Spyware / Malware / Virus Removal

possible hack thru ftp

29 min read

Looking for the outcome? Ask AI

blindlemon Topic Starter

Post #1June 23, 2009, 3:22 PM UTC

Hello,
I believe my system has been comprimised and the hack came thru Core FTP
I've attached the following malwarebytes log and hjt log.

Thanks for any help.

Malwarebytes' Anti-Malware 1.38
Database version: 2323
Windows 5.1.2600 Service Pack 2

6/22/2009 9:02:21 PM
mbam-log-2009-06-22 (21-02-21).txt

Scan type: Full Scan (C:\|M:\|)
Objects scanned: 470181
Time elapsed: 6 hour(s), 27 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> Not selected for removal.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls\wxfw.dll (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\hosts (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Owner\Start Menu\Programs\Startup\rncsys32.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\Owner\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:24:30 AM, on 6/23/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\M-Audio Sonica Theater\Install\STinst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\M-Audio Sonica Theater\STTask.exe
C:\Program Files\SqueezeCenter\SqueezeTray.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\PROGRA~1\SQUEEZ~1\server\SQUEEZ~1.EXE
C:\PROGRA~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Google\Google Earth\googleearth.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\PayPal\PayPal Plug-In\RBroker.exe
C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O2 - BHO: OToolbarHelper Class - {EAD3A971-6A23-4246-8691-C9244E858967} - C:\Program Files\PayPal\PayPal Plug-In\PayPalHelper.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O3 - Toolbar: PayPal Plug-In - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - C:\Program Files\PayPal\PayPal Plug-In\OToolbar.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LtcyCfgApply] "C:\Program Files\Ltcycfg2\LtcyCfg.exe" /a
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SDActiveMonitor] C:\Program Files\SpywareDetector\SDActiveMonitor.exe -AUTO
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: M-Audio Sonica Theater Control Panel Launcher.lnk = C:\Program Files\M-Audio Sonica Theater\STTask.exe
O4 - Global Startup: SqueezeCenter Tray Tool.lnk = C:\Program Files\SqueezeCenter\SqueezeTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} (NewUpgradeFinder Control) - http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1123110157281
O16 - DPF: {6DD4EA80-8981-40FB-B2FC-06B8EDC632B8} (PrintControl.PrinterControl) - http://www.2for1.com/downloads/PrintControl.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1213284287968
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/telepo…ty4LotTeleX.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} - http://fdl.msn.com/public/investor/v13/ticker.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Google Update Service (gupdate1c99eaec907864) (gupdate1c99eaec907864) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Just Flight Limited License Service - Just Flight Limited - C:\Program Files\Common Files\Just Flight Limited Shared\Service\JustFlightLimitedLicSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Sonica Theater Installer (SonicaTheaterInstallerService) - Nemesis - C:\Program Files\M-Audio Sonica Theater\Install\STinst.exe
O23 - Service: SqueezeMySQL - Unknown owner - C:\PROGRA~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: WnsService - Unknown owner - G:\+OldMachine\Bootdrive\cgi-bin\WnsService.exe (file missing)

–
End of file - 12932 bytes

emeraldnzl

Post #2June 24, 2009, 4:52 AM UTC

Hello blindlemon,

Welcome to WTT.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

blindlemon

Post #3June 24, 2009, 2:54 PM UTC

Here's the info you requested.

Thanks much
Blind Lemon

OTL Extras logfile created on: 6/24/2009 8:37:28 AM - Run 1
OTL by OldTimer - Version 3.0.5.2 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.03 Gb Available Physical Memory | 51.73% Memory free
3.85 Gb Paging File | 3.26 Gb Available in Paging File | 84.70% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072E:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 107.34 Gb Total Space | 25.71 Gb Free Space | 23.95% Space Free | Partition Type: NTFS
Drive D: | 4.43 Gb Total Space | 0.53 Gb Free Space | 11.98% Space Free | Partition Type: FAT32
Drive E: | 149.05 Gb Total Space | 108.36 Gb Free Space | 72.70% Space Free | Partition Type: NTFS
Drive F: | 298.01 Gb Total Space | 232.36 Gb Free Space | 77.97% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 65.94 Gb Total Space | 29.75 Gb Free Space | 45.12% Space Free | Partition Type: NTFS
Drive M: | 111.81 Gb Total Space | 56.68 Gb Free Space | 50.69% Space Free | Partition Type: NTFS
Drive O: | 243.98 Mb Total Space | 243.37 Mb Free Space | 99.75% Space Free | Partition Type: FAT

Computer Name: TKPGOLD
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – C:\WINDOWS\hh.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] –
.js [@ = JSFile] – C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe (Macromedia, Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.scr [@ = AutoCADScriptFile] – C:\WINDOWS\notepad.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"9000:TCP" = 9000:TCP:*:Enabled:SqueezeCenter 9000 tcp
"3483:UDP" = 3483:UDP:*:Enabled:SqueezeCenter 3483 udp
"3483:TCP" = 3483:TCP:*:Enabled:SqueezeCenter 3483 tcp
"137:TCP" = 137:TCP:*:Enabled:MacMachine
"138:TCP" = 138:TCP:*:Enabled:MacMachine2
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 (Microsoft Corporation)
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 (Microsoft Corporation)
C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger (Microsoft Corporation)
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe:*:Disabled:BackWeb-137903 ()
C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe:*:Enabled:Microsoft Flight Simulator (Microsoft Corporation)
C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server (Microsoft Corporation)
C:\Program Files\NETGEAR\Media Server\MediaServer.exe:*:Enabled:Digital 5 Streaming Media Application File not found
C:\Program Files\NETGEAR\Media Server\immsService.exe:*:Enabled:D5 Integrated Multimedia Server Service File not found
G:\Program Files\NETGEAR\Media Server\immsService.exe:*:Enabled:D5 Integrated Multimedia Server Service File not found
G:\Program Files\NETGEAR\Media Server\MediaServer.exe:*:Enabled:Media Server Application File not found
C:\Program Files\Hewlett-Packard\HP DeskJet 1220C Toolbox\HPW8TBX.exe:*:Enabled:Toolbox for HP Printing System for Windows File not found
C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe:*:Enabled:Dreamweaver MX (Macromedia, Inc.)
E:\Program Files\NETGEAR\Media Server\MediaServer.exe:*:Enabled:Media Server File not found
E:\Program Files\NETGEAR\Media Server\immsService.exe:*:Enabled:D5 Integrated Multimedia Server Service File not found
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Computer, Inc.)
C:\Program Files\Macromedia\Flash MX\Flash.exe:*:Enabled:Flash 6.0 r25 (Macromedia, Inc.)
C:\Program Files\WS_FTP Pro\FTP95PRO.EXE:*:Enabled:FTP95PRO.EXE (Ipswitch, Inc. 81 Hartwell Ave. Lexington, MA)
C:\Program Files\Real\RealOne Player\realplay.exe:*:Enabled:RealOne Player (RealNetworks, Inc.)
C:\Program Files\Microsoft Games\Links 2003\LinksMMIII.exe:*:Enabled:Links 2003 (Microsoft Corporation)
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player (Microsoft Corporation)
C:\Bentley\Program\MicroStation\ustation.exe:*:Enabled:MicroStation for Windows x86 (Bentley Systems, Inc.)
E:\Program Files\Bentley\Program\MicroStation\ustation.exe:*:Enabled:MicroStation for Windows x86 (Bentley Systems, Inc.)
C:\Program Files\Autodesk\3ds Max 9\3dsmax.exe:*:Enabled:Autodesk 3ds Max 9 32-bit (Autodesk, Inc.)
C:\Program Files\DiskTrix\UltimateDefrag\UDefrag.exe:*:Enabled:UltimateDefrag V1.72 90 Day License File not found
C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup (Nero AG)
C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer (Microsoft Corporation)
C:\Program Files\DiskTrix\UltimateDefrag2008\UDefrag.exe:*:Enabled:UltimateDefrag 2008 (DiskTrix)
C:\Program Files\MediaMonkey\VisHelper.exe:*:Enabled:VisHelper ()
C:\Program Files\Microsoft ActiveSync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager (Microsoft Corporation)
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:*:Enabled:ActiveSync Application (Microsoft Corporation)
C:\Program Files\CoffeeCup Software\CoffeeCup Website Access Manager\CCAccess.exe:*:Enabled:CoffeeCup Website Access Manager (CoffeeCup Software)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{036AA4D4-6D32-11D4-9875-00105ACE7734}" = Logitech iTouch Software
"{0663708C-35D2-4A9B-AD98-2D49FB6729B6}" = LAGO Twin Otter Version 2.00
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}" = WD Diagnostics
"{0BD37B60-4FB2-48C9-B45F-39375611F899}" = LAGO Emma Field 2004
"{0F84C31B-D9D2-4FE2-935A-AF81A24DABB8}" = LAGO GeoRender3 version 2.00
"{14589F05-C658-4594-9429-D437BA688686}" = IntelliMover Data Transfer Demo
"{16E217EA-C3E0-402D-8D4F-6189DB74497A}" = Studio 9.4 Patch
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{1CFF36CE-2A4C-4ABD-9251-284491A383D2}" = PTDD Partition Table Doctor 3.0
"{1D639238-EDDF-4A28-8AD7-82744AF5BC34}" = Saitek Drivers
"{1F51A0CA-2BDD-474E-BB90-C7FA8EA78F52}" = ImageMixer VCD/DVD2 for OLYMPUS
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{2A267BC6-F77F-4DD4-825F-7AEB1F68B4B1}" = HpSdpAppCoreApp
"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150080}" = J2SE Runtime Environment 5.0 Update 8
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E853C8-8E86-4259-B4D6-E2B5BEDDABCD}" = LAGO Male Scenery FS2004 2.00
"{35E90FA5-2CB4-4039-A8BB-BE1B9DB94E21}" = HP Memories Disc
"{362BFFCD-8274-11D8-97C8-000129760CBE}" = MediaLife
"{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}" = QuickTime
"{3A9E0E2F-B0D1-452B-B833-7A7300EA1231}" = Saitek SD02.5 NT Drivers
"{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}" = Macromedia Flash MX
"{419CF344-3D94-4DAD-99C8-EA7B00E5EA8B}" = Acronis True Image Home
"{48EE6C79-1CE2-4CE8-B511-F2140B6781D6}" = Google Earth Pro
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{4F45B603-8E1B-4E1F-8E5D-0ADDD1BF0621}_0" = Bentley MicroStation (V 08.01.01.09) - 1
"{4FCC384C-18EA-4E25-9281-A06AE006D219}" = Weblink
"{5094C629-274C-4631-84D7-960FEF6D13F7}" = LAGO Honolulu INTL Version 2.00
"{53480370-6CA2-47EC-BC05-02B4B9271C31}" = O&O; Defrag Professional Edition
"{5783F2D7-0201-0409-0000-0060B0CE6BBA}" = AutoCAD 2004
"{5B3FB6D4-1B88-413D-8DE7-A7E2D58DE5B2}" = TOPO! 4
"{5FAB6A66-2DAC-11D4-8524-00C04F602FD3}" = Adobe After Effects 5.0
"{5FAC5488-E7CF-43C5-AC88-B4514F31456D}" = aerosoft's - DHC2 Beaver
"{609F7AC8-C510-11D4-A788-009027ABA5D0}" = Easy CD Creator 5 Basic
"{60E80B13-8649-4A69-85E2-1AE99E061F43}" = ShowBiz DVD
"{60E971B7-51A0-48CA-8687-C6B8F094A409}" = Simple Backup for My Pictures
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{666E0B91-3FD3-43B7-B6A2-EB9012758982}" = FSAutoStart
"{698BB337-5F2B-4944-90BB-180A16D37787}" = Weather Maker Pro 4.2 (Update)
"{6B36DEBF-27D0-4B1E-858D-D397091C6C7D}" = HP Precisionscan Pro 3.1
"{6C3F7A25-458D-4FBF-8C38-B29313CD99C7}" = Weather Maker Pro 4.0
"{6C57791A-4AA1-46A4-9879-2E9852A42D9C}" = LAGO GeoRender 6 Scenery FS2004 Version 1.00
"{73317C31-2B6E-4B88-9865-B97C1331A39D}" = PayPal Plug-In
"{7A5E68D5-DEA7-4067-B191-B4AE756C057B}" = STOPzilla
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{7C5BCAA4-80F2-4092-BD22-F426453BCD17}" = gigabeat S Series Manual
"{8055A473-C0E0-4F14-8B07-A531C44E5DE4}" = American Data Roads Railroads and Streams
"{85D9D4FD-AD19-459E-A901-158AE62A3A7D}" = Patch
"{868D7896-99D4-4513-BC62-2B3AD3E24926}" = TuneUp Utilities 2006
"{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}" = iTunes
"{884705D8-575F-4F12-9FA6-E4558866A127}" = Spam Bully 2 for Outlook Express
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B4AB829-DFD3-436D-B808-D9733D76C590}" = Macromedia Dreamweaver MX
"{8BF6957D-9288-41A3-88B6-D5902FBC51EF}" = Uru - To D'ni Expansion Pack
"{8DFFE63E-A689-45C7-A309-E00E28ACDF07}" = Tongass Fjords
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90126B79-C0D2-41A5-86B2-2F6666C446B9}" = Saitek Configuration Software
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{97097F2D-CFBF-4DC9-A8AF-1C8EAC322275}" = Vocal Remover
"{97A908F8-F3B6-44ED-83BB-55E7BFE23F06}" = TOPO!
"{9E491AB7-4589-48CA-9CBB-874CB2788391}" = Studio 9
"{A1BC8E02-6B5B-4B4A-A75F-B27A16918C2B}" = DiscWizard for Windows
"{A351224F-533A-4EED-89F4-0BF3417FD31D}" = WD Backup
"{A5BA14E0-7384-11D4-BAE7-00409631A2C8}" = Macromedia Extension Manager
"{A7A34FC9-DF24-4A36-00AD-D4EFE94CC116}" = SimCity 4 Deluxe
"{A7BF5269-3E74-11D5-B00F-00104B398D77}" = QuarkXPress 5.0
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe 1.4.136.1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B1A9CD45-A702-4E3B-91ED-8CD562869901}" = DWG TrueView 2008
"{B28B351F-1232-46EA-85EF-B8EA91641033}" = Nero 7 Essentials
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B43357AA-3A6D-4D94-B56E-43C44D09E548}" = Microsoft .NET Framework (English)
"{B4FEA924-630D-11D4-B78E-005004566E4D}" = ViewSonic Monitor Drivers
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{B67624DE-75CE-4FAD-9F29-5C115773CE61}" = Studio 9 Content CD/DVD
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BA820A24-704B-428D-9904-71A10DAC1372}" = OLYMPUS Master
"{C539AF6F-9DB3-458C-9274-1F3EE3291FB1}" = Abacus EZ-Libraries
"{C88E49AA-41C5-4420-A08D-BE1B6C5A3A74}" = DAO
"{C894366E-51C4-4162-BA82-ECBEFC1C2C61}" = PayPal Plug-In
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC016F21-3970-11DE-B878-005056806466}" = Google Earth
"{CE8472F3-6611-4F7A-B53E-A5E34103DD6B}" = LAGO FS Enhancer 2004
"{DA496AB5-DBFD-486F-8A37-D75FA179CAF3}" = CYPB - Port Alberni, British Columbia, Canada
"{DB1064C8-E623-441A-9036-FCDF0F2DE08C}" = NuRoads Configurator
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware 2007
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E55A7A90-184D-40A3-93AA-6F749B66C2F6}" = aerosoft's - Beech18 - FS2004
"{E7A6ED40-F230-11D4-BBC4-00104B991322}" = VBA (2720)
"{E96D4088-AAC5-437F-9E39-EC0E387897B4}" = Autodesk 3ds Max 9 32-bit
"{EA1F8E2F-9057-496A-BE1C-92CCA15479E3}" = H264 PRO IRS
"{EEF397AC-DAEF-4C04-90A9-5B2BD31875DC}" = Simple Installer - Multilanguage Version
"{F165A635-9DFF-4F34-A669-49493E0A5B38}" = M2PMCEncoderZX
"{F4E57F49-84B4-4CF2-B0A1-8CA1752BDF7E}" = OmniPass
"{F61F2821-694C-475F-99AB-6AF2EFDF40FD}" = Quicken 2003 New User Edition
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FC053571-8507-44E4-8B6D-AACEAB8CA57C}" = Sansa Media Converter
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"{FD6C6B7F-5696-48C5-A601-2EE9E50C3D46}" = WD Firewire HID Driver
"{FDE97748-2050-47B1-9BDD-E049626FDE63}" = Smartparts Desktop
"3DSMAX25" = 3D Studio MAX R2.5
"AB 412 GUARDIA COSTIERA (Italia)" = AB 412 GUARDIA COSTIERA (Italia)
"ACDSee" = ACDSee
"ACID 2.0" = Sonic Foundry ACID 2.0d
"ACT! 4.0 for Windows" = ACT! 4.0 for Windows
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Illustrator 9.0" = Adobe Illustrator 9.0
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Advanced Encode Decode Tools v.1.062e" = Advanced Encode Decode Tools v.1.062e
"Advanced WMA Workshop_is1" = Advanced WMA Workshop version 2.09b
"allTunes" = allTunes
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.3
"Antilles 2004" = Antilles 2004 v1.1 Int
"ArcherFS9" = Archer!
"ArcSoft Software Suite" = ArcSoft Picture Software
"ATI Display Driver" = ATI Display Driver (Omega 3.8.231)
"AutoCAD R14.0 Uninstall" = AutoCAD R14.0
"Autodesk Express Viewer" = Autodesk Express Viewer
"AutoGK" = Auto Gordian Knot 2.40
"AviSynth" = AviSynth 2.5
"BackWeb-137903 Uninstaller" = Updates from HP
"Belarc Advisor 2.0" = Belarc Advisor 7.1
"BirdsEyeView1.0" = BirdsEyeView
"BirdsEyeView1.1" = BirdsEyeView
"BrowserMaster_is1" = BrowserMaster v2.5
"Carenado Cessna U206G Stationair 6 II Full" = Carenado Cessna U206G Stationair 6 II Full
"CoffeeCup Web Form Builder - Registered" = CoffeeCup Web Form Builder - Registered
"CoffeeCup Web Form Builder - Trial" = CoffeeCup Web Form Builder - Trial
"CoffeeCup Website Access Manager" = CoffeeCup Website Access Manager
"Core FTP LE 1.3c" = Core FTP LE 1.3c
"DivX Content Uploader" = DivX Content Uploader
"DreamFleet A36 Bonanza 1.1" = DreamFleet A36 Bonanza 1.1
"DreamFleet A36 Bonanza Floatplane Update 1.1" = DreamFleet A36 Bonanza Floatplane Update 1.1
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVDx_is1" = DVDx
"DWG TrueView 2008" = DWG TrueView 2008
"EndItAll_is1" = EndItAll 2.0
"Flight Environment" = Flight Environment
"Flight Simulator 9.0" = Microsoft Flight Simulator 2004 A Century of Flight
"FlightZone 02: Portland" = FlightZone 02: Portland
"FSGenesis Appalachians & Northeast 38m Terrain" = FSGenesis Appalachians & Northeast 38m Terrain
"FSGenesis Cordillera Canada 38.2m Terrain" = FSGenesis Cordillera Canada 38.2m Terrain
"FSGenesis Cordillera Canada 38.2m Terrain – Yukon" = FSGenesis Cordillera Canada 38.2m Terrain – Yukon
"FSGenesis The Great Plains 38m Terrain" = FSGenesis The Great Plains 38m Terrain
"FSGenesis The West Coast 38m Terrain" = FSGenesis The West Coast 38m Terrain
"FSGenesis US National Landclass Project" = FSGenesis US National Landclass Project
"FZ02-CRGUT Compatibility Upgrade Kit" = FZ02-CRGUT Compatibility Upgrade Kit
"GAArcher" = Archer
"GARMIN 400 Series Trainer" = GARMIN 400 Series Trainer
"G-Force" = G-Force
"HijackThis" = HijackThis 2.0.2
"Hollywood FX 5" = Pinnacle Hollywood FX 5

