Spyware / Malware / Virus Removal

[Resolved] HiJackThis Log File

5 min read

Looking for the outcome? Ask AI

ebosack Topic Starter

Post #1April 15, 2009, 8:08 PM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:00:35 PM, on 4/15/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\asimpson\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=9396&clcid=0x409
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: &Research - {4AFC04A3-B551-4B68-9BEB-8677D90150D9} - C:\WINDOWS\system32\wincontrol.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SpySweeperEnterprise] "C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.EXE" /StartInTray
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: &Search - ?p=ZKman000
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://datapoint.irr.com
O15 - Trusted Zone: http://*.irr.com
O16 - DPF: {1416D7C8-8A28-11CF-9236-444553540000} (Infragistics Data Explorer Control) - https://www.amtdirect.com/amtapp/Cab/pvxplore8.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {220D02A2-6F7F-4B02-B37C-0F9F61AFED33} (TemplateMgr Class) - http://interconnect.irr.com/iePrintTools.dll
O16 - DPF: {22ACD16F-99EB-11D2-9BB3-00400561D975} (Infragistics Calendar Control) - https://www.amtdirect.com/amtapp/Cab/pvCalendar.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {48F660FA-8B27-4815-947E-D6CD8C5BEC17} (REAppsClientAuth.Logoff) - http://datapoint.irr.com/ClientApps/REAppsClientAuth.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099591151492
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1181590944161
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {B3014671-7872-4671-BE73-5D05EB5B2AF5} (Infragistics UltraGrid Control 2.0) - https://www.amtdirect.com/amtapp/Cab/UltraGrid20.cab
O16 - DPF: {F375116A-793C-11D2-BFE1-444553540001} (First American Res MapActiveX Control) - http://www.realquest.com/mapviewer/mapviewer.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.integra.com
O17 - HKLM\Software\..\Telephony: DomainName = corp.integra.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.integra.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.integra.com
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot CommAgent Service (WebrootCommAgentService) - Webroot Software, Inc. - C:\Program Files\Webroot\Enterprise\Spy Sweeper\commagent.exe

–
End of file - 7823 bytes

ebosack

Post #2April 15, 2009, 8:11 PM UTC

The computer has some sort of a browser hijacker.

Essexboy

Post #3April 15, 2009, 8:15 PM UTC

Hi there you have a backdoor trojan so I need to remove that before it invites it friends to lunch

[external image: Posted Image] Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

THEN

Download OTListIt2 to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

ebosack

Post #4April 16, 2009, 1:43 PM UTC

Malwarebytes' Anti-Malware 1.36
Database version: 1987
Windows 5.1.2600 Service Pack 3

4/16/2009 9:34:05 AM
mbam-log-2009-04-16 (09-34-05).txt

Scan type: Quick Scan
Objects scanned: 211556
Time elapsed: 50 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 21
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4afc04a3-b551-4b68-9beb-8677d90150d9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4afc04a3-b551-4b68-9beb-8677d90150d9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Common Files\Uninstal\PAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Common Files\Uninstal\PAV\Uninstall.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\Program Files\PAV\pav.exe (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wincontrol.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

———————

OTListIt logfile created on: 4/16/2009 9:39:01 AM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\asimpson\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.98 Mb Total Physical Memory | 524.25 Mb Available Physical Memory | 51.65% Memory free
1.64 Gb Paging File | 1.28 Gb Available in Paging File | 78.10% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.86 Gb Total Space | 6.20 Gb Free Space | 17.78% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 136.73 Gb Total Space | 45.11 Gb Free Space | 32.99% Space Free | Partition Type: NTFS
Drive H: | 136.73 Gb Total Space | 45.11 Gb Free Space | 32.99% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded
Drive L: | 67.80 Gb Total Space | 0.69 Gb Free Space | 1.01% Space Free | Partition Type: NTFS
Drive M: | 931.28 Gb Total Space | 849.97 Gb Free Space | 91.27% Space Free | Partition Type: FAT
Drive R: | 136.73 Gb Total Space | 45.11 Gb Free Space | 32.99% Space Free | Partition Type: NTFS
Drive W: | 67.80 Gb Total Space | 0.69 Gb Free Space | 1.01% Space Free | Partition Type: NTFS
Drive Z: | 189.42 Gb Total Space | 27.89 Gb Free Space | 14.72% Space Free | Partition Type: NTFS

Computer Name: EMILY-IBM
Current User Name: asimpson
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\dla\tfswctrl.exe (Sonic Solutions)
PRC - C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.EXE (Webroot Software, Inc.)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Documents and Settings\asimpson\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Disabled | Stopped]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (ccEvtMgr [Disabled | Stopped]) – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (ccSetMgr [Disabled | Stopped]) – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (DefWatch [Disabled | Stopped]) – C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (iPod Service [Disabled | Stopped]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Disabled | Stopped]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LiveUpdate [Disabled | Stopped]) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE (Symantec Corporation)
SRV - (MDM [Disabled | Running]) – C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
SRV - (MGABGEXE [Disabled | Stopped]) – C:\WINDOWS\system32\mgabg.exe (Matrox Graphics Inc.)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (PestPatrol Remote [Disabled | Stopped]) – C:\WINDOWS\system32\ppRemoteService.exe (PestPatrol, Inc.)
SRV - (SavRoam [Disabled | Stopped]) – C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (SNDSrvc [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (SoundMAX Agent Service (default) [Auto | Running]) – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
SRV - (SPBBCSvc [Disabled | Stopped]) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
SRV - (Symantec AntiVirus [Disabled | Stopped]) – C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (WebrootCommAgentService [Auto | Stopped]) – C:\Program Files\Webroot\Enterprise\Spy Sweeper\commagent.exe (Webroot Software, Inc.)
SRV - (WebrootSpySweeperService [Disabled | Stopped]) – C:\Program Files\Webroot\Enterprise\Spy Sweeper\spysweeper.exe (Webroot Software, Inc.)
SRV - (WMPNetworkSvc [Disabled | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (ac97intc [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (aeaudio [On_Demand | Running]) – C:\WINDOWS\system32\drivers\aeaudio.sys (Andrea Electronics Corporation)
DRV - (AliIde [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (amdagp [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (asc [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (CmdIde [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (dac2w2k [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (drvmcdb [Boot | Running]) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (drvnddm [Auto | Running]) – C:\WINDOWS\system32\drivers\drvnddm.sys (Sonic Solutions)
DRV - (E100B [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (eeCtrl [System | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (G400DH [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\g400dhm.sys (Matrox Graphics Inc.)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (mgabg [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\mgabg.sys (Matrox Graphics Inc.)
DRV - (mraid35x [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (NAVENG [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090413.003\NAVENG.SYS (Symantec Corporation)
DRV - (NAVEX15 [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090413.003\NAVEX15.SYS (Symantec Corporation)
DRV - (nv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (pelmouse [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\pelmouse.sys (Primax Electronics Ltd.)
DRV - (pelusblf [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\pelusblf.sys (Primax Electronics Ltd.)
DRV - (PMEM [Auto | Running]) – C:\WINDOWS\system32\drivers\PMEMNT.SYS (Microsoft Corporation)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (ql1080 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql12160 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1280 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (SAVRT [System | Running]) – C:\Program Files\Symantec AntiVirus\savrt.sys (Symantec Corporation)
DRV - (SAVRTPEL [System | Running]) – C:\Program Files\Symantec AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (sisagp [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (smwdm [On_Demand | Running]) – C:\WINDOWS\system32\drivers\smwdm.sys (Analog Devices, Inc.)
DRV - (SONYPVU1 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (Sparrow [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (SPBBCDrv [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (sscdbhk5 [System | Running]) – C:\WINDOWS\system32\drivers\sscdbhk5.sys (Sonic Solutions)
DRV - (SSFS041A [Boot | Running]) – C:\WINDOWS\SYSTEM32\Drivers\SSFS041A.SYS (Webroot Software Inc (www.webroot.com))
DRV - (SSHRMD [Boot | Running]) – C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS (Webroot Software Inc (www.webroot.com))
DRV - (SSIDRV [Boot | Running]) – C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS (Webroot Software Inc (www.webroot.com))
DRV - (ssrtln [System | Running]) – C:\WINDOWS\system32\drivers\ssrtln.sys (Sonic Solutions)
DRV - (symc810 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (symc8xx [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (SymEvent [On_Demand | Running]) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMREDRV [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMTDI [System | Running]) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (sym_hi [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (sym_u3 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (tfsnboio [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsncofs [Auto | Running]) – C:\WINDOWS\system32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsndrct [Auto | Running]) – C:\WINDOWS\system32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres [Auto | Running]) – C:\WINDOWS\system32\dla\tfsndres.sys (Sonic Solutions)
DRV - (tfsnifs [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsnopio [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsnudf [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnudfa [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (ultra [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (UtilNT [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\UtilNT.sys (Matrox Graphics Inc.)
DRV - ({6080A529-897E-4629-A488-ABA0C29B635E} [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ialmsbw.sys (Intel Corporation)
DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91} [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ialmkchw.sys (Intel Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\S-1-5-21-1630905916-499750001-2300041866-1121\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\extensions\\[removed]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/03/11 09:27:42 | 00,000,000 | —D | M]

