What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Win32TrojanQhost

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm alittle new to this. I've had this spyware for awhile now and it just keeps hiding, and copying itself to other areas when I delete it. I use ad-aware and Spybot S&D dayam near every time I get on the comp, but there it is, smiling at me…. The Ad-aware program names the trojan bug Win32TrojanQhost. there are almost always at least 2 of them and it seems to always be downloading cookies. PLEASE HELP~~!! :pullhair:
Post #2
Hi there before I can help I need to see what you have

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
Post #3
OTL logfile created on: 6/19/2009 1:38:38 PM - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\LH6INQHA
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.17 Gb Available Physical Memory | 58.41% Memory free
3.85 Gb Paging File | 2.98 Gb Available in Paging File | 77.34% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 27.36 Gb Free Space | 36.71% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 465.75 Gb Total Space | 95.17 Gb Free Space | 20.43% Space Free | Partition Type: NTFS
Drive I: | 5.05 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: CCOMPUTI-BDC23C
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
PRC - C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
PRC - C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Customer\Wireless PCI_CardBus utility V1.01\Wireless PCI_CardBus utility V1.01.exe ()
PRC - C:\Program Files\MSN Messenger\usnsvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\Program Files\MSN Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe (Lavasoft)
PRC - C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\LH6INQHA\OTL[1].exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Bonjour Service [Auto | Running]) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (idsvc [Unknown | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Stopped]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Lavasoft Ad-Aware Service [Auto | Running]) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (Microsoft Office Groove Audit Service [On_Demand | Stopped]) – C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (NVSvc [Auto | Running]) – C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
SRV - (odserv [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (usnjsvc [On_Demand | Running]) – C:\Program Files\MSN Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (YahooAUService [Auto | Running]) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)

========== Driver Services (SafeList) ==========

DRV - (BIOS [System | Running]) – C:\WINDOWS\system32\drivers\BIOS.sys (BIOSTAR Group)
DRV - (FETNDIS [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\fetnd5.sys (VIA Technologies, Inc. )
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (IntcAzAudAddService [On_Demand | Running]) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Lbd [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (nv [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (RT61 [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\RT61.sys (Ralink Technology Inc.)
DRV - (SCDEmu [System | Running]) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (sptd [Boot | Running]) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (SVKP [Auto | Running]) – C:\WINDOWS\system32\SVKP.sys (AntiCracking)
DRV - (USBAAPL [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (W8335XP [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\Mrvw125.sys (Marvell Semiconductor, Inc)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2009/03/31 20:58:37 | 00,000,000 | —D | M]


O1 HOSTS File: (305047 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 10505 more lines…
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - Reg Error: Key error. File not found
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [Alcmtr] ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" (Microsoft Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup (Macrovision Corporation)
O4 - HKLM..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start (Macrovision Corporation)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" File not found
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] nwiz.exe /install File not found
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SkyTel] SkyTel.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" (Yahoo! Inc)
O4 - HKCU..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun (DT Soft Ltd)
O4 - HKCU..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (Yahoo! Inc.)
O4 - HKCU..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless PCI_CardBus utility V1.01.exe.lnk = C:\Program Files\Customer\Wireless PCI_CardBus utility V1.01\Wireless PCI_CardBus utility V1.01.exe ()
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1220833295015 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd…ows-i586-jc.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/08 08:38:58 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/01/06 07:20:22 | 00,000,061 | R— | M] () - I:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{637a1398-8d9b-11dd-8e47-0018f8b11c3e}\Shell - "" = AutoRun
O33 - MountPoints2\{637a1398-8d9b-11dd-8e47-0018f8b11c3e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{637a1398-8d9b-11dd-8e47-0018f8b11c3e}\Shell\AutoRun\command - "" = L:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009/06/19 13:22:21 | 00,000,000 | —D | M]
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