"Hollywood FX 5.5 Additional Effects" = Hollywood FX 5.5 Additional Effects
"Hollywood FX for Studio" = Pinnacle Hollywood FX for Studio
"hp instant support" = HP Instant Support
"HPTOOLKIT" = toolkit
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ImgBurn" = ImgBurn (Remove Only)
"InstallShield_{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}" = QuickTime
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}" = iTunes
"InstallShield_{97A908F8-F3B6-44ED-83BB-55E7BFE23F06}" = TOPO!
"InstallShield_{BA820A24-704B-428D-9904-71A10DAC1372}" = OLYMPUS Master
"InstallShield_{C88E49AA-41C5-4420-A08D-BE1B6C5A3A74}" = DAO
"InstallShield_{F61F2821-694C-475F-99AB-6AF2EFDF40FD}" = Quicken 2003 New User Edition
"InterActual Player" = InterActual Player
"Kai's Power Tools 5" = Kai's Power Tools 5
"LegalSounds Music Downloader_is1" = LegalSounds Music Downloader 1.4
"LifeGlobe Sharks, Terrors of the Deep 2_is1" = LifeGlobe Sharks, Terrors of the Deep 2
"Links 2003 1.0" = Microsoft Links 2003
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 1.80 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaMonkey_is1" = MediaMonkey 3.0
"MegaCITY - Denver_is1" = Denver
"MegaCity Hawaii - Honolulu and the Island of Oahu_is1" = Hawaii Oahu
"MegaScenery - Pacific Northwest_is1" = Pacific Northwest Scenery
"MegaScenery - Southern California_is1" = Southern California
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework Full v1.0.3705 (1033)" = Microsoft .NET Framework (English) v1.0.3705
"MovieConverter" = Movie Converter
"Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MultiRes (remove only)" = MultiRes (remove only)
"NetworkAddonMod" = NetworkAddonMod Beta Version 2006.12.24
"NFR" = Nasty File Remover v0.71 (remove only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PhotoTools 2.0" = Extensis PhotoTools 2.0
"Pinnacle Hollywood FX Pack - Extra FX" = Pinnacle Hollywood FX Pack - Extra FX
"Plugins Galaxy" = Plugins Galaxy
"PocketDVDStudio" = Pocket-DVD Studio(remove only)
"proDAD-Heroglyph-1.0" = proDAD Heroglyph 1.0
"PS2" = PS2
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Python 2.2.1" = Python 2.2.1
"Radeon Omega Drivers for Windows 2k/XPv3.8.231" = Radeon Omega Drivers v3.8.231 Setup Files and Tools
"Real Terrain© Colorado Installation For FS 2004" = Real Terrain© Colorado Installation For FS 2004
"RealPlayer 6.0" = RealPlayer
"RER MOV Converter3.0.5" = RER MOV Converter
"S3Display" = S3Display
"S3Gamma2" = S3Gamma2
"S3Info2" = S3Info2
"S3Overlay" = S3Overlay
"Save Flash" = Save Flash 4.1
"SimCity 4 Startup Manager" = SimCity 4 Startup Manager
"Sound Forge XP" = Sonic Foundry Sound Forge XP 4.5f
"Spam Bully for OE" = Spam Bully for OE [removed]
"SpeedFan" = SpeedFan (remove only)
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"SqueezeCenter_is1" = SqueezeCenter 7.0.1
"Studio 9.0.4" = Studio 9.0.4
"SystemBooster V2.0" = SystemBooster V2.0
"TexoMatic_Unique" = Flight One Text-o-Matic
"The Weather Channel Desktop" = The Weather Channel Desktop
"Tools 1.0_is1" = Tools 1.0
"TOPO!" = TOPO!
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"Ultimate Terrain - Canada & Alaska" = Ultimate Terrain - Canada & Alaska
"Ultimate Terrain - USA" = Ultimate Terrain - USA
"UltimateDefrag 2008" = UltimateDefrag 2008
"UniC310Ver10" = Seven Charlie Mike: The Cessna 310
"UniC310Ver11" = Seven Charlie Mike: The Cessna 310 - FS2004 Update
"Uninstaller_B4D28000_Schweizer 300CBi" = Schweizer 300CBi (Shared Components)
"USBTheater" = Sonica Theater [removed]
"VETWIN32Vp5" = CA Anti-Virus
"ViewBuild Professional" = ViewBuild Professional
"VobSub" = VobSub v2.23 (Remove Only)
"Vocal Remover" = Vocal Remover
"Weather Services" = Weather Services
"WhiteCap" = WhiteCap
"Winamp" = Winamp (remove only)
"Windows CE Services" = Microsoft ActiveSync 3.8
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XviD MPEG4 Video Codec" = XviD MPEG4 Video Codec (remove only)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/4/2009 11:08:30 AM | Computer Name = TKPGOLD | Source = | ID = 0
Description =

Error - 4/11/2009 12:06:38 AM | Computer Name = TKPGOLD | Source = Application Error | ID = 1000
Description = Faulting application mediamonkey.exe, version 3.0.4.1185, faulting
module kernel32.dll, version 5.1.2600.3119, fault address 0x00012a5b.

Error - 4/17/2009 10:17:49 AM | Computer Name = TKPGOLD | Source = Google Update | ID = 20
Description =

Error - 4/17/2009 1:07:06 PM | Computer Name = TKPGOLD | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Standard Edition 2003 – Error 1706. Setup
cannot find the required files. Check your connection to the network, or CD-ROM
drive. For other potential solutions to this problem, see C:\Program Files\Microsoft
Office\OFFICE11\1033\SETUP.CHM.

Error - 4/27/2009 11:09:53 AM | Computer Name = TKPGOLD | Source = Application Hang | ID = 1002
Description = Hanging application Dreamweaver.exe, version 6.0.1714.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/3/2009 3:44:34 PM | Computer Name = TKPGOLD | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16827, faulting
module flash10b.ocx, version 10.0.22.87, fault address 0x002da8ba.

Error - 6/3/2009 3:46:29 PM | Computer Name = TKPGOLD | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16827, faulting
module flash10b.ocx, version 10.0.22.87, fault address 0x002da8ba.

Error - 6/3/2009 4:26:21 PM | Computer Name = TKPGOLD | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16827, faulting
module flash10b.ocx, version 10.0.22.87, fault address 0x002da926.

Error - 6/3/2009 4:26:41 PM | Computer Name = TKPGOLD | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16827, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/18/2009 4:33:30 PM | Computer Name = TKPGOLD | Source = Application Error | ID = 1000
Description = Faulting application vb3core.exe, version 0.0.0.0, faulting module
vb3core.exe, version 0.0.0.0, fault address 0x00064ad6.

[ System Events ]
Error - 6/23/2009 2:29:58 PM | Computer Name = TKPGOLD | Source = BROWSER | ID = 8032
Description = The browser service has failed to retrieve the backup list too many
times on transport \Device\NetBT_Tcpip_{29DC17E6-6DB8-4CB2-84A3-82E0F08B8D0D}. The
backup browser is stopping.

Error - 6/23/2009 4:15:31 PM | Computer Name = TKPGOLD | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 6/23/2009 4:15:32 PM | Computer Name = TKPGOLD | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
agp440 fasttx2k SDManager SISAGP viaagp1

Error - 6/23/2009 4:16:06 PM | Computer Name = TKPGOLD | Source = ipnathlp | ID = 30013
Description = The DHCP allocator has disabled itself on IP address 169.254.114.176,
since
the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses
are being allocated to DHCP clients. To enable the DHCP allocator on this IP address,
please
change the scope to include the IP address, or change the IP address to fall within
the scope.

Error - 6/23/2009 5:45:58 PM | Computer Name = TKPGOLD | Source = BROWSER | ID = 8032
Description = The browser service has failed to retrieve the backup list too many
times on transport \Device\NetBT_Tcpip_{29DC17E6-6DB8-4CB2-84A3-82E0F08B8D0D}. The
backup browser is stopping.

Error - 6/23/2009 8:36:14 PM | Computer Name = TKPGOLD | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 6/23/2009 8:36:15 PM | Computer Name = TKPGOLD | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
agp440 fasttx2k SDManager SISAGP viaagp1

Error - 6/23/2009 8:37:06 PM | Computer Name = TKPGOLD | Source = ipnathlp | ID = 30013
Description = The DHCP allocator has disabled itself on IP address 169.254.114.176,
since
the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses
are being allocated to DHCP clients. To enable the DHCP allocator on this IP address,
please
change the scope to include the IP address, or change the IP address to fall within
the scope.

Error - 6/23/2009 10:03:38 PM | Computer Name = TKPGOLD | Source = BROWSER | ID = 8032
Description = The browser service has failed to retrieve the backup list too many
times on transport \Device\NetBT_Tcpip_{29DC17E6-6DB8-4CB2-84A3-82E0F08B8D0D}. The
backup browser is stopping.

Error - 6/24/2009 8:33:49 AM | Computer Name = TKPGOLD | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.101 for the Network Card with network
address 000C6E741192 has been denied by the DHCP server 192.168.0.254 (The DHCP
Server sent a DHCPNACK message).

< End of report >

OTL logfile created on: 6/24/2009 8:37:28 AM - Run 1
OTL by OldTimer - Version 3.0.5.2 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.03 Gb Available Physical Memory | 51.73% Memory free
3.85 Gb Paging File | 3.26 Gb Available in Paging File | 84.70% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072E:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 107.34 Gb Total Space | 25.71 Gb Free Space | 23.95% Space Free | Partition Type: NTFS
Drive D: | 4.43 Gb Total Space | 0.53 Gb Free Space | 11.98% Space Free | Partition Type: FAT32
Drive E: | 149.05 Gb Total Space | 108.36 Gb Free Space | 72.70% Space Free | Partition Type: NTFS
Drive F: | 298.01 Gb Total Space | 232.36 Gb Free Space | 77.97% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 65.94 Gb Total Space | 29.75 Gb Free Space | 45.12% Space Free | Partition Type: NTFS
Drive M: | 111.81 Gb Total Space | 56.68 Gb Free Space | 50.69% Space Free | Partition Type: NTFS
Drive O: | 243.98 Mb Total Space | 243.37 Mb Free Space | 99.75% Space Free | Partition Type: FAT

Computer Name: TKPGOLD
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe (iS3, Inc.)
PRC - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (Lavasoft)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
PRC - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe (Computer Associates International, Inc.)
PRC - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
PRC - C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe ()
PRC - C:\WINDOWS\System32\oodag.exe (O&O; Software GmbH)
PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Softex\OmniPass\Omniserv.exe ()
PRC - C:\Program Files\M-Audio Sonica Theater\Install\STinst.exe (Nemesis)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\SqueezeCenter\server\Bin\MSWin32-x86-multi-thread\mysqld.exe ()
PRC - C:\Program Files\STOPzilla!\STOPzilla.exe (iS3, Inc.)
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe (CA, Inc.)
PRC - C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
PRC - C:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\WINDOWS\System32\ps2.exe (Hewlett-Packard Company)
PRC - C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe (CA, Inc.)
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe (CA, Inc.)
PRC - C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
PRC - C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\Logitech\SetPoint\KEM.exe (Logitech Inc.)
PRC - C:\Program Files\M-Audio Sonica Theater\STTask.exe (M-Audio)
PRC - C:\Program Files\SqueezeCenter\SqueezeTray.exe ()
PRC - C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE (Logitech Inc.)
PRC - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (CA, Inc.)
PRC - C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aawservice [Auto | Running]) – C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (Lavasoft)
SRV - (AcrSch2Svc [Auto | Running]) – C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Running]) – C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (ATI Smart [Auto | Stopped]) – C:\WINDOWS\System32\ati2sgag.exe ()
SRV - (Autodesk Licensing Service [Auto | Running]) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (CaCCProvSP [On_Demand | Running]) – C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (CA, Inc.)
SRV - (CAISafe [Auto | Running]) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe (Computer Associates International, Inc.)
SRV - (clr_optimization_v2.0.50727_32 [Auto | Running]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (gupdate1c99eaec907864 [Auto | Stopped]) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (iPodService [Disabled | Stopped]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Computer, Inc.)
SRV - (Just Flight Limited License Service [On_Demand | Stopped]) – C:\Program Files\Common Files\Just Flight Limited Shared\Service\JustFlightLimitedLicSvc.exe (Just Flight Limited)
SRV - (LightScribeService [Auto | Running]) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (mi-raysat_3dsmax9_32 [Auto | Running]) – C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe ()
SRV - (NMIndexingService [On_Demand | Stopped]) – C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG)
SRV - (O&O; Defrag [Auto | Running]) – C:\WINDOWS\System32\oodag.exe (O&O; Software GmbH)
SRV - (omniserv [Auto | Running]) – C:\Program Files\Softex\OmniPass\Omniserv.exe ()
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (SonicaTheaterInstallerService [Auto | Running]) – C:\Program Files\M-Audio Sonica Theater\Install\STinst.exe (Nemesis)
SRV - (SqueezeMySQL [Auto | Running]) – C:\Program Files\SqueezeCenter\server\Bin\MSWin32-x86-multi-thread\mysqld.exe ()
SRV - (szserver [Auto | Running]) – C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe (iS3, Inc.)
SRV - (UxTuneUp [Auto | Running]) – C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (VETMSGNT [Auto | Running]) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe (CA, Inc.)
SRV - (WMPNetworkSvc [Auto | Running]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (WnsService [On_Demand | Stopped]) – File not found
SRV - (MBAMService [Auto | Running]) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

========== Driver Services (SafeList) ==========

DRV - (Afc [On_Demand | Running]) – C:\WINDOWS\System32\drivers\Afc.sys (Arcsoft, Inc.)
DRV - (ALCXSENS [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (ALCXWDM [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (ASAPIW2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ASAPIW2k.sys (Pinnacle Systems GmbH)
DRV - (ati2mtag [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ATIAVAIW [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\atinavt2.sys (ATI Technologies Inc.)
DRV - (atinevxx [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\atinevxx.sys (ATI Technologies Inc.)
DRV - (atinrvxx [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\atinrvxx.sys (ATI Technologies Inc.)
DRV - (atitray [System | Running]) – C:\Program Files\Radeon Omega Drivers\v3.8.231\ATI Tray Tools\atitray.sys ()
DRV - (BANTExt [System | Running]) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (BENDER [On_Demand | Running]) – C:\WINDOWS\System32\drivers\bender.sys (Pinnacle Systems GmbH)
DRV - (Cdr4_xp [System | Running]) – C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (Cdralw2k [System | Running]) – C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (cdrbsdrv [System | Running]) – C:\WINDOWS\System32\drivers\CDRBSDRV.SYS (B.H.A Corporation)
DRV - (cdudf_xp [System | Running]) – C:\WINDOWS\System32\drivers\cdudf_xp.sys (Roxio)
DRV - (drvmcdb [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\drvmcdb.sys (VERITAS Software, Inc.)
DRV - (dvd_2K [On_Demand | Running]) – C:\WINDOWS\System32\drivers\Dvd_2k.sys (Roxio)
DRV - (fasttx2k [Boot | Stopped]) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (ialm [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (itchfltr [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\itchfltr.sys (Logitech, Inc.)
DRV - (Iviaspi [On_Demand | Running]) – C:\WINDOWS\System32\drivers\iviaspi.sys (InterVideo, Inc.)
DRV - (L8042mou [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\L8042mou.Sys (Logitech, Inc.)
DRV - (LMouKE [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\LMouKE.Sys (Logitech, Inc.)
DRV - (ltmodem5 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys (LT)
DRV - (ma763007 [On_Demand | Running]) – C:\WINDOWS\System32\drivers\MA763007.sys (Nemesis)
DRV - (MarvinBus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\MarvinBus.sys (Pinnacle Systems GmbH)
DRV - (MCSTRM [Auto | Running]) – C:\WINDOWS\System32\drivers\mcstrm.sys (RealNetworks, Inc.)
DRV - (mmc_2K [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\Mmc_2k.sys (Roxio)
DRV - (MPE [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\MPE.sys (Microsoft Corporation)
DRV - (MVDCODEC [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\atinmdxx.sys (ATI Technologies Inc.)
DRV - (NVENET [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\NVENET.sys (NVIDIA Corporation)
DRV - (nv_agp [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (PCLEPCI [System | Running]) – C:\WINDOWS\System32\drivers\pclepci.sys (Pinnacle Systems GmbH)
DRV - (pfc [On_Demand | Running]) – C:\WINDOWS\System32\drivers\pfc.sys (Padus, Inc.)
DRV - (Point32 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\point32.sys (Microsoft Corporation)
DRV - (Ps2 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (pwd_2K [System | Running]) – C:\WINDOWS\System32\drivers\pwd_2K.sys (Roxio)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (rtl8139 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\RTL8139.SYS (Realtek Semiconductor Corporation)
DRV - (rxpvbus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rxpvbus.sys (Reality XP)
DRV - (S3Psddr [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (SaiClass [On_Demand | Running]) – C:\WINDOWS\System32\drivers\SaiNtBus.sys (Saitek)
DRV - (SaiMini [On_Demand | Running]) – C:\WINDOWS\System32\drivers\SaiMini.sys (Saitek)
DRV - (SaiNtHid [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\SaiNtHid.sys (Saitek)
DRV - (Secdrv [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Sentinel [Auto | Running]) – C:\WINDOWS\System32\Drivers\SENTINEL.SYS ()
DRV - (SiS315 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP [Boot | Stopped]) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (snapman [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (speedfan [Boot | Running]) – C:\WINDOWS\system32\speedfan.sys (Windows ® 2000 DDK provider)
DRV - (SSHDRV64 [System | Running]) – C:\WINDOWS\System32\drivers\SSHDRV64.sys ()
DRV - (szkg5 [Boot | Running]) – C:\WINDOWS\system32\drivers\szkg.sys (iS3 Inc.)
DRV - (tifsfilter [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\tifsfilt.sys (Acronis)
DRV - (timounter [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis)
DRV - (UdfReadr_xp [System | Running]) – C:\WINDOWS\System32\drivers\udfreadr_xp.sys (Roxio)
DRV - (usbaudio [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (VET-FILT [System | Running]) – C:\WINDOWS\System32\drivers\vet-filt.sys (Computer Associates International, Inc.)
DRV - (VET-REC [System | Running]) – C:\WINDOWS\System32\drivers\vet-rec.sys (Computer Associates International, Inc.)
DRV - (VETEBOOT [On_Demand | Running]) – C:\WINDOWS\System32\drivers\veteboot.sys (Computer Associates International, Inc.)
DRV - (VETEFILE [System | Running]) – C:\WINDOWS\System32\drivers\vetefile.sys (Computer Associates International, Inc.)
DRV - (VETFDDNT [System | Running]) – C:\WINDOWS\System32\drivers\vetfddnt.sys (Computer Associates International, Inc.)
DRV - (VETMONNT [System | Running]) – C:\WINDOWS\System32\drivers\vetmonnt.sys (Computer Associates International, Inc.)
DRV - (viaagp1 [Boot | Stopped]) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (wceusbsh [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\wceusbsh.sys (Microsoft Corporation)
DRV - ({6080A529-897E-4629-A488-ABA0C29B635E} [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\ialmsbw.sys (Intel Corporation)
DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91} [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\ialmkchw.sys (Intel Corporation)
DRV - (MBAMProtector [On_Demand | Running]) – C:\WINDOWS\System32\drivers\mbam.sys (Malwarebytes Corporation)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://my.msn.com/"
FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:3.1.20081127W
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}:6.0.02
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}:6.0.01
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}:6.0.05
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.071101000055
FF - prefs.js..extensions.enabledItems: paypalfirefoxplugin@orbiscom:[removed]
FF - prefs.js..extensions.enabledItems: {d494da20-8750-11db-b606-0800200c9a66}:3.0.1
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.11