O1 HOSTS File: (312232 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 10750 more lines…
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..\Toolbar\WebBrowser: (no name) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" (Symantec Corporation)
O4 - HKLM..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe (Sonic Solutions)
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SpySweeperEnterprise] "C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.EXE" /StartInTray (Webroot Software, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search - ?p=ZKman000 File not found
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html File not found
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_12.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\.DEFAULT\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Sites: irr.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Sites: irr.com ([]https in Trusted sites)
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Domains: irr.com ([datapoint] http in Trusted sites)
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Domains: irr.com ([datapoint] https in Trusted sites)
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {1416D7C8-8A28-11CF-9236-444553540000} https://www.amtdirect.com/amtapp/Cab/pvxplore8.cab (Infragistics Data Explorer Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {220D02A2-6F7F-4B02-B37C-0F9F61AFED33} http://interconnect.irr.com/iePrintTools.dll (TemplateMgr Class)
O16 - DPF: {22ACD16F-99EB-11D2-9BB3-00400561D975} https://www.amtdirect.com/amtapp/Cab/pvCalendar.cab (Infragistics Calendar Control)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {48F660FA-8B27-4815-947E-D6CD8C5BEC17} http://datapoint.irr.com/ClientApps/REAppsClientAuth.cab (REAppsClientAuth.Logoff)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1099591151492 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1181590944161 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/…tiveXPlugin.cab (Reg Error: Key error.)
O16 - DPF: {B3014671-7872-4671-BE73-5D05EB5B2AF5} https://www.amtdirect.com/amtapp/Cab/UltraGrid20.cab (Infragistics UltraGrid Control 2.0)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4.0/…all-140-win.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F375116A-793C-11D2-BFE1-444553540001} http://www.realquest.com/mapviewer/mapviewer.cab (First American Res MapActiveX Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.integra.com
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2 C:\WINDOWS\*.tmp files]
[2009/04/15 16:49:10 | 00,000,000 | —D | C] – C:\Documents and Settings\asimpson\Application Data\Malwarebytes
[2009/04/15 16:49:08 | 00,015,504 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/15 16:49:08 | 00,000,707 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/15 16:49:05 | 00,038,496 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/15 16:49:04 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/04/15 16:49:04 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/04/15 16:48:17 | 00,501,248 | —- | C] (OldTimer Tools) – C:\Documents and Settings\asimpson\Desktop\OTListIt2.exe
[2009/04/15 16:48:07 | 02,967,800 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\asimpson\Desktop\mbam-setup.exe
[2009/04/15 15:58:56 | 00,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\asimpson\Desktop\HiJackThis.exe
[2009/04/15 11:17:41 | 00,008,520 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\2.jpg
[2009/04/15 11:17:37 | 00,008,018 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\1.jpg
[2009/04/15 10:19:39 | 00,040,664 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Fed Ex-161-2008-0047.pdf
[2009/04/15 09:43:54 | 00,473,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fastprox.dll
[2009/04/15 09:43:54 | 00,453,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvsd.dll
[2009/04/15 09:43:54 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcss.dll
[2009/04/15 09:43:54 | 00,284,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pdh.dll
[2009/04/15 09:43:54 | 00,227,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvse.exe
[2009/04/15 09:43:54 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\services.exe
[2009/04/15 09:43:54 | 00,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sc.exe
[2009/04/15 09:43:53 | 00,729,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lsasrv.dll
[2009/04/15 09:43:53 | 00,714,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntdll.dll
[2009/04/15 09:43:53 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\advapi32.dll
[2009/04/15 09:42:33 | 00,002,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsp4res.dll
[2009/04/15 09:42:32 | 01,203,922 | —- | C] () – C:\WINDOWS\System32\dllcache\sysmain.sdb
[2009/04/15 09:42:32 | 00,215,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wordpad.exe
[2009/04/14 14:46:17 | 00,000,944 | —- | C] () – C:\Documents and Settings\asimpson\Desktop\Spybot - Search & Destroy.lnk
[2009/04/10 10:25:48 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2009/04/09 12:36:05 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Uninstal
[2009/04/09 12:35:47 | 00,000,000 | —D | C] – C:\Program Files\PAV
[2009/04/09 12:31:24 | 00,036,349 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Hibachi.jpg
[2009/04/08 09:57:47 | 01,870,336 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Brian_Stoffers-Examining the Outlook for Lending.ppt
[2009/04/08 09:57:11 | 00,161,792 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Ralph_Rose-Examining the Outlook for Lending.ppt
[2009/04/07 09:50:12 | 00,124,213 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Literature.pdf
[2009/04/03 12:50:18 | 00,012,765 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Another Example.jpg
[2009/04/03 12:40:46 | 00,058,045 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Example.jpg
[2009/04/01 16:31:29 | 05,997,144 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\131-2009-0026 Frankford Ave Condos-FINAL.pdf
[2009/03/31 15:50:34 | 00,471,392 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Tax Info.pdf
[2009/03/30 10:00:54 | 00,194,048 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Improved Sales.est
[2009/03/26 15:24:00 | 00,000,000 | —D | C] – C:\Documents and Settings\asimpson\Application Data\Sibelius Software
[2009/03/21 10:06:58 | 00,989,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kernel32.dll
[2008/12/11 19:34:58 | 00,000,072 | —- | C] () – C:\WINDOWS\MediaManager.INI
[2008/12/11 16:46:19 | 01,040,384 | —- | C] () – C:\WINDOWS\System32\vorbisenc.dll
[2008/12/11 16:46:19 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\OggDS.dll
[2008/12/11 16:46:19 | 00,077,824 | —- | C] () – C:\WINDOWS\System32\vorbisfile.dll
[2008/12/11 16:46:18 | 01,163,264 | —- | C] () – C:\WINDOWS\System32\vorbis.dll
[2008/12/11 16:46:18 | 00,730,659 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2008/12/11 16:46:18 | 00,421,888 | —- | C] () – C:\WINDOWS\System32\OpenQuicktimeLib.dll
[2008/12/11 16:46:18 | 00,225,280 | —- | C] () – C:\WINDOWS\System32\qtmlClient.dll
[2008/12/11 16:46:18 | 00,155,648 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/12/11 16:46:18 | 00,061,440 | —- | C] () – C:\WINDOWS\System32\ogg.dll
[2008/12/11 16:46:18 | 00,049,152 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2008/12/11 16:46:17 | 00,164,352 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2008/12/11 16:46:17 | 00,043,520 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2008/12/11 16:46:16 | 01,115,648 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2008/12/11 16:46:15 | 00,196,608 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2008/12/11 16:46:15 | 00,129,024 | —- | C] () – C:\WINDOWS\System32\ff_mpeg2enc.dll
[2008/12/11 16:46:15 | 00,115,200 | —- | C] () – C:\WINDOWS\System32\ff_samplerate.dll
[2008/12/11 16:46:15 | 00,107,008 | —- | C] () – C:\WINDOWS\System32\ff_theora.dll
[2008/12/11 16:46:15 | 00,107,008 | —- | C] () – C:\WINDOWS\System32\ff_realaac.dll
[2008/12/11 16:46:15 | 00,049,664 | —- | C] () – C:\WINDOWS\System32\ff_tremor.dll
[2008/12/11 16:46:15 | 00,037,888 | —- | C] () – C:\WINDOWS\System32\ff_unrar.dll
[2008/12/11 16:46:15 | 00,023,552 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2008/12/11 16:46:14 | 00,186,880 | —- | C] () – C:\WINDOWS\System32\ff_libfaad2.dll
[2008/12/11 16:46:14 | 00,122,880 | —- | C] () – C:\WINDOWS\System32\ff_libdts.dll