========== Files/Folders - Created Within 30 Days ==========

[7 C:\WINDOWS\*.tmp files]
[2009/06/19 13:23:26 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2009/06/19 13:22:30 | 00,000,767 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/06/19 13:22:21 | 00,000,592 | —- | C] () – C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2009/06/19 13:22:19 | 00,000,000 | —D | C] – C:\Program Files\ERUNT
[2009/06/19 11:31:44 | 00,001,336 | -H– | C] () – C:\aaw7boot.cmd
[2009/06/19 00:55:31 | 03,774,004 | —- | C] () – C:\Documents and Settings\Owner\Desktop\4.mpg
[2009/06/19 00:55:14 | 03,774,004 | —- | C] () – C:\Documents and Settings\Owner\Desktop\3.mpg
[2009/06/19 00:54:29 | 03,841,688 | —- | C] () – C:\Documents and Settings\Owner\Desktop\ava3.mpg
[2009/06/19 00:54:17 | 03,983,232 | —- | C] () – C:\Documents and Settings\Owner\Desktop\ava4.mpg
[2009/06/19 00:52:48 | 01,624,064 | —- | C] () – C:\Documents and Settings\Owner\Desktop\28.mpg
[2009/06/19 00:52:18 | 01,277,952 | —- | C] () – C:\Documents and Settings\Owner\Desktop\33.mpg
[2009/06/19 00:51:25 | 01,368,064 | —- | C] () – C:\Documents and Settings\Owner\Desktop\34.mpg
[2009/06/19 00:49:36 | 03,776,052 | —- | C] () – C:\Documents and Settings\Owner\Desktop\2.mpg
[2009/06/19 00:49:25 | 03,511,460 | —- | C] () – C:\Documents and Settings\Owner\Desktop\1.mpg
[2009/06/19 00:46:24 | 03,839,640 | —- | C] () – C:\Documents and Settings\Owner\Desktop\ava1.mpg
[2009/06/19 00:46:14 | 03,866,304 | —- | C] () – C:\Documents and Settings\Owner\Desktop\ava2.mpg
[2009/06/19 00:44:49 | 04,759,556 | —- | C] () – C:\Documents and Settings\Owner\Desktop\sophia4.mpg
[2009/06/19 00:44:26 | 04,386,820 | —- | C] () – C:\Documents and Settings\Owner\Desktop\sophia3.mpg
[2009/06/19 00:39:48 | 03,885,060 | —- | C] () – C:\Documents and Settings\Owner\Desktop\sophia2.mpg
[2009/06/19 00:39:41 | 04,278,276 | —- | C] () – C:\Documents and Settings\Owner\Desktop\sophia1.mpg
[2009/06/19 00:37:04 | 04,182,089 | —- | C] () – C:\Documents and Settings\Owner\Desktop\p3.wmv
[2009/06/19 00:35:12 | 04,206,089 | —- | C] () – C:\Documents and Settings\Owner\Desktop\p4.wmv
[2009/06/19 00:34:17 | 00,456,704 | —- | C] () – C:\Documents and Settings\Owner\Desktop\3.avi
[2009/06/19 00:33:59 | 00,444,416 | —- | C] () – C:\Documents and Settings\Owner\Desktop\2.avi
[2009/06/19 00:33:54 | 00,446,464 | —- | C] () – C:\Documents and Settings\Owner\Desktop\1.avi
[2009/06/19 00:32:26 | 04,078,089 | —- | C] () – C:\Documents and Settings\Owner\Desktop\p2.wmv
[2009/06/19 00:32:22 | 04,342,089 | —- | C] () – C:\Documents and Settings\Owner\Desktop\p1.wmv
[2009/06/18 15:25:43 | 00,077,122 | —- | C] () – C:\Documents and Settings\Owner\Desktop\R 14.jpg
[2009/06/18 14:38:32 | 00,095,624 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Sarah.jpg
[2009/06/18 14:06:07 | 00,057,330 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Rosy.jpg
[2009/06/18 13:52:22 | 00,086,325 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Becky.jpg
[2009/06/18 13:48:58 | 00,039,030 | —- | C] () – C:\Documents and Settings\Owner\Desktop\J145.jpg
[2009/06/18 13:34:23 | 00,082,643 | —- | C] () – C:\Documents and Settings\Owner\Desktop\PICT0109.JPG
[2009/06/18 13:34:23 | 00,078,462 | —- | C] () – C:\Documents and Settings\Owner\Desktop\PICT0110.JPG
[2009/06/18 13:34:23 | 00,078,418 | —- | C] () – C:\Documents and Settings\Owner\Desktop\PICT0111.JPG