FF - HKLM\software\mozilla\Firefox\Extensions\\paypalfirefoxplugin@orbiscom: C:\Program Files\PayPal\PayPal Plug-In
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/06/16 10:53:02 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/06/16 10:53:02 | 00,000,000 | —D | M]

[2008/08/26 14:22:48 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Extensions
[2008/08/26 14:22:48 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/06/23 09:50:01 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions
[2009/01/07 10:30:11 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2007/12/04 17:12:52 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions\{526fd696-27a0-11dc-8314-0800200c9a66}
[2007/10/19 10:20:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions\{5c434b90-6318-11da-8cd6-0800200c9a69}
[2007/07/31 15:23:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2008/04/02 08:01:54 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions\{a45e6b3a-725d-4b20-afde-e7486bfe317c}
[2008/10/03 15:47:43 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions\{d494da20-8750-11db-b606-0800200c9a66}
[2006/04/27 16:05:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions\{F2BF34A6-7865-4526-8FA1-F21C4E694AF3}
[2006/04/27 16:01:11 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions\[removed]
[2009/01/22 20:23:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\p4y9thml.default\extensions\[removed]
[2008/06/18 15:21:34 | 00,001,712 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\FireFox\Profiles\p4y9thml.default\searchplugins\ask.xml
[2009/06/24 08:33:22 | 00,005,500 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\FireFox\Profiles\p4y9thml.default\searchplugins\foodtv.xml
[2008/06/18 15:21:36 | 00,000,908 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\FireFox\Profiles\p4y9thml.default\searchplugins\IMDB.xml
[2009/06/24 08:33:22 | 00,002,143 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\FireFox\Profiles\p4y9thml.default\searchplugins\marketwatch.xml
[2009/06/22 09:44:26 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2006/10/19 08:56:40 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/06/16 10:53:02 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2007/04/18 15:26:55 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
[2007/07/18 15:00:57 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
[2007/10/18 13:30:01 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
[2008/03/18 13:40:15 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
[2008/07/18 15:07:49 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2009/06/16 10:52:55 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/06/16 10:52:55 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2007/03/27 01:48:51 | 00,717,312 | —- | M] (DivX,Inc.) – C:\Program Files\mozilla firefox\plugins\npdivx32.dll
[2007/03/27 01:49:32 | 00,094,208 | —- | M] (DivX, Inc) – C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll
[2009/06/16 10:53:01 | 00,065,528 | —- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2007/03/22 19:23:30 | 00,017,248 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL
[2006/12/18 04:18:30 | 00,077,824 | —- | M] (Adobe Systems Inc.) – C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2006/08/22 08:47:46 | 00,139,305 | —- | M] (RealNetworks, Inc.) – C:\Program Files\mozilla firefox\plugins\nppl3260.dll
[2005/12/02 14:32:07 | 00,126,976 | —- | M] (Apple Computer, Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2005/12/02 14:32:07 | 00,126,976 | —- | M] (Apple Computer, Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2006/08/22 08:48:19 | 00,024,621 | —- | M] (RealNetworks, Inc.) – C:\Program Files\mozilla firefox\plugins\nprjplug.dll
[2006/08/22 08:47:37 | 00,081,967 | —- | M] (RealNetworks, Inc.) – C:\Program Files\mozilla firefox\plugins\nprpjplug.dll
[2008/12/23 15:50:08 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2008/12/23 15:50:08 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/12/23 15:50:08 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/12/23 15:50:08 | 00,002,343 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2008/12/23 15:50:08 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/12/23 15:50:08 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/12/23 15:50:08 | 00,000,792 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (36936 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.whippet.bfast.com
O1 - Hosts: 127.0.0.1 www.qwest.bfast.com
O1 - Hosts: 127.0.0.1 www.qwest.bfast.com
O1 - Hosts: 127.0.0.1 www.reporting.net
O1 - Hosts: 127.0.0.1 www.whippet.bfast.com
O1 - Hosts: 127.0.0.1 www.wolfhound.bfast.com
O1 - Hosts: 127.0.0.1 www.ads09.bpath.com
O1 - Hosts: 127.0.0.1 www.ads51.bpath.com
O1 - Hosts: 127.0.0.1 www.ns2.acim.com
O1 - Hosts: 127.0.0.1 www1.track4.com
O1 - Hosts: 127.0.0.1 www.ad.se.doubleclick.net
O1 - Hosts: 127.0.0.1 www.gravitychannel.netgravity.com
O1 - Hosts: 127.0.0.1 www.network-199-95-208-4.doubleclick.net
O1 - Hosts: 127.0.0.1 www.ny.netgravity.com
O1 - Hosts: 127.0.0.1 www.phase2media.doubleclick.net
O1 - Hosts: 127.0.0.1 www.ads2.speedbit.com
O1 - Hosts: 127.0.0.1 www.ads3.speedbit.com
O1 - Hosts: 127.0.0.1 www.contenttest.conducent.com
O1 - Hosts: 127.0.0.1 www.ip134.timesink.com
O1 - Hosts: 127.0.0.1 www.ad2-1.aureate.com
O1 - Hosts: 127.0.0.1 www.ad2-4.aureate.com
O1 - Hosts: 127.0.0.1 www.aim3.aureate.com
O1 - Hosts: 127.0.0.1 www.aureatemedia.com
O1 - Hosts: 127.0.0.1 www.cyrus.aureate.com
O1 - Hosts: 896 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ZILLAbar Browser Helper Object) - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll (iS3, Inc)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (STOPzilla Browser Helper Object) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll (iS3, Inc.)
O2 - BHO: (OToolbarHelper Class) - {EAD3A971-6A23-4246-8691-C9244E858967} - C:\Program Files\PayPal\PayPal Plug-In\PayPalHelper.dll ()
O3 - HKLM\..\Toolbar: (&Save; Flash) - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll (TODO: )
O3 - HKLM\..\Toolbar: (STOPzilla) - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll (iS3, Inc)
O3 - HKLM\..\Toolbar: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (PayPal Plug-In) - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - C:\Program Files\PayPal\PayPal Plug-In\OToolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - SITEguard - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address;) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Links;) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address;) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links;) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Save; Flash) - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll (TODO: )
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [AtiPTA] C:\WINDOWS\System32\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [CAVRID] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe (CA, Inc.)
O4 - HKLM..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe (CA, Inc.)
O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [LtcyCfgApply] C:\Program Files\Ltcycfg2\LtcyCfg.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] File not found
O4 - HKLM..\Run: [PS2] C:\WINDOWS\System32\ps2.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe (Logitech Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\M-Audio Sonica Theater Control Panel Launcher.lnk = C:\Program Files\M-Audio Sonica Theater\STTask.exe (M-Audio)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SqueezeCenter Tray Tool.lnk = C:\Program Files\SqueezeCenter\SqueezeTray.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: _NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKLM\..Trusted Domains: 32 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab (NewUpgradeFinder Control)
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab (SysData Class)
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} http://simcity.ea.com/update/EARTPX.cab (EARTPatchX Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1123110157281 (WUWebControl Class)
O16 - DPF: {6DD4EA80-8981-40FB-B2FC-06B8EDC632B8} http://www.2for1.com/downloads/PrintControl.CAB (PrintControl.PrinterControl)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1213284287968 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…7869.3365972222 (Reg Error: Key error.)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx (Get_ActiveX Control)
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} http://simcity.ea.com/exchange/lots/telepo…ty4LotTeleX.cab (MaxisSimCity4LotTeleX Control)
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab (MaxisSimCity4PatcherX Control)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_08)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_10)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} http://fdl.msn.com/public/investor/v13/ticker.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mctp {d7b95390-b1c5-11d0-b111-0080c712fe82} - C:\Program Files\Microsoft ActiveSync\aatp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/octet-stream - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-complus - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-msdownload - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - Class Install Handler - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - deflate - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - gzip - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - lzdhtml - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/webviewhtml - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (C:\Documents) - File not found
O20 - HKLM Winlogon: UIHost - (and) - File not found
O20 - HKLM Winlogon: UIHost - (Settings\All) - File not found
O20 - HKLM Winlogon: UIHost - (Users\Application) - File not found
O20 - HKLM Winlogon: UIHost - (Data\TuneUp) - File not found
O20 - HKLM Winlogon: UIHost - (Software\TuneUp) - File not found
O20 - HKLM Winlogon: UIHost - (Utilities\WinStyler\tu_logonui.exe) - File not found
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\WlNotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\System32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\System32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\System32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\Your Image File Name Here without a path: Debugger - C:\WINDOWS\System32\ntsd.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/04/09 23:19:17 | 00,000,000 | -HS- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 07:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2002/09/11 04:02:32 | 00,000,045 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2006/08/10 13:15:50 | 00,000,000 | —D | M] - F:\autorun – [ FAT32 ]
O32 - AutoRun File - [2005/11/15 12:08:04 | 00,000,036 | -H– | M] () - F:\autorun.inf – [ FAT32 ]
O33 - MountPoints2\{92dda43e-adad-11dc-b9e4-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{92dda43e-adad-11dc-b9e4-806d6172696f}\Shell\AutoRun - "" = Auto&Play;
O34 - HKLM BootExecute: (SDEarlyDelete) - C:\WINDOWS\System32\SDEarlyDelete.exe ()
O34 - HKLM BootExecute: (SDEarlyDelete) - C:\WINDOWS\System32\SDEarlyDelete.exe ()
O34 - HKLM BootExecute: (\??\C:\Program) - File not found
O34 - HKLM BootExecute: (Files\SpywareDetector) - File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (OODBS) - C:\WINDOWS\System32\OODBS.exe (O&O; Software GmbH)
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

========== Files/Folders - Created Within 30 Days ==========

[2009/06/24 08:34:57 | 00,512,512 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2009/06/24 08:31:20 | 00,000,478 | —- | C] () – C:\WINDOWS\tasks\Malwarebytes' Scheduled Update for Owner.job
[2009/06/24 08:31:06 | 00,000,492 | —- | C] () – C:\WINDOWS\tasks\Malwarebytes' Scheduled Scan for Owner.job
[2009/06/23 18:34:24 | 00,000,920 | —- | C] () – C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2009/06/23 13:44:44 | 00,026,624 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Please do the following.doc
[2009/06/23 13:42:57 | 00,278,221 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2009/06/23 13:42:02 | 00,359,893 | —- | C] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2009/06/23 09:42:06 | 18,071,615 | —- | C] () – C:\Fetch_5.5.dmg
[2009/06/23 09:39:00 | 00,000,791 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Shortcut to HijackThis.exe.lnk
[2009/06/22 14:31:14 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2009/06/22 14:31:06 | 00,000,739 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/22 14:31:04 | 00,038,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/06/22 14:31:02 | 00,019,096 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/06/22 14:31:02 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/06/22 14:31:02 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/06/22 14:27:42 | 03,561,744 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2009/06/10 15:40:27 | 00,095,676 | —- | C] () – C:\WINDOWS\System32\drivers\ac0a2fff5a08b1b35bb6f5c125c07e76.szcpf
[2009/06/10 15:34:52 | 00,144,648 | —- | C] () – C:\Documents and Settings\Owner\Desktop\SupportBridge.remoteassist.ca.com.443.supportbridge.$.exe
[2009/06/10 15:07:19 | 00,000,000 | -HSD | C] – C:\Config.Msi
[2009/06/09 17:16:40 | 00,095,676 | —- | C] () – C:\WINDOWS\System32\drivers\71f4af93.sys
[2009/06/08 10:07:55 | 06,768,808 | —- | C] () – C:\pccolorado.tif
[2009/05/28 14:16:24 | 00,017,408 | R— | C] (iS3, Inc.) – C:\WINDOWS\System32\SZIO5.dll
[2009/05/28 14:15:22 | 00,294,912 | R— | C] (iS3, Inc.) – C:\WINDOWS\System32\SZBase5.dll
[2009/05/28 14:14:56 | 00,540,672 | R— | C] (iS3, Inc.) – C:\WINDOWS\System32\SZComp5.dll
[2009/01/13 17:49:48 | 00,000,101 | —- | C] () – C:\WINDOWS\VSWizard.ini
[2008/04/18 11:00:49 | 00,000,110 | —- | C] () – C:\WINDOWS\System32\SDEarlyDelete.ini
[2007/04/20 14:48:20 | 00,000,049 | —- | C] () – C:\WINDOWS\topo4.INI
[2007/04/13 09:47:09 | 00,000,000 | —- | C] () – C:\WINDOWS\MTSTACK.INI
[2007/04/02 16:11:44 | 00,000,110 | —- | C] () – C:\WINDOWS\TOPO.INI
[2007/03/27 01:55:48 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2006/12/12 10:24:42 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2006/12/08 06:50:14 | 00,217,088 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2006/12/08 06:47:54 | 01,159,168 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2006/05/04 16:03:52 | 00,063,488 | —- | C] () – C:\WINDOWS\xobglu16.dll
[2006/05/04 16:03:52 | 00,023,552 | —- | C] () – C:\WINDOWS\xobglu32.dll
[2006/04/17 16:13:01 | 00,009,392 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2006/04/03 14:55:27 | 00,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2006/01/26 06:51:56 | 00,110,080 | —- | C] () – C:\WINDOWS\System32\nlame.dll
[2006/01/03 10:15:34 | 00,210,944 | —- | C] () – C:\WINDOWS\System32\Msvcrt10.dll
[2006/01/03 10:15:28 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\adistres.dll
[2005/12/09 09:11:48 | 00,104,060 | —- | C] () – C:\WINDOWS\System32\ShellEx.dll
[2005/12/06 18:11:11 | 00,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2005/12/06 18:11:11 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2005/12/06 18:11:11 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2005/12/06 18:11:11 | 00,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2005/12/06 18:11:10 | 00,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2005/12/06 18:11:10 | 00,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2005/11/17 16:32:09 | 00,000,000 | —- | C] () – C:\WINDOWS\winpm.INI
[2005/11/17 16:28:38 | 03,592,192 | —- | C] () – C:\WINDOWS\System32\qt-mt323.dll
[2005/11/01 12:15:00 | 00,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2005/11/01 10:14:44 | 00,373,248 | —- | C] () – C:\WINDOWS\EyeCand3.INI
[2005/11/01 09:55:13 | 00,000,076 | —- | C] () – C:\WINDOWS\System32\PhotoRg2.ini
[2005/11/01 09:54:44 | 00,087,552 | —- | C] () – C:\WINDOWS\System32\ereglb32.dll
[2005/11/01 09:54:44 | 00,023,040 | —- | C] () – C:\WINDOWS\System32\ergint32.dll
[2005/10/30 15:51:27 | 00,000,000 | —- | C] () – C:\WINDOWS\ATIMMC.INI
[2005/10/29 14:11:26 | 00,094,720 | —- | C] () – C:\WINDOWS\System32\SH30W32.DLL
[2005/10/29 14:11:22 | 00,000,443 | —- | C] () – C:\WINDOWS\8272A4GS.INI
[2005/10/29 14:11:22 | 00,000,412 | —- | C] () – C:\WINDOWS\VIAPLAY.INI
[2005/10/29 14:11:22 | 00,000,000 | R— | C] () – C:\WINDOWS\VMARK.INI
[2005/10/13 16:53:43 | 00,003,120 | —- | C] () – C:\WINDOWS\System32\fd20925b-ce57-42b1-bf58-6eb6683232a2.dll
[2005/08/31 15:47:22 | 00,000,017 | —- | C] () – C:\WINDOWS\MovingPicture.ini
[2005/08/09 16:13:31 | 00,831,488 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2005/08/09 16:13:31 | 00,159,744 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2005/07/12 12:30:19 | 00,318,014 | —- | C] () – C:\WINDOWS\System32\flt1chk4.dll
[2005/05/11 10:40:26 | 00,000,032 | —- | C] () – C:\WINDOWS\CD-Start.INI
[2005/03/04 16:12:57 | 00,335,872 | —- | C] () – C:\WINDOWS\System32\ldf252.dll
[2005/03/04 04:00:08 | 00,001,257 | —- | C] () – C:\WINDOWS\GARMINWT.INI
[2005/01/20 16:23:56 | 00,156,672 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2005/01/19 12:14:07 | 00,090,112 | —- | C] () – C:\WINDOWS\System32\dfltchk2.dll
[2004/11/18 10:18:06 | 00,053,248 | —- | C] () – C:\WINDOWS\System32\gpvbd.dll
[2004/11/18 10:18:06 | 00,027,136 | —- | C] () – C:\WINDOWS\System32\AuthDVD.DLL
[2004/11/14 14:38:10 | 00,104,612 | —- | C] () – C:\WINDOWS\System32\TomcatShellEx.dll
[2004/11/14 14:38:09 | 00,107,520 | —- | C] () – C:\WINDOWS\System32\dvrms.dll
[2004/11/14 14:38:05 | 01,778,176 | —- | C] () – C:\WINDOWS\System32\avcodec.dll
[2004/11/14 14:38:05 | 00,182,272 | —- | C] () – C:\WINDOWS\System32\avformat.dll
[2004/11/14 14:38:03 | 00,916,480 | —- | C] () – C:\WINDOWS\System32\FFMpeg.dll
[2004/09/16 14:24:26 | 03,375,104 | —- | C] () – C:\WINDOWS\System32\qt-mt331.dll
[2004/04/29 13:21:24 | 00,064,512 | —- | C] () – C:\WINDOWS\System32\drivers\SENTINEL.SYS
[2004/04/29 13:21:24 | 00,038,400 | —- | C] () – C:\WINDOWS\System32\SNTI386.DLL
[2004/04/29 13:21:24 | 00,016,896 | —- | C] () – C:\WINDOWS\System32\RNBOVDD.DLL
[2004/04/07 08:51:51 | 00,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2004/02/26 18:01:51 | 00,109,568 | —- | C] () – C:\WINDOWS\System32\drivers\SSHDRV64.sys
[2003/12/22 15:40:06 | 01,663,068 | —- | C] () – C:\WINDOWS\System32\libmmd.dll
[2003/12/08 12:16:11 | 00,000,488 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/12/04 10:24:33 | 00,000,084 | —- | C] () – C:\WINDOWS\ALBUM.INI
[2003/11/19 19:41:42 | 00,037,954 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2003/11/08 23:31:34 | 00,544,768 | —- | C] () – C:\WINDOWS\System32\SZFrame.dll
[2003/10/24 17:18:21 | 00,000,053 | —- | C] () – C:\WINDOWS\WININIT.INI
[2003/10/07 13:17:24 | 00,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2003/09/23 16:38:03 | 00,004,005 | —- | C] () – C:\WINDOWS\FORGXP32.ini
[2003/09/23 16:28:56 | 00,061,952 | —- | C] () – C:\WINDOWS\System32\rmmerge2.DLL
[2003/09/23 16:28:56 | 00,009,728 | —- | C] () – C:\WINDOWS\System32\rmevents.DLL
[2003/09/12 11:01:05 | 00,000,386 | —- | C] () – C:\WINDOWS\I5E1000.INI
[2003/09/10 13:56:54 | 00,001,110 | —- | C] () – C:\WINDOWS\winamp.ini
[2003/09/06 08:43:49 | 00,363,520 | —- | C] () – C:\WINDOWS\System32\PsisDecd.dll
[2003/09/05 10:05:14 | 00,000,219 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2003/09/04 19:22:37 | 00,102,400 | —- | C] () – C:\WINDOWS\System32\SaiCfg.dll
[2003/09/04 17:20:57 | 00,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2003/07/08 08:33:00 | 00,031,744 | —- | C] () – C:\WINDOWS\System32\flt1chk2.dll
[2003/04/10 05:35:00 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/04/10 05:34:24 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\iAlmcoin.dll
[2003/04/10 05:21:36 | 00,000,051 | —- | C] () – C:\WINDOWS\System32\mshrml.ini
[2003/04/10 02:51:07 | 00,000,438 | —- | C] () – C:\WINDOWS\System32\1_ssetup.ini
[2003/04/10 02:51:07 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\sunistlog.ini
[2003/04/10 01:32:34 | 00,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2003/04/10 01:32:34 | 00,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/10 01:06:10 | 00,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/04/10 01:03:38 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/04/10 01:03:38 | 00,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/04/10 00:57:15 | 00,000,052 | —- | C] () – C:\WINDOWS\intuprof.ini
[2003/04/10 00:57:04 | 00,000,626 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/04/10 00:16:44 | 00,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/04/09 23:44:58 | 00,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/04/09 23:44:58 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/04/09 23:44:29 | 00,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/04/09 23:23:21 | 00,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/04/09 23:05:45 | 00,000,659 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/04/09 23:05:33 | 00,000,935 | —- | C] () – C:\WINDOWS\win.ini
[2003/04/09 23:05:31 | 00,000,290 | —- | C] () – C:\WINDOWS\SYSTEM.INI
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/10/15 16:54:04 | 00,153,088 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2002/02/27 18:50:00 | 00,197,120 | —- | C] () – C:\WINDOWS\System32\patchw32.dll
[2001/08/14 19:47:08 | 00,020,480 | —- | C] () – C:\WINDOWS\System32\vxpsapi.dll
[2001/08/10 13:14:16 | 00,028,672 | —- | C] () – C:\WINDOWS\System32\ImapiRoxPS.dll
[2000/04/14 17:50:02 | 00,343,040 | —- | C] () – C:\WINDOWS\System32\Lffpx7.dll
[1998/06/11 15:08:06 | 00,095,232 | —- | C] () – C:\WINDOWS\System32\Lfkodak.dll