[2008/12/11 16:46:14 | 00,086,528 | —- | C] () – C:\WINDOWS\System32\ff_libmad.dll
[2008/12/11 16:46:14 | 00,057,344 | —- | C] () – C:\WINDOWS\System32\ff_kerneldeint.dll
[2008/12/11 16:46:14 | 00,049,664 | —- | C] () – C:\WINDOWS\System32\ff_liba52.dll
[2007/01/15 16:28:54 | 00,010,593 | —- | C] () – C:\WINDOWS\CSTBox.INI
[2007/01/15 16:17:58 | 00,040,960 | —- | C] () – C:\WINDOWS\System32\IPPCPUID.DLL
[2007/01/15 16:17:05 | 00,011,776 | —- | C] () – C:\WINDOWS\System32\pmsbfn32.dll
[2007/01/15 16:14:48 | 00,000,419 | —- | C] () – C:\WINDOWS\MAXLINK.INI
[2005/10/13 11:23:40 | 00,000,165 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2005/09/14 17:35:14 | 00,000,000 | R— | C] () – C:\WINDOWS\SA2006.ini
[2004/11/04 13:15:51 | 00,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2004/07/02 13:41:46 | 00,000,000 | —- | C] () – C:\WINDOWS\JDSecure20.INI
[2004/03/03 14:31:38 | 00,000,058 | —- | C] () – C:\WINDOWS\WINHELP.INI
[2004/01/28 13:02:03 | 00,000,191 | —- | C] () – C:\WINDOWS\DOCSTAR.INI
[2004/01/28 13:01:58 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\w048t32w.dll
[2004/01/28 13:01:58 | 00,223,232 | —- | C] () – C:\WINDOWS\System32\w042t32w.dll
[2004/01/28 13:01:58 | 00,169,472 | —- | C] () – C:\WINDOWS\System32\w037t32w.dll
[2004/01/28 13:01:58 | 00,164,864 | —- | C] () – C:\WINDOWS\System32\w033t32w.dll
[2004/01/28 13:01:58 | 00,138,240 | —- | C] () – C:\WINDOWS\System32\w043t32w.dll
[2004/01/28 13:01:58 | 00,128,000 | —- | C] () – C:\WINDOWS\System32\w046t32w.dll
[2004/01/28 13:01:58 | 00,099,840 | —- | C] () – C:\WINDOWS\System32\w021t32w.dll
[2004/01/28 13:01:58 | 00,098,304 | —- | C] () – C:\WINDOWS\System32\w040t32w.dll
[2004/01/28 13:01:58 | 00,097,280 | —- | C] () – C:\WINDOWS\System32\w801t32w.dll
[2004/01/28 13:01:58 | 00,084,480 | —- | C] () – C:\WINDOWS\System32\w770t32w.dll
[2004/01/28 13:01:57 | 00,235,008 | —- | C] () – C:\WINDOWS\System32\g615t32w.dll
[2004/01/28 13:01:57 | 00,218,624 | —- | C] () – C:\WINDOWS\System32\w019t32w.dll
[2004/01/28 13:01:57 | 00,185,856 | —- | C] () – C:\WINDOWS\System32\w007t32w.dll
[2004/01/28 13:01:57 | 00,121,856 | —- | C] () – C:\WINDOWS\System32\w020t32w.dll
[2004/01/28 13:01:57 | 00,107,520 | —- | C] () – C:\WINDOWS\System32\w001t32w.dll
[2004/01/28 13:01:57 | 00,105,984 | —- | C] () – C:\WINDOWS\System32\w010t32w.dll
[2004/01/28 13:01:57 | 00,105,984 | —- | C] () – C:\WINDOWS\System32\w008t32w.dll
[2004/01/28 13:01:57 | 00,101,888 | —- | C] () – C:\WINDOWS\System32\w015t32w.dll
[2004/01/28 13:01:57 | 00,090,112 | —- | C] () – C:\WINDOWS\System32\w006t32w.dll
[2004/01/28 13:01:56 | 00,254,464 | —- | C] () – C:\WINDOWS\System32\g521t32w.dll
[2004/01/28 13:01:56 | 00,240,128 | —- | C] () – C:\WINDOWS\System32\g610t32w.dll
[2004/01/28 13:01:56 | 00,236,544 | —- | C] () – C:\WINDOWS\System32\g606t32w.dll
[2004/01/28 13:01:56 | 00,123,904 | —- | C] () – C:\WINDOWS\System32\g521f32w.dll
[2004/01/28 13:01:56 | 00,105,984 | —- | C] () – C:\WINDOWS\System32\g502f32w.dll
[2004/01/28 13:01:56 | 00,091,648 | —- | C] () – C:\WINDOWS\System32\g610f32w.dll
[2004/01/28 13:01:46 | 00,044,544 | —- | C] () – C:\WINDOWS\System32\binder.dll
[2004/01/28 13:01:30 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\wisemsg.dll
[2003/12/02 10:51:17 | 00,000,000 | —- | C] () – C:\WINDOWS\PROTOCOL.INI
[2003/11/25 16:50:23 | 00,000,100 | —- | C] () – C:\WINDOWS\webica.ini
[2003/11/18 14:19:54 | 00,000,885 | —- | C] () – C:\WINDOWS\lrun32.ini
[2003/11/18 14:19:46 | 00,000,602 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/11/06 21:39:40 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/11/06 21:33:19 | 00,000,138 | —- | C] () – C:\WINDOWS\wininit.ini
[2003/11/06 21:32:11 | 00,000,023 | —- | C] () – C:\WINDOWS\Welcome.ini
[2003/11/06 21:25:43 | 00,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2003/11/06 21:25:25 | 00,004,902 | —- | C] () – C:\WINDOWS\System32\Setup2k.ini
[2003/11/06 21:25:25 | 00,000,267 | —- | C] () – C:\WINDOWS\System32\presetup.ini
[2003/11/06 21:20:28 | 00,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/11/06 21:14:46 | 00,002,481 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/06/20 13:00:06 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/02/19 17:39:14 | 00,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/11/15 06:14:26 | 00,143,360 | —- | C] () – C:\WINDOWS\System32\AIBMRUNL.dll
[2002/05/24 05:00:00 | 00,208,896 | —- | C] () – C:\WINDOWS\System32\lockout.dll
[2002/05/24 05:00:00 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\lockres.dll
[1980/01/01 04:00:00 | 00,000,794 | —- | C] () – C:\WINDOWS\win.ini
[1980/01/01 04:00:00 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[44 C:\WINDOWS\System32\*.tmp files]
[2 C:\WINDOWS\*.tmp files]
[2009/04/16 09:40:24 | 00,481,674 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/04/16 09:40:24 | 00,409,232 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/04/16 09:40:24 | 00,064,372 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/04/16 09:37:20 | 00,000,794 | —- | M] () – C:\WINDOWS\win.ini
[2009/04/16 09:37:20 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/04/16 09:37:20 | 00,000,211 | RHS- | M] () – C:\BOOT.INI
[2009/04/16 09:36:35 | 00,002,278 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/04/16 09:35:58 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/04/16 09:35:53 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/04/16 09:35:45 | 10,643,57888 | -HS- | M] () – C:\hiberfil.sys
[2009/04/16 09:32:00 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/04/15 16:49:08 | 00,000,707 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/15 16:45:56 | 00,501,248 | —- | M] (OldTimer Tools) – C:\Documents and Settings\asimpson\Desktop\OTListIt2.exe
[2009/04/15 16:45:11 | 02,967,800 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\asimpson\Desktop\mbam-setup.exe
[2009/04/15 15:58:58 | 00,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\asimpson\Desktop\HiJackThis.exe
[2009/04/15 11:16:35 | 00,008,520 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\2.jpg
[2009/04/15 11:16:34 | 00,008,018 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\1.jpg
[2009/04/15 10:19:39 | 00,040,664 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Fed Ex-161-2008-0047.pdf
[2009/04/14 14:49:33 | 00,312,232 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/04/14 14:46:17 | 00,000,944 | —- | M] () – C:\Documents and Settings\asimpson\Desktop\Spybot - Search & Destroy.lnk
[2009/04/09 12:33:30 | 00,036,349 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Hibachi.jpg
[2009/04/08 09:59:00 | 01,870,336 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Brian_Stoffers-Examining the Outlook for Lending.ppt
[2009/04/08 09:57:12 | 00,161,792 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Ralph_Rose-Examining the Outlook for Lending.ppt
[2009/04/07 21:25:04 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/04/07 09:50:13 | 00,124,213 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Literature.pdf
[2009/04/06 15:32:54 | 00,038,496 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/06 15:32:46 | 00,015,504 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/06 10:57:24 | 24,921,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe
[2009/04/03 12:49:54 | 00,012,765 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Another Example.jpg
[2009/04/03 12:40:15 | 00,058,045 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Example.jpg
[2009/04/01 16:35:08 | 05,997,144 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\131-2009-0026 Frankford Ave Condos-FINAL.pdf
[2009/04/01 10:27:39 | 00,000,100 | —- | M] () – C:\WINDOWS\webica.ini
[2009/03/31 15:50:34 | 00,471,392 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Tax Info.pdf
[2009/03/30 10:00:55 | 00,194,048 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Improved Sales.est
[2009/03/30 09:10:30 | 00,340,240 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/03/27 11:47:54 | 00,095,592 | —- | M] () – C:\Documents and Settings\asimpson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/03/27 02:58:38 | 01,203,922 | —- | M] () – C:\WINDOWS\System32\dllcache\sysmain.sdb
[2009/03/21 10:06:58 | 00,989,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\kernel32.dll
[2009/03/21 10:06:58 | 00,989,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kernel32.dll