[2009/06/18 13:26:20 | 00,031,754 | —- | C] () – C:\Documents and Settings\Owner\Desktop\J123.jpg
[2009/06/18 13:19:11 | 00,191,927 | —- | C] () – C:\Documents and Settings\Owner\Desktop\J112.jpg
[2009/06/18 13:06:12 | 00,135,515 | —- | C] () – C:\Documents and Settings\Owner\Desktop\J1.jpg
[2009/06/14 21:36:34 | 00,009,971 | —- | C] () – C:\Documents and Settings\Owner\My Documents\250mm carbide railgun1.docx
[2009/06/13 22:32:49 | 00,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/06/13 22:32:22 | 00,000,000 | —D | C] – C:\Program Files\iPod
[2009/06/13 22:32:17 | 00,000,000 | —D | C] – C:\Program Files\iTunes
[2009/06/13 22:30:37 | 00,001,604 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2009/06/13 22:30:08 | 00,000,000 | —D | C] – C:\Program Files\QuickTime
[2009/06/10 19:25:25 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\EVEMon
[2009/06/10 19:25:16 | 00,000,000 | —D | C] – C:\Program Files\EVEMon
[2009/06/10 18:41:10 | 01,984,178 | —- | C] (battleclinic.com) – C:\Documents and Settings\Owner\Desktop\EVEMon-install-1.2.7.1283.exe
[2009/06/10 16:38:53 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\EVE
[2009/06/10 16:38:49 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\CCP
[2009/06/10 16:34:59 | 00,001,532 | —- | C] () – C:\Documents and Settings\Owner\Desktop\EVE.lnk
[2009/06/10 16:28:43 | 58,108,247 | —- | C] () – C:\Documents and Settings\Owner\Desktop\EVECAREERSGUIDE.pdf
[2009/06/10 16:25:19 | 00,000,000 | —D | C] – C:\Program Files\CCP
[2009/06/05 11:38:28 | 00,016,170 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Submission Confirmation Page - FAFSA on the Web - Federal Student Aid.htm
[2009/06/05 08:56:49 | 00,000,162 | -H– | C] () – C:\Documents and Settings\Owner\Desktop\~$ademic thingy.docx
[2009/05/21 00:18:37 | 00,041,351 | —- | C] () – C:\Documents and Settings\Owner\Desktop\l_955d4f3439334eecad6233599f87bb46.jpg
[2009/05/20 23:46:53 | 00,163,840 | -HS- | C] () – C:\Documents and Settings\Owner\Desktop\Thumbs.db
[2008/12/12 15:47:57 | 00,028,672 | —- | C] () – C:\WINDOWS\System32\AVEQ.dll
[2008/12/09 12:40:52 | 00,002,438 | —- | C] () – C:\WINDOWS\System32\ASPRTMM1.DLL
[2008/12/05 22:10:37 | 00,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/09/08 11:10:14 | 00,717,296 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2008/09/08 09:18:26 | 00,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2008/09/07 22:11:14 | 00,164,352 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2008/09/07 22:11:13 | 00,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2008/09/07 22:11:10 | 00,007,680 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2008/09/07 22:11:10 | 00,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2008/07/23 11:50:52 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/05/16 16:01:00 | 01,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/16 16:01:00 | 01,486,848 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/05/16 16:01:00 | 01,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 16:01:00 | 00,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/05/16 16:01:00 | 00,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2007/07/25 16:24:30 | 01,559,040 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2006/02/26 17:08:28 | 00,585,728 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2004/08/04 07:00:00 | 00,000,231 | —- | C] () – C:\WINDOWS\system.ini
[2004/08/04 06:55:56 | 00,000,582 | —- | C] () – C:\WINDOWS\win.ini