========== Files - Modified Within 30 Days ==========

[2 C:\WINDOWS\System32\*.tmp files]
[1 C:\WINDOWS\*.tmp files]
[2009/06/24 08:34:58 | 00,512,512 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2009/06/24 08:31:29 | 00,000,478 | —- | M] () – C:\WINDOWS\tasks\Malwarebytes' Scheduled Update for Owner.job
[2009/06/24 08:31:21 | 00,000,492 | —- | M] () – C:\WINDOWS\tasks\Malwarebytes' Scheduled Scan for Owner.job
[2009/06/24 08:09:25 | 00,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2009/06/24 04:04:47 | 00,000,920 | —- | M] () – C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2009/06/23 18:36:52 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/06/23 18:36:45 | 00,000,189 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2009/06/23 18:35:11 | 00,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[2009/06/23 18:34:07 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/06/23 18:33:34 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/06/23 18:33:22 | 21,468,81536 | -HS- | M] () – C:\hiberfil.sys
[2009/06/23 18:33:20 | 01,566,742 | —- | M] () – C:\WINDOWS\System32\OODBS.lor
[2009/06/23 13:52:27 | 00,026,624 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Please do the following.doc
[2009/06/23 13:43:01 | 00,278,221 | —- | M] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2009/06/23 13:42:02 | 00,359,893 | —- | M] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2009/06/23 09:43:31 | 18,071,615 | —- | M] () – C:\Fetch_5.5.dmg
[2009/06/23 09:39:00 | 00,000,791 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shortcut to HijackThis.exe.lnk
[2009/06/23 09:24:08 | 00,001,777 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2009/06/22 14:31:06 | 00,000,739 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/22 14:27:54 | 03,561,744 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2009/06/17 11:27:56 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/06/17 11:27:44 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/06/15 08:11:42 | 00,037,954 | —- | M] () – C:\WINDOWS\cdplayer.ini
[2009/06/11 18:10:50 | 00,555,160 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/06/11 18:02:25 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/06/10 19:59:48 | 00,000,935 | —- | M] () – C:\WINDOWS\win.ini
[2009/06/10 15:40:27 | 00,095,676 | —- | M] () – C:\WINDOWS\System32\drivers\ac0a2fff5a08b1b35bb6f5c125c07e76.szcpf
[2009/06/10 15:39:03 | 00,095,676 | —- | M] () – C:\WINDOWS\System32\drivers\71f4af93.sys
[2009/06/10 15:34:53 | 00,144,648 | —- | M] () – C:\Documents and Settings\Owner\Desktop\SupportBridge.remoteassist.ca.com.443.supportbridge.$.exe
[2009/06/10 15:23:35 | 00,161,920 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/06/08 10:15:03 | 06,768,808 | —- | M] () – C:\pccolorado.tif
[2009/06/04 15:37:04 | 86,751,7440 | —- | M] () – C:\Outlook backup.pst
[2009/06/01 10:51:12 | 23,635,392 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe
[2009/05/28 14:16:24 | 00,017,408 | R— | M] (iS3, Inc.) – C:\WINDOWS\System32\SZIO5.dll
[2009/05/28 14:15:22 | 00,294,912 | R— | M] (iS3, Inc.) – C:\WINDOWS\System32\SZBase5.dll
[2009/05/28 14:14:56 | 00,540,672 | R— | M] (iS3, Inc.) – C:\WINDOWS\System32\SZComp5.dll
[2009/05/26 08:10:20 | 00,004,005 | —- | M] () – C:\WINDOWS\FORGXP32.ini

========== LOP Check ==========

[2009/06/22 14:31:02 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2007/05/16 10:16:44 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{7DDD0C26-E7D0-4422-8616-030EE13368AF}
[2007/04/23 16:35:51 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Acronis
[2007/05/10 11:49:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\allTunes
[2003/10/23 18:53:38 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ArcSoft
[2005/10/31 15:48:08 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ATI MMC
[2008/02/11 14:59:20 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Autodesk
[2006/10/08 12:14:53 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CA
[2007/02/02 13:44:54 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Just Flight Limited
[2007/12/18 16:38:42 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2003/09/12 18:10:15 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Links 2003
[2003/04/10 01:12:30 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Motive
[2004/02/26 17:24:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pinnacle
[2003/04/09 23:24:18 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBSI
[2009/05/18 15:14:15 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2006/04/17 12:26:21 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
[2008/06/26 16:34:50 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SqueezeCenter
[2009/06/24 08:39:17 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2008/06/25 13:46:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2006/04/27 13:45:08 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2009/06/22 21:02:21 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Owner\Application Data
[2005/03/04 16:13:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ACD Systems
[2007/04/26 14:18:50 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Acronis
[2007/12/18 16:38:43 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Ahead
[2007/05/10 11:49:16 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\allTunes
[2008/06/10 21:08:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Amazon
[2006/11/24 16:16:14 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ArcSoft
[2006/04/20 14:14:28 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ATI
[2005/08/08 19:00:14 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\atitray
[2007/04/13 10:58:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Autodesk
[2006/04/01 10:16:03 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Axaware
[2009/03/16 14:07:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\CoffeeCup Software
[2009/06/17 11:08:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\CoreFTP
[2005/11/11 10:34:36 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\CyberLink
[2005/09/23 11:21:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\FSAutoStart
[2008/10/31 08:30:11 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GetRightToGo
[2007/08/08 16:44:09 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ImgBurn
[2008/07/22 13:39:23 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\interMute
[2003/04/10 00:52:19 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterTrust
[2003/09/05 13:54:55 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InterVideo
[2007/08/07 14:45:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\LegalSounds
[2003/09/08 21:18:42 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Motive
[2009/01/22 20:24:49 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Move Networks
[2005/08/31 16:23:20 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OLYMPUS
[2009/02/23 18:10:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\PluginLab
[2003/09/16 10:22:01 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Roxio
[2003/04/10 01:04:31 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2003/04/10 00:27:02 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Share-to-Web Upload Folder
[2009/04/10 16:59:29 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SoundSpectrum
[2004/05/27 11:53:16 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TuneUp Software
[2004/03/18 13:27:52 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\VERITAS
[2002/08/29 13:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2003/11/03 17:53:00 | 00,000,272 | —- | M] () – C:\WINDOWS\Tasks\easy Internet sign-up.job
[2009/06/23 18:35:11 | 00,000,882 | —- | M] () – C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job
[2009/06/24 08:31:21 | 00,000,492 | —- | M] () – C:\WINDOWS\Tasks\Malwarebytes' Scheduled Scan for Owner.job
[2009/06/24 08:31:29 | 00,000,478 | —- | M] () – C:\WINDOWS\Tasks\Malwarebytes' Scheduled Update for Owner.job
[2009/06/23 18:34:07 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 60 bytes -> C:\winzip.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\WINDOWS:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\sound32.dll:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\signaturefile.txt:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\signaturefile.rtf:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\signaturefile.doc:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\mmcInst.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\megaScenery.ini:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\megaCITY.ini:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Log.txt:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\GodWill.txt:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\gateway.asp.htm:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\e_partitiontable.dat:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\devicetable.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\debug.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\CWSInstall.exe:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\CONFIG.SYS:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\caisslog.txt:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\caavsetupLog.txt:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\caavsetup.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\AUTOEXEC.BAT:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Archifects:AFP_AfpInfo
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B7BEAFF
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F7B65412
< End of report >

emeraldnzl

Post #4June 24, 2009, 11:46 PM UTC

Hello blindlemon,

Your Adobe Acrobat Reader is out of date. Older versions are vunerable to attack.

Please go to the link below to update.

http://www.adobe.com/products/acrobat/readstep2.html

Step 2

Your Java is out of date, older versions are vunerable to attack.

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Step 3

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now. TeaTimer can be re-activated once we have finished cleaning your machine.

Open Spybot Search & Destroy.
In the Mode menu click "Advanced mode" if not already selected.
Choose "Yes" at the Warning prompt.
Expand the "Tools" menu.
Click "Resident".
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
In the File menu click "Exit" to exit Spybot Search & Destroy.

Reboot your computer.

After that

We need to disable your remaining AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.

Now

Please run OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O33 - MountPoints2\{92dda43e-adad-11dc-b9e4-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{92dda43e-adad-11dc-b9e4-806d6172696f}\Shell\AutoRun - "" = Auto&Play

:Files
C:\WINDOWS\System32\SDEarlyDelete.exe
C:\WINDOWS\System32\OODBS.exe
C:\WINDOWS\System32\drivers\kgpcpy.cfg
C:\WINDOWS\System32\drivers\71f4af93.sys
C:\WINDOWS\System32\fd20925b-ce57-42b1-bf58-6eb6683232a2.dll

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.

blindlemon

Post #5June 25, 2009, 2:19 AM UTC

Okay, I went thru all the steps you described and here's the log file you requested. I will be away from my computer for a week starting Friday morning so if there is a delay in my next response, that's why. Thanks for the help!! All processes killed Error: Unable to interpret <:OTLI> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! ========== FILES ========== C:\WINDOWS\System32\SDEarlyDelete.exe moved successfully. C:\WINDOWS\System32\oodbs.exe moved successfully. C:\WINDOWS\System32\drivers\kgpcpy.cfg moved successfully. C:\WINDOWS\System32\drivers\71f4af93.sys moved successfully. LoadLibrary failed for C:\WINDOWS\System32\fd20925b-ce57-42b1-bf58-6eb6683232a2.dll C:\WINDOWS\System32\fd20925b-ce57-42b1-bf58-6eb6683232a2.dll NOT unregistered. C:\WINDOWS\System32\fd20925b-ce57-42b1-bf58-6eb6683232a2.dll moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32969 bytes User: LocalService ->Temp folder emptied: 65984 bytes File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 7726211 bytes User: NetworkService ->Temp folder emptied: 66016 bytes File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: Owner ->Temp folder emptied: 18932912 bytes ->Temporary Internet Files folder emptied: 100041752 bytes ->Java cache emptied: 17793518 bytes ->FireFox cache emptied: 60534334 bytes %systemdrive% .tmp files removed: 0 bytes C:\WINDOWS\msdownld.tmp folder deleted successfully. %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 247985 bytes Windows Temp folder emptied: 579 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 195.99 mb Error: Unable to interpret <[start explorer]> in the current context! OTL by OldTimer - Version 3.0.5.2 log created on 06242009_200150 Files\Folders moved on Reboot… Registry entries deleted on Reboot…

emeraldnzl

Post #6June 25, 2009, 6:30 AM UTC

Hello blindlemon,

I will be away from my computer for a week starting Friday morning so if there is a delay in my next response, that's why.

No problem, I will still be here.

Now

You should go to Windows Update and download Windows updates. This is important to protect your computer. Apart from improvements to XP there are some security patches, in particular, ones to protect against the Conficker infection.

Next

Please download ComboFix from one of these locations:

NOTE: If you are guest watching this topic. ComboFix is a very powerful tool. The disclaimer clearly states that you should not use it without supervision. There is good reason for this as ComboFix can, and sometimes does, run into conflict on a computer and render it unusable.

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

blindlemon

Post #7June 25, 2009, 1:32 PM UTC last edited June 25, 2009, 1:34 PM UTC

Hi emeraldnzi, I do have automatic updates loaded on my machine and at this time the only update it has for me to download is Internet Explorer 8. I don't see any other security updates. Should I still try manually from the website? I should also mention that I do see service pack 3 but from what I've read, it's a nightmare. Thanks Blind Lemon

blindlemon

Post #8June 25, 2009, 2:41 PM UTC

Hi emeraldnzi,

Here's the log file from Combofix. I have not installed any windows updates because of my concern I mentioned above.

Thanks so much for all your help.
ComboFix 09-06-24.05 - Owner 06/25/2009 8:05.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1125 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: CA Anti-Virus *On-access scanning disabled* (Updated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}
.
ADS - WINDOWS: deleted 60 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\054a515a11c7920cfc4d7faea7af4932.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\0fdf6651ec58af7738a5f192a16308f3.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\1c4c331123ae5269fbd179de68e18722.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\33dea2ee1515e1c0eedfcd55d2d0540f.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\37dbb36b1afb4153f311e1937d13beb9.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\3dab63509796d9defe82e7c8f292cdc2.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\42111b2ff16ef6b9a300033651849df2.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\426234b03a6207e763a72e588f8ed8de.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\463172d63e5c347ebd2a2c9f3e30a769.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\4698d6dad1d9192f189448cd2250e41c.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\480ac5427cb6705921c199c825f6feda.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\4e2f70cf514e42eb8319b6c42723ed06.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\531074183cd92c8ee6e38095fed64379.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\563d7ead40b59c49009856a0b10f2014.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\5665e9d91ffd5329b4b069811edd98e1.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\5f4010392d26de2972604a5df777f946\perl58.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\619eb23c53abde1a9d9d6b8d81ccd746.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\6b58dab08175faa9470d9b8f08345f77.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\776043a051266bed6315875a8a879b49.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\804a82b53759189a7786eee16508a628.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\8715287e64467664fda73ee36a680ad6.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\8d9ba91df5b696882e70aa59f4766acb.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\93e8018418e0dd3aeabcea5210c424d9.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\95e9a2327e375c6b6f41bca6adf49352.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\9e11e8cf40c66b8d30f95ce783f2ac0b.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\a507fccf2be25b878761a66bf411c201.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\abaa64637ebb3715a020574efc3032f8.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\ad76515ff4d1de346e3888790190a3c0.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\b2a041897a5d2e9486f60c2f6017af23.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\b44b56de153a5879c1b84993c5cdadfa.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\baf7b671cd22e344218d4404c5715954.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\bbd2dcfa51103025d57caa776bc1047b.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\bd9a153164799d8be71e6a02e5c8cc4b.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\c0bb48510a66e6fdcb5936be6801222d.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\c537490a8d5597db7ef38c63a14dd378.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\c92f1c7d4396f53f4c5d352e2bd8c9a9.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\cd36294c81a9e8872c0bc2638facfd15.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\cd6be9554293967a36ad1075b097a79b.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\df3d88a56622b79eb806b7ec6d5febc2.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\e247dd11d21a2bfdb97ad0cdd295b32d.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\e51718032942dd5fb4b1590be1ec8d83.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\ea8f9cce13d067ab0d898ca399b403ed.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\fa142febd5dc53f93f911452e1a99387.dll
c:\docume~1\Owner\LOCALS~1\Temp\pdk-Owner\fb2e449d6244301907de33f5adebdb35.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\054a515a11c7920cfc4d7faea7af4932.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\0fdf6651ec58af7738a5f192a16308f3.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\1c4c331123ae5269fbd179de68e18722.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\33dea2ee1515e1c0eedfcd55d2d0540f.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\37dbb36b1afb4153f311e1937d13beb9.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\3dab63509796d9defe82e7c8f292cdc2.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\42111b2ff16ef6b9a300033651849df2.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\426234b03a6207e763a72e588f8ed8de.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\463172d63e5c347ebd2a2c9f3e30a769.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\4698d6dad1d9192f189448cd2250e41c.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\480ac5427cb6705921c199c825f6feda.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\4e2f70cf514e42eb8319b6c42723ed06.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\531074183cd92c8ee6e38095fed64379.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\563d7ead40b59c49009856a0b10f2014.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\5665e9d91ffd5329b4b069811edd98e1.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\5f4010392d26de2972604a5df777f946\perl58.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\619eb23c53abde1a9d9d6b8d81ccd746.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\6b58dab08175faa9470d9b8f08345f77.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\776043a051266bed6315875a8a879b49.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\804a82b53759189a7786eee16508a628.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\8715287e64467664fda73ee36a680ad6.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\8d9ba91df5b696882e70aa59f4766acb.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\93e8018418e0dd3aeabcea5210c424d9.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\95e9a2327e375c6b6f41bca6adf49352.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\9e11e8cf40c66b8d30f95ce783f2ac0b.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\a507fccf2be25b878761a66bf411c201.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\abaa64637ebb3715a020574efc3032f8.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\ad76515ff4d1de346e3888790190a3c0.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\b2a041897a5d2e9486f60c2f6017af23.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\b44b56de153a5879c1b84993c5cdadfa.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\baf7b671cd22e344218d4404c5715954.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\bbd2dcfa51103025d57caa776bc1047b.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\bd9a153164799d8be71e6a02e5c8cc4b.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\c0bb48510a66e6fdcb5936be6801222d.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\c537490a8d5597db7ef38c63a14dd378.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\c92f1c7d4396f53f4c5d352e2bd8c9a9.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\cd36294c81a9e8872c0bc2638facfd15.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\cd6be9554293967a36ad1075b097a79b.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\df3d88a56622b79eb806b7ec6d5febc2.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\e247dd11d21a2bfdb97ad0cdd295b32d.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\e51718032942dd5fb4b1590be1ec8d83.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\ea8f9cce13d067ab0d898ca399b403ed.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\fa142febd5dc53f93f911452e1a99387.dll
c:\documents and settings\Owner\Local Settings\Temp\pdk-Owner\fb2e449d6244301907de33f5adebdb35.dll
c:\windows\620743ec-62cc-4d58-8cad-66e2f9f09330.ocx
c:\windows\system32\iAlmcoin.dll
c:\windows\system32\Ijl11.dll
D:\Autorun.inf
D:\Desktop.ini

.
((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-06-25 )))))))))))))))))))))))))))))))
.