========== LOP Check ==========

[2005/10/13 11:18:47 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Administrator\Application Data
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Identities
[2003/12/15 11:10:11 | 00,000,000 | –SD | M] – C:\Documents and Settings\Administrator\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Symantec
[2008/06/16 10:25:14 | 00,000,000 | RH-D | M] – C:\Documents and Settings\administrator.CORP\Application Data
[2008/06/16 10:31:25 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Adobe
[2007/01/15 16:28:17 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\AdobeUM
[2007/01/11 11:11:07 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Brightmail
[2007/01/15 16:26:19 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Canon
[2008/06/16 10:25:14 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Google
[2007/04/03 15:13:51 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Identities
[2005/10/13 11:21:35 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Macromedia
[2007/04/03 15:31:07 | 00,000,000 | –SD | M] – C:\Documents and Settings\administrator.CORP\Application Data\Microsoft
[2007/01/15 16:27:56 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\NewSoft
[2007/01/11 11:31:34 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\OfficeUpdate12
[2007/01/15 16:14:40 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\ScanSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Symantec
[2006/07/20 14:57:27 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Webroot
[2009/04/15 16:49:04 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2008/12/01 11:23:25 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2008/06/25 09:35:17 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2008/04/23 12:21:50 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple
[2008/04/23 12:24:54 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2008/12/11 18:13:22 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2007/04/18 11:12:38 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IBM
[2007/01/15 16:14:43 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallShield
[2009/04/15 16:49:04 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2007/06/11 15:58:19 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2005/06/23 19:44:19 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2007/09/12 09:09:19 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuickTime
[2003/02/19 17:40:02 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBSI
[2007/11/08 11:25:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2009/04/14 14:47:40 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2007/07/11 13:13:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Symantec
[2008/11/04 14:56:46 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2005/08/17 14:53:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2007/10/01 14:04:11 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\zeon
[2009/04/15 16:49:10 | 00,000,000 | -H-D | M] – C:\Documents and Settings\asimpson\Application Data
[2008/06/16 10:41:25 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Adobe
[2009/04/15 11:16:18 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\AdobeUM
[2007/09/19 12:32:51 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Apple Computer
[2008/12/11 18:23:49 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\AVS4YOU
[2007/02/14 15:34:42 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Brightmail
[2007/01/17 17:46:32 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Canon
[2008/04/25 11:35:17 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\eFax Messenger
[2007/10/29 15:26:54 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Google
[2007/08/07 14:40:05 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Help
[2007/02/19 11:37:19 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Identities
[2007/10/17 09:44:43 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\InterTrust
[2009/01/26 12:43:41 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\LimeWire
[2007/02/14 15:39:25 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Macromedia
[2009/04/15 16:49:10 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Malwarebytes
[2009/04/09 12:56:40 | 00,000,000 | –SD | M] – C:\Documents and Settings\asimpson\Application Data\Microsoft
[2007/01/17 17:48:11 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\NewSoft
[2007/11/08 11:24:55 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\ScanSoft
[2009/03/26 15:24:00 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Sibelius Software
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Sonic
[2007/09/27 09:59:43 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Sun
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Symantec
[2008/11/04 14:56:48 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Viewpoint
[2007/10/01 14:05:43 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Zeon
[2006/06/16 08:29:57 | 00,000,000 | RH-D | M] – C:\Documents and Settings\aweber\Application Data
[2006/06/16 08:29:57 | 00,000,000 | —D | M] – C:\Documents and Settings\aweber\Application Data\Adobe
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\aweber\Application Data\Identities
[2006/06/15 17:54:25 | 00,000,000 | –SD | M] – C:\Documents and Settings\aweber\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\aweber\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\aweber\Application Data\Symantec
[2007/03/15 10:27:10 | 00,000,000 | RH-D | M] – C:\Documents and Settings\bsjohnson\Application Data
[2007/01/23 17:00:10 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Adobe
[2007/03/06 12:27:14 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Brightmail
[2007/01/23 16:58:34 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Canon
[2007/03/06 16:15:03 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Help
[2007/03/15 10:27:26 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Identities
[2007/03/06 11:54:12 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Macromedia
[2007/04/24 14:59:22 | 00,000,000 | –SD | M] – C:\Documents and Settings\bsjohnson\Application Data\Microsoft
[2007/01/23 16:59:58 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Symantec
[2007/05/01 16:18:36 | 00,000,000 | RH-D | M] – C:\Documents and Settings\cmccready\Application Data
[2007/01/15 17:51:11 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Adobe
[2007/01/15 17:51:14 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\AdobeUM
[2007/02/23 18:27:00 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Brightmail
[2007/01/15 17:49:32 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Canon
[2007/05/01 16:30:07 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Identities
[2007/05/01 15:06:07 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Macromedia
[2007/02/23 17:34:49 | 00,000,000 | –SD | M] – C:\Documents and Settings\cmccready\Application Data\Microsoft
[2007/01/15 17:50:46 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Symantec
[2003/02/19 17:19:28 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Default User\Application Data
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\Identities
[2003/02/19 17:19:10 | 00,000,000 | –SD | M] – C:\Documents and Settings\Default User\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\Symantec
[2007/03/02 15:22:24 | 00,000,000 | RH-D | M] – C:\Documents and Settings\ebosack\Application Data
[2007/01/16 14:36:32 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Adobe
[2007/01/16 16:56:26 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\ArcSoft
[2007/03/02 15:24:30 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Brightmail
[2007/01/16 10:03:20 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Canon
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Identities
[2007/01/16 14:24:42 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Macromedia
[2007/03/02 15:22:33 | 00,000,000 | –SD | M] – C:\Documents and Settings\ebosack\Application Data\Microsoft
[2007/01/16 10:04:37 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Symantec
[2005/09/14 17:45:41 | 00,000,000 | RH-D | M] – C:\Documents and Settings\erisser\Application Data
[2005/06/08 15:52:00 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Adobe
[2005/10/12 13:36:17 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\AdobeUM
[2005/09/14 17:45:41 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\DeLorme
[2005/06/08 16:16:03 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Identities
[2005/06/08 13:55:18 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Macromedia
[2005/09/08 16:18:31 | 00,000,000 | –SD | M] – C:\Documents and Settings\erisser\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Symantec
[2006/05/05 17:08:03 | 00,000,000 | RH-D | M] – C:\Documents and Settings\erisser.CORP\Application Data
[2005/10/13 15:10:48 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Adobe
[2007/09/02 13:15:57 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\AdobeUM
[2005/10/13 14:34:44 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\DeLorme
[2006/03/25 16:38:21 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Help
[2005/10/17 16:52:59 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Identities
[2005/10/13 11:50:34 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Macromedia
[2006/02/01 15:18:26 | 00,000,000 | –SD | M] – C:\Documents and Settings\erisser.CORP\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Symantec
[2006/05/05 17:08:03 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\VERITAS
[2009/02/04 16:51:43 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data
[2009/02/04 16:51:43 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Google
[2007/06/26 12:06:38 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2006/07/20 14:57:36 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Webroot
[2007/01/17 11:38:50 | 00,000,000 | RH-D | M] – C:\Documents and Settings\lolagunju\Application Data
[2006/05/31 15:03:22 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Adobe
[2007/02/07 12:50:16 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\AdobeUM
[2007/01/15 14:59:31 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Brightmail
[2007/01/17 11:15:29 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Canon
[2006/10/17 13:09:53 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Help
[2006/06/07 16:51:01 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\IBM
[2006/07/24 09:42:00 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Identities
[2006/05/31 14:09:58 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Macromedia
[2007/01/15 14:58:45 | 00,000,000 | –SD | M] – C:\Documents and Settings\lolagunju\Application Data\Microsoft
[2007/01/17 11:38:50 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Symantec
[2007/01/15 17:59:20 | 00,000,000 | RH-D | M] – C:\Documents and Settings\msilverman\Application Data
[2007/01/15 17:59:20 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Adobe
[2007/01/15 17:57:41 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Canon
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Identities
[2003/02/19 17:19:10 | 00,000,000 | –SD | M] – C:\Documents and Settings\msilverman\Application Data\Microsoft
[2007/01/15 17:58:49 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Symantec
[2006/08/01 13:59:36 | 00,000,000 | RH-D | M] – C:\Documents and Settings\mstoner\Application Data
[2006/08/01 13:59:36 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Adobe
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Identities
[2006/08/01 13:57:34 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Macromedia
[2006/08/01 15:12:15 | 00,000,000 | –SD | M] – C:\Documents and Settings\mstoner\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Symantec
[2003/02/19 17:34:20 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data
[2003/02/19 17:19:10 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/02/06 13:03:41 | 00,000,000 | RH-D | M] – C:\Documents and Settings\scrossley\Application Data
[2009/02/06 13:06:11 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Adobe
[2009/02/06 13:01:04 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Google
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Identities
[2009/02/06 13:03:41 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Macromedia
[2009/02/06 13:03:41 | 00,000,000 | –SD | M] – C:\Documents and Settings\scrossley\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Symantec
[2009/04/07 21:25:04 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2001/08/18 06:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/04/16 09:35:58 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

< End of report >

—————————-

OTListIt logfile created on: 4/16/2009 9:39:01 AM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\asimpson\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.98 Mb Total Physical Memory | 524.25 Mb Available Physical Memory | 51.65% Memory free
1.64 Gb Paging File | 1.28 Gb Available in Paging File | 78.10% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.86 Gb Total Space | 6.20 Gb Free Space | 17.78% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 136.73 Gb Total Space | 45.11 Gb Free Space | 32.99% Space Free | Partition Type: NTFS
Drive H: | 136.73 Gb Total Space | 45.11 Gb Free Space | 32.99% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded
Drive L: | 67.80 Gb Total Space | 0.69 Gb Free Space | 1.01% Space Free | Partition Type: NTFS
Drive M: | 931.28 Gb Total Space | 849.97 Gb Free Space | 91.27% Space Free | Partition Type: FAT
Drive R: | 136.73 Gb Total Space | 45.11 Gb Free Space | 32.99% Space Free | Partition Type: NTFS
Drive W: | 67.80 Gb Total Space | 0.69 Gb Free Space | 1.01% Space Free | Partition Type: NTFS
Drive Z: | 189.42 Gb Total Space | 27.89 Gb Free Space | 14.72% Space Free | Partition Type: NTFS