========== Files - Modified Within 30 Days ==========

[5 C:\WINDOWS\System32\*.tmp files]
[7 C:\WINDOWS\*.tmp files]
[2009/06/19 13:35:23 | 00,003,328 | —- | M] () – C:\WINDOWS\System32\tmp.reg
[2009/06/19 13:22:30 | 00,000,767 | —- | M] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/06/19 13:22:21 | 00,000,592 | —- | M] () – C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2009/06/19 12:42:21 | 00,001,336 | -H– | M] () – C:\aaw7boot.cmd
[2009/06/19 11:23:58 | 00,000,601 | —- | M] () – C:\Documents and Settings\Owner\My Documents\My Sharing Folders.lnk
[2009/06/19 10:08:29 | 00,186,097 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2009/06/19 10:08:19 | 00,000,062 | -HS- | M] () – C:\Documents and Settings\Owner\Local Settings\desktop.ini
[2009/06/19 10:08:13 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/06/19 10:08:11 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/06/19 00:55:31 | 03,774,004 | —- | M] () – C:\Documents and Settings\Owner\Desktop\4.mpg
[2009/06/19 00:55:14 | 03,774,004 | —- | M] () – C:\Documents and Settings\Owner\Desktop\3.mpg
[2009/06/19 00:54:29 | 03,841,688 | —- | M] () – C:\Documents and Settings\Owner\Desktop\ava3.mpg
[2009/06/19 00:54:17 | 03,983,232 | —- | M] () – C:\Documents and Settings\Owner\Desktop\ava4.mpg
[2009/06/19 00:52:48 | 01,624,064 | —- | M] () – C:\Documents and Settings\Owner\Desktop\28.mpg
[2009/06/19 00:52:18 | 01,277,952 | —- | M] () – C:\Documents and Settings\Owner\Desktop\33.mpg
[2009/06/19 00:51:25 | 01,368,064 | —- | M] () – C:\Documents and Settings\Owner\Desktop\34.mpg
[2009/06/19 00:49:36 | 03,776,052 | —- | M] () – C:\Documents and Settings\Owner\Desktop\2.mpg
[2009/06/19 00:49:25 | 03,511,460 | —- | M] () – C:\Documents and Settings\Owner\Desktop\1.mpg
[2009/06/19 00:46:24 | 03,839,640 | —- | M] () – C:\Documents and Settings\Owner\Desktop\ava1.mpg
[2009/06/19 00:46:14 | 03,866,304 | —- | M] () – C:\Documents and Settings\Owner\Desktop\ava2.mpg
[2009/06/19 00:44:49 | 04,759,556 | —- | M] () – C:\Documents and Settings\Owner\Desktop\sophia4.mpg
[2009/06/19 00:44:26 | 04,386,820 | —- | M] () – C:\Documents and Settings\Owner\Desktop\sophia3.mpg
[2009/06/19 00:39:48 | 03,885,060 | —- | M] () – C:\Documents and Settings\Owner\Desktop\sophia2.mpg
[2009/06/19 00:39:41 | 04,278,276 | —- | M] () – C:\Documents and Settings\Owner\Desktop\sophia1.mpg
[2009/06/19 00:37:04 | 04,182,089 | —- | M] () – C:\Documents and Settings\Owner\Desktop\p3.wmv
[2009/06/19 00:35:12 | 04,206,089 | —- | M] () – C:\Documents and Settings\Owner\Desktop\p4.wmv
[2009/06/19 00:34:17 | 00,456,704 | —- | M] () – C:\Documents and Settings\Owner\Desktop\3.avi
[2009/06/19 00:33:59 | 00,444,416 | —- | M] () – C:\Documents and Settings\Owner\Desktop\2.avi
[2009/06/19 00:33:54 | 00,446,464 | —- | M] () – C:\Documents and Settings\Owner\Desktop\1.avi
[2009/06/19 00:32:26 | 04,078,089 | —- | M] () – C:\Documents and Settings\Owner\Desktop\p2.wmv
[2009/06/19 00:32:25 | 04,342,089 | —- | M] () – C:\Documents and Settings\Owner\Desktop\p1.wmv
[2009/06/18 15:24:41 | 00,163,840 | -HS- | M] () – C:\Documents and Settings\Owner\Desktop\Thumbs.db
[2009/06/18 15:02:10 | 00,077,122 | —- | M] () – C:\Documents and Settings\Owner\Desktop\R 14.jpg
[2009/06/18 14:38:37 | 00,095,624 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Sarah.jpg
[2009/06/18 14:06:09 | 00,057,330 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Rosy.jpg
[2009/06/18 13:52:29 | 00,086,325 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Becky.jpg
[2009/06/18 13:49:03 | 00,039,030 | —- | M] () – C:\Documents and Settings\Owner\Desktop\J145.jpg
[2009/06/18 13:26:25 | 00,031,754 | —- | M] () – C:\Documents and Settings\Owner\Desktop\J123.jpg
[2009/06/18 13:19:20 | 00,191,927 | —- | M] () – C:\Documents and Settings\Owner\Desktop\J112.jpg
[2009/06/18 13:06:21 | 00,135,515 | —- | M] () – C:\Documents and Settings\Owner\Desktop\J1.jpg
[2009/06/16 11:00:17 | 00,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/06/15 10:26:46 | 00,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/06/14 21:36:34 | 00,009,971 | —- | M] () – C:\Documents and Settings\Owner\My Documents\250mm carbide railgun1.docx
[2009/06/13 22:32:49 | 00,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/06/13 22:30:37 | 00,001,604 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2009/06/13 18:47:01 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/06/11 23:08:21 | 00,267,800 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/06/11 16:04:55 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/06/10 18:41:10 | 01,984,178 | —- | M] (battleclinic.com) – C:\Documents and Settings\Owner\Desktop\EVEMon-install-1.2.7.1283.exe
[2009/06/10 16:34:59 | 00,001,532 | —- | M] () – C:\Documents and Settings\Owner\Desktop\EVE.lnk
[2009/06/10 16:29:10 | 58,108,247 | —- | M] () – C:\Documents and Settings\Owner\Desktop\EVECAREERSGUIDE.pdf
[2009/06/05 20:23:18 | 00,013,181 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Academic thingy.docx
[2009/06/05 11:38:28 | 00,016,170 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Submission Confirmation Page - FAFSA on the Web - Federal Student Aid.htm
[2009/06/05 08:56:49 | 00,000,162 | -H– | M] () – C:\Documents and Settings\Owner\Desktop\~$ademic thingy.docx
[2009/06/01 11:51:12 | 23,635,392 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe
[2009/05/27 10:27:41 | 00,015,688 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2009/05/20 23:58:46 | 00,041,351 | —- | M] () – C:\Documents and Settings\Owner\Desktop\l_955d4f3439334eecad6233599f87bb46.jpg