2009-06-25 02:01 . 2009-06-25 02:22 ——– d—–w- C:\_OTL
2009-06-25 01:30 . 2009-06-25 01:29 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-06-24 20:48 . 1998-07-13 10:02 71296 —-a-w- c:\windows\DrvAct16.dll
2009-06-24 20:48 . 1998-07-13 10:02 158208 —-a-w- c:\windows\DrvAct32.dll
2009-06-22 20:31 . 2009-06-22 20:31 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-06-22 20:31 . 2009-06-17 17:27 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-22 20:31 . 2009-06-22 20:31 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-22 20:31 . 2009-06-22 20:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-22 20:31 . 2009-06-17 17:27 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-10 21:38 . 2009-06-10 21:38 ——– d—–w- c:\windows\system32\wbem\Repository
2009-05-28 20:16 . 2009-05-28 20:16 17408 —-a-r- c:\windows\system32\SZIO5.dll
2009-05-28 20:15 . 2009-05-28 20:15 294912 —-a-r- c:\windows\system32\SZBase5.dll
2009-05-28 20:14 . 2009-05-28 20:14 540672 —-a-r- c:\windows\system32\SZComp5.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 14:14 . 2009-06-25 14:12 1120 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-06-25 14:14 . 2007-10-12 21:23 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-06-25 14:13 . 2009-06-25 14:13 424 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2009-06-25 01:29 . 2006-05-11 22:20 ——– d—–w- c:\program files\Java
2009-06-25 01:23 . 2003-04-10 06:52 ——– d—–w- c:\program files\Common Files\Adobe
2009-06-18 20:34 . 2008-11-19 16:15 ——– d—–w- c:\program files\ViewBuild Professional
2009-06-17 17:08 . 2007-04-18 23:45 ——– d—–w- c:\documents and settings\Owner\Application Data\CoreFTP
2009-06-10 21:40 . 2009-06-10 21:40 95676 —-a-w- c:\windows\system32\drivers\ac0a2fff5a08b1b35bb6f5c125c07e76.szcpf
2009-06-10 21:23 . 2003-10-22 15:14 161920 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-10 21:07 . 2007-10-12 21:23 ——– d—–w- c:\program files\STOPzilla!
2009-06-10 14:35 . 2003-09-23 22:38 ——– d—–w- c:\program files\Sound Forge XP
2009-05-27 15:57 . 2009-04-20 19:41 ——– d—–w- c:\program files\SpywareDetector
2009-05-18 21:14 . 2008-02-14 02:30 ——– d—–w- c:\documents and settings\All Users\Application Data\SITEguard
2009-05-12 20:13 . 2009-05-12 20:13 61328 —-a-r- c:\windows\system32\drivers\SZKG.sys
2009-05-07 15:44 . 2001-01-03 13:38 344064 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-02-07 00:05 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-17 09:58 . 2001-01-03 13:12 1846656 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 15:26 . 2004-04-22 16:21 583168 —-a-w- c:\windows\system32\rpcrt4.dll
2009-03-27 16:56 . 2009-03-27 16:56 126976 —-a-r- c:\windows\system32\IS3HTUI5.dll
2009-03-27 16:55 . 2009-03-27 16:55 393216 —-a-r- c:\windows\system32\IS3DBA5.dll
2009-03-27 16:55 . 2009-03-27 16:55 372736 —-a-r- c:\windows\system32\IS3UI5.dll
2009-03-27 16:55 . 2009-03-27 16:55 61440 —-a-r- c:\windows\system32\IS3Hks5.dll
2009-03-27 16:54 . 2009-03-27 16:54 23040 —-a-r- c:\windows\system32\IS3XDat5.dll
2009-03-27 16:54 . 2009-03-27 16:54 221184 —-a-r- c:\windows\system32\IS3Win325.dll
2009-03-27 16:54 . 2009-03-27 16:54 94208 —-a-r- c:\windows\system32\IS3Inet5.dll
2009-03-27 16:53 . 2009-03-27 16:53 90112 —-a-r- c:\windows\system32\IS3Svc5.dll
2009-03-27 16:50 . 2009-03-27 16:50 716800 —-a-r- c:\windows\system32\IS3Base5.dll
2006-01-03 22:44 . 2006-01-03 22:44 61 –sh–w- c:\windows\cnerolf.dat
2003-09-09 02:13 . 2003-09-09 02:13 0 –sha-w- c:\windows\SMINST\HPCD.sys
2008-05-15 20:32 . 2006-04-17 22:13 9392 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-04 405583]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"LtcyCfgApply"="c:\program files\Ltcycfg2\LtcyCfg.exe" [2004-11-05 265216]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2009-02-04 177392]
"CAVRID"="c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-02 230928]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-02-17 1169776]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-02-17 1945960]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2007-02-17 149024]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-06-17 414992]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-25 148888]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2005-11-23 344064]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2006-1-3 49254]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-9-10 98304]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\KEM.exe [2005-11-7 581632]
M-Audio Sonica Theater Control Panel Launcher.lnk - c:\program files\M-Audio Sonica Theater\STTask.exe [2003-5-21 172032]
SqueezeCenter Tray Tool.lnk - c:\program files\SqueezeCenter\SqueezeTray.exe [2008-6-26 1728599]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ SDEarlyDelete\0SDEarlyDelete \??\c:\program files\SpywareDetector\0autocheck autochk *\0OODBS\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ WinCinema Manager.lnk
backup=c:\windows\pss\ WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR Media Server.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NETGEAR Media Server.lnk
backup=c:\windows\pss\NETGEAR Media Server.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"DW4"="c:\program files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
"OM_Monitor"=c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"Spam Bully for Outlook Express"="c:\program files\Axaware\Spam Bully 2 for OE\oespambully.exe" install
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE"
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"AlcxMonitor"=ALCXMNTR.EXE
"OmniPass"=c:\program files\Softex\OmniPass\scureapp.exe
"zBrowser Launcher"=c:\program files\Logitech\iTouch\iTouch.exe
"PinnacleDriverCheck"=c:\windows\system32\PSDrvCheck.exe -CheckReg
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"WD Button Manager"=WDBtnMgr.exe
"AdaptecDirectCD"=c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
"SDActiveMonitor"=c:\program files\SpywareDetector\SDActiveMonitor.exe -AUTO

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Updates from HP\\137903\\Program\\BackWeb-137903.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Macromedia\\Flash MX\\Flash.exe"=
"c:\\Program Files\\WS_FTP Pro\\FTP95PRO.EXE"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\Microsoft Games\\Links 2003\\LinksMMIII.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Bentley\\Program\\MicroStation\\ustation.exe"=
"e:\\Program Files\\Bentley\\Program\\MicroStation\\ustation.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\DiskTrix\\UltimateDefrag2008\\UDefrag.exe"=
"c:\\Program Files\\MediaMonkey\\VisHelper.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"=
"c:\\Program Files\\CoffeeCup Software\\CoffeeCup Website Access Manager\\CCAccess.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"9000:TCP"= 9000:TCP:SqueezeCenter 9000 tcp
"3483:UDP"= 3483:UDP:SqueezeCenter 3483 udp
"3483:TCP"= 3483:TCP:SqueezeCenter 3483 tcp
"137:TCP"= 137:TCP:MacMachine
"138:TCP"= 138:TCP:MacMachine2

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [5/12/2009 2:13 PM 61328]
R1 atitray;atitray;c:\program files\Radeon Omega Drivers\v3.8.231\ATI Tray Tools\atitray.sys [11/13/2005 4:43 PM 11008]
R1 SSHDRV64;SSHDRV64;c:\windows\system32\drivers\SSHDRV64.sys [2/26/2004 6:01 PM 109568]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/22/2009 2:31 PM 195856]
R2 SqueezeMySQL;SqueezeMySQL;c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe –defaults-file=c:\docume~1\ALLUSE~1\APPLIC~1\SQUEEZ~1\Cache\my.cnf SqueezeMySQL –> c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe –defaults-file=c:\docume~1\ALLUSE~1\APPLIC~1\SQUEEZ~1\Cache\my.cnf SqueezeMySQL [?]
R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [7/9/2003 3:35 PM 180480]
R3 ma763007;M-Audio Sonica Theater Driver;c:\windows\system32\drivers\MA763007.sys [3/13/2008 10:35 AM 83456]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/22/2009 2:31 PM 19096]
R3 rxpvbus;Reality XP Avionics Bus Driver;c:\windows\system32\drivers\rxpvbus.sys [3/4/2005 4:00 AM 44032]
S1 SDManager;SDManager;\??\c:\program files\SpywareDetector\SDManager.sys –> c:\program files\SpywareDetector\SDManager.sys [?]
S2 gupdate1c99eaec907864;Google Update Service (gupdate1c99eaec907864);c:\program files\Google\Update\GoogleUpdate.exe [3/6/2009 4:51 PM 133104]
S2 mrtRate;mrtRate; [x]
S3 Just Flight Limited License Service;Just Flight Limited License Service;c:\program files\Common Files\Just Flight Limited Shared\Service\JustFlightLimitedLicSvc.exe [2/2/2007 1:42 PM 69632]
S3 PCD64X2;PCD64X2;\??\c:\docume~1\Owner\LOCALS~1\Temp\PCD64X2.sys –> c:\docume~1\Owner\LOCALS~1\Temp\PCD64X2.sys [?]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys –> c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [?]
S3 SDActMon;SDActMon;\??\c:\program files\SpywareDetector\SDActMon.sys –> c:\program files\SpywareDetector\SDActMon.sys [?]
S3 WnsService;WnsService;g:\+oldmachine\Bootdrive\cgi-bin\WnsService.exe –> g:\+oldmachine\Bootdrive\cgi-bin\WnsService.exe [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-06-25 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-06 22:51]

2009-06-25 c:\windows\Tasks\Malwarebytes' Scheduled Scan for Owner.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-22 17:27]

2009-06-25 c:\windows\Tasks\Malwarebytes' Scheduled Update for Owner.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-22 17:27]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = localhost
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
LSP: c:\windows\system32\VetRedir.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} - hxxp://plpadmin.tempdomainname.com/CabFiles/NewUpgradeFinder.cab
DPF: {6DD4EA80-8981-40FB-B2FC-06B8EDC632B8} - hxxp://www.2for1.com/downloads/PrintControl.CAB
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-25 08:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,d0,3c,c4,96,fe,
2a,7c,d5,2e,e8,e1,00,eb,16,2b,de,c6,d8,19,21,87,9c,0b,a3,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,66,20,fa,ac,6a,
d5,3f,4b,46,47,15,b0,92,4b,c7,ef,ea,1d,24,24,e3,41,25,0c,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,b7,07,70,71,b0,
36,36,d6,7a,45,05,fd,91,e8,6f,31,0d,04,99,63,b2,3c,b4,88,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,4e,e5,a5,a6,c1,
d3,b7,ca,6b,65,49,6a,7e,99,74,f7,1d,53,94,90,da,10,41,12,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,da,5b,55,89,fd,
08,63,6f,e9,02,6c,fa,fb,1d,47,57,90,e9,7a,2a,c2,08,b5,5d,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,ed,4f,f1,b7,5c,
db,c8,f4,50,93,e5,ab,ec,6a,4e,ab,0c,39,85,ba,81,f8,f4,3c,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,b6,9b,f0,c2,a6,
4e,43,a6,97,20,4e,9a,c7,f1,35,ee,da,1b,5b,30,ba,e8,a0,28,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,4a,85,79,6b,65,
f4,7f,1b,aa,52,c6,00,84,3c,26,64,0d,da,93,97,ab,72,57,d1,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,3a,b0,e9,df,d4,
f7,71,fd,b2,46,9a,e2,1b,fe,1b,94,8f,2e,71,16,95,63,87,c1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,91,b0,9e,22,db,
11,38,62,37,a4,aa,c3,a6,15,56,0a,12,b7,eb,b0,51,bd,cf,3c,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,6b,86,3b,ef,ae,
7c,48,2f,f8,31,0f,a9,5f,a0,ec,fb,a4,cf,b3,ca,2a,55,6a,c0,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,5e,92,53,71,16,
3e,d0,d6,05,73,21,dd,54,d8,4a,c5,29,ed,bc,11,b7,15,f4,3a,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\*@d*@d]
"DisplayName"="??????"
"DeviceDesc"="??????"
"ProviderName"="??"
"MFG"="urrentControlSet\\Services\\ati2mtag\\Device0"
"ReinstallString"="????"
"DeviceInstanceIds"=multi:"`\00"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\ @*ðˆúw]
"DisplayName"=""
"DeviceDesc"=""
"ProviderName"=""
"MFG"=""
"ReinstallString"="????"
"DeviceInstanceIds"=multi:"`\00"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="172B632976C7B181AF38692326FEBF9897271AC4CC284BC74DF4285F91E22D66B825CD11CF0
72361122984FE58D6407F825A98268AC01EC22C890DB734B267C06F93468748FCB4A40A8F0E0FE1C3
2DAE848861759C03854D6A479733B19E4646DB2CC83CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9
E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E6679DB7CE
019D40AA5CC038D530D6EB3452BA7FD869164D6794A8E211070B4700FC8E08053999BE0996A3BFB56
BD5AB0189FA487DCB84E47D41EC5F491C352AED5BBD5463DD527B935F8E2A8803FD033C7424495538
BE92D5397BC479B9F7294C1C2EA941BA3D91BCC8A5E2F0DA680EF42B202D6DAD0A0D44FC081730CFA
27999E29115139035907718372168259CD2B334FA74646E3B7505F3F7C0D2D377F5E7984B88A2268A
AC4BD8C502BC1817FD145B7204AC429B916AC9E80F183DAC9B5D6C745C0C457E3A53D785028E6F48D
EC52FF7A20CF66948D76FA9338C0A6B0DB54ED84AC03A4935BDA8DF86D5E914690E0434FD1ED9D4A7
49983E4210BAD18FBCF2F9EF85D716BD50A073D6D9C8513645EF00A652BE02E0C9BD5DB5D4D2710DD
6D40D50F1720394DFD9901D3AD3CD02574E6A11EAFD8BC77B1B726B65DA5214782F78517364A423D8
B2BD6A675649A9C4BE3614FEF27D5793301DA49A62EC57AD05D93E4B0D7F71B9CC34B1299CF6B321A
3D9EDF77DD8A9DBC0328626F52F2A939B02450ECB90B0170F614817FBFE4715A37F3E960293023056
B79A0AADFB88DCF974F7A4864633172366EC20497DAF5D2C06886C66954482BC69CEA01FA810506E6
BCCCB28046EF6771A3D0660835E4AEA00B660183C79D8833873136A7F82C70BD120939CA000833E84
3CDE9E9265BFD1B315AC85594D4C7F46BFE3ADBEC4B124C82DE05866A49F6DE35293E7A5FD359A1B5
3E1A230928949EA4AE48D18620F52A5986D4D1640C5BF294AE1A1A604393FE506E0E77CBDD13B3393
3DB3B18877746FE8C5F760597EB1FAD35CB7F676E9FD76A561CF6867FB76DCF96A4D268795AA63084
9D4ED9AEA87B102E718E9F87CDAE28E6ED9964DEE5F5CC53B898258A658F2C22FE65A53BCC55C4CBF
B54855391EF502668A9BCE291E599E551EC813FDA9414E7EB0B3773CB73A8F70874DF57B51AD237CE
980713C9E2F92AD436F75800A27BF14BF7C9B436BC2885B07A86B3443BC7A360343DD4C11EC1291B5
E0622AABB111219EABFB43329F5C3833FEE869888A75EE655362946957F39F367ADE078220212A612
EF7BDA12C920F1168C7B0F6B0E2562496ED6060E3F04E098F16BBC86932889BE0114B16FB953E23F0
02B62B7D79EE5866179171C02662766354FB7AB36A686718EF96ACD4B576F719383D04F4CE0F1D0F1
59E5DCA16794CB20C15D9DCD4CA64"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(976)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1048)
c:\windows\system32\relog_ap.dll
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
c:\windows\system32\VetRedir.dll
c:\windows\system32\ISafeIf.dll

- - - - - - - > 'explorer.exe'(2304)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
c:\windows\system32\oodag.exe
c:\program files\Softex\OmniPass\omniServ.exe
c:\program files\M-Audio Sonica Theater\Install\STInst.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\program files\Logitech\SetPoint\KHALMNPR.exe
c:\program files\CA\CA Internet Security Suite\ccprovsp.exe
.
**************************************************************************
.
Completion time: 2009-06-25 8:30 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-25 14:30

Pre-Run: 27,902,828,544 bytes free
Post-Run: 26,272,542,720 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn /TUTag=RYC3J1 /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition (TuneUp Backup)" /fastdetect /NoExecute=OptIn /TUTag=RYC3J1-BAK

427 — E O F — 2009-06-12 00:02

emeraldnzl

Post #9June 25, 2009, 11:47 PM UTC

Hello blindlemon,

I do have automatic updates loaded on my machine and at this time the only update it has for me to download is Internet Explorer 8. I don't see any other security updates. Should I still try manually from the website? I should also mention that I do see service pack 3 but from what I've read, it's a nightmare.

Service pack 3 was the one I was thinking of. If you don't want it that is your choice. Hasn't caused any problems on my machine but as you say some people do say they have difficulties with it.

Now

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

KillAll::

Driver::
PCD64X2

File::
c:\docume~1\Owner\LOCALS~1\Temp\PCD64X2.sys

Reboot::

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at C:\ComboFix.txt. Please post that here for further review.

Next

You have used Malwarebytes before. If you still have it on your machine please update and run. Post the scan report back here.