Computer Name: EMILY-IBM
Current User Name: asimpson
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\dla\tfswctrl.exe (Sonic Solutions)
PRC - C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.EXE (Webroot Software, Inc.)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Documents and Settings\asimpson\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Disabled | Stopped]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (ccEvtMgr [Disabled | Stopped]) – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (ccSetMgr [Disabled | Stopped]) – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (DefWatch [Disabled | Stopped]) – C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (iPod Service [Disabled | Stopped]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Disabled | Stopped]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LiveUpdate [Disabled | Stopped]) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE (Symantec Corporation)
SRV - (MDM [Disabled | Running]) – C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
SRV - (MGABGEXE [Disabled | Stopped]) – C:\WINDOWS\system32\mgabg.exe (Matrox Graphics Inc.)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (PestPatrol Remote [Disabled | Stopped]) – C:\WINDOWS\system32\ppRemoteService.exe (PestPatrol, Inc.)
SRV - (SavRoam [Disabled | Stopped]) – C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (SNDSrvc [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (SoundMAX Agent Service (default) [Auto | Running]) – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
SRV - (SPBBCSvc [Disabled | Stopped]) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
SRV - (Symantec AntiVirus [Disabled | Stopped]) – C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (WebrootCommAgentService [Auto | Stopped]) – C:\Program Files\Webroot\Enterprise\Spy Sweeper\commagent.exe (Webroot Software, Inc.)
SRV - (WebrootSpySweeperService [Disabled | Stopped]) – C:\Program Files\Webroot\Enterprise\Spy Sweeper\spysweeper.exe (Webroot Software, Inc.)
SRV - (WMPNetworkSvc [Disabled | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (ac97intc [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (aeaudio [On_Demand | Running]) – C:\WINDOWS\system32\drivers\aeaudio.sys (Andrea Electronics Corporation)
DRV - (AliIde [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (amdagp [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (asc [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (CmdIde [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (dac2w2k [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (drvmcdb [Boot | Running]) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (drvnddm [Auto | Running]) – C:\WINDOWS\system32\drivers\drvnddm.sys (Sonic Solutions)
DRV - (E100B [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (eeCtrl [System | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (G400DH [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\g400dhm.sys (Matrox Graphics Inc.)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (mgabg [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\mgabg.sys (Matrox Graphics Inc.)
DRV - (mraid35x [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (NAVENG [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090413.003\NAVENG.SYS (Symantec Corporation)
DRV - (NAVEX15 [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090413.003\NAVEX15.SYS (Symantec Corporation)
DRV - (nv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (pelmouse [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\pelmouse.sys (Primax Electronics Ltd.)
DRV - (pelusblf [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\pelusblf.sys (Primax Electronics Ltd.)
DRV - (PMEM [Auto | Running]) – C:\WINDOWS\system32\drivers\PMEMNT.SYS (Microsoft Corporation)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (ql1080 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql12160 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1280 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (SAVRT [System | Running]) – C:\Program Files\Symantec AntiVirus\savrt.sys (Symantec Corporation)
DRV - (SAVRTPEL [System | Running]) – C:\Program Files\Symantec AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (sisagp [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (smwdm [On_Demand | Running]) – C:\WINDOWS\system32\drivers\smwdm.sys (Analog Devices, Inc.)
DRV - (SONYPVU1 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (Sparrow [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (SPBBCDrv [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (sscdbhk5 [System | Running]) – C:\WINDOWS\system32\drivers\sscdbhk5.sys (Sonic Solutions)
DRV - (SSFS041A [Boot | Running]) – C:\WINDOWS\SYSTEM32\Drivers\SSFS041A.SYS (Webroot Software Inc (www.webroot.com))
DRV - (SSHRMD [Boot | Running]) – C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS (Webroot Software Inc (www.webroot.com))
DRV - (SSIDRV [Boot | Running]) – C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS (Webroot Software Inc (www.webroot.com))
DRV - (ssrtln [System | Running]) – C:\WINDOWS\system32\drivers\ssrtln.sys (Sonic Solutions)
DRV - (symc810 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (symc8xx [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (SymEvent [On_Demand | Running]) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMREDRV [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMTDI [System | Running]) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (sym_hi [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (sym_u3 [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (tfsnboio [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsncofs [Auto | Running]) – C:\WINDOWS\system32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsndrct [Auto | Running]) – C:\WINDOWS\system32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres [Auto | Running]) – C:\WINDOWS\system32\dla\tfsndres.sys (Sonic Solutions)
DRV - (tfsnifs [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsnopio [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsnudf [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnudfa [Auto | Running]) – C:\WINDOWS\system32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (ultra [Disabled | Stopped]) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (UtilNT [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\UtilNT.sys (Matrox Graphics Inc.)
DRV - ({6080A529-897E-4629-A488-ABA0C29B635E} [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ialmsbw.sys (Intel Corporation)
DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91} [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ialmkchw.sys (Intel Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome
IE - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\S-1-5-21-1630905916-499750001-2300041866-1121\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\extensions\\[removed]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/03/11 09:27:42 | 00,000,000 | —D | M]

