.drv
[2005/02/27 09:14:16 | 00,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/11/25 13:30:57 | 00,000,044 | —- | C] () – C:\WINDOWS\liveup.ini
[2004/10/11 22:31:01 | 00,000,016 | —- | C] () – C:\WINDOWS\timeseal.ini
[2004/08/27 18:02:20 | 00,110,592 | —- | C] () – C:\WINDOWS\System32\cdsync.dll
[2004/08/18 14:24:35 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\cdrules.dll
[2004/08/18 14:24:34 | 00,143,360 | —- | C] () – C:\WINDOWS\System32\cdcore.dll
[2004/07/10 21:12:07 | 00,000,045 | —- | C] () – C:\WINDOWS\BHGEEHPQ.ini
[2004/07/08 15:38:25 | 00,004,332 | —- | C] () – C:\WINDOWS\Pqmaps.ini
[2004/07/07 14:43:03 | 00,000,185 | —- | C] () – C:\WINDOWS\Belt.ini
[2004/05/15 07:03:55 | 00,000,414 | —- | C] () – C:\WINDOWS\System32\MSrev43.dll
[2004/05/15 07:03:54 | 00,000,446 | —- | C] () – C:\WINDOWS\System32\MSrev23.dll
[2004/05/13 16:16:24 | 00,000,112 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/03/30 17:23:11 | 00,004,400 | —- | C] () – C:\WINDOWS\DevMgr.ini
[2004/03/30 17:20:52 | 00,000,020 | —- | C] () – C:\WINDOWS\Hposcv07.INI
[2004/02/29 23:22:31 | 00,000,568 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2004/01/19 14:47:53 | 00,000,106 | —- | C] () – C:\WINDOWS\MSREGUSR.INI
[2003/12/21 21:38:02 | 00,115,200 | —- | C] () – C:\WINDOWS\System32\npen32.dll
[2003/12/21 21:38:02 | 00,086,528 | —- | C] () – C:\WINDOWS\System32\VSCRDD32.DLL
[2003/12/21 21:38:01 | 00,254,976 | —- | C] () – C:\WINDOWS\System32\esafedrv.dll
[2003/12/21 21:38:01 | 00,046,592 | —- | C] () – C:\WINDOWS\System32\em32.dll
[2003/09/22 13:04:50 | 00,000,000 | —- | C] () – C:\WINDOWS\QFN.ini
[2003/09/22 13:04:50 | 00,000,000 | —- | C] () – C:\WINDOWS\QDQICK.ini
[2003/08/31 12:15:07 | 00,000,064 | —- | C] () – C:\WINDOWS\QBWCD.INI
[2003/08/30 18:21:24 | 00,000,173 | —- | C] () – C:\WINDOWS\KPCMS.INI
[2003/08/30 18:21:09 | 00,210,944 | —- | C] () – C:\WINDOWS\System32\MSVCRT10.DLL
[2003/08/30 18:06:53 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/06/27 14:00:26 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/06/27 12:16:05 | 00,012,288 | R— | C] () – C:\WINDOWS\System32\e100bmsg.dll
[2002/08/29 05:00:00 | 00,000,717 | —- | C] () – C:\WINDOWS\win.ini
[2002/08/29 05:00:00 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2002/03/04 10:16:34 | 00,110,592 | R— | C] () – C:\WINDOWS\System32\Jpeg32.dll
[2002/01/08 19:03:10 | 00,077,824 | —- | C] () – C:\WINDOWS\System32\MiniBrowser.dll
[1998/08/16 07:00:00 | 00,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll
========== Files - Modified Within 30 Days ==========
[1 C:\WINDOWS\System32\*.tmp files]
[5 C:\WINDOWS\*.tmp files]
[2 C:\Documents and Settings\Owner\My Documents\*.tmp files]
[2009/04/12 14:39:02 | 00,471,150 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/04/12 14:39:02 | 00,401,064 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/04/12 14:39:02 | 00,062,344 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/04/12 14:38:43 | 00,002,607 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2009/04/12 14:36:57 | 00,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/04/12 14:34:48 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/04/12 14:34:37 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/04/12 13:56:27 | 00,000,484 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/12 13:54:17 | 02,967,800 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2009/04/12 13:18:16 | 00,501,248 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/04/12 10:47:49 | 01,107,156 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2009/04/12 10:35:26 | 03,063,218 | —- | M] (Symantec Corporation) – C:\Documents and Settings\Owner\Desktop\Norton_Removal_Tool.exe