If you no-longer have Malwarebytes please download from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

blindlemon

Post #10July 8, 2009, 4:22 PM UTC

Hello emeraldnzl
I'm back and have done the next steps. Here's the log files.
Again, thanks so much. Once I have the desktop cleaned, I need to do my laptop. Should I start a new thread or continue with this one? Of course, once this is done.

ComboFix 09-07-07.A9 - Owner 07/08/2009 9:20.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1457 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: CA Anti-Virus *On-access scanning disabled* (Updated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}

FILE ::
"c:\docume~1\Owner\LOCALS~1\Temp\PCD64X2.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\1484226.msi
c:\windows\Installer\149fb20.msi
c:\windows\Installer\158c0be.msi
c:\windows\Installer\1aab4b3.msi
c:\windows\Installer\1fd677d.msi
c:\windows\Installer\20da7b.msi
c:\windows\Installer\31d6ab1.msi
c:\windows\Installer\38ea58.msi
c:\windows\Installer\59088b.msp
c:\windows\Installer\594df09.msi
c:\windows\Installer\6430458.msi
c:\windows\Installer\66f8da58-7554-4383-8a01-0544f524e8ba4.4.6.0.msi
c:\windows\Installer\76124.msp
c:\windows\Installer\83acafe0-b7af-48e6-b2cd-dac4267a56c84.4.8.0.msi
c:\windows\Installer\888e64.msi
c:\windows\Installer\89c2e.msi
c:\windows\Installer\9198540.msi
c:\windows\Installer\a67e9.msi
c:\windows\Installer\a7a828d.msp
c:\windows\Installer\a7a82a7.msp
c:\windows\Installer\c0c57.msi
c:\windows\Installer\cda060.msp
c:\windows\Installer\fc867c.msp
c:\windows\Installer\SZProBase4.3.38.0.msi
c:\windows\Installer\SZProBase4.3.39.0.msi
c:\windows\Installer\SZProBase4.4.4.0.msi
c:\windows\Installer\WMEncoder.msi
F:\autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PCD64X2
——-\Service_PCD64X2

((((((((((((((((((((((((( Files Created from 2009-06-08 to 2009-07-08 )))))))))))))))))))))))))))))))
.

2009-06-25 02:01 . 2009-06-25 14:43 ——– d—–w- C:\_OTL
2009-06-25 01:30 . 2009-06-25 01:29 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-06-24 20:48 . 1998-07-13 10:02 71296 —-a-w- c:\windows\DrvAct16.dll
2009-06-24 20:48 . 1998-07-13 10:02 158208 —-a-w- c:\windows\DrvAct32.dll
2009-06-22 20:31 . 2009-06-22 20:31 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-06-22 20:31 . 2009-06-17 17:27 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-22 20:31 . 2009-06-22 20:31 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-22 20:31 . 2009-06-22 20:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-22 20:31 . 2009-06-17 17:27 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-10 21:38 . 2009-06-10 21:38 ——– d—–w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-08 15:43 . 2009-07-08 15:42 1120 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-07-08 15:43 . 2007-10-12 21:23 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-07-08 15:42 . 2009-07-08 15:42 424 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2009-06-25 01:29 . 2006-05-11 22:20 ——– d—–w- c:\program files\Java
2009-06-25 01:23 . 2003-04-10 06:52 ——– d—–w- c:\program files\Common Files\Adobe
2009-06-18 20:34 . 2008-11-19 16:15 ——– d—–w- c:\program files\ViewBuild Professional
2009-06-17 17:08 . 2007-04-18 23:45 ——– d—–w- c:\documents and settings\Owner\Application Data\CoreFTP
2009-06-10 21:40 . 2009-06-10 21:40 95676 —-a-w- c:\windows\system32\drivers\ac0a2fff5a08b1b35bb6f5c125c07e76.szcpf
2009-06-10 21:23 . 2003-10-22 15:14 161920 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-10 21:07 . 2007-10-12 21:23 ——– d—–w- c:\program files\STOPzilla!
2009-06-10 14:35 . 2003-09-23 22:38 ——– d—–w- c:\program files\Sound Forge XP
2009-05-28 20:16 . 2009-05-28 20:16 17408 —-a-r- c:\windows\system32\SZIO5.dll
2009-05-28 20:15 . 2009-05-28 20:15 294912 —-a-r- c:\windows\system32\SZBase5.dll
2009-05-28 20:14 . 2009-05-28 20:14 540672 —-a-r- c:\windows\system32\SZComp5.dll
2009-05-27 15:57 . 2009-04-20 19:41 ——– d—–w- c:\program files\SpywareDetector
2009-05-18 21:14 . 2008-02-14 02:30 ——– d—–w- c:\documents and settings\All Users\Application Data\SITEguard
2009-05-12 20:13 . 2009-05-12 20:13 61328 —-a-r- c:\windows\system32\drivers\SZKG.sys
2009-05-07 15:44 . 2001-01-03 13:38 344064 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-02-07 00:05 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-17 09:58 . 2001-01-03 13:12 1846656 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 15:26 . 2004-04-22 16:21 583168 —-a-w- c:\windows\system32\rpcrt4.dll
2006-01-03 22:44 . 2006-01-03 22:44 61 –sh–w- c:\windows\cnerolf.dat
2003-09-09 02:13 . 2003-09-09 02:13 0 –sha-w- c:\windows\SMINST\HPCD.sys
2008-05-15 20:32 . 2006-04-17 22:13 9392 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-06-25_14.17.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-08 15:43 . 2009-07-08 15:43 16384 c:\windows\temp\Perflib_Perfdata_6e0.dat
+ 2005-11-13 22:43 . 2005-11-15 14:26 38400 c:\windows\system32\atiicdxx.msi
+ 2008-04-13 06:54 . 2008-04-13 06:54 86528 c:\windows\Installer\d19b3ca.msi
+ 2006-10-19 14:56 . 2006-10-19 14:56 94208 c:\windows\Installer\a8042.msi
+ 2005-08-17 15:00 . 2005-08-17 15:00 20480 c:\windows\Installer\a0b30.msi
+ 2006-01-03 22:38 . 2006-01-03 22:38 88064 c:\windows\Installer\7ee013.msi
+ 2004-12-28 19:24 . 2004-12-28 19:24 98304 c:\windows\Installer\17de6d.msi
+ 2009-07-07 13:59 . 2009-07-07 13:59 22528 c:\windows\Installer\108141.msi
+ 2003-04-10 05:03 . 2002-08-29 19:00 67584 c:\windows\I386\WINNT32.MSI
+ 2007-04-24 19:51 . 2007-04-24 19:51 240128 c:\windows\Installer\f4d926.msi
+ 2005-09-01 02:58 . 2005-09-01 02:58 881664 c:\windows\Installer\ebfcb6.msi
+ 2004-02-26 23:02 . 2004-02-26 23:02 916480 c:\windows\Installer\e4130.msi
+ 2003-04-10 05:23 . 2003-04-10 05:23 264704 c:\windows\Installer\e2a3.msi
+ 2007-11-07 21:07 . 2007-11-07 21:07 999936 c:\windows\Installer\d19b3d3.msp
+ 2007-11-07 20:56 . 2007-11-07 20:56 553472 c:\windows\Installer\d19b3d0.msp
+ 2007-11-07 20:58 . 2007-11-07 20:58 908800 c:\windows\Installer\d19b3cc.msp
+ 2007-11-07 20:54 . 2007-11-07 20:54 507392 c:\windows\Installer\d19b3cb.msp
+ 2003-04-10 06:49 . 2003-04-10 06:49 936448 c:\windows\Installer\c775e.msi
+ 2007-12-18 21:36 . 2007-12-18 21:36 990720 c:\windows\Installer\bd5c5.msi
+ 2005-09-23 17:17 . 2005-09-23 17:18 209920 c:\windows\Installer\acd35.msi
+ 2009-05-20 01:06 . 2009-05-20 01:06 744448 c:\windows\Installer\9ea9f.msp
+ 2006-01-03 22:37 . 2006-01-03 22:37 193024 c:\windows\Installer\7ee00d.msi
+ 2008-11-23 19:04 . 2008-11-23 19:04 742912 c:\windows\Installer\72c099.msi
+ 2006-08-22 14:48 . 2006-08-22 14:48 164352 c:\windows\Installer\68f97.msi
+ 2007-05-16 16:16 . 2007-05-16 16:16 278016 c:\windows\Installer\59ceef.msi
+ 2005-05-26 15:10 . 2005-05-26 15:10 299008 c:\windows\Installer\5333d8e.msi
+ 2009-02-03 15:31 . 2009-02-03 15:31 204288 c:\windows\Installer\4f84ad2.msi
+ 2007-04-20 20:37 . 2007-04-20 20:37 292864 c:\windows\Installer\3dd7b3.msi
+ 2006-04-01 16:14 . 2006-04-01 16:14 837632 c:\windows\Installer\3747dd2.msi
+ 2008-08-26 14:09 . 2008-08-26 14:09 593920 c:\windows\Installer\32d0d2d.msi
+ 2006-11-24 22:14 . 2006-11-24 22:14 916480 c:\windows\Installer\2f0851.msi
+ 2004-02-11 17:22 . 2004-02-11 17:22 389120 c:\windows\Installer\285df9.msi
+ 2008-06-13 23:39 . 2008-06-13 23:39 470528 c:\windows\Installer\2373410.msi
+ 2006-11-17 01:02 . 2006-11-17 01:02 428544 c:\windows\Installer\21f3291.msi
+ 2007-08-06 21:42 . 2007-08-06 21:42 324096 c:\windows\Installer\1f4613d.msi
+ 2009-02-16 15:44 . 2009-02-16 15:44 355328 c:\windows\Installer\1ea291.msi
+ 2007-08-15 21:41 . 2007-08-15 21:41 431104 c:\windows\Installer\1df653.msi
+ 2008-11-17 16:28 . 2008-11-17 16:28 972800 c:\windows\Installer\17cab7.msi
+ 2008-11-17 16:22 . 2008-11-17 16:22 432640 c:\windows\Installer\17ca7e.msi
+ 2008-06-11 20:02 . 2008-06-11 20:02 830464 c:\windows\Installer\1233fdc.msp
+ 2006-02-16 04:12 . 2006-02-16 04:12 205824 c:\windows\Installer\106b3c8.msi
+ 2005-12-02 20:29 . 2005-04-04 09:07 982016 c:\windows\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\ISScript11.Msi
+ 2001-01-03 13:12 . 2004-07-17 18:35 1326080 c:\windows\system32\webfldrs.msi
+ 2004-07-17 18:35 . 2004-07-17 18:35 1326080 c:\windows\ServicePackFiles\i386\webfldrs.msi
+ 2003-02-20 07:34 . 2003-02-20 07:34 4158976 c:\windows\MSBN\MSBN.msi
+ 2007-05-25 18:08 . 2007-05-25 18:08 9609728 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp
+ 2007-01-19 00:14 . 2007-01-19 00:14 3463680 c:\windows\Microsoft.NET\Framework\v1.0.3705\Updates\M928367\M928367Uninstall.msp
+ 2002-06-13 01:01 . 2002-06-13 01:01 7100416 c:\windows\Installer\fc86b8.msp
+ 2007-04-13 16:58 . 2007-04-13 16:58 3060224 c:\windows\Installer\f125c.msi
+ 2009-06-25 01:29 . 2009-06-25 01:29 1563648 c:\windows\Installer\db8347.msi
+ 2009-06-25 01:24 . 2009-06-25 01:24 3938816 c:\windows\Installer\db8340.msi
+ 2007-11-07 20:50 . 2007-11-07 20:50 6055936 c:\windows\Installer\d19b3d2.msp
+ 2007-11-07 21:00 . 2007-11-07 21:00 3407360 c:\windows\Installer\d19b3d1.msp
+ 2007-11-07 20:46 . 2007-11-07 20:46 3010560 c:\windows\Installer\d19b3cf.msp
+ 2007-11-07 21:02 . 2007-11-07 21:02 6473216 c:\windows\Installer\d19b3ce.msp
+ 2007-11-07 21:12 . 2007-11-07 21:12 2533376 c:\windows\Installer\d19b3cd.msp
+ 2007-07-11 21:05 . 2007-07-11 21:05 6743040 c:\windows\Installer\c7eef.msp
+ 2003-04-10 07:03 . 2003-04-10 07:03 1343488 c:\windows\Installer\c7779.msi
+ 2003-04-10 06:57 . 2003-04-10 06:57 2323456 c:\windows\Installer\c776b.msi
+ 2003-04-10 06:48 . 2003-04-10 06:48 4347904 c:\windows\Installer\c7759.msi
+ 2005-02-28 02:08 . 2005-02-28 02:08 1422848 c:\windows\Installer\c5b8a.msp
+ 2009-01-14 22:43 . 2009-01-14 22:43 5520384 c:\windows\Installer\aadffb6.msp
+ 2008-10-23 05:43 . 2008-10-23 05:43 6820352 c:\windows\Installer\a1a86a.msp
+ 2008-10-23 05:48 . 2008-10-23 05:48 7672832 c:\windows\Installer\a1a853.msp
+ 2008-11-05 21:25 . 2008-11-05 21:25 5518336 c:\windows\Installer\a1a83c.msp
+ 2009-05-04 13:46 . 2009-05-04 13:46 8299008 c:\windows\Installer\9eae9.msp
+ 2009-05-12 19:01 . 2009-05-12 19:01 6818816 c:\windows\Installer\9eadb.msp
+ 2009-04-24 18:30 . 2009-04-24 18:30 2583552 c:\windows\Installer\9eac4.msp
+ 2009-05-28 18:32 . 2009-05-28 18:32 5518848 c:\windows\Installer\9eab5.msp
+ 2005-08-31 22:21 . 2005-08-31 22:21 5635584 c:\windows\Installer\839154.msi
+ 2009-01-14 15:34 . 2009-01-14 15:34 3350528 c:\windows\Installer\82af5.msi
+ 2006-05-10 13:45 . 2006-05-10 13:45 2768384 c:\windows\Installer\7c15a.msi
+ 2005-10-29 20:18 . 2005-10-29 20:18 3587584 c:\windows\Installer\7b460e.msi
+ 2005-10-11 19:40 . 2005-10-11 19:40 2802688 c:\windows\Installer\797bc.msi
+ 2006-04-05 23:06 . 2006-04-05 23:06 4418560 c:\windows\Installer\75b484.msi
+ 2005-01-11 03:39 . 2005-01-11 03:39 3443712 c:\windows\Installer\726b5.msi
+ 2009-04-23 23:57 . 2009-04-23 23:57 7672832 c:\windows\Installer\6f390c.msp
+ 2009-02-08 16:11 . 2009-02-08 16:11 1430016 c:\windows\Installer\6a6eb.msi
+ 2005-10-30 21:13 . 2005-10-30 21:13 1479168 c:\windows\Installer\59337.msi
+ 2009-05-01 21:49 . 2009-05-01 21:49 4328960 c:\windows\Installer\53f8704.msp
+ 2009-04-24 18:31 . 2009-04-24 18:31 1425920 c:\windows\Installer\53f86ec.msp
+ 2003-04-10 07:49 . 2003-04-10 07:49 2652672 c:\windows\Installer\453973.msi
+ 2003-09-05 14:57 . 2003-09-05 14:57 2928640 c:\windows\Installer\329f6c.msi
+ 2005-11-03 00:00 . 2005-11-03 00:00 1522688 c:\windows\Installer\2eb421.msi
+ 2009-05-19 04:10 . 2009-05-19 04:10 1401344 c:\windows\Installer\2d88b67.msi
+ 2005-12-23 22:41 . 2005-12-23 22:41 9933312 c:\windows\Installer\2a75f.msi
+ 2009-04-06 23:00 . 2009-04-06 23:00 5518336 c:\windows\Installer\2a40041c.msp
+ 2008-09-05 19:08 . 2008-09-05 19:08 5515776 c:\windows\Installer\26d8ce7.msp
+ 2008-08-14 21:01 . 2008-08-14 21:01 5517312 c:\windows\Installer\26ab2a5c.msp
+ 2009-02-11 21:02 . 2009-02-11 21:02 5519872 c:\windows\Installer\2620916.msp
+ 2007-04-03 00:15 . 2007-04-03 00:15 1333760 c:\windows\Installer\243c4b7.msi
+ 2005-10-26 20:59 . 2005-10-26 20:59 2883072 c:\windows\Installer\2373468.msp
+ 2008-05-15 15:50 . 2008-05-15 15:50 5515776 c:\windows\Installer\2373452.msp
+ 2008-01-31 16:30 . 2008-01-31 16:30 9947648 c:\windows\Installer\2373406.msp
+ 2008-01-14 22:53 . 2008-01-14 22:53 5213696 c:\windows\Installer\23733d3.msp
+ 2007-11-08 17:42 . 2007-11-08 17:42 4158464 c:\windows\Installer\23733a8.msp
+ 2008-06-20 01:28 . 2008-06-20 01:28 1573376 c:\windows\Installer\21edc25.msp
+ 2007-07-21 20:26 . 2007-07-21 20:26 7574016 c:\windows\Installer\21edbe5.msp
+ 2008-10-20 17:18 . 2008-10-20 17:18 6474240 c:\windows\Installer\21edbd9.msp
+ 2008-12-12 18:09 . 2008-12-12 18:09 5517824 c:\windows\Installer\1b2b1d0d.msp
+ 2004-10-11 23:49 . 2004-10-11 23:49 2157568 c:\windows\Installer\1af4d5e.msi
+ 2008-06-11 21:05 . 2008-06-11 21:05 9994240 c:\windows\Installer\1a7413.msp
+ 2008-06-10 20:09 . 2008-06-10 20:09 5517312 c:\windows\Installer\1a73fd.msp
+ 2007-12-18 23:55 . 2007-12-18 23:55 6074368 c:\windows\Installer\19da6b.msi
+ 2008-10-25 16:15 . 2008-10-25 16:15 6227456 c:\windows\Installer\17caab.msp
+ 2008-10-17 16:03 . 2008-10-17 16:03 5518336 c:\windows\Installer\17ca94.msp
+ 2006-04-12 02:09 . 2006-04-12 02:09 5864960 c:\windows\Installer\1593a7.msp
+ 2006-04-27 19:46 . 2006-04-27 19:46 1241088 c:\windows\Installer\139c986.msi
+ 2006-04-12 02:38 . 2006-04-12 02:38 4716032 c:\windows\Installer\130cfb.msi
+ 2005-12-02 20:31 . 2005-12-02 20:31 9781760 c:\windows\Installer\12f5b99.msi
+ 2008-07-16 16:39 . 2008-07-16 16:39 5519360 c:\windows\Installer\123400a.msp
+ 2008-07-08 17:27 . 2008-07-08 17:27 8436736 c:\windows\Installer\1233ff3.msp
+ 2009-03-05 21:40 . 2009-03-05 21:40 6819840 c:\windows\Installer\115f117c.msp
+ 2004-02-26 23:02 . 2004-02-26 23:02 1863168 c:\windows\Downloaded Installations\{FF1CF8DB-E276-4481-BDA6-ECFBD4EAA651}\HMTCDWizard.msi
+ 2007-04-03 00:15 . 2007-04-03 00:15 7571456 c:\windows\Downloaded Installations\{C950B09E-30B9-46FB-BE61-BB75314A36BF}\TOPO!.msi
+ 2003-10-31 23:03 . 2003-10-30 20:08 3853176 c:\windows\Downloaded Installations\{AF58B5C6-42C4-43A0-826E-A7FEDA558889}\Premier Collection DHC-3 Otter for FS2004.msi
+ 2005-12-02 20:29 . 2005-10-18 20:01 9935872 c:\windows\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\iTunes.msi
+ 2005-12-26 22:29 . 2005-12-26 22:29 6809228 c:\windows\Downloaded Installations\{8379D168-79F6-4394-81A2-BB1944E8F892}\Adobe Photoshop Album 3 SE.msi
+ 2006-04-05 23:05 . 2005-11-18 18:28 4418248 c:\windows\Downloaded Installations\{00C333C7-1B8C-4E34-BE57-D78A81ADA4D8}\Abacus EZ-Libraries.msi
+ 2004-09-09 20:18 . 2002-08-29 12:00 1325568 c:\windows\$NtServicePackUninstall$\webfldrs.msi
+ 2007-07-11 21:15 . 2007-07-11 21:15 15256576 c:\windows\Installer\c7f55.msp
+ 2005-10-30 21:14 . 2005-10-30 21:14 10462208 c:\windows\Installer\59342.msi
+ 2007-05-10 20:27 . 2007-05-10 20:27 10259968 c:\windows\Installer\39686e.msi
+ 2004-09-29 19:26 . 2004-09-29 19:26 10723328 c:\windows\Installer\2857a7.msp
+ 2008-08-13 20:49 . 2008-08-13 20:49 11816960 c:\windows\Installer\26d8cfe.msp
+ 2008-07-30 14:50 . 2008-07-30 14:50 12506112 c:\windows\Installer\26ab2a8a.msp
+ 2008-06-04 19:29 . 2008-06-04 19:29 16905728 c:\windows\Installer\26ab2a73.msp
+ 2008-03-17 18:48 . 2008-03-17 18:48 11813888 c:\windows\Installer\237343b.msp
+ 2008-03-01 04:09 . 2008-03-01 04:09 16907776 c:\windows\Installer\2373425.msp
+ 2008-04-14 20:26 . 2008-04-14 20:26 11888128 c:\windows\Installer\23733e9.msp
+ 2008-01-14 21:24 . 2008-01-14 21:24 10721280 c:\windows\Installer\23733bd.msp
+ 2008-10-20 17:22 . 2008-10-20 17:22 11758592 c:\windows\Installer\21edc3f.msp
+ 2008-08-11 18:51 . 2008-08-11 18:51 15916544 c:\windows\Installer\21edc32.msp
+ 2008-08-11 18:49 . 2008-08-11 18:49 22457344 c:\windows\Installer\21edc17.msp
+ 2008-09-24 19:05 . 2008-09-24 19:05 16381440 c:\windows\Installer\21edc0a.msp
+ 2007-10-15 06:33 . 2007-10-15 06:33 26646016 c:\windows\Installer\21edbfe.msp
+ 2007-04-20 15:25 . 2007-04-20 15:25 10162688 c:\windows\Installer\217d21.msi
+ 2006-04-12 01:41 . 2006-04-12 01:41 19210240 c:\windows\Installer\1314310.msp
+ 2008-07-08 16:09 . 2008-07-08 16:09 11887616 c:\windows\Installer\1234021.msp
+ 2008-07-01 15:25 . 2008-07-01 15:25 11814912 c:\windows\Installer\1233fc6.msp
+ 2009-02-26 01:07 . 2009-02-26 01:07 11646464 c:\windows\Installer\115f118a.msp
+ 2005-02-16 00:45 . 2005-02-16 00:45 20877312 c:\windows\Downloaded Installations\{628E8630-7947-49EA-BE90-7F8BFF77A79C}\iTunes.msi
+ 2007-07-27 15:03 . 2007-07-27 15:03 119977472 c:\windows\Installer\1ef553.msp
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-04 405583]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"LtcyCfgApply"="c:\program files\Ltcycfg2\LtcyCfg.exe" [2004-11-05 265216]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2009-02-04 177392]
"CAVRID"="c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-02 230928]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-02-17 1169776]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-02-17 1945960]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2007-02-17 149024]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-06-17 414992]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-25 148888]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2005-11-23 344064]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2006-1-3 49254]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-9-10 98304]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\KEM.exe [2005-11-7 581632]
M-Audio Sonica Theater Control Panel Launcher.lnk - c:\program files\M-Audio Sonica Theater\STTask.exe [2003-5-21 172032]
SqueezeCenter Tray Tool.lnk - c:\program files\SqueezeCenter\SqueezeTray.exe [2008-6-26 1728599]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ SDEarlyDelete\0SDEarlyDelete \??\c:\program files\SpywareDetector\0autocheck autochk *\0OODBS\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ WinCinema Manager.lnk
backup=c:\windows\pss\ WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR Media Server.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NETGEAR Media Server.lnk
backup=c:\windows\pss\NETGEAR Media Server.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"DW4"="c:\program files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
"OM_Monitor"=c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"Spam Bully for Outlook Express"="c:\program files\Axaware\Spam Bully 2 for OE\oespambully.exe" install
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE"
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"AlcxMonitor"=ALCXMNTR.EXE
"OmniPass"=c:\program files\Softex\OmniPass\scureapp.exe
"zBrowser Launcher"=c:\program files\Logitech\iTouch\iTouch.exe
"PinnacleDriverCheck"=c:\windows\system32\PSDrvCheck.exe -CheckReg
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"WD Button Manager"=WDBtnMgr.exe
"AdaptecDirectCD"=c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
"SDActiveMonitor"=c:\program files\SpywareDetector\SDActiveMonitor.exe -AUTO