O1 HOSTS File: (312232 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 10750 more lines…
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..\Toolbar\WebBrowser: (no name) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" (Symantec Corporation)
O4 - HKLM..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe (Sonic Solutions)
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SpySweeperEnterprise] "C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.EXE" /StartInTray (Webroot Software, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search - ?p=ZKman000 File not found
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html File not found
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_12.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\.DEFAULT\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Sites: irr.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Sites: irr.com ([]https in Trusted sites)
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Domains: irr.com ([datapoint] http in Trusted sites)
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Domains: irr.com ([datapoint] https in Trusted sites)
O15 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {1416D7C8-8A28-11CF-9236-444553540000} https://www.amtdirect.com/amtapp/Cab/pvxplore8.cab (Infragistics Data Explorer Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {220D02A2-6F7F-4B02-B37C-0F9F61AFED33} http://interconnect.irr.com/iePrintTools.dll (TemplateMgr Class)
O16 - DPF: {22ACD16F-99EB-11D2-9BB3-00400561D975} https://www.amtdirect.com/amtapp/Cab/pvCalendar.cab (Infragistics Calendar Control)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {48F660FA-8B27-4815-947E-D6CD8C5BEC17} http://datapoint.irr.com/ClientApps/REAppsClientAuth.cab (REAppsClientAuth.Logoff)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1099591151492 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1181590944161 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/…tiveXPlugin.cab (Reg Error: Key error.)
O16 - DPF: {B3014671-7872-4671-BE73-5D05EB5B2AF5} https://www.amtdirect.com/amtapp/Cab/UltraGrid20.cab (Infragistics UltraGrid Control 2.0)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4.0/…all-140-win.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F375116A-793C-11D2-BFE1-444553540001} http://www.realquest.com/mapviewer/mapviewer.cab (First American Res MapActiveX Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.integra.com
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2 C:\WINDOWS\*.tmp files]
[2009/04/15 16:49:10 | 00,000,000 | —D | C] – C:\Documents and Settings\asimpson\Application Data\Malwarebytes
[2009/04/15 16:49:08 | 00,015,504 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/15 16:49:08 | 00,000,707 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/15 16:49:05 | 00,038,496 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/15 16:49:04 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/04/15 16:49:04 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/04/15 16:48:17 | 00,501,248 | —- | C] (OldTimer Tools) – C:\Documents and Settings\asimpson\Desktop\OTListIt2.exe
[2009/04/15 16:48:07 | 02,967,800 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\asimpson\Desktop\mbam-setup.exe
[2009/04/15 15:58:56 | 00,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\asimpson\Desktop\HiJackThis.exe
[2009/04/15 11:17:41 | 00,008,520 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\2.jpg
[2009/04/15 11:17:37 | 00,008,018 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\1.jpg
[2009/04/15 10:19:39 | 00,040,664 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Fed Ex-161-2008-0047.pdf
[2009/04/15 09:43:54 | 00,473,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fastprox.dll
[2009/04/15 09:43:54 | 00,453,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvsd.dll
[2009/04/15 09:43:54 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcss.dll
[2009/04/15 09:43:54 | 00,284,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pdh.dll
[2009/04/15 09:43:54 | 00,227,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvse.exe
[2009/04/15 09:43:54 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\services.exe
[2009/04/15 09:43:54 | 00,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sc.exe
[2009/04/15 09:43:53 | 00,729,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lsasrv.dll
[2009/04/15 09:43:53 | 00,714,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntdll.dll
[2009/04/15 09:43:53 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\advapi32.dll
[2009/04/15 09:42:33 | 00,002,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsp4res.dll
[2009/04/15 09:42:32 | 01,203,922 | —- | C] () – C:\WINDOWS\System32\dllcache\sysmain.sdb
[2009/04/15 09:42:32 | 00,215,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wordpad.exe
[2009/04/14 14:46:17 | 00,000,944 | —- | C] () – C:\Documents and Settings\asimpson\Desktop\Spybot - Search & Destroy.lnk
[2009/04/10 10:25:48 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2009/04/09 12:36:05 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Uninstal
[2009/04/09 12:35:47 | 00,000,000 | —D | C] – C:\Program Files\PAV
[2009/04/09 12:31:24 | 00,036,349 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Hibachi.jpg
[2009/04/08 09:57:47 | 01,870,336 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Brian_Stoffers-Examining the Outlook for Lending.ppt
[2009/04/08 09:57:11 | 00,161,792 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Ralph_Rose-Examining the Outlook for Lending.ppt
[2009/04/07 09:50:12 | 00,124,213 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Literature.pdf
[2009/04/03 12:50:18 | 00,012,765 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Another Example.jpg
[2009/04/03 12:40:46 | 00,058,045 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Example.jpg
[2009/04/01 16:31:29 | 05,997,144 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\131-2009-0026 Frankford Ave Condos-FINAL.pdf
[2009/03/31 15:50:34 | 00,471,392 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Tax Info.pdf
[2009/03/30 10:00:54 | 00,194,048 | —- | C] () – C:\Documents and Settings\asimpson\My Documents\Improved Sales.est
[2009/03/26 15:24:00 | 00,000,000 | —D | C] – C:\Documents and Settings\asimpson\Application Data\Sibelius Software
[2009/03/21 10:06:58 | 00,989,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kernel32.dll
[2008/12/11 19:34:58 | 00,000,072 | —- | C] () – C:\WINDOWS\MediaManager.INI
[2008/12/11 16:46:19 | 01,040,384 | —- | C] () – C:\WINDOWS\System32\vorbisenc.dll
[2008/12/11 16:46:19 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\OggDS.dll
[2008/12/11 16:46:19 | 00,077,824 | —- | C] () – C:\WINDOWS\System32\vorbisfile.dll
[2008/12/11 16:46:18 | 01,163,264 | —- | C] () – C:\WINDOWS\System32\vorbis.dll
[2008/12/11 16:46:18 | 00,730,659 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2008/12/11 16:46:18 | 00,421,888 | —- | C] () – C:\WINDOWS\System32\OpenQuicktimeLib.dll
[2008/12/11 16:46:18 | 00,225,280 | —- | C] () – C:\WINDOWS\System32\qtmlClient.dll
[2008/12/11 16:46:18 | 00,155,648 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/12/11 16:46:18 | 00,061,440 | —- | C] () – C:\WINDOWS\System32\ogg.dll
[2008/12/11 16:46:18 | 00,049,152 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2008/12/11 16:46:17 | 00,164,352 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2008/12/11 16:46:17 | 00,043,520 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2008/12/11 16:46:16 | 01,115,648 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2008/12/11 16:46:15 | 00,196,608 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2008/12/11 16:46:15 | 00,129,024 | —- | C] () – C:\WINDOWS\System32\ff_mpeg2enc.dll
[2008/12/11 16:46:15 | 00,115,200 | —- | C] () – C:\WINDOWS\System32\ff_samplerate.dll
[2008/12/11 16:46:15 | 00,107,008 | —- | C] () – C:\WINDOWS\System32\ff_theora.dll
[2008/12/11 16:46:15 | 00,107,008 | —- | C] () – C:\WINDOWS\System32\ff_realaac.dll
[2008/12/11 16:46:15 | 00,049,664 | —- | C] () – C:\WINDOWS\System32\ff_tremor.dll
[2008/12/11 16:46:15 | 00,037,888 | —- | C] () – C:\WINDOWS\System32\ff_unrar.dll
[2008/12/11 16:46:15 | 00,023,552 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2008/12/11 16:46:14 | 00,186,880 | —- | C] () – C:\WINDOWS\System32\ff_libfaad2.dll
[2008/12/11 16:46:14 | 00,122,880 | —- | C] () – C:\WINDOWS\System32\ff_libdts.dll