========== LOP Check ==========

[2009/06/10 16:38:49 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2009/03/14 20:04:16 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/04/01 10:22:52 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
[2009/04/11 18:56:24 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2008/09/07 22:36:10 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2008/12/12 15:34:09 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple
[2008/12/12 15:36:02 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2008/10/20 14:27:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Blizzard
[2009/06/10 16:38:49 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CCP
[2009/02/16 20:56:09 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2008/11/22 08:59:24 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallShield
[2009/04/01 10:26:09 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2009/05/12 14:25:10 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/06/15 00:11:25 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2008/09/08 07:38:02 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NOS
[2009/03/08 11:44:42 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2008/10/14 10:25:37 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trymedia
[2008/09/07 22:50:36 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ubisoft
[2008/09/07 19:38:30 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/05/05 02:45:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Yahoo!
[2009/05/05 17:13:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2009/06/10 19:25:25 | 00,000,000 | -H-D | M] – C:\Documents and Settings\Owner\Application Data
[2008/10/28 19:17:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Acreon
[2008/09/11 13:40:59 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Adobe
[2009/01/22 17:06:39 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Apple Computer
[2008/09/08 11:10:09 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DAEMON Tools
[2009/06/10 22:38:50 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\EVEMon
[2008/09/08 07:40:31 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Google
[2008/09/08 08:43:42 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Identities
[2009/03/28 13:38:47 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InstallShield
[2008/10/14 10:25:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\iWin
[2009/06/11 00:18:42 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\LimeWire
[2008/09/07 19:11:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Macromedia
[2008/09/11 03:09:34 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Media Player Classic
[2009/01/29 14:30:48 | 00,000,000 | –SD | M] – C:\Documents and Settings\Owner\Application Data\Microsoft
[2009/04/13 10:23:11 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla
[2009/02/16 21:14:17 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Red Alert 3
[2009/02/16 17:29:39 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Owner\Application Data\SecuROM
[2008/09/11 12:50:24 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Sun
[2008/09/07 23:05:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Ubisoft
[2009/05/07 01:38:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\uTorrent
[2008/12/05 22:11:38 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Ventrilo
[2008/11/06 16:04:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\vlc
[2008/10/14 15:42:26 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\WarZone
[2009/05/07 08:19:27 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Yahoo!
[2009/06/15 10:26:46 | 00,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2009/06/13 18:47:01 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2004/08/04 07:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/06/19 10:08:13 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