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Updates from HP\\137903\\Program\\BackWeb-137903.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Macromedia\\Flash MX\\Flash.exe"=
"c:\\Program Files\\WS_FTP Pro\\FTP95PRO.EXE"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\Microsoft Games\\Links 2003\\LinksMMIII.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Bentley\\Program\\MicroStation\\ustation.exe"=
"e:\\Program Files\\Bentley\\Program\\MicroStation\\ustation.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\DiskTrix\\UltimateDefrag2008\\UDefrag.exe"=
"c:\\Program Files\\MediaMonkey\\VisHelper.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"=
"c:\\Program Files\\CoffeeCup Software\\CoffeeCup Website Access Manager\\CCAccess.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"9000:TCP"= 9000:TCP:SqueezeCenter 9000 tcp
"3483:UDP"= 3483:UDP:SqueezeCenter 3483 udp
"3483:TCP"= 3483:TCP:SqueezeCenter 3483 tcp
"137:TCP"= 137:TCP:MacMachine
"138:TCP"= 138:TCP:MacMachine2

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [5/12/2009 2:13 PM 61328]
R1 atitray;atitray;c:\program files\Radeon Omega Drivers\v3.8.231\ATI Tray Tools\atitray.sys [11/13/2005 4:43 PM 11008]
R1 SSHDRV64;SSHDRV64;c:\windows\system32\drivers\SSHDRV64.sys [2/26/2004 6:01 PM 109568]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/22/2009 2:31 PM 195856]
R2 SqueezeMySQL;SqueezeMySQL;c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe –defaults-file=c:\docume~1\ALLUSE~1\APPLIC~1\SQUEEZ~1\Cache\my.cnf SqueezeMySQL –> c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe –defaults-file=c:\docume~1\ALLUSE~1\APPLIC~1\SQUEEZ~1\Cache\my.cnf SqueezeMySQL [?]
R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [7/9/2003 3:35 PM 180480]
R3 ma763007;M-Audio Sonica Theater Driver;c:\windows\system32\drivers\MA763007.sys [3/13/2008 10:35 AM 83456]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/22/2009 2:31 PM 19096]
R3 rxpvbus;Reality XP Avionics Bus Driver;c:\windows\system32\drivers\rxpvbus.sys [3/4/2005 4:00 AM 44032]
S1 SDManager;SDManager;\??\c:\program files\SpywareDetector\SDManager.sys –> c:\program files\SpywareDetector\SDManager.sys [?]
S2 gupdate1c99eaec907864;Google Update Service (gupdate1c99eaec907864);c:\program files\Google\Update\GoogleUpdate.exe [3/6/2009 4:51 PM 133104]
S2 mrtRate;mrtRate; [x]
S3 Just Flight Limited License Service;Just Flight Limited License Service;c:\program files\Common Files\Just Flight Limited Shared\Service\JustFlightLimitedLicSvc.exe [2/2/2007 1:42 PM 69632]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys –> c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [?]
S3 SDActMon;SDActMon;\??\c:\program files\SpywareDetector\SDActMon.sys –> c:\program files\SpywareDetector\SDActMon.sys [?]
S3 WnsService;WnsService;g:\+oldmachine\Bootdrive\cgi-bin\WnsService.exe –> g:\+oldmachine\Bootdrive\cgi-bin\WnsService.exe [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-06 22:51]

2009-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-06 22:51]

2009-07-08 c:\windows\Tasks\Malwarebytes' Scheduled Scan for Owner.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-22 17:27]

2009-07-08 c:\windows\Tasks\Malwarebytes' Scheduled Update for Owner.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-22 17:27]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = localhost
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
LSP: c:\windows\system32\VetRedir.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} - hxxp://plpadmin.tempdomainname.com/CabFiles/NewUpgradeFinder.cab
DPF: {6DD4EA80-8981-40FB-B2FC-06B8EDC632B8} - hxxp://www.2for1.com/downloads/PrintControl.CAB
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://my.msn.com/
FF - component: c:\program files\PayPal\PayPal Plug-In\components\PayPalPlugin.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-08 09:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,d0,3c,c4,96,fe,
2a,7c,d5,2e,e8,e1,00,eb,16,2b,de,c6,d8,19,21,87,9c,0b,a3,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,66,20,fa,ac,6a,
d5,3f,4b,46,47,15,b0,92,4b,c7,ef,ea,1d,24,24,e3,41,25,0c,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,b7,07,70,71,b0,
36,36,d6,7a,45,05,fd,91,e8,6f,31,0d,04,99,63,b2,3c,b4,88,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,4e,e5,a5,a6,c1,
d3,b7,ca,6b,65,49,6a,7e,99,74,f7,1d,53,94,90,da,10,41,12,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,da,5b,55,89,fd,
08,63,6f,e9,02,6c,fa,fb,1d,47,57,90,e9,7a,2a,c2,08,b5,5d,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,ed,4f,f1,b7,5c,
db,c8,f4,50,93,e5,ab,ec,6a,4e,ab,0c,39,85,ba,81,f8,f4,3c,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,b6,9b,f0,c2,a6,
4e,43,a6,97,20,4e,9a,c7,f1,35,ee,da,1b,5b,30,ba,e8,a0,28,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,4a,85,79,6b,65,
f4,7f,1b,aa,52,c6,00,84,3c,26,64,0d,da,93,97,ab,72,57,d1,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,3a,b0,e9,df,d4,
f7,71,fd,b2,46,9a,e2,1b,fe,1b,94,8f,2e,71,16,95,63,87,c1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,91,b0,9e,22,db,
11,38,62,37,a4,aa,c3,a6,15,56,0a,12,b7,eb,b0,51,bd,cf,3c,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,6b,86,3b,ef,ae,
7c,48,2f,f8,31,0f,a9,5f,a0,ec,fb,a4,cf,b3,ca,2a,55,6a,c0,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,5e,92,53,71,16,
3e,d0,d6,05,73,21,dd,54,d8,4a,c5,29,ed,bc,11,b7,15,f4,3a,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\*@d*@d]
"DisplayName"="??????"
"DeviceDesc"="??????"
"ProviderName"="??"
"MFG"="urrentControlSet\\Services\\ati2mtag\\Device0"
"ReinstallString"="????"
"DeviceInstanceIds"=multi:"`\00"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\ @*ðˆúw]
"DisplayName"=""
"DeviceDesc"=""
"ProviderName"=""
"MFG"=""
"ReinstallString"="????"
"DeviceInstanceIds"=multi:"`\00"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="172B632976C7B181AF38692326FEBF9897271AC4CC284BC74DF4285F91E22D66B825CD11CF0
72361122984FE58D6407F825A98268AC01EC22C890DB734B267C06F93468748FCB4A40A8F0E0FE1C3
2DAE848861759C03854D6A479733B19E4646DB2CC83CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9
E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E6679DB7CE
019D40AA5CC038D530D6EB3452BA7FD869164D6794A8E211070B4700FC8E08053999BE0996A3BFB56
BD5AB0189FA487DCB84E47D41EC5F491C352AED5BBD5463DD527B935F8E2A8803FD033C7424495538
BE92D5397BC479B9F7294C1C2EA941BA3D91BCC8A5E2F0DA680EF42B202D6DAD0A0D44FC081730CFA
27999E29115139035907718372168259CD2B334FA74646E3B7505F3F7C0D2D377F5E7984B88A2268A
AC4BD8C502BC1817FD145B7204AC429B916AC9E80F183DAC9B5D6C745C0C457E3A53D785028E6F48D
EC52FF7A20CF66948D76FA9338C0A6B0DB54ED84AC03A4935BDA8DF86D5E914690E0434FD1ED9D4A7
49983E4210BAD18FBCF2F9EF85D716BD50A073D6D9C8513645EF00A652BE02E0C9BD5DB5D4D2710DD
6D40D50F1720394DFD9901D3AD3CD02574E6A11EAFD8BC77B1B726B65DA5214782F78517364A423D8
B2BD6A675649A9C4BE3614FEF27D5793301DA49A62EC57AD05D93E4B0D7F71B9CC34B1299CF6B321A
3D9EDF77DD8A9DBC0328626F52F2A939B02450ECB90B0170F614817FBFE4715A37F3E960293023056
B79A0AADFB88DCF974F7A4864633172366EC20497DAF5D2C06886C66954482BC69CEA01FA810506E6
BCCCB28046EF6771A3D0660835E4AEA00B660183C79D8833873136A7F82C70BD120939CA000833E84
3CDE9E9265BFD1B315AC85594D4C7F46BFE3ADBEC4B124C82DE05866A49F6DE35293E7A5FD359A1B5
3E1A230928949EA4AE48D18620F52A5986D4D1640C5BF294AE1A1A604393FE506E0E77CBDD13B3393
3DB3B18877746FE8C5F760597EB1FAD35CB7F676E9FD76A561CF6867FB76DCF96A4D268795AA63084
9D4ED9AEA87B102E718E9F87CDAE28E6ED9964DEE5F5CC53B898258A658F2C22FE65A53BCC55C4CBF
B54855391EF502668A9BCE291E599E551EC813FDA9414E7EB0B3773CB73A8F70874DF57B51AD237CE
980713C9E2F92AD436F75800A27BF14BF7C9B436BC2885B07A86B3443BC7A360343DD4C11EC1291B5
E0622AABB111219EABFB43329F5C3833FEE869888A75EE655362946957F39F367ADE078220212A612
EF7BDA12C920F1168C7B0F6B0E2562496ED6060E3F04E098F16BBC86932889BE0114B16FB953E23F0
02B62B7D79EE5866179171C02662766354FB7AB36A686718EF96ACD4B576F719383D04F4CE0F1D0F1
59E5DCA16794CB20C15D9DCD4CA64"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1060)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1124)
c:\windows\system32\relog_ap.dll
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
c:\windows\system32\VetRedir.dll
c:\windows\system32\ISafeIf.dll

- - - - - - - > 'explorer.exe'(2424)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
c:\windows\system32\oodag.exe
c:\program files\Softex\OmniPass\omniServ.exe
c:\program files\M-Audio Sonica Theater\Install\STInst.exe
c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
c:\windows\system32\ati2evxx.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\program files\Logitech\SetPoint\KHALMNPR.exe
c:\program files\CA\CA Internet Security Suite\ccprovsp.exe
.
**************************************************************************
.
Completion time: 2009-07-08 10:07 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-08 16:07
ComboFix2.txt 2009-06-25 14:30

Pre-Run: 26,229,719,040 bytes free
Post-Run: 26,111,311,872 bytes free

522 — E O F — 2009-06-12 00:02

Malwarebytes' Anti-Malware 1.38
Database version: 2393
Windows 5.1.2600 Service Pack 2

7/8/2009 10:20:55 AM
mbam-log-2009-07-08 (10-20-55).txt

Scan type: Quick Scan
Objects scanned: 101333
Time elapsed: 5 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

emeraldnzl

Post #11July 10, 2009, 11:58 PM UTC

Hello blindlemon,

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

KillAll::

File::
c:\windows\system32\drivers\kgpfr2.cfg
c:\windows\system32\drivers\kgpfr2.cfg
c:\windows\system32\drivers\ac0a2fff5a08b1b35bb6f5c125c07e76.szcpf

blindlemon

Post #12July 13, 2009, 5:27 PM UTC

Hi Emeraldnzl
Here's the log files you requested.
Thanks so much

ComboFix 09-07-12.03 - Owner 07/13/2009 9:34.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1504 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: CA Anti-Virus *On-access scanning disabled* (Updated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}

FILE ::
"c:\windows\system32\drivers\ac0a2fff5a08b1b35bb6f5c125c07e76.szcpf"
"c:\windows\system32\drivers\kgpfr2.cfg"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\ac0a2fff5a08b1b35bb6f5c125c07e76.szcpf

.
((((((((((((((((((((((((( Files Created from 2009-06-13 to 2009-07-13 )))))))))))))))))))))))))))))))
.