[2009/04/08 10:13:40 | 00,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 8.lnk
[2009/04/07 22:26:15 | 00,001,734 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2009/04/07 22:25:36 | 00,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HJTInstall.exe
[2009/04/06 15:32:54 | 00,038,496 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/06 15:32:46 | 00,015,504 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/05 21:45:24 | 00,025,088 | —- | M] () – C:\Documents and Settings\Owner\My Documents\classification lab.doc
[2009/04/05 21:30:25 | 00,024,064 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Group found poem.doc
[2009/04/02 20:19:22 | 00,025,088 | —- | M] () – C:\Documents and Settings\Owner\My Documents\sight notes week 3.doc
[2009/04/02 20:06:55 | 00,024,576 | —- | M] () – C:\Documents and Settings\Owner\My Documents\foucus questiond week 3.doc
[2009/03/31 21:31:16 | 00,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2009/03/30 21:06:19 | 01,635,328 | —- | M] () – C:\Documents and Settings\Owner\My Documents\week 2.ppt
[2009/03/30 21:03:41 | 03,601,920 | —- | M] () – C:\Documents and Settings\Owner\My Documents\weeks 2.ppt
[2009/03/30 20:59:00 | 03,304,448 | —- | M] () – C:\Documents and Settings\Owner\My Documents\feild study week 2.ppt
[2009/03/30 20:37:20 | 00,031,232 | —- | M] () – C:\Documents and Settings\Owner\My Documents\population density lab.doc
[2009/03/30 19:57:33 | 00,033,280 | —- | M] () – C:\Documents and Settings\Owner\My Documents\feild study data.doc
[2009/03/26 10:55:58 | 00,027,136 | —- | M] () – C:\Documents and Settings\Owner\My Documents\ryancraves contract doc..doc
[2009/03/26 09:58:16 | 00,000,162 | -H– | M] () – C:\Documents and Settings\Owner\My Documents\~$e sky is green poem.doc
[2009/03/19 21:41:44 | 00,027,136 | —- | M] () – C:\Documents and Settings\Owner\My Documents\week 1 foucas questions.doc
[2009/03/16 09:54:39 | 00,000,952 | -HS- | M] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2009/03/15 21:46:06 | 01,833,472 | —- | M] () – C:\Documents and Settings\Owner\My Documents\feild study3.ppt
[2009/03/15 21:42:38 | 03,303,424 | —- | M] () – C:\Documents and Settings\Owner\My Documents\feild study2.ppt
[2009/03/15 21:36:15 | 03,517,440 | —- | M] () – C:\Documents and Settings\Owner\My Documents\feild study.ppt
[2009/03/15 21:13:58 | 00,029,696 | —- | M] () – C:\Documents and Settings\Owner\My Documents\feild study intro.doc
[2009/03/15 20:53:13 | 00,024,064 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Page 2.doc
[2009/03/15 17:30:18 | 00,844,288 | —- | M] () – C:\Documents and Settings\Owner\My Documents\alis.ppt
[2009/03/14 07:49:32 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\lvuvc.hs
[2009/03/14 07:49:30 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\logiflt.iad
< End of report >
An "Extras" txt file that magically appeared:
OTListIt Extras logfile created on: 4/12/2009 2:42:04 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
494.73 Mb Total Physical Memory | 189.13 Mb Available Physical Memory | 38.23% Memory free
1.86 Gb Paging File | 1.44 Gb Available in Paging File | 77.75% Paging File free
Paging file location(s): C:\pagefile.sys 1488 1488;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 7.13 Gb Free Space | 19.12% Space Free | Partition Type: NTFS
Drive D: | 37.26 Gb Total Space | 9.05 Gb Free Space | 24.29% Space Free | Partition Type: NTFS
Drive E: | 614.11 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: MOM
Current User Name: Owner
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2008/04/13 11:53:32 | 00,558,080 | —- | M] (Microsoft Corporation) – %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