[2008/12/11 16:46:14 | 00,086,528 | —- | C] () – C:\WINDOWS\System32\ff_libmad.dll
[2008/12/11 16:46:14 | 00,057,344 | —- | C] () – C:\WINDOWS\System32\ff_kerneldeint.dll
[2008/12/11 16:46:14 | 00,049,664 | —- | C] () – C:\WINDOWS\System32\ff_liba52.dll
[2007/01/15 16:28:54 | 00,010,593 | —- | C] () – C:\WINDOWS\CSTBox.INI
[2007/01/15 16:17:58 | 00,040,960 | —- | C] () – C:\WINDOWS\System32\IPPCPUID.DLL
[2007/01/15 16:17:05 | 00,011,776 | —- | C] () – C:\WINDOWS\System32\pmsbfn32.dll
[2007/01/15 16:14:48 | 00,000,419 | —- | C] () – C:\WINDOWS\MAXLINK.INI
[2005/10/13 11:23:40 | 00,000,165 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2005/09/14 17:35:14 | 00,000,000 | R— | C] () – C:\WINDOWS\SA2006.ini
[2004/11/04 13:15:51 | 00,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2004/07/02 13:41:46 | 00,000,000 | —- | C] () – C:\WINDOWS\JDSecure20.INI
[2004/03/03 14:31:38 | 00,000,058 | —- | C] () – C:\WINDOWS\WINHELP.INI
[2004/01/28 13:02:03 | 00,000,191 | —- | C] () – C:\WINDOWS\DOCSTAR.INI
[2004/01/28 13:01:58 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\w048t32w.dll
[2004/01/28 13:01:58 | 00,223,232 | —- | C] () – C:\WINDOWS\System32\w042t32w.dll
[2004/01/28 13:01:58 | 00,169,472 | —- | C] () – C:\WINDOWS\System32\w037t32w.dll
[2004/01/28 13:01:58 | 00,164,864 | —- | C] () – C:\WINDOWS\System32\w033t32w.dll
[2004/01/28 13:01:58 | 00,138,240 | —- | C] () – C:\WINDOWS\System32\w043t32w.dll
[2004/01/28 13:01:58 | 00,128,000 | —- | C] () – C:\WINDOWS\System32\w046t32w.dll
[2004/01/28 13:01:58 | 00,099,840 | —- | C] () – C:\WINDOWS\System32\w021t32w.dll
[2004/01/28 13:01:58 | 00,098,304 | —- | C] () – C:\WINDOWS\System32\w040t32w.dll
[2004/01/28 13:01:58 | 00,097,280 | —- | C] () – C:\WINDOWS\System32\w801t32w.dll
[2004/01/28 13:01:58 | 00,084,480 | —- | C] () – C:\WINDOWS\System32\w770t32w.dll
[2004/01/28 13:01:57 | 00,235,008 | —- | C] () – C:\WINDOWS\System32\g615t32w.dll
[2004/01/28 13:01:57 | 00,218,624 | —- | C] () – C:\WINDOWS\System32\w019t32w.dll
[2004/01/28 13:01:57 | 00,185,856 | —- | C] () – C:\WINDOWS\System32\w007t32w.dll
[2004/01/28 13:01:57 | 00,121,856 | —- | C] () – C:\WINDOWS\System32\w020t32w.dll
[2004/01/28 13:01:57 | 00,107,520 | —- | C] () – C:\WINDOWS\System32\w001t32w.dll
[2004/01/28 13:01:57 | 00,105,984 | —- | C] () – C:\WINDOWS\System32\w010t32w.dll
[2004/01/28 13:01:57 | 00,105,984 | —- | C] () – C:\WINDOWS\System32\w008t32w.dll
[2004/01/28 13:01:57 | 00,101,888 | —- | C] () – C:\WINDOWS\System32\w015t32w.dll
[2004/01/28 13:01:57 | 00,090,112 | —- | C] () – C:\WINDOWS\System32\w006t32w.dll
[2004/01/28 13:01:56 | 00,254,464 | —- | C] () – C:\WINDOWS\System32\g521t32w.dll
[2004/01/28 13:01:56 | 00,240,128 | —- | C] () – C:\WINDOWS\System32\g610t32w.dll
[2004/01/28 13:01:56 | 00,236,544 | —- | C] () – C:\WINDOWS\System32\g606t32w.dll
[2004/01/28 13:01:56 | 00,123,904 | —- | C] () – C:\WINDOWS\System32\g521f32w.dll
[2004/01/28 13:01:56 | 00,105,984 | —- | C] () – C:\WINDOWS\System32\g502f32w.dll
[2004/01/28 13:01:56 | 00,091,648 | —- | C] () – C:\WINDOWS\System32\g610f32w.dll
[2004/01/28 13:01:46 | 00,044,544 | —- | C] () – C:\WINDOWS\System32\binder.dll
[2004/01/28 13:01:30 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\wisemsg.dll
[2003/12/02 10:51:17 | 00,000,000 | —- | C] () – C:\WINDOWS\PROTOCOL.INI
[2003/11/25 16:50:23 | 00,000,100 | —- | C] () – C:\WINDOWS\webica.ini
[2003/11/18 14:19:54 | 00,000,885 | —- | C] () – C:\WINDOWS\lrun32.ini
[2003/11/18 14:19:46 | 00,000,602 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/11/06 21:39:40 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/11/06 21:33:19 | 00,000,138 | —- | C] () – C:\WINDOWS\wininit.ini
[2003/11/06 21:32:11 | 00,000,023 | —- | C] () – C:\WINDOWS\Welcome.ini
[2003/11/06 21:25:43 | 00,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2003/11/06 21:25:25 | 00,004,902 | —- | C] () – C:\WINDOWS\System32\Setup2k.ini
[2003/11/06 21:25:25 | 00,000,267 | —- | C] () – C:\WINDOWS\System32\presetup.ini
[2003/11/06 21:20:28 | 00,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/11/06 21:14:46 | 00,002,481 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/06/20 13:00:06 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/02/19 17:39:14 | 00,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/11/15 06:14:26 | 00,143,360 | —- | C] () – C:\WINDOWS\System32\AIBMRUNL.dll
[2002/05/24 05:00:00 | 00,208,896 | —- | C] () – C:\WINDOWS\System32\lockout.dll
[2002/05/24 05:00:00 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\lockres.dll
[1980/01/01 04:00:00 | 00,000,794 | —- | C] () – C:\WINDOWS\win.ini
[1980/01/01 04:00:00 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[44 C:\WINDOWS\System32\*.tmp files]
[2 C:\WINDOWS\*.tmp files]
[2009/04/16 09:40:24 | 00,481,674 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/04/16 09:40:24 | 00,409,232 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/04/16 09:40:24 | 00,064,372 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/04/16 09:37:20 | 00,000,794 | —- | M] () – C:\WINDOWS\win.ini
[2009/04/16 09:37:20 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/04/16 09:37:20 | 00,000,211 | RHS- | M] () – C:\BOOT.INI
[2009/04/16 09:36:35 | 00,002,278 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/04/16 09:35:58 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/04/16 09:35:53 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/04/16 09:35:45 | 10,643,57888 | -HS- | M] () – C:\hiberfil.sys
[2009/04/16 09:32:00 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/04/15 16:49:08 | 00,000,707 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/15 16:45:56 | 00,501,248 | —- | M] (OldTimer Tools) – C:\Documents and Settings\asimpson\Desktop\OTListIt2.exe
[2009/04/15 16:45:11 | 02,967,800 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\asimpson\Desktop\mbam-setup.exe
[2009/04/15 15:58:58 | 00,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\asimpson\Desktop\HiJackThis.exe
[2009/04/15 11:16:35 | 00,008,520 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\2.jpg
[2009/04/15 11:16:34 | 00,008,018 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\1.jpg
[2009/04/15 10:19:39 | 00,040,664 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Fed Ex-161-2008-0047.pdf
[2009/04/14 14:49:33 | 00,312,232 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/04/14 14:46:17 | 00,000,944 | —- | M] () – C:\Documents and Settings\asimpson\Desktop\Spybot - Search & Destroy.lnk
[2009/04/09 12:33:30 | 00,036,349 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Hibachi.jpg
[2009/04/08 09:59:00 | 01,870,336 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Brian_Stoffers-Examining the Outlook for Lending.ppt
[2009/04/08 09:57:12 | 00,161,792 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Ralph_Rose-Examining the Outlook for Lending.ppt
[2009/04/07 21:25:04 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/04/07 09:50:13 | 00,124,213 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Literature.pdf
[2009/04/06 15:32:54 | 00,038,496 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/06 15:32:46 | 00,015,504 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/06 10:57:24 | 24,921,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe
[2009/04/03 12:49:54 | 00,012,765 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Another Example.jpg
[2009/04/03 12:40:15 | 00,058,045 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Example.jpg
[2009/04/01 16:35:08 | 05,997,144 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\131-2009-0026 Frankford Ave Condos-FINAL.pdf
[2009/04/01 10:27:39 | 00,000,100 | —- | M] () – C:\WINDOWS\webica.ini
[2009/03/31 15:50:34 | 00,471,392 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Tax Info.pdf
[2009/03/30 10:00:55 | 00,194,048 | —- | M] () – C:\Documents and Settings\asimpson\My Documents\Improved Sales.est
[2009/03/30 09:10:30 | 00,340,240 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/03/27 11:47:54 | 00,095,592 | —- | M] () – C:\Documents and Settings\asimpson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/03/27 02:58:38 | 01,203,922 | —- | M] () – C:\WINDOWS\System32\dllcache\sysmain.sdb
[2009/03/21 10:06:58 | 00,989,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\kernel32.dll
[2009/03/21 10:06:58 | 00,989,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kernel32.dll