2009-06-25 02:01 . 2009-06-25 14:43 ——– d—–w- C:\_OTL
2009-06-25 01:30 . 2009-06-25 01:29 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-06-24 20:48 . 1998-07-13 10:02 71296 —-a-w- c:\windows\DrvAct16.dll
2009-06-24 20:48 . 1998-07-13 10:02 158208 —-a-w- c:\windows\DrvAct32.dll
2009-06-22 20:31 . 2009-06-22 20:31 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-06-22 20:31 . 2009-06-17 17:27 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-22 20:31 . 2009-06-22 20:31 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-22 20:31 . 2009-06-22 20:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-22 20:31 . 2009-06-17 17:27 19096 —-a-w- c:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-13 16:59 . 2009-07-13 16:58 1120 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-07-13 16:59 . 2007-10-12 21:23 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-07-13 16:58 . 2009-07-13 16:58 424 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2009-06-25 01:29 . 2006-05-11 22:20 ——– d—–w- c:\program files\Java
2009-06-25 01:23 . 2003-04-10 06:52 ——– d—–w- c:\program files\Common Files\Adobe
2009-06-18 20:34 . 2008-11-19 16:15 ——– d—–w- c:\program files\ViewBuild Professional
2009-06-17 17:08 . 2007-04-18 23:45 ——– d—–w- c:\documents and settings\Owner\Application Data\CoreFTP
2009-06-10 21:23 . 2003-10-22 15:14 161920 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-10 21:07 . 2007-10-12 21:23 ——– d—–w- c:\program files\STOPzilla!
2009-06-10 14:35 . 2003-09-23 22:38 ——– d—–w- c:\program files\Sound Forge XP
2009-05-28 20:16 . 2009-05-28 20:16 17408 —-a-r- c:\windows\system32\SZIO5.dll
2009-05-28 20:15 . 2009-05-28 20:15 294912 —-a-r- c:\windows\system32\SZBase5.dll
2009-05-28 20:14 . 2009-05-28 20:14 540672 —-a-r- c:\windows\system32\SZComp5.dll
2009-05-27 15:57 . 2009-04-20 19:41 ——– d—–w- c:\program files\SpywareDetector
2009-05-18 21:14 . 2008-02-14 02:30 ——– d—–w- c:\documents and settings\All Users\Application Data\SITEguard
2009-05-12 20:13 . 2009-05-12 20:13 61328 —-a-r- c:\windows\system32\drivers\SZKG.sys
2009-05-07 15:44 . 2001-01-03 13:38 344064 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-02-07 00:05 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-17 09:58 . 2001-01-03 13:12 1846656 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 15:26 . 2004-04-22 16:21 583168 —-a-w- c:\windows\system32\rpcrt4.dll
2006-01-03 22:44 . 2006-01-03 22:44 61 –sh–w- c:\windows\cnerolf.dat
2003-09-09 02:13 . 2003-09-09 02:13 0 –sha-w- c:\windows\SMINST\HPCD.sys
2008-05-15 20:32 . 2006-04-17 22:13 9392 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot_2009-07-08_15.45.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2003-04-10 05:05 . 2009-07-08 23:51 72748 c:\windows\system32\perfc009.dat
- 2003-04-10 05:05 . 2009-05-01 20:08 72748 c:\windows\system32\perfc009.dat
+ 2003-04-10 05:05 . 2009-07-08 23:51 428114 c:\windows\system32\perfh009.dat
- 2003-04-10 05:05 . 2009-05-01 20:08 428114 c:\windows\system32\perfh009.dat
+ 2009-01-18 22:05 . 2009-01-18 22:05 675840 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0100000010\9.1.0\JP2KLib.dll
+ 2009-07-10 23:29 . 2009-07-10 23:29 6653952 c:\windows\Installer\c0d5dbc.msp
+ 2008-12-18 22:48 . 2008-12-18 22:48 3645440 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0100000010\9.1.0\authplay.dll
+ 2009-02-27 22:37 . 2009-02-27 22:37 20403568 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0100000010\9.1.0\AcroRd32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-04 405583]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"LtcyCfgApply"="c:\program files\Ltcycfg2\LtcyCfg.exe" [2004-11-05 265216]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2009-02-04 177392]
"CAVRID"="c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-02 230928]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-02-17 1169776]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-02-17 1945960]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2007-02-17 149024]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-06-17 414992]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-25 148888]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2005-11-23 344064]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2006-1-3 49254]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-9-10 98304]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\KEM.exe [2005-11-7 581632]
M-Audio Sonica Theater Control Panel Launcher.lnk - c:\program files\M-Audio Sonica Theater\STTask.exe [2003-5-21 172032]
SqueezeCenter Tray Tool.lnk - c:\program files\SqueezeCenter\SqueezeTray.exe [2008-6-26 1728599]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ SDEarlyDelete\0SDEarlyDelete \??\c:\program files\SpywareDetector\0autocheck autochk *\0OODBS\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ WinCinema Manager.lnk
backup=c:\windows\pss\ WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR Media Server.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NETGEAR Media Server.lnk
backup=c:\windows\pss\NETGEAR Media Server.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"DW4"="c:\program files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
"OM_Monitor"=c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"Spam Bully for Outlook Express"="c:\program files\Axaware\Spam Bully 2 for OE\oespambully.exe" install
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE"
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"AlcxMonitor"=ALCXMNTR.EXE
"OmniPass"=c:\program files\Softex\OmniPass\scureapp.exe
"zBrowser Launcher"=c:\program files\Logitech\iTouch\iTouch.exe
"PinnacleDriverCheck"=c:\windows\system32\PSDrvCheck.exe -CheckReg
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"WD Button Manager"=WDBtnMgr.exe
"AdaptecDirectCD"=c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
"SDActiveMonitor"=c:\program files\SpywareDetector\SDActiveMonitor.exe -AUTO

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Updates from HP\\137903\\Program\\BackWeb-137903.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Macromedia\\Flash MX\\Flash.exe"=
"c:\\Program Files\\WS_FTP Pro\\FTP95PRO.EXE"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\Microsoft Games\\Links 2003\\LinksMMIII.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Bentley\\Program\\MicroStation\\ustation.exe"=
"e:\\Program Files\\Bentley\\Program\\MicroStation\\ustation.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\DiskTrix\\UltimateDefrag2008\\UDefrag.exe"=
"c:\\Program Files\\MediaMonkey\\VisHelper.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"=
"c:\\Program Files\\CoffeeCup Software\\CoffeeCup Website Access Manager\\CCAccess.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"9000:TCP"= 9000:TCP:SqueezeCenter 9000 tcp
"3483:UDP"= 3483:UDP:SqueezeCenter 3483 udp
"3483:TCP"= 3483:TCP:SqueezeCenter 3483 tcp
"137:TCP"= 137:TCP:MacMachine
"138:TCP"= 138:TCP:MacMachine2

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [5/12/2009 2:13 PM 61328]
R1 atitray;atitray;c:\program files\Radeon Omega Drivers\v3.8.231\ATI Tray Tools\atitray.sys [11/13/2005 4:43 PM 11008]
R1 SSHDRV64;SSHDRV64;c:\windows\system32\drivers\SSHDRV64.sys [2/26/2004 6:01 PM 109568]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/22/2009 2:31 PM 195856]
R2 SqueezeMySQL;SqueezeMySQL;c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe –defaults-file=c:\docume~1\ALLUSE~1\APPLIC~1\SQUEEZ~1\Cache\my.cnf SqueezeMySQL –> c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe –defaults-file=c:\docume~1\ALLUSE~1\APPLIC~1\SQUEEZ~1\Cache\my.cnf SqueezeMySQL [?]
R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [7/9/2003 3:35 PM 180480]
R3 ma763007;M-Audio Sonica Theater Driver;c:\windows\system32\drivers\MA763007.sys [3/13/2008 10:35 AM 83456]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/22/2009 2:31 PM 19096]
R3 rxpvbus;Reality XP Avionics Bus Driver;c:\windows\system32\drivers\rxpvbus.sys [3/4/2005 4:00 AM 44032]
S1 SDManager;SDManager;\??\c:\program files\SpywareDetector\SDManager.sys –> c:\program files\SpywareDetector\SDManager.sys [?]
S2 gupdate1c99eaec907864;Google Update Service (gupdate1c99eaec907864);c:\program files\Google\Update\GoogleUpdate.exe [3/6/2009 4:51 PM 133104]
S2 mrtRate;mrtRate; [x]
S3 Just Flight Limited License Service;Just Flight Limited License Service;c:\program files\Common Files\Just Flight Limited Shared\Service\JustFlightLimitedLicSvc.exe [2/2/2007 1:42 PM 69632]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys –> c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [?]
S3 SDActMon;SDActMon;\??\c:\program files\SpywareDetector\SDActMon.sys –> c:\program files\SpywareDetector\SDActMon.sys [?]
S3 WnsService;WnsService;g:\+oldmachine\Bootdrive\cgi-bin\WnsService.exe –> g:\+oldmachine\Bootdrive\cgi-bin\WnsService.exe [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-06 22:51]

2009-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-06 22:51]

2009-07-10 c:\windows\Tasks\Malwarebytes' Scheduled Scan for Owner.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-22 17:27]

2009-07-10 c:\windows\Tasks\Malwarebytes' Scheduled Update for Owner.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-22 17:27]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-SITEguard - (no file)

.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = localhost
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
LSP: c:\windows\system32\VetRedir.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} - hxxp://plpadmin.tempdomainname.com/CabFiles/NewUpgradeFinder.cab
DPF: {6DD4EA80-8981-40FB-B2FC-06B8EDC632B8} - hxxp://www.2for1.com/downloads/PrintControl.CAB
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://my.msn.com/
FF - component: c:\program files\PayPal\PayPal Plug-In\components\PayPalPlugin.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-13 10:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,d0,3c,c4,96,fe,
2a,7c,d5,2e,e8,e1,00,eb,16,2b,de,c6,d8,19,21,87,9c,0b,a3,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,66,20,fa,ac,6a,
d5,3f,4b,46,47,15,b0,92,4b,c7,ef,ea,1d,24,24,e3,41,25,0c,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,b7,07,70,71,b0,
36,36,d6,7a,45,05,fd,91,e8,6f,31,0d,04,99,63,b2,3c,b4,88,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,4e,e5,a5,a6,c1,
d3,b7,ca,6b,65,49,6a,7e,99,74,f7,1d,53,94,90,da,10,41,12,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,da,5b,55,89,fd,
08,63,6f,e9,02,6c,fa,fb,1d,47,57,90,e9,7a,2a,c2,08,b5,5d,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,ed,4f,f1,b7,5c,
db,c8,f4,50,93,e5,ab,ec,6a,4e,ab,0c,39,85,ba,81,f8,f4,3c,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,b6,9b,f0,c2,a6,
4e,43,a6,97,20,4e,9a,c7,f1,35,ee,da,1b,5b,30,ba,e8,a0,28,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,4a,85,79,6b,65,
f4,7f,1b,aa,52,c6,00,84,3c,26,64,0d,da,93,97,ab,72,57,d1,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,3a,b0,e9,df,d4,
f7,71,fd,b2,46,9a,e2,1b,fe,1b,94,8f,2e,71,16,95,63,87,c1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,91,b0,9e,22,db,
11,38,62,37,a4,aa,c3,a6,15,56,0a,12,b7,eb,b0,51,bd,cf,3c,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,6b,86,3b,ef,ae,
7c,48,2f,f8,31,0f,a9,5f,a0,ec,fb,a4,cf,b3,ca,2a,55,6a,c0,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,5e,92,53,71,16,
3e,d0,d6,05,73,21,dd,54,d8,4a,c5,29,ed,bc,11,b7,15,f4,3a,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\*@d*@d]
"DisplayName"="??????"
"DeviceDesc"="??????"
"ProviderName"="??"
"MFG"="urrentControlSet\\Services\\ati2mtag\\Device0"
"ReinstallString"="????"
"DeviceInstanceIds"=multi:"`\00"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\ @*ðˆúw]
"DisplayName"=""
"DeviceDesc"=""
"ProviderName"=""
"MFG"=""
"ReinstallString"="????"
"DeviceInstanceIds"=multi:"`\00"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="172B632976C7B181AF38692326FEBF9897271AC4CC284BC74DF4285F91E22D66B825CD11CF0
72361122984FE58D6407F825A98268AC01EC22C890DB734B267C06F93468748FCB4A40A8F0E0FE1C3
2DAE848861759C03854D6A479733B19E4646DB2CC83CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9
E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E6679DB7CE
019D40AA5CC038D530D6EB3452BA7FD869164D6794A8E211070B4700FC8E08053999BE0996A3BFB56
BD5AB0189FA487DCB84E47D41EC5F491C352AED5BBD5463DD527B935F8E2A8803FD033C7424495538
BE92D5397BC479B9F7294C1C2EA941BA3D91BCC8A5E2F0DA680EF42B202D6DAD0A0D44FC081730CFA
27999E29115139035907718372168259CD2B334FA74646E3B7505F3F7C0D2D377F5E7984B88A2268A
AC4BD8C502BC1817FD145B7204AC429B916AC9E80F183DAC9B5D6C745C0C457E3A53D785028E6F48D
EC52FF7A20CF66948D76FA9338C0A6B0DB54ED84AC03A4935BDA8DF86D5E914690E0434FD1ED9D4A7
49983E4210BAD18FBCF2F9EF85D716BD50A073D6D9C8513645EF00A652BE02E0C9BD5DB5D4D2710DD
6D40D50F1720394DFD9901D3AD3CD02574E6A11EAFD8BC77B1B726B65DA5214782F78517364A423D8
B2BD6A675649A9C4BE3614FEF27D5793301DA49A62EC57AD05D93E4B0D7F71B9CC34B1299CF6B321A
3D9EDF77DD8A9DBC0328626F52F2A939B02450ECB90B0170F614817FBFE4715A37F3E960293023056
B79A0AADFB88DCF974F7A4864633172366EC20497DAF5D2C06886C66954482BC69CEA01FA810506E6
BCCCB28046EF6771A3D0660835E4AEA00B660183C79D8833873136A7F82C70BD120939CA000833E84
3CDE9E9265BFD1B315AC85594D4C7F46BFE3ADBEC4B124C82DE05866A49F6DE35293E7A5FD359A1B5
3E1A230928949EA4AE48D18620F52A5986D4D1640C5BF294AE1A1A604393FE506E0E77CBDD13B3393
3DB3B18877746FE8C5F760597EB1FAD35CB7F676E9FD76A561CF6867FB76DCF96A4D268795AA63084
9D4ED9AEA87B102E718E9F87CDAE28E6ED9964DEE5F5CC53B898258A658F2C22FE65A53BCC55C4CBF
B54855391EF502668A9BCE291E599E551EC813FDA9414E7EB0B3773CB73A8F70874DF57B51AD237CE
980713C9E2F92AD436F75800A27BF14BF7C9B436BC2885B07A86B3443BC7A360343DD4C11EC1291B5
E0622AABB111219EABFB43329F5C3833FEE869888A75EE655362946957F39F367ADE078220212A612
EF7BDA12C920F1168C7B0F6B0E2562496ED6060E3F04E098F16BBC86932889BE0114B16FB953E23F0
02B62B7D79EE5866179171C02662766354FB7AB36A686718EF96ACD4B576F719383D04F4CE0F1D0F1
59E5DCA16794CB20C15D9DCD4CA64"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1044)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1108)
c:\windows\system32\relog_ap.dll
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
c:\windows\system32\VetRedir.dll
c:\windows\system32\ISafeIf.dll

- - - - - - - > 'explorer.exe'(3104)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
c:\windows\system32\oodag.exe
c:\program files\Softex\OmniPass\omniServ.exe
c:\program files\M-Audio Sonica Theater\Install\STInst.exe
c:\progra~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\program files\Logitech\SetPoint\KHALMNPR.exe
c:\program files\CA\CA Internet Security Suite\ccprovsp.exe
.
**************************************************************************
.
Completion time: 2009-07-13 11:22 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-13 17:22
ComboFix2.txt 2009-07-08 16:07
ComboFix3.txt 2009-06-25 14:30

Pre-Run: 26,008,997,888 bytes free
Post-Run: 26,012,532,736 bytes free

356 — E O F — 2009-06-12 00:02

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:23:59 AM, on 7/13/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\M-Audio Sonica Theater\Install\STinst.exe
C:\PROGRA~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\M-Audio Sonica Theater\STTask.exe
C:\Program Files\SqueezeCenter\SqueezeTray.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: OToolbarHelper Class - {EAD3A971-6A23-4246-8691-C9244E858967} - C:\Program Files\PayPal\PayPal Plug-In\PayPalHelper.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &Save; Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O3 - Toolbar: PayPal Plug-In - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - C:\Program Files\PayPal\PayPal Plug-In\OToolbar.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LtcyCfgApply] "C:\Program Files\Ltcycfg2\LtcyCfg.exe" /a
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: M-Audio Sonica Theater Control Panel Launcher.lnk = C:\Program Files\M-Audio Sonica Theater\STTask.exe
O4 - Global Startup: SqueezeCenter Tray Tool.lnk = C:\Program Files\SqueezeCenter\SqueezeTray.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} (NewUpgradeFinder Control) - http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1123110157281
O16 - DPF: {6DD4EA80-8981-40FB-B2FC-06B8EDC632B8} (PrintControl.PrinterControl) - http://www.2for1.com/downloads/PrintControl.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1213284287968
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/telepo…ty4LotTeleX.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} (Java Plug-in 1.5.0_08) -
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Plug-in 1.5.0_09) -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} - http://fdl.msn.com/public/investor/v13/ticker.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Google Update Service (gupdate1c99eaec907864) (gupdate1c99eaec907864) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Just Flight Limited License Service - Just Flight Limited - C:\Program Files\Common Files\Just Flight Limited Shared\Service\JustFlightLimitedLicSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: O&O; Defrag - O&O; Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Sonica Theater Installer (SonicaTheaterInstallerService) - Nemesis - C:\Program Files\M-Audio Sonica Theater\Install\STinst.exe
O23 - Service: SqueezeMySQL - Unknown owner - C:\PROGRA~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: WnsService - Unknown owner - G:\+OldMachine\Bootdrive\cgi-bin\WnsService.exe (file missing)

–
End of file - 13138 bytes

emeraldnzl

Post #13July 13, 2009, 10:47 PM UTC

Hello again blindlemon,

You have used Malwarebytes before. If you still have it on your machine please update and run. Post the scan report back here.

If you no-longer have Malwarebytes please download from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next

Kaspersky on line scanner is very thorough. It can take a long time and for periods may seem not to be working. Just be patient and let it do its job.

Kaspersky works with Internet Explorer and Firefox 3.

Go to Kaspersky website and perform an online antivirus scan.

Note: you will need to turn off your security programs to allow Kaspersky to do its job.

Read through the requirements and privacy statement and click on Accept button.
It will start dowanloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

Copy and paste that information in your next post.

So when you return please post
MBAM report
Kaspersky scan results
and tell me how your machine is working now

blindlemon

Post #14July 14, 2009, 8:33 PM UTC

Here's the log files you requested. My computer itself runs pretty good, but a couple of things recently have me concerned since we've started cleaning. My stopzilla has come back recently finding a "catchme" virus or trojan. I did clean it via stopzilla but it did come back. Also, on the 12th a site that I built for a client was hacked thru my ftp client I assume. Now maybe they got the username and password back when I first discovered this and just now attacked the home page( I have since gotten new passwords to all the site I ftp and only upload on a mac). The Kaspersky did find two "backdoor" items as you see. Thanks again for all your help. Blind Lemon Malwarebytes' Anti-Malware 1.38 Database version: 2393 Windows 5.1.2600 Service Pack 2 7/14/2009 2:31:33 PM mbam-log-2009-07-14 (14-31-33).txt Scan type: Quick Scan Objects scanned: 103666 Time elapsed: 7 minute(s), 50 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Tuesday, July 14, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Tuesday, July 14, 2009 15:54:48 Records in database: 2467969 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ I:\ M:\ O:\ P:\ Q:\ R:\ X:\ Y:\ Z:\ Scan statistics: Files scanned: 601586 Threat name: 2 Infected objects: 3 Suspicious objects: 0 Duration of the scan: 05:53:54 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\ac0a2fff5a08b1b35bb6f5c125c07e76.szcpf.vir Infected: Backdoor.Win32.NewRest.ao 1 C:\Temp\dougstuff\archive backup.pst Infected: Virus.MSWord.Ethan 1 C:\_OTL\MovedFiles\06242009_200150\WINDOWS\System32\drivers\71f4af93.sys Infected: Backdoor.Win32.NewRest.ao 1 The scan was stopped by the user. I did stop the scan when it started looking into my extra drives. Only music and pics there.

blindlemon

Post #15July 14, 2009, 8:38 PM UTC

One more thing I caught is the two "backdoor" virus that kaspersky listed have the same date as the hacked web site files that started this. Thanks Blind Lemon

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

possible hack thru ftp

✨ Ask AI

Ask AI