[2006/08/01 15:35:36 | 00,067,112 | —- | M] (America Online, Inc.) – C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger
[2009/02/16 20:53:11 | 00,066,864 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2008/04/13 11:53:32 | 00,558,080 | —- | M] (Microsoft Corporation) – %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
[2008/04/13 17:12:28 | 01,695,232 | —- | M] (Microsoft Corporation) – C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
[2006/08/01 15:35:36 | 00,067,112 | —- | M] (America Online, Inc.) – C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger
[2006/09/13 10:32:12 | 00,128,536 | —- | M] (iAnywhere Solutions, Inc.) – C:\Program Files\Intuit\QuickBooks Pro\QBDBMgrN.exe:*:Enabled:QuickBooks 2008 Data Manager
[2007/09/10 15:12:44 | 00,069,632 | —- | M] (Software 2000 Limited) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE:*:Enabled:SMLMProxy Module - HP1006MC.EXE
[2007/10/14 20:38:52 | 00,214,360 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
[2007/10/19 20:46:08 | 00,184,320 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
[2007/11/30 01:05:44 | 00,107,864 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
[2007/11/02 10:58:46 | 01,421,312 | —- | M] (Hewlett-Packard) – C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe
[2007/10/31 15:45:22 | 00,147,456 | —- | M] (Hewlett-Packard) – C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe
[2009/02/16 20:53:11 | 00,066,864 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
[2009/01/29 15:01:36 | 23,975,720 | R— | M] (Skype Technologies S.A.) – C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
"{04B2FED0-D2FF-11D5-B494-0008C7AA880E}" = PQMaps
"{0BA9CAC3-5131-4E59-B2AB-B765E876AAA2}" = Brother MFL-Pro Suite
"{0DCCE3F4-E888-40E8-8AE5-CF8058F25631}" = DVC5.1 Driver
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{12E75B98-8463-4C1F-8DDA-F6CF31566A55}" = Google SketchUp Pro 6
"{158BC6C5-5950-4FDD-BE33-0294668923F2}" = Samsung DVC Media 5.1
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{1A15507A-8551-4626-915D-3D5FA095CC1B}" = Corel Paint Shop Pro X
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{1F64D075-84F1-4EBC-A842-F2EF9C58009A}" = The Print Shop Premium Fonts
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{3248F0A8-6813-11D6-A77B-00B0D0150020}" = J2SE Runtime Environment 5.0 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant
"{40A6C96D-808E-41DD-8716-617AB6B0F1F1}" = Brother MFL-Pro Suite
"{43DCF766-6838-4F9A-8C91-D92DA586DFA8}" = Microsoft Windows Journal Viewer
"{4D9C7DA3-D532-432D-A556-5F6CD186B0A5}" = DJ_AIO_03_F4200_ProductContext
"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{5783F2D7-4004-0409-0002-0060B0CE6BBA}" = Autodesk Architectural Desktop 2006
"{5A3F6A80-7913-475E-8B96-477A952CFA43}" = SupportSoft Assisted Service
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{62653245-3DC5-4019-AF6B-4E62D6150D9E}" = F4200_Help
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67DFCE0D-BBA9-43AC-90B3-548390ECE522}" = F4200
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7148F0A8-6813-11D6-A77B-00B0D0142050}" = Java 2 Runtime Environment, SE v1.4.2_05
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = The Sims 2 Open For Business
"{863DCE5B-D6CA-4DC5-9F95-7DCFED15DE8F}" = The Print Shop 20
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
"{8AB8D458-939E-403F-0097-9BA1C1F013D5}" = The Sims 2
"{8ECB8220-F426-4BEB-9596-97033C533702}" = QuickBooks Premier: Contractor Edition 2008
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91120409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Standard
"{937B232D-9776-471E-92BD-D424E514EF14}" = Logitech QuickCam