< End of report >
Post #4
OTL Extras logfile created on: 6/19/2009 1:38:38 PM - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\LH6INQHA
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.17 Gb Available Physical Memory | 58.41% Memory free
3.85 Gb Paging File | 2.98 Gb Available in Paging File | 77.34% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 27.36 Gb Free Space | 36.71% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 465.75 Gb Total Space | 95.17 Gb Free Space | 20.43% Space Free | Partition Type: NTFS
Drive I: | 5.05 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: CCOMPUTI-BDC23C
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"7000:TCP" = 7000:TCP:*:Enabled:Blizzard Downloader: 7000
"3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 (Microsoft Corporation)
C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook (Microsoft Corporation)
C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove (Microsoft Corporation)
C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote (Microsoft Corporation)
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord File not found
C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent (BitTorrent, Inc.)
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger (Yahoo! Inc.)
C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server File not found
C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire (Lime Wire, LLC)
C:\Program Files\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility File not found
C:\Program Files\Xfire\xfire.exe:*:Enabled:Xfire File not found
C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe ()
C:\Documents and Settings\Owner\Local Settings\Temp\Blizzard Launcher Temporary - 42597048\Launcher.exe:*:Enabled:Blizzard Launcher File not found
C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 (Microsoft Corporation)
C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) (Microsoft Corporation)
C:\Documents and Settings\Owner\Local Settings\Temp\Blizzard Launcher Temporary - 375da218\Launcher.exe:*:Enabled:Blizzard Launcher File not found
C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader File not found
C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour (Apple Inc.)
C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher File not found
C:\Program Files\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile (CCP hf.)
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0150ECF7-60CB-43C5-AB0A-877BB76ABA55}" = Wireless PCI_CardBus utility V1.01
"{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}" = Medieval II Total War : Kingdoms : Crusades
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{571700F0-DB9D-4B3A-B03D-35A14BB5939F}" = Windows Live Messenger
"{5D601655-6D54-4384-B52C-17EC5385FBBD}" = iTunes
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75983B66-804C-40D1-BA13-64DAF652A6F1}" = Medieval II Total War : Kingdoms : Americas
"{75D9A9AA-3416-4651-B165-57DB30733E9E}" = Movavi Video Converter 6
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}" = Medieval II Total War : Kingdoms : Teutonic
"{7FD14A8A-FBCC-4442-ACAC-A0E9EC223AED}" = Europa Universalis - Rome
"{8355F970-601D-442D-A79B-1D7DB4F24CAD}" = Apple Mobile Device Support
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}" = Medieval II Total War : Kingdoms : Britannia
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"7-Zip" = 7-Zip 4.57
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Allok Video to iPod Converter_is1" = Allok Video to iPod Converter 2.3.2
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"EVE" = EVE-ONLINE (remove only)
"EVEMon" = EVEMon
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.1.7 (Full)
"LimeWire" = LimeWire 5.1.2
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PowerISO" = PowerISO
"Sid Meier's Alpha Centauri" = Sid Meier's Alpha Centauri
"VLC media player" = VideoLAN VLC media player 0.8.6i
"Vodei Multimedia Processor" = Vodei Multimedia Processor 2.10
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"World of Warcraft" = World of Warcraft
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Chivalry II - The Sicilian Vespers 3.0" = Chivalry II - The Sicilian Vespers 3.0
"Chivalry II - The Sicilian Vespers 3.2" = Chivalry II - The Sicilian Vespers 3.2
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/18/2009 6:41:14 PM | Computer Name = CCOMPUTI-BDC23C | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16827, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/20/2009 10:56:07 AM | Computer Name = CCOMPUTI-BDC23C | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16827, faulting
module sdhelper.dll, version 1.6.2.14, fault address 0x000019f1.

Error - 4/23/2009 11:43:33 AM | Computer Name = CCOMPUTI-BDC23C | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/24/2009 10:36:34 AM | Computer Name = CCOMPUTI-BDC23C | Source = Application Error | ID = 1000
Description = Faulting application wmplayer.exe, version 11.0.5721.5145, faulting
module avisplitter.ax, version 1.0.0.9, fault address 0x00023048.

Error - 4/26/2009 12:15:22 PM | Computer Name = CCOMPUTI-BDC23C | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16827, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/2/2009 3:41:27 PM | Computer Name = CCOMPUTI-BDC23C | Source = Application Error | ID = 1000
Description = Faulting application itunes.exe, version 8.1.1.10, faulting module
quicktime.qts, version 7.60.92.0, fault address 0x001526f4.