========== LOP Check ==========

[2005/10/13 11:18:47 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Administrator\Application Data
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Identities
[2003/12/15 11:10:11 | 00,000,000 | –SD | M] – C:\Documents and Settings\Administrator\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Symantec
[2008/06/16 10:25:14 | 00,000,000 | RH-D | M] – C:\Documents and Settings\administrator.CORP\Application Data
[2008/06/16 10:31:25 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Adobe
[2007/01/15 16:28:17 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\AdobeUM
[2007/01/11 11:11:07 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Brightmail
[2007/01/15 16:26:19 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Canon
[2008/06/16 10:25:14 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Google
[2007/04/03 15:13:51 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Identities
[2005/10/13 11:21:35 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Macromedia
[2007/04/03 15:31:07 | 00,000,000 | –SD | M] – C:\Documents and Settings\administrator.CORP\Application Data\Microsoft
[2007/01/15 16:27:56 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\NewSoft
[2007/01/11 11:31:34 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\OfficeUpdate12
[2007/01/15 16:14:40 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\ScanSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Symantec
[2006/07/20 14:57:27 | 00,000,000 | —D | M] – C:\Documents and Settings\administrator.CORP\Application Data\Webroot
[2009/04/15 16:49:04 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2008/12/01 11:23:25 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2008/06/25 09:35:17 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2008/04/23 12:21:50 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple
[2008/04/23 12:24:54 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2008/12/11 18:13:22 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2007/04/18 11:12:38 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IBM
[2007/01/15 16:14:43 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallShield
[2009/04/15 16:49:04 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2007/06/11 15:58:19 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2005/06/23 19:44:19 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2007/09/12 09:09:19 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuickTime
[2003/02/19 17:40:02 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBSI
[2007/11/08 11:25:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2009/04/14 14:47:40 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2007/07/11 13:13:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Symantec
[2008/11/04 14:56:46 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2005/08/17 14:53:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2007/10/01 14:04:11 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\zeon
[2009/04/15 16:49:10 | 00,000,000 | -H-D | M] – C:\Documents and Settings\asimpson\Application Data
[2008/06/16 10:41:25 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Adobe
[2009/04/15 11:16:18 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\AdobeUM
[2007/09/19 12:32:51 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Apple Computer
[2008/12/11 18:23:49 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\AVS4YOU
[2007/02/14 15:34:42 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Brightmail
[2007/01/17 17:46:32 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Canon
[2008/04/25 11:35:17 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\eFax Messenger
[2007/10/29 15:26:54 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Google
[2007/08/07 14:40:05 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Help
[2007/02/19 11:37:19 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Identities
[2007/10/17 09:44:43 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\InterTrust
[2009/01/26 12:43:41 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\LimeWire
[2007/02/14 15:39:25 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Macromedia
[2009/04/15 16:49:10 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Malwarebytes
[2009/04/09 12:56:40 | 00,000,000 | –SD | M] – C:\Documents and Settings\asimpson\Application Data\Microsoft
[2007/01/17 17:48:11 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\NewSoft
[2007/11/08 11:24:55 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\ScanSoft
[2009/03/26 15:24:00 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Sibelius Software
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Sonic
[2007/09/27 09:59:43 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Sun
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Symantec
[2008/11/04 14:56:48 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Viewpoint
[2007/10/01 14:05:43 | 00,000,000 | —D | M] – C:\Documents and Settings\asimpson\Application Data\Zeon
[2006/06/16 08:29:57 | 00,000,000 | RH-D | M] – C:\Documents and Settings\aweber\Application Data
[2006/06/16 08:29:57 | 00,000,000 | —D | M] – C:\Documents and Settings\aweber\Application Data\Adobe
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\aweber\Application Data\Identities
[2006/06/15 17:54:25 | 00,000,000 | –SD | M] – C:\Documents and Settings\aweber\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\aweber\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\aweber\Application Data\Symantec
[2007/03/15 10:27:10 | 00,000,000 | RH-D | M] – C:\Documents and Settings\bsjohnson\Application Data
[2007/01/23 17:00:10 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Adobe
[2007/03/06 12:27:14 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Brightmail
[2007/01/23 16:58:34 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Canon
[2007/03/06 16:15:03 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Help
[2007/03/15 10:27:26 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Identities
[2007/03/06 11:54:12 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Macromedia
[2007/04/24 14:59:22 | 00,000,000 | –SD | M] – C:\Documents and Settings\bsjohnson\Application Data\Microsoft
[2007/01/23 16:59:58 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\bsjohnson\Application Data\Symantec
[2007/05/01 16:18:36 | 00,000,000 | RH-D | M] – C:\Documents and Settings\cmccready\Application Data
[2007/01/15 17:51:11 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Adobe
[2007/01/15 17:51:14 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\AdobeUM
[2007/02/23 18:27:00 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Brightmail
[2007/01/15 17:49:32 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Canon
[2007/05/01 16:30:07 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Identities
[2007/05/01 15:06:07 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Macromedia
[2007/02/23 17:34:49 | 00,000,000 | –SD | M] – C:\Documents and Settings\cmccready\Application Data\Microsoft
[2007/01/15 17:50:46 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\cmccready\Application Data\Symantec
[2003/02/19 17:19:28 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Default User\Application Data
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\Identities
[2003/02/19 17:19:10 | 00,000,000 | –SD | M] – C:\Documents and Settings\Default User\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\Symantec
[2007/03/02 15:22:24 | 00,000,000 | RH-D | M] – C:\Documents and Settings\ebosack\Application Data
[2007/01/16 14:36:32 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Adobe
[2007/01/16 16:56:26 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\ArcSoft
[2007/03/02 15:24:30 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Brightmail
[2007/01/16 10:03:20 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Canon
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Identities
[2007/01/16 14:24:42 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Macromedia
[2007/03/02 15:22:33 | 00,000,000 | –SD | M] – C:\Documents and Settings\ebosack\Application Data\Microsoft
[2007/01/16 10:04:37 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\ebosack\Application Data\Symantec
[2005/09/14 17:45:41 | 00,000,000 | RH-D | M] – C:\Documents and Settings\erisser\Application Data
[2005/06/08 15:52:00 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Adobe
[2005/10/12 13:36:17 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\AdobeUM
[2005/09/14 17:45:41 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\DeLorme
[2005/06/08 16:16:03 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Identities
[2005/06/08 13:55:18 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Macromedia
[2005/09/08 16:18:31 | 00,000,000 | –SD | M] – C:\Documents and Settings\erisser\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser\Application Data\Symantec
[2006/05/05 17:08:03 | 00,000,000 | RH-D | M] – C:\Documents and Settings\erisser.CORP\Application Data
[2005/10/13 15:10:48 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Adobe
[2007/09/02 13:15:57 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\AdobeUM
[2005/10/13 14:34:44 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\DeLorme
[2006/03/25 16:38:21 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Help
[2005/10/17 16:52:59 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Identities
[2005/10/13 11:50:34 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Macromedia
[2006/02/01 15:18:26 | 00,000,000 | –SD | M] – C:\Documents and Settings\erisser.CORP\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\Symantec
[2006/05/05 17:08:03 | 00,000,000 | —D | M] – C:\Documents and Settings\erisser.CORP\Application Data\VERITAS
[2009/02/04 16:51:43 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data
[2009/02/04 16:51:43 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Google
[2007/06/26 12:06:38 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2006/07/20 14:57:36 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Webroot
[2007/01/17 11:38:50 | 00,000,000 | RH-D | M] – C:\Documents and Settings\lolagunju\Application Data
[2006/05/31 15:03:22 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Adobe
[2007/02/07 12:50:16 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\AdobeUM
[2007/01/15 14:59:31 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Brightmail
[2007/01/17 11:15:29 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Canon
[2006/10/17 13:09:53 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Help
[2006/06/07 16:51:01 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\IBM
[2006/07/24 09:42:00 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\ICAClient
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Identities
[2006/05/31 14:09:58 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Macromedia
[2007/01/15 14:58:45 | 00,000,000 | –SD | M] – C:\Documents and Settings\lolagunju\Application Data\Microsoft
[2007/01/17 11:38:50 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\lolagunju\Application Data\Symantec
[2007/01/15 17:59:20 | 00,000,000 | RH-D | M] – C:\Documents and Settings\msilverman\Application Data
[2007/01/15 17:59:20 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Adobe
[2007/01/15 17:57:41 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Canon
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Identities
[2003/02/19 17:19:10 | 00,000,000 | –SD | M] – C:\Documents and Settings\msilverman\Application Data\Microsoft
[2007/01/15 17:58:49 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\NewSoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\msilverman\Application Data\Symantec
[2006/08/01 13:59:36 | 00,000,000 | RH-D | M] – C:\Documents and Settings\mstoner\Application Data
[2006/08/01 13:59:36 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Adobe
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Identities
[2006/08/01 13:57:34 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Macromedia
[2006/08/01 15:12:15 | 00,000,000 | –SD | M] – C:\Documents and Settings\mstoner\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\mstoner\Application Data\Symantec
[2003/02/19 17:34:20 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data
[2003/02/19 17:19:10 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/02/06 13:03:41 | 00,000,000 | RH-D | M] – C:\Documents and Settings\scrossley\Application Data
[2009/02/06 13:06:11 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Adobe
[2009/02/06 13:01:04 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Google
[2003/02/19 17:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Identities
[2009/02/06 13:03:41 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Macromedia
[2009/02/06 13:03:41 | 00,000,000 | –SD | M] – C:\Documents and Settings\scrossley\Application Data\Microsoft
[2003/11/06 21:33:30 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Sonic
[2003/11/06 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\scrossley\Application Data\Symantec
[2009/04/07 21:25:04 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2001/08/18 06:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/04/16 09:35:58 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

< End of report >

ebosack

Post #5April 16, 2009, 3:43 PM UTC

…and here is an updated HJT log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:44:11 AM, on 4/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Documents and Settings\asimpson\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=9396&clcid=0x409
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SpySweeperEnterprise] "C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeperUI.EXE" /StartInTray
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: &Search - ?p=ZKman000
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://datapoint.irr.com
O15 - Trusted Zone: http://*.irr.com
O16 - DPF: {1416D7C8-8A28-11CF-9236-444553540000} (Infragistics Data Explorer Control) - https://www.amtdirect.com/amtapp/Cab/pvxplore8.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {220D02A2-6F7F-4B02-B37C-0F9F61AFED33} (TemplateMgr Class) - http://interconnect.irr.com/iePrintTools.dll
O16 - DPF: {22ACD16F-99EB-11D2-9BB3-00400561D975} (Infragistics Calendar Control) - https://www.amtdirect.com/amtapp/Cab/pvCalendar.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {48F660FA-8B27-4815-947E-D6CD8C5BEC17} (REAppsClientAuth.Logoff) - http://datapoint.irr.com/ClientApps/REAppsClientAuth.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099591151492
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1181590944161
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {B3014671-7872-4671-BE73-5D05EB5B2AF5} (Infragistics UltraGrid Control 2.0) - https://www.amtdirect.com/amtapp/Cab/UltraGrid20.cab
O16 - DPF: {F375116A-793C-11D2-BFE1-444553540001} (First American Res MapActiveX Control) - http://www.realquest.com/mapviewer/mapviewer.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.integra.com
O17 - HKLM\Software\..\Telephony: DomainName = corp.integra.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.integra.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.integra.com
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot CommAgent Service (WebrootCommAgentService) - Webroot Software, Inc. - C:\Program Files\Webroot\Enterprise\Spy Sweeper\commagent.exe

–
End of file - 7844 bytes

Essexboy

Post #6April 16, 2009, 9:07 PM UTC

Looks quite good - a few remnants to move. On completion of this run could you let me know how your computer is running ?

Run OTList2.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTLI
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-21-1630905916-499750001-2300041866-1121\..\Toolbar\WebBrowser: (no name) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - Reg Error: Key error. File not found
O8 - Extra context menu item: &Search - ?p=ZKman000 File not found

:Commands
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done

ebosack

Post #7April 17, 2009, 8:50 PM UTC

Looks good, thank you very much.

Essexboy

Post #8April 17, 2009, 8:57 PM UTC

Now the best part of the day —– Your log now appears clean

A good workman always cleans up after himself so..Run OTListit and hit the cleanup button. It will remove all the programmes we have used plus itself. MBAM can be uninstalled via control panel add/remove along with ERUNT. But they may be useful tools to keep

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Do not show hidden files and folders.
Click Yes to confirm.
Click OK.

[external image: Posted Image] Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Upgrading Java:

Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 13.
Click the "Download" button to the right.
Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
Click on Continue.
Click on the link to download Windows Offline Installation (jre-6u13-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u13-windows-i586-p.exe and select "Run as an Administrator.")

XP
Now to get you off to a good start we will clean your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your restore points, but this is my method:

Select Start > All Programs > Accessories > System tools > System Restore.
On the dialogue box that appears select Create a Restore Point
Click NEXT
Enter a name e.g. Clean
Click CREATE

You now have a clean restore point, to get rid of the bad ones:

Select Start > All Programs > Accessories > System tools > Disk Cleanup.
In the Drop down box that appears select your main drive e.g. C
Click OK
The System will do some calculation and the display a dialogue box with TABS
Select the More Options Tab.
At the bottom will be a system restore box with a CLEANUP button click this
Accept the Warning and select OK again, the program will close and you are done

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

SpywareBlaster to help prevent spyware from installing in the first place.
SuperAntispyware Run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

Secunia Software inspector To check your programme update status
Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe

Essexboy

Post #9April 18, 2009, 10:40 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] HiJackThis Log File

✨ Ask AI

Ask AI