"{98736A65-3C79-49EC-B7E9-A3C77774B0E6}" = Google SketchUp 6
"{9DBCE8C7-FE94-4D8F-9FF0-38EF3D8BC99E}" = DJ_AIO_03_F4200_Software
"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status
"{A11409F1-CD33-4076-85CB-4EE4A8439BFE}" = Scan
"{A17EABB6-D0C6-44E5-820C-72DC7F495064}" = PaperPort
"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero - Burning Rom
"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4
"{AE9A67F9-ADF1-4a44-BAB5-C1DB302B37A2}" = HP Deskjet F4200 All-In-One Driver Software 10.0 Rel .3
"{B29B526D-F027-4122-BC7A-D9E5BC86CC40}" = DJ_AIO_03_F4200_Software_Min
"{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}" = Google SketchUp 6
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{C12D609B-EB71-411B-82C3-9BE6D40435D7}" = Google SketchUp LayOut 6
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CEB3A11A-03EA-11DA-BFBD-00065BBDC0B5}" = MSN Messenger 7.5
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D87149B3-7A1D-4548-9CBF-032B791E5908}" = Desktop Doctor
"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{EB459C2F-41CA-4222-B9CA-F8EBA40B8DAB}" = Google SketchUp 6 Exporters
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F42CD69D-E393-47c8-B2CD-B139C4ADA9A8}" = Copy
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"AOL Instant Messenger" = AOL Instant Messenger
"Autodesk DWF Viewer" = Autodesk DWF Viewer
"avast!" = avast! Antivirus
"ComcastHSI" = Comcast High-Speed Internet Install Wizard
"Complete Legal Collection" = Complete Legal Collection 3.1
"DVD Burning Xpress" = DVD Burning Xpress 3.30
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InCD!UninstallKey" = Ahead InCD
"IO" = IO
"lvdrivers_11.90" = Logitech QuickCam Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MavisBeacon10_STANDARD" = Mavis Beacon Teaches Typing 10
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.0.8)" = Mozilla Firefox (3.0.8)
"MRW!UninstallKey" = Ahead InCD EasyWrite Reader
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PROSet" = Intel® PRO Network Adapters and Drivers
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer
"Shockwave" = Shockwave
"Shop for HP Supplies" = Shop for HP Supplies
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4
"Tweak UI 2.10" = Tweak UI
"Viewpoint Manager" = Viewpoint Manager (Remove Only)
"ViewpointMediaPlayer" = Viewpoint Media Player
"WebPost" = Microsoft Web Publishing Wizard 1.52
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinMX" = WinMX
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
========== Last 10 Event Log Errors ==========
[ Antivirus Events ]
Error - 7/22/2008 11:01:09 AM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 2.
Error - 7/22/2008 11:01:09 AM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 2.
Error - 7/22/2008 11:12:22 AM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 2.
Error - 7/22/2008 11:12:23 AM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 2.
Error - 7/22/2008 11:12:24 AM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestAddFile Error 2.
Error - 9/8/2008 8:56:15 PM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\DOCUME~1\OWNER\LOCALS~1\TEMP\~E5.0001.DIR.0020\~DEE0D4.TMP failed, 00000005.
Error - 10/19/2008 7:54:46 PM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\MEMORY.DMP failed, 00000005.
Error - 10/19/2008 7:54:46 PM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\MEMORY.DMP failed, 00000005.
Error - 12/28/2008 9:57:19 PM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\MEMORY.DMP failed, 00000005.
Error - 12/28/2008 9:57:19 PM | Computer Name = MOM | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\MEMORY.DMP failed, 00000005.
[ Application Events ]
Error - 4/9/2009 12:03:31 PM | Computer Name = MOM | Source = QuickBooks | ID = 4
Description =
Error - 4/9/2009 12:03:31 PM | Computer Name = MOM | Source = QuickBooks | ID = 4
Description =
Error - 4/9/2009 12:03:31 PM | Computer Name = MOM | Source = QuickBooks | ID = 4
Description =
Error - 4/9/2009 12:03:31 PM | Computer Name = MOM | Source = QuickBooks | ID = 4
Description =
Error - 4/9/2009 12:03:31 PM | Computer Name = MOM | Source = QuickBooks | ID = 4
Description =
Error - 4/9/2009 12:04:40 PM | Computer Name = MOM | Source = QuickBooks | ID = 4
Description =
Error - 4/9/2009 12:04:40 PM | Computer Name = MOM | Source = QuickBooks | ID = 4
Description =
Error - 4/9/2009 12:04:40 PM | Computer Name = MOM | Source = QuickBooks | ID = 4
Description =
Error - 4/11/2009 9:08:07 PM | Computer Name = MOM | Source = Automatic LiveUpdate Scheduler | ID = 101
Description =
Error - 4/12/2009 1:01:46 PM | Computer Name = MOM | Source = MsiInstaller | ID = 11306
Description = Product: Norton Internet Security – Error 1306. Another application
has exclusive access to the file 'C:\Documents and Settings\All Users\Application
Data\Symantec\SubEng\submissions.idx'. Please shut down all other applications,
then click Retry.
[ System Events ]
Error - 4/12/2009 5:36:24 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
ppa3
Error - 4/12/2009 5:36:54 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the avast! Web Scanner service
to connect.
Error - 4/12/2009 5:36:54 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7000
Description = The avast! Web Scanner service failed to start due to the following
error: %%1053
Error - 4/12/2009 5:37:31 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the avast! Web Scanner service
to connect.
Error - 4/12/2009 5:37:32 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7000
Description = The avast! Web Scanner service failed to start due to the following
error: %%1053
Error - 4/12/2009 5:38:06 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the avast! Web Scanner service
to connect.
Error - 4/12/2009 5:38:06 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7000
Description = The avast! Web Scanner service failed to start due to the following
error: %%1053
Error - 4/12/2009 5:38:38 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the avast! Web Scanner service
to connect.
Error - 4/12/2009 5:38:38 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7000
Description = The avast! Web Scanner service failed to start due to the following
error: %%1053
Error - 4/12/2009 5:39:24 PM | Computer Name = MOM | Source = Service Control Manager | ID = 7034
Description = The avast! Web Scanner service terminated unexpectedly. It has done
this 1 time(s).
< End of report >
The MBAM log:
Malwarebytes' Anti-Malware 1.36
Database version: 1971
Windows 5.1.2600 Service Pack 3
4/12/2009 2:31:28 PM
mbam-log-2009-04-12 (14-31-28).txt
Scan type: Quick Scan
Objects scanned: 173663
Time elapsed: 32 minute(s), 52 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\0ff.exe (Malware.Tool) -> Quarantined and deleted successfully.
and the latest HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:49:34 PM, on 4/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\avast\aswUpdSv.exe
D:\avast\ashServ.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
D:\avast\ashDisp.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
D:\avast\ashMaiSv.exe
D:\avast\ashWebSv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [avast!] D:\avast\ashDisp.exe
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\RunOnce: [] C:\Program Files\Mozilla Firefox\firefox.exe
http://www.symantec.com/techsupp/servlet/P…00002C.000000E2
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk.disabled
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) -
http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {42D06124-98A2-47EC-8098-3778B58CE7D5} (SupportSoft External Control) -
https://actsvr.comcastonline.com/techtools/…%20Controls.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) -
http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -
http://a1540.g.akamai.net/7/1540/52/200411…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/…b?1120317897959
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1135437924031
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) -
http://zone.msn.com/bingame/zpagames/zpa_txhe.cab60231.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {C432C4BD-3566-411C-8F3C-E5E0D3AE5D33} (CBrowser Class) - http://msltv.multicastmedia.com/common/mbr…MINIBrowser.CAB
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) -
http://h30043.www3.hp.com/aio/eng/check/qdiagh.cab?316
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks Pro\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\avast\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\avast\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\avast\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\avast\ashWebSv.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O24 - Desktop Component 0: (no name) -
http://img.xmradio.com/images/spacer.gif
O24 - Desktop Component 1: (no name) -
http://www.comcast.net/images/global/nav2.gif
–
End of file - 14058 bytes
Hope this helps.
Thanks