Error - 5/4/2009 1:19:45 AM | Computer Name = CCOMPUTI-BDC23C | Source = Application Hang | ID = 1002
Description = Hanging application YahooMessenger.exe, version 9.0.0.1912, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/7/2009 12:10:24 AM | Computer Name = CCOMPUTI-BDC23C | Source = Application Hang | ID = 1002
Description = Hanging application YahooMessenger.exe, version 9.0.0.2152, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/7/2009 4:53:51 PM | Computer Name = CCOMPUTI-BDC23C | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16827, faulting
module ytnavassist.dll, version 2009.3.13.2, fault address 0x000205da.

Error - 5/8/2009 1:13:53 AM | Computer Name = CCOMPUTI-BDC23C | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16827, faulting
module unknown, version 0.0.0.0, fault address 0x6d5f3421.

[ OSession Events ]
Error - 4/16/2009 12:07:27 PM | Computer Name = CCOMPUTI-BDC23C | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 512
seconds with 60 seconds of active time. This session ended with a crash.

Error - 6/18/2009 3:54:57 PM | Computer Name = CCOMPUTI-BDC23C | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.

Error - 6/18/2009 3:55:06 PM | Computer Name = CCOMPUTI-BDC23C | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 5/25/2009 12:13:27 PM | Computer Name = CCOMPUTI-BDC23C | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.65 for the Network Card with network
address 081074168263 has been denied by the DHCP server 192.168.1.2 (The DHCP Server
sent a DHCPNACK message).

Error - 5/26/2009 11:39:45 AM | Computer Name = CCOMPUTI-BDC23C | Source = Dhcp | ID = 1001
Description = Your computer was not assigned an address from the network (by the
DHCP Server) for the Network Card with network address 081074168263. The following
error occurred: %%1223. Your computer will continue to try and obtain an address
on its own from the network address (DHCP) server.

Error - 5/27/2009 10:27:29 AM | Computer Name = CCOMPUTI-BDC23C | Source = Dhcp | ID = 1001
Description = Your computer was not assigned an address from the network (by the
DHCP Server) for the Network Card with network address 081074168263. The following
error occurred: %%1223. Your computer will continue to try and obtain an address
on its own from the network address (DHCP) server.

Error - 5/27/2009 10:27:29 AM | Computer Name = CCOMPUTI-BDC23C | Source = Dhcp | ID = 1001
Description = Your computer was not assigned an address from the network (by the
DHCP Server) for the Network Card with network address 081074168263. The following
error occurred: %%1223. Your computer will continue to try and obtain an address
on its own from the network address (DHCP) server.

Error - 6/4/2009 1:14:24 PM | Computer Name = CCOMPUTI-BDC23C | Source = Service Control Manager | ID = 7031
Description = The Lavasoft Ad-Aware Service service terminated unexpectedly. It
has done this 1 time(s). The following corrective action will be taken in 5000
milliseconds: Restart the service.

Error - 6/4/2009 1:14:26 PM | Computer Name = CCOMPUTI-BDC23C | Source = Service Control Manager | ID = 7034
Description = The Yahoo! Updater service terminated unexpectedly. It has done this
1 time(s).

Error - 6/4/2009 1:14:32 PM | Computer Name = CCOMPUTI-BDC23C | Source = Service Control Manager | ID = 7034
Description = The iPod Service service terminated unexpectedly. It has done this
1 time(s).

Error - 6/15/2009 9:19:23 AM | Computer Name = CCOMPUTI-BDC23C | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.225 for the Network Card with network
address 081074168263 has been denied by the DHCP server 192.168.1.2 (The DHCP Server
sent a DHCPNACK message).

Error - 6/17/2009 3:24:31 PM | Computer Name = CCOMPUTI-BDC23C | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.225 for the Network Card with network
address 081074168263 has been denied by the DHCP server 192.168.1.2 (The DHCP Server
sent a DHCPNACK message).

Error - 6/18/2009 7:22:16 AM | Computer Name = CCOMPUTI-BDC23C | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.225 for the Network Card with network
address 081074168263 has been denied by the DHCP server 192.168.1.2 (The DHCP Server
sent a DHCPNACK message).


< End of report >
Post #5
I can see no sign of that trojan on your system -

[external image: Posted Image] Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
Post #6
Yeah. it's still there. I even tried the new tool you told me to download. Maybe you guys didnt see anything because I had already tried cleaning the drive before posting online.
Post #7
Did you get a report from MBAM - what did you do prior to posting here ?

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI