Spyware / Malware / Virus Removal

[Resolved] what happened? (failtechie)

51 min read

Looking for the outcome? Ask AI

jun23

Post #46July 23, 2009, 1:46 PM UTC

Hi, I'm not sure what Comodo is. Sorry. The Netgear router has blocked everything (even Google O.o) On the blocked page it says Website blocked by Netgear firewall. The firewall has blocked websites in IE and Firefox. I've tried typing the router's address into the web browser and in the prompt I've tried the username "admin" and the password "admin". I've also tried using "password" as the password but that didnt work either.

oldman960

Post #47July 23, 2009, 1:57 PM UTC

HI Jun23, Comodo is the firewall installed on the infected computer, but that's not the problem. Is it possible to bypass the router and connect the computer to the outlet that the router is connected to? Or is the NetGear a router and modem? If you can post the model # of the NetGear router, I may be able to give you some reset instructions. Thanks

jun23

Post #48July 25, 2009, 1:20 PM UTC

Hi, Thanks for the help, my brother fixed the netgear firewall thing.

Here is the DDS.txt

Attachments:

📎DDS.txt

oldman960

Post #49July 25, 2009, 4:35 PM UTC

Hi Jun23,

Good, was it just a reset?

Did you by chance use System Restore?

The log didn't come out right.

On the infected computer

Click your start button, click Run
In the run box, type these two lines, one at a time, hitting enter after each one
regsvr32 jscript.dll
regsvr32 vbscript.dll

please note there is a space after the reserv32
You should get a message as to whether or not it was successful. Let us know.

Rerun DDS and post both logs. Please use copy and paste.

Thanks

jun23

Post #50July 27, 2009, 2:46 PM UTC

Hi, I'm not sure how he fixed it. I think it was a reset. Both lines regsvr32 jscript.dll and regsvr32 vbscript.dll were successful Here is the DDS.txt DDS (Ver_09-05-14.01) - NTFSx86 Run by [removed] at 15:36:45.00 on 27/07/2009 Internet Explorer: 6.0.2900.2180 ============== Pseudo HJT Report =============== uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q105&bd=pavilion&pf=desktop uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=Q105&bd=pavilion&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=Q105&bd=pavilion&pf=desktop BHO: {001B00AE-7860-4251-AB09-F5084B6016EC} - No File BHO: {051C4D78-98FA-4B6D-ADF3-79904CC8B7AF} - No File BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: {09EABA3C-397E-4F2C-8840-5AD3D8BDDFDB} - No File BHO: {0C8A0741-B54F-4CFA-85F8-494662FE8E41} - No File BHO: {0EDF10DE-12F8-44B7-83F4-E2AFEEDC0183} - No File BHO: {1CE272AD-E408-451E-A08B-B0048D907B33} - No File BHO: {1E1949F7-B16A-47EA-85B2-A89939417F61} - No File BHO: {1EF042BE-1F1F-44AC-B301-E6E794691394} - No File BHO: {1F0DB968-B499-4C0F-84A7-A5D30660E822} - No File BHO: {216187C0-423C-4123-908E-7246D86886A0} - No File BHO: {216D8D75-DEE0-499F-8F87-DDE12FE03DF8} - No File BHO: {27BD3C51-BC2E-49E0-9C6B-F0D0D010CE80} - No File BHO: {2FC7A6B7-EFAA-4AFC-989D-02310398F83A} - No File BHO: {303B270C-AA0A-4DE6-91A7-FD452C9631DC} - No File BHO: {3081BC85-2BB3-4238-BB8E-0D5F930892C3} - No File BHO: {33A4125A-0E9E-4959-B46E-A34689E8DD73} - No File BHO: {340DA371-C36E-4C98-85B4-3A29C3A5A0F9} - No File BHO: {350A958B-8897-4FA6-BA8E-C0202CD3F30E} - No File BHO: {35A71AF0-50BA-4074-93E6-6F097384689F} - No File BHO: {36B0CE3B-2389-48E4-92E4-00ED8579DC74} - No File BHO: {3B31C0ED-586A-408E-9CF3-D12DCD23376E} - No File BHO: {40167E6E-9DF0-423B-9094-9578D043C432} - No File BHO: {444B7843-A646-4525-A5E7-6F4CD7CE0628} - No File BHO: {46AAF4BD-32DD-4E49-91B8-33B70119D9AC} - No File BHO: {46CB60B7-610C-4A58-9E1A-32B16F37B211} - No File BHO: {511512CB-CFAC-49E0-BD1D-F5DF656A1C8A} - No File BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: {538DF27D-F49D-40B1-9644-A696C2071B78} - No File BHO: {5817FDBD-3462-4B7B-9E8A-7842189010BE} - No File BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: {633808CA-C1BE-4EA7-9279-1C8282BF07FF} - No File BHO: {67520427-1A9C-44CE-A679-BAC8122D8746} - No File BHO: {690E9E38-8FDB-48C7-8CD1-534E73F2666B} - No File BHO: {69432058-704F-4E6E-B1A4-493C1F3723F3} - No File BHO: {6EF9FD7C-C8B9-4F63-9271-26015961B294} - No File BHO: {74ED29C2-3B04-491F-B00E-3B1383159E91} - No File BHO: {75E0D66C-5620-4BCF-9962-AA78188164EC} - No File BHO: {765402F7-A14D-4279-88A8-EE51096F18D3} - No File BHO: {7A1F6839-AA47-4EF9-A879-E83E6AABB99A} - No File BHO: {7A4C7266-E6EF-4361-8A86-696BD89C7239} - No File BHO: {81125015-08af-4a04-9512-f21ec33a1f93} - No File BHO: {841FDACB-8EC2-4512-A9A7-51E090448A11} - No File BHO: {882F2FE5-61B3-4765-845A-485582732E33} - No File BHO: {887A2277-9875-4300-90B0-E56D56791EC3} - No File BHO: {8EDC0272-3960-41BC-91BF-1E3B32615FF0} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: {90BE6A4A-895D-46D4-9051-6EE6465390DC} - No File BHO: {9731BF4D-69EA-46F8-9F1E-8AAEA2EDB36E} - No File BHO: {979C9B28-D9DD-45D2-A910-642990B3DACD} - No File BHO: {9C2F459E-AA22-4CD2-B56D-E3D8878117A5} - No File BHO: {9DA61E8E-66C6-4576-8B9D-DCB3EAAF13C2} - No File BHO: {A0584506-0BC5-4623-8702-83E1EB3934D9} - No File BHO: {A0A17DFB-BD47-4618-B187-1A0E1B799EA9} - No File BHO: {A19120DB-8D7D-4BF2-A126-6C58DEEB04AD} - No File BHO: {A230C57E-46FE-4278-88DC-FFC3F296F16C} - No File BHO: {A3081139-B6D2-4DF3-B460-7DC729729457} - No File BHO: {A377CB11-8F15-4DAE-BB3E-ABBD65B1002D} - No File BHO: {A5C775ED-DFA0-417F-A84D-1850A3484F9E} - No File BHO: {A7788911-F6E2-42A1-BEEC-739001DDC8FD} - No File BHO: {A9F1B5BD-99CB-4280-AD15-F59808DE8FAF} - No File BHO: {AC10C684-C169-469F-8F8E-D057CD5FD0B9} - No File BHO: {AF912E8A-CA9E-4A9F-AA86-190C6AE9CFDE} - No File BHO: {B1387124-3580-4FC6-B866-3090489DEE59} - No File BHO: {B23E8909-C3F4-43F7-833A-9403598D6066} - No File BHO: {B309E0DF-A0FB-4391-8DD4-AF1F901AB0C3} - No File BHO: {B324C745-5811-40DF-962D-4BBCE6031155} - No File BHO: {B4672FFB-E4C6-40E2-9013-F8EDAB6F3B89} - No File BHO: {B4AA5C1C-31B4-472C-8B69-1415FC0F9AA4} - No File BHO: {B7F1CA51-A658-4824-8034-538C96E86BE8} - No File BHO: {BB4531ED-E666-4F13-B0D1-BFFAB935B300} - No File BHO: {C85B854A-A280-4B4C-8D36-2D8E3B83F591} - No File BHO: {CF2038DD-3204-4FD1-9AD1-C2B532E42779} - No File BHO: {D1AAECDA-9484-4226-B7E3-B2D718B3D076} - No File BHO: {D32943BD-A447-45DC-9F0A-27FF4E826B30} - No File BHO: {D701BC89-4050-49FC-A78B-933E976411BC} - No File BHO: {D9C33BF9-5318-4B94-9DBC-B6F1F3BB585E} - No File BHO: {DAB439E3-70F7-492A-9E1A-D3612E066DB5} - No File BHO: {DB135C85-892F-44FF-B5BC-25F3CE421C85} - No File BHO: {DBD21D7E-DCD3-477B-B6A7-06123403BC48} - No File BHO: {DDAF548A-4E81-4FF6-A5C7-BF5CA6721465} - No File BHO: {DFA0C81E-4192-4B00-8541-01D024C20998} - No File BHO: {E0E5477E-5B2E-4566-A967-52A27FF39768} - No File BHO: {E21D36C8-AC9B-4A98-8084-8E71BB61B123} - No File BHO: {E5DC1D5C-BC91-459A-85B3-97F481B05B5A} - No File BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll BHO: {EAFAFB62-C6FF-4B95-A0C0-756A17327F48} - No File BHO: {F1A449AC-5AC7-4B4D-BD32-DCCB6BE57F89} - No File BHO: {FF715C15-D67C-4CC2-A66D-69426256129F} - No File TB: HP view: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hp\digital imaging\bin\HPDTLK02.dll TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRunOnce: [SpybotDeletingB2047] command /c del "c:\windows\system32\KRsrAJlm.ini" mRun: [SunJavaUpdateSched] c:\program files\java\j2re1.4.2_03\bin\jusched.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER mRun: [PS2] c:\windows\system32\ps2.exe mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [HPHUPD06] c:\program files\hp\{aac4fc36-8f89-4587-8dd3-ebc57c83374d}\hphupd06.exe mRun: [HostManager] c:\program files\common files\aol\1229762181\ee\AOLSoftware.exe mRun: [COMODO Firewall Pro] "c:\program files\comodo\firewall\cfp.exe" -h mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe mRun: [AlcWzrd] ALCWZRD.EXE mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [a0fa9d1c] rundll32.exe "c:\windows\system32\smooroaa.dll",b mRunOnce: [SpybotSnD] "c:\program files\spybot - search & destroy\SpybotSD.exe" /autocheck mRunOnce: [Spybot - Search & Destroy] "c:\program files\spybot - search & destroy\SpybotSD.exe" /autocheck IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C} IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\hp_owner\applic~1\mozilla\firefox\profiles\17ibpqgm.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.explosm.net/comics FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava11.dll FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava12.dll FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava13.dll FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava14.dll FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava32.dll FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJPI142_03.dll FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPOJI610.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll ============= SERVICES / DRIVERS =============== =============== Created Last 30 ================ ==================== Find3M ==================== 2009-06-08 08:10 155,136 a——- c:\windows\PEV.exe ============= FINISH: 15:37:36.98 =============== Here is the Attach log from DDS ==== Installed Programs ====================== ABC (remove only) Adobe Acrobat - Reader 6.0.2 Update Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 6.0.1 Agere Systems PCI Soft Modem AiO_Scan AiOSoftware AOL Coach Version 1.0(Build:20040229.1 uk) AOL Uninstaller ATI Control Panel ATI Display Driver BufferChm CameraDrivers CCleaner (remove only) Choice Guard Combined Community Codec Pack 2008-09-21 16:18 COMODO Firewall Pro Copy CreativeProjects CreativeProjectsTemplates CueTour Dawn Of War Dawn of War - Dark Crusade Dawn of War - Soulstorm Dawn Of War - Winter Assault Destinations DG834 Director DocProc DocumentViewer Easy Internet Sign-up EPSON CardMonitor EPSON Copy Utility 3 EPSON PhotoQuicker3.5 EPSON PhotoStarter3.1 EPSON PRINT Image Framer Tool2.1 EPSON Printer Software EPSON Scan EPSON Smart Panel EPSON Web-To-Page ESCX6600 Reference Guide ESCX6600 Software Guide Fax Help and Support Additions High Definition Audio Driver Package - KB835221 HijackThis 2.0.2 Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB942288-v3) HP Deskjet Preloaded Printer Drivers HP Diagnostic Assistant HP Image Zone 4.2.3 HP Image Zone Plus 4.2.3 HP Photosmart Cameras 4.0 HP PSC & OfficeJet 4.0 HP Software Update HPIZ423 HpSdpAppCoreApp InstantShare InterVideo DiscLabel Java 2 Runtime Environment, SE v1.4.2_03 KBD Learn2 Player (Uninstall Only) Microsoft .NET Framework 1.1 Microsoft Application Error Reporting Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Visio MUI (English) 2007 Microsoft Office Visio Professional 2007 Microsoft Office Word MUI (English) 2007 Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.5 Microsoft WinUsb 1.0 Mozilla Firefox (3.0.12) MP3 Player Utilities 4.17 MSVCRT PC-Doctor for Windows PhotoGallery Photosmart 320,370,7400,8100,8400 Series PIF DESIGNER2.1 PrintScreen PS2 PSPrinters06 Python 2.2 combined Win32 extensions Python 2.2.1 QFolder QuickProjects QuickTime Readme RealPlayer Basic RemoveIT Pro v4 - SE Scan ScanToWeb Segoe UI SiS VGA Utilities SkinsHP1 Skype™ 3.8 Spybot - Search & Destroy TrayApp Unload VC 9.0 Runtime Viewpoint Media Player WebFldrs XP WebReg Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Messenger Windows Live Sign-in Assistant Windows Live Upload Tool Windows Media Format 11 runtime Windows Media Player 11 Windows Movie Maker 2.0 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB885295 WinRAR WinRAR archiver Xvid 1.1.3 final uninstall ==== End Of File ===========================

oldman960

Post #51July 28, 2009, 1:51 AM UTC

Hi Jun23,

There is something very odd about this. Everything we remove, ie the orphaned registry entries, are back. Which is why asked about System Restore.

Since combofix doesn't seem to agreeing with this computer, we'll go about it differently.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

Click the Scan button and let the program do its work. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.

[*]Save it where you can easily find it, such as your desktop

Download OTListIt2 to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
In the Services section, change it to All
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with

Gmer log
both OTL logs

Thanks

jun23

Post #52July 30, 2009, 3:31 PM UTC

Hi,

Here is the gmer log

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-30 12:23:02
Windows 5.1.2600 Service Pack 2

—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0xEF01DC8C]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwConnectPort [0xEF01D3C4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreatePort [0xEF01D080]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0xEF01DE72]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreateThread [0xEF01CC50]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwDeleteKey [0xEF01E0B8]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwDeleteValueKey [0xEF01E268]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwDuplicateObject [0xEF01CB02]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwOpenProcess [0xEF01C822]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwOpenThread [0xEF01C9AA]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwRenameKey [0xEF01E7F2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0xEF01D196]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwSecureConnectPort [0xEF01EAE6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwSetSystemInformation [0xEF01EEC4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwSetValueKey [0xEF01E602]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwShutdownSystem [0xEF01D5D2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwSystemDebugControl [0xEF01D638]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwTerminateProcess [0xEF01CF4A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwTerminateThread [0xEF01CE18]

Code F8646F92 ZwCreateDirectoryObject
Code F8646D47 ZwCreateFile
Code F86470E2 ZwCreateKey
Code F864724A ZwCreateSection
Code F8647D62 ZwEnumerateKey
Code F86479FB ZwEnumerateValueKey
Code F86485D5 ZwLoadDriver
Code F864703A ZwOpenDirectoryObject
Code F8646ED8 ZwOpenFile
Code F86471A2 ZwOpenKey
Code F864730A ZwOpenSection
Code F86473B2 ZwOpenSymbolicLinkObject
Code F86486B8 ZwQueryDirectoryFile
Code F8647680 ZwQueryDirectoryObject
Code F8648091 ZwQueryValueKey
Code F8646E12 IoCreateFile
Code F8646E88 IoCreateStreamFileObject
Code F8646D46 NtCreateFile
Code F8647249 NtCreateSection
Code F8646ED7 NtOpenFile
Code F86486B7 NtQueryDirectoryFile
Code F8646FE4 ZwCreateDirectoryObject
Code F8646DA5 ZwCreateFile
Code F8647140 ZwCreateKey
Code F86472A8 ZwCreateSection
Code F8647EF6 ZwEnumerateKey
Code F8647BA9 ZwEnumerateValueKey
Code F8648643 ZwLoadDriver
Code F864708C ZwOpenDirectoryObject
Code F8646F33 ZwOpenFile
Code F86471F4 ZwOpenKey
Code F864735C ZwOpenSection
Code F8647404 ZwOpenSymbolicLinkObject
Code F8648764 ZwQueryDirectoryFile
Code F864783A ZwQueryDirectoryObject
Code F8648212 ZwQueryValueKey

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCreateDirectoryObject 804FF348 5 Bytes JMP F8646FE9
.text ntkrnlpa.exe!ZwCreateFile 804FF384 5 Bytes JMP F8646DAA
.text ntkrnlpa.exe!ZwCreateKey 804FF3D4 5 Bytes JMP F8647145
.text ntkrnlpa.exe!ZwCreateSection 804FF488 5 Bytes JMP F86472AD
.text ntkrnlpa.exe!ZwEnumerateKey 804FF62C 5 Bytes JMP F8647EFB
.text ntkrnlpa.exe!ZwEnumerateValueKey 804FF654 5 Bytes JMP F8647BAE
.text ntkrnlpa.exe!ZwLoadDriver 804FF834 5 Bytes JMP F8648648
.text ntkrnlpa.exe!ZwOpenDirectoryObject 804FF974 5 Bytes JMP F8647091
.text ntkrnlpa.exe!ZwOpenFile 804FF9B0 5 Bytes JMP F8646F38
.text ntkrnlpa.exe!ZwOpenKey 804FF9EC 5 Bytes JMP F86471F9
.text ntkrnlpa.exe!ZwOpenSection 804FFA64 5 Bytes JMP F8647361
.text ntkrnlpa.exe!ZwOpenSymbolicLinkObject 804FFA8C 5 Bytes JMP F8647409
.text ntkrnlpa.exe!ZwQueryDirectoryFile 804FFBF4 5 Bytes JMP F8648769
.text ntkrnlpa.exe!ZwQueryDirectoryObject 804FFC08 5 Bytes JMP F864783F
.text ntkrnlpa.exe!ZwQueryValueKey 804FFE74 5 Bytes JMP F8648217
.text ntkrnlpa.exe!ZwCallbackReturn + 2E7C 80503A7C 4 Bytes JMP 481EEF01
PAGE ntkrnlpa.exe!IoCreateStreamFileObject 80574FA0 5 Bytes JMP F8646E8D
PAGE ntkrnlpa.exe!IoCreateFile 80575736 5 Bytes JMP F8646E17
PAGE ntkrnlpa.exe!NtCreateFile 80577E5E 5 Bytes JMP F8646D4B
PAGE ntkrnlpa.exe!NtQueryDirectoryFile 80578C3E 5 Bytes JMP F86486BC
PAGE ntkrnlpa.exe!NtOpenFile 80578F5C 5 Bytes JMP F8646EDC
PAGE ntkrnlpa.exe!ZwLoadDriver 80582DFE 7 Bytes JMP F86485D9
PAGE ntkrnlpa.exe!ZwOpenSection 805A8E12 7 Bytes JMP F864730E
PAGE ntkrnlpa.exe!NtCreateSection 805A9DEE 7 Bytes JMP F864724E
PAGE ntkrnlpa.exe!ZwCreateDirectoryObject 805BCD68 7 Bytes JMP F8646F96
PAGE ntkrnlpa.exe!ZwOpenDirectoryObject 805BCE3A 7 Bytes JMP F864703E
PAGE ntkrnlpa.exe!ZwQueryDirectoryObject 805BCEDA 7 Bytes JMP F8647684
PAGE ntkrnlpa.exe!ZwOpenSymbolicLinkObject 805C37C6 7 Bytes JMP F86473B6
PAGE ntkrnlpa.exe!ZwQueryValueKey 80620102 7 Bytes JMP F8648095
PAGE ntkrnlpa.exe!ZwCreateKey 80622048 5 Bytes JMP F86470E6
PAGE ntkrnlpa.exe!ZwCreateKey + 7 8062204F 1 Byte [99]
PAGE ntkrnlpa.exe!ZwEnumerateKey 80622888 7 Bytes JMP F8647D66
PAGE ntkrnlpa.exe!ZwEnumerateValueKey 80622AF2 7 Bytes JMP F86479FF
PAGE ntkrnlpa.exe!ZwOpenKey 806233DE 5 Bytes JMP F86471A6
PAGE ntkrnlpa.exe!ZwOpenKey + 7 806233E5 1 Byte [9A]
.text fltMgr.sys!FltReadFile F8453C2A 5 Bytes JMP F8648572
PAGE fltMgr.sys!FltCreateFile F8460B32 5 Bytes JMP F86484FC
PAGE fltMgr.sys!FltQueryInformationFile F84612B8 5 Bytes JMP F864849E

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F8375710] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F8375770] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] [F8375990] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F8375950] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F8375950] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F8375770] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F8375710] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [F8375990] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [F8375990] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F8375950] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F8375770] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F8375710] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F8375950] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F8375710] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F8375770] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [F8375990] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F8375710] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F8375950] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F8375770] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip6.sys[NDIS.SYS!NdisRegisterProtocol] [F8375950] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip6.sys[NDIS.SYS!NdisDeregisterProtocol] [F8375990] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip6.sys[NDIS.SYS!NdisCloseAdapter] [F8375710] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\tcpip6.sys[NDIS.SYS!NdisOpenAdapter] [F8375770] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [F8375990] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F8375950] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F8375770] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F8375710] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisCloseAdapter] [F8375710] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisOpenAdapter] [F8375770] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisDeregisterProtocol] [F8375990] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisRegisterProtocol] [F8375950] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F8375950] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [F8375990] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F8375710] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F8375770] inspect.sys (COMODO Firewall Pro Firewall Driver/COMODO)

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetModuleHandleA] [005E2390] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [005E2350] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleA] [005E2390] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [005E22D0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [005E22D0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [GDI32.dll!DeleteObject] [005E1540] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleA] [005E2390] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [005E2310] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [005E2350] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [005E22D0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcA] [005E1920] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcW] [005E19B0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!GetSysColor] [005E14F0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!RegisterClassA] [005E1E50] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!RegisterClassW] [005E1F10] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!SystemParametersInfoW] [005E1FD0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CallWindowProcW] [005E17E0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CallWindowProcA] [005E1880] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [GDI32.dll!DeleteObject] [005E1540] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!AdjustWindowRectEx] [005E20B0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcA] [005E1920] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColor] [005E14F0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcW] [005E19B0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!RegisterClassW] [005E1F10] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColorBrush] [005E1580] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!FillRect] [005E21C0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DrawFrameControl] [005E2230] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DrawEdge] [005E2210] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!SystemParametersInfoW] [005E1FD0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetScrollInfo] [005E1770] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!CallWindowProcW] [005E17E0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!SetScrollInfo] [005E1660] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleA] [005E2390] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [005E22D0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [005E2350] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [005E2310] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [GDI32.dll!DeleteObject] [005E1540] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [005E22D0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [005E2350] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [005E2310] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!SystemParametersInfoW] [005E1FD0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetSysColor] [005E14F0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!CallWindowProcW] [005E17E0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!RegisterClassW] [005E1F10] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!DefWindowProcW] [005E19B0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [005E22D0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [005E2310] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [005E2350] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetModuleHandleA] [005E2390] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetModuleHandleA] [005E2390] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!CreateThread] [005E1DC0] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [005E2290] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\COMODO\Firewall\cfp.exe[644] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] [005E2420] C:\Program Files\COMODO\Firewall\cfp.exe
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLDial.exe[992] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\crypt32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\crypt32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\crypt32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\crypt32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\netapi32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\netapi32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\netapi32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\psapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[1288] @ C:\WINDOWS\system32\psapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys (COMODO Firewall Pro Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys (COMODO Firewall Pro Helper Driver/COMODO)

Device \Driver\pggrkatg \Device\SAMPLEDEV35 F8646416

AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys (COMODO Firewall Pro Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys (COMODO Firewall Pro Helper Driver/COMODO)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Modules - GMER 1.0.15 —-

Module rrwpczyg.sys (*** hidden *** ) F8645000-F864E000 (36864 bytes)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\ControlSet001\Control\Lsa@Authentication Packages %I?
Reg HKLM\SYSTEM\ControlSet002\Control\Lsa@Authentication Packages %I?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Lsa@Authentication Packages %I?

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\drivers\rrwpczyg.sys 25088 bytes executable <– ROOTKIT !!!
File C:\WINDOWS\system32\mlJArsRK.dll.vir 297472 bytes executable
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001 0 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT 237568 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002 0 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat 8192 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003 0 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT 7745536 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004 0 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat 45056 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005 0 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT 237568 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006 0 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat 8192 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007 0 bytes
File C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007\NTUSER.DAT 12288 bytes

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\rrwpczyg.sys [BOOT] pggrkatg <– ROOTKIT !!!

—- EOF - GMER 1.0.15 —-

Here is the OTL.Txt

OTL logfile created on: 30/07/2009 16:21:04 - Run 1
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\HP_Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

511.29 Mb Total Physical Memory | 201.16 Mb Available Physical Memory | 39.34% Memory free
1.22 Gb Paging File | 0.96 Gb Available in Paging File | 78.73% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 181.71 Gb Total Space | 130.39 Gb Free Space | 71.76% Space Free | Partition Type: NTFS
Drive D: | 4.58 Gb Total Space | 0.96 Gb Free Space | 20.93% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-A52C34C618
Current User Name: HP_Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
PRC - C:\Program Files\COMODO\Firewall\cmdagent.exe ()
PRC - C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe ()
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
PRC - C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\Program Files\COMODO\Firewall\cfp.exe ()
PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (AOL LLC)
PRC - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\AOL Companion\companion.exe ()
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
PRC - C:\Documents and Settings\HP_Owner\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (All) ==========

SRV - (6to4 [Auto | Stopped]) – C:\WINDOWS\System32\6to4svc.dll (Microsoft Corporation)
SRV - (Alerter [Disabled | Stopped]) – C:\WINDOWS\System32\alrsvc.dll (Microsoft Corporation)
SRV - (ALG [On_Demand | Stopped]) – C:\WINDOWS\System32\alg.exe (Microsoft Corporation)
SRV - (AOL ACS [Auto | Running]) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (AppMgmt [On_Demand | Stopped]) – C:\WINDOWS\System32\svchost.exe (Microsoft Corporation)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Running]) – C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (AudioSrv [Auto | Stopped]) – C:\WINDOWS\System32\audiosrv.dll (Microsoft Corporation)
SRV - (BITS [Auto | Stopped]) – C:\WINDOWS\System32\qmgr.dll (Microsoft Corporation)
SRV - (Browser [Auto | Stopped]) – C:\WINDOWS\System32\browser.dll (Microsoft Corporation)
SRV - (CiSvc [On_Demand | Stopped]) – C:\WINDOWS\System32\cisvc.exe (Microsoft Corporation)
SRV - (ClipSrv [Disabled | Stopped]) – C:\WINDOWS\System32\clipsrv.exe (Microsoft Corporation)
SRV - (cmdAgent [Auto | Running]) – C:\Program Files\COMODO\Firewall\cmdagent.exe ()
SRV - (COMSysApp [On_Demand | Stopped]) – C:\WINDOWS\System32\dllhost.exe (Microsoft Corporation)
SRV - (CryptSvc [Auto | Stopped]) – C:\WINDOWS\System32\cryptsvc.dll (Microsoft Corporation)
SRV - (DcomLaunch [Auto | Start_Pending]) – C:\WINDOWS\System32\rpcss.dll (Microsoft Corporation)
SRV - (Dhcp [Auto | Running]) – C:\WINDOWS\System32\dhcpcsvc.dll (Microsoft Corporation)
SRV - (dmadmin [On_Demand | Stopped]) – C:\WINDOWS\System32\dmadmin.exe (Microsoft Corp., Veritas Software)
SRV - (dmserver [On_Demand | Stopped]) – C:\WINDOWS\System32\dmserver.dll (Microsoft Corp.)
SRV - (Dnscache [Auto | Stopped]) – C:\WINDOWS\System32\dnsrslvr.dll (Microsoft Corporation)
SRV - (ERSvc [Auto | Stopped]) – C:\WINDOWS\System32\ersvc.dll (Microsoft Corporation)
SRV - (Eventlog [Auto | Running]) – C:\WINDOWS\System32\services.exe (Microsoft Corporation)
SRV - (EventSystem [On_Demand | Stopped]) – C:\WINDOWS\System32\es.dll (Microsoft Corporation)
SRV - (FastUserSwitchingCompatibility [On_Demand | Stopped]) – C:\WINDOWS\System32\shsvcs.dll (Microsoft Corporation)
SRV - (helpsvc [Auto | Stopped]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (HidServ [Auto | Stopped]) – C:\WINDOWS\System32\hidserv.dll (Microsoft Corporation)
SRV - (HTTPFilter [On_Demand | Stopped]) – C:\WINDOWS\System32\w3ssl.dll (Microsoft Corporation)
SRV - (ImapiService [On_Demand | Stopped]) – C:\WINDOWS\System32\imapi.exe (Microsoft Corporation)
SRV - (lanmanserver [Auto | Running]) – C:\WINDOWS\System32\srvsvc.dll (Microsoft Corporation)
SRV - (lanmanworkstation [Auto | Stopped]) – C:\WINDOWS\System32\wkssvc.dll (Microsoft Corporation)
SRV - (LmHosts [Auto | Stopped]) – C:\WINDOWS\System32\lmhsvc.dll (Microsoft Corporation)
SRV - (LPDSVC [On_Demand | Stopped]) – C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
SRV - (Messenger [Disabled | Stopped]) – C:\WINDOWS\System32\msgsvc.dll (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service [On_Demand | Stopped]) – C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (mnmsrvc [On_Demand | Stopped]) – C:\WINDOWS\System32\mnmsrvc.exe (Microsoft Corporation)
SRV - (MSDTC [On_Demand | Stopped]) – C:\WINDOWS\System32\msdtc.exe (Microsoft Corporation)
SRV - (MSIServer [On_Demand | Stopped]) – C:\WINDOWS\System32\msiexec.exe (Microsoft Corporation)
SRV - (NetDDE [Disabled | Stopped]) – C:\WINDOWS\System32\netdde.exe (Microsoft Corporation)
SRV - (NetDDEdsdm [Disabled | Stopped]) – C:\WINDOWS\System32\netdde.exe (Microsoft Corporation)
SRV - (Netlogon [On_Demand | Stopped]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (Netman [On_Demand | Stopped]) – C:\WINDOWS\System32\netman.dll (Microsoft Corporation)
SRV - (Nla [On_Demand | Stopped]) – C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
SRV - (NtLmSsp [On_Demand | Stopped]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (NtmsSvc [On_Demand | Stopped]) – C:\WINDOWS\System32\ntmssvc.dll (Microsoft Corporation)
SRV - (odserv [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (p2pgasvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2pgasvc.dll (Microsoft Corporation)
SRV - (p2pimsvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2psvc.dll (Microsoft Corporation)
SRV - (p2psvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2psvc.dll (Microsoft Corporation)
SRV - (PlugPlay [Auto | Running]) – C:\WINDOWS\System32\services.exe (Microsoft Corporation)
SRV - (PNRPSvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2psvc.dll (Microsoft Corporation)
SRV - (PolicyAgent [Auto | Stopped]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (ProtectedStorage [Auto | Stopped]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (RasAuto [On_Demand | Stopped]) – C:\WINDOWS\System32\rasauto.dll (Microsoft Corporation)
SRV - (RasMan [On_Demand | Stopped]) – C:\WINDOWS\System32\rasmans.dll (Microsoft Corporation)
SRV - (RDSessMgr [On_Demand | Stopped]) – C:\WINDOWS\System32\sessmgr.exe (Microsoft Corporation)
SRV - (RemoteAccess [Disabled | Stopped]) – C:\WINDOWS\System32\mprdim.dll (Microsoft Corporation)
SRV - (RpcLocator [On_Demand | Stopped]) – C:\WINDOWS\System32\locator.exe (Microsoft Corporation)
SRV - (RpcSs [Auto | Stopped]) – C:\WINDOWS\System32\rpcss.dll (Microsoft Corporation)
SRV - (RSVP [On_Demand | Stopped]) – C:\WINDOWS\System32\rsvp.exe (Microsoft Corporation)
SRV - (SamSs [Auto | Stopped]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (SCardSvr [On_Demand | Stopped]) – C:\WINDOWS\System32\SCardSvr.exe (Microsoft Corporation)
SRV - (Schedule [Auto | Stopped]) – C:\WINDOWS\System32\schedsvc.dll (Microsoft Corporation)
SRV - (seclogon [Auto | Start_Pending]) – C:\WINDOWS\System32\seclogon.dll (Microsoft Corporation)
SRV - (SENS [Auto | Stopped]) – C:\WINDOWS\System32\sens.dll (Microsoft Corporation)
SRV - (SharedAccess [Auto | Stopped]) – C:\WINDOWS\System32\ipnathlp.dll (Microsoft Corporation)
SRV - (ShellHWDetection [Auto | Stopped]) – C:\WINDOWS\System32\shsvcs.dll (Microsoft Corporation)
SRV - (SimpTcp [Auto | Running]) – C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
SRV - (Spooler [Auto | Stopped]) – C:\WINDOWS\System32\spoolsv.exe (Microsoft Corporation)
SRV - (srservice [Auto | Stopped]) – C:\WINDOWS\System32\srsvc.dll (Microsoft Corporation)
SRV - (SSDPSRV [On_Demand | Stopped]) – C:\WINDOWS\System32\ssdpsrv.dll (Microsoft Corporation)
SRV - (stisvc [Auto | Stopped]) – C:\WINDOWS\System32\wiaservc.dll (Microsoft Corporation)
SRV - (SwPrv [On_Demand | Stopped]) – C:\WINDOWS\System32\dllhost.exe (Microsoft Corporation)
SRV - (SysmonLog [On_Demand | Stopped]) – C:\WINDOWS\System32\smlogsvc.exe (Microsoft Corporation)
SRV - (TapiSrv [On_Demand | Stopped]) – C:\WINDOWS\System32\tapisrv.dll (Microsoft Corporation)
SRV - (TermService [On_Demand | Stopped]) – C:\WINDOWS\System32\termsrv.dll (Microsoft Corporation)
SRV - (Themes [Auto | Running]) – C:\WINDOWS\System32\shsvcs.dll (Microsoft Corporation)
SRV - (TrkWks [Auto | Stopped]) – C:\WINDOWS\System32\trkwks.dll (Microsoft Corporation)
SRV - (upnphost [On_Demand | Stopped]) – C:\WINDOWS\System32\upnphost.dll (Microsoft Corporation)
SRV - (UPS [On_Demand | Stopped]) – C:\WINDOWS\System32\ups.exe (Microsoft Corporation)
SRV - (VSS [On_Demand | Stopped]) – C:\WINDOWS\System32\vssvc.exe (Microsoft Corporation)
SRV - (W32Time [Auto | Running]) – C:\WINDOWS\System32\w32time.dll (Microsoft Corporation)
SRV - (WebClient [Auto | Stopped]) – C:\WINDOWS\System32\webclnt.dll (Microsoft Corporation)
SRV - (winmgmt [Auto | Stopped]) – C:\WINDOWS\System32\wbem\WMIsvc.dll (Microsoft Corporation)
SRV - (WmdmPmSN [On_Demand | Stopped]) – C:\WINDOWS\System32\MsPMSNSv.dll (Microsoft Corporation)
SRV - (WmiApSrv [On_Demand | Stopped]) – C:\WINDOWS\System32\wbem\wmiapsrv.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (wscsvc [Auto | Stopped]) – C:\WINDOWS\System32\wscsvc.dll (Microsoft Corporation)
SRV - (wuauserv [Auto | Stopped]) – C:\WINDOWS\System32\wuauserv.dll (Microsoft Corporation)
SRV - (WudfSvc [Auto | Running]) – C:\WINDOWS\System32\WUDFSvc.dll (Microsoft Corporation)
SRV - (WZCSVC [Auto | Stopped]) – C:\WINDOWS\System32\wzcsvc.dll (Microsoft Corporation)
SRV - (xmlprov [On_Demand | Stopped]) – C:\WINDOWS\System32\xmlprov.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AgereSoftModem [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\AGRSM.sys (Agere Systems)
DRV - (ASCTRM [Auto | Running]) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (ati2mtag [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Cap7134 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\Cap7134.sys (ASUSTek)
DRV - (cmdGuard [System | Running]) – C:\WINDOWS\System32\DRIVERS\cmdguard.sys (COMODO)
DRV - (cmdHlp [System | Running]) – C:\WINDOWS\System32\DRIVERS\cmdhlp.sys (COMODO)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (ialm [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (Inspect [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (IntcAzAudAddService [On_Demand | Running]) – C:\WINDOWS\System32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Iviaspi [On_Demand | Running]) – C:\WINDOWS\System32\drivers\iviaspi.sys (InterVideo, Inc.)
DRV - (pggrkatg [Boot | Stopped]) – C:\WINDOWS\system32\drivers\rrwpczyg.sys [FILE handle not seen by OS]
DRV - (PhTVTune [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\PhTVTune.sys (ASUSTek)
DRV - (Ps2 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (rtl8139 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation )
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys ()
DRV - (SiS315 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp [System | Running]) – C:\WINDOWS\System32\DRIVERS\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (Tcpip6 [System | Running]) – C:\WINDOWS\System32\DRIVERS\tcpip6.sys (Microsoft Corporation)
DRV - (viaagp1 [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (viagfx [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics Co, Ltd.)
DRV - (wanatw [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\wanatw4.sys (America Online, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=localhost:7070

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.explosm.net/comics"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:6.0
FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:3.1.20081127W
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.4.4
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.12
FF - prefs.js..network.proxy.http_port: 7070

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/30 10:58:54 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/07/25 16:54:21 | 00,000,000 | —D | M]

[2008/12/20 09:53:38 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Extensions
[2008/12/20 09:53:38 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/07/29 22:19:31 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions
[2009/01/20 16:35:54 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/01/27 21:42:31 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009/02/11 01:34:02 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\[removed]
[2009/04/04 19:40:17 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\[removed]
[2009/07/29 22:19:31 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/07/25 16:54:21 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/01/04 20:39:03 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
[2009/07/25 16:54:05 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/07/25 16:54:06 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/07/25 16:54:12 | 00,065,528 | —- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2006/10/26 21:12:16 | 00,016,192 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL
[2008/01/04 16:36:50 | 00,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2006/07/05 19:47:38 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/01/04 16:36:50 | 00,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2008/03/08 10:35:22 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/09/22 20:14:04 | 00,000,759 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2008/04/16 05:08:20 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/03/28 19:11:14 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/01/04 16:36:50 | 00,000,831 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (311525 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 10750 more lines…
O2 - BHO: (no name) - {001B00AE-7860-4251-AB09-F5084B6016EC} - No CLSID value found.
O2 - BHO: (no name) - {051C4D78-98FA-4B6D-ADF3-79904CC8B7AF} - No CLSID value found.
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {09EABA3C-397E-4F2C-8840-5AD3D8BDDFDB} - No CLSID value found.
O2 - BHO: (no name) - {0C8A0741-B54F-4CFA-85F8-494662FE8E41} - No CLSID value found.
O2 - BHO: (no name) - {0EDF10DE-12F8-44B7-83F4-E2AFEEDC0183} - No CLSID value found.
O2 - BHO: (no name) - {1CE272AD-E408-451E-A08B-B0048D907B33} - No CLSID value found.
O2 - BHO: (no name) - {1E1949F7-B16A-47EA-85B2-A89939417F61} - No CLSID value found.
O2 - BHO: (no name) - {1EF042BE-1F1F-44AC-B301-E6E794691394} - No CLSID value found.
O2 - BHO: (no name) - {1F0DB968-B499-4C0F-84A7-A5D30660E822} - No CLSID value found.
O2 - BHO: (no name) - {216187C0-423C-4123-908E-7246D86886A0} - No CLSID value found.
O2 - BHO: (no name) - {216D8D75-DEE0-499F-8F87-DDE12FE03DF8} - No CLSID value found.
O2 - BHO: (no name) - {27BD3C51-BC2E-49E0-9C6B-F0D0D010CE80} - No CLSID value found.
O2 - BHO: (no name) - {2FC7A6B7-EFAA-4AFC-989D-02310398F83A} - No CLSID value found.
O2 - BHO: (no name) - {303B270C-AA0A-4DE6-91A7-FD452C9631DC} - No CLSID value found.
O2 - BHO: (no name) - {3081BC85-2BB3-4238-BB8E-0D5F930892C3} - No CLSID value found.
O2 - BHO: (no name) - {33A4125A-0E9E-4959-B46E-A34689E8DD73} - No CLSID value found.
O2 - BHO: (no name) - {340DA371-C36E-4C98-85B4-3A29C3A5A0F9} - No CLSID value found.
O2 - BHO: (no name) - {350A958B-8897-4FA6-BA8E-C0202CD3F30E} - No CLSID value found.
O2 - BHO: (no name) - {35A71AF0-50BA-4074-93E6-6F097384689F} - No CLSID value found.
O2 - BHO: (no name) - {36B0CE3B-2389-48E4-92E4-00ED8579DC74} - No CLSID value found.
O2 - BHO: (no name) - {3B31C0ED-586A-408E-9CF3-D12DCD23376E} - No CLSID value found.
O2 - BHO: (no name) - {40167E6E-9DF0-423B-9094-9578D043C432} - No CLSID value found.
O2 - BHO: (no name) - {444B7843-A646-4525-A5E7-6F4CD7CE0628} - No CLSID value found.
O2 - BHO: (no name) - {46AAF4BD-32DD-4E49-91B8-33B70119D9AC} - No CLSID value found.
O2 - BHO: (no name) - {46CB60B7-610C-4A58-9E1A-32B16F37B211} - No CLSID value found.
O2 - BHO: (no name) - {511512CB-CFAC-49E0-BD1D-F5DF656A1C8A} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {538DF27D-F49D-40B1-9644-A696C2071B78} - No CLSID value found.
O2 - BHO: (no name) - {5817FDBD-3462-4B7B-9E8A-7842189010BE} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {633808CA-C1BE-4EA7-9279-1C8282BF07FF} - No CLSID value found.
O2 - BHO: (no name) - {67520427-1A9C-44CE-A679-BAC8122D8746} - No CLSID value found.
O2 - BHO: (no name) - {690E9E38-8FDB-48C7-8CD1-534E73F2666B} - No CLSID value found.
O2 - BHO: (no name) - {69432058-704F-4E6E-B1A4-493C1F3723F3} - No CLSID value found.
O2 - BHO: (no name) - {6EF9FD7C-C8B9-4F63-9271-26015961B294} - No CLSID value found.
O2 - BHO: (no name) - {74ED29C2-3B04-491F-B00E-3B1383159E91} - No CLSID value found.
O2 - BHO: (no name) - {75E0D66C-5620-4BCF-9962-AA78188164EC} - No CLSID value found.
O2 - BHO: (no name) - {765402F7-A14D-4279-88A8-EE51096F18D3} - No CLSID value found.
O2 - BHO: (no name) - {7A1F6839-AA47-4EF9-A879-E83E6AABB99A} - No CLSID value found.
O2 - BHO: (no name) - {7A4C7266-E6EF-4361-8A86-696BD89C7239} - No CLSID value found.
O2 - BHO: (no name) - {81125015-08af-4a04-9512-f21ec33a1f93} - No CLSID value found.
O2 - BHO: (no name) - {841FDACB-8EC2-4512-A9A7-51E090448A11} - No CLSID value found.
O2 - BHO: (no name) - {882F2FE5-61B3-4765-845A-485582732E33} - No CLSID value found.
O2 - BHO: (no name) - {887A2277-9875-4300-90B0-E56D56791EC3} - No CLSID value found.
O2 - BHO: (no name) - {8EDC0272-3960-41BC-91BF-1E3B32615FF0} - No CLSID value found.
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (no name) - {90BE6A4A-895D-46D4-9051-6EE6465390DC} - No CLSID value found.
O2 - BHO: (no name) - {9731BF4D-69EA-46F8-9F1E-8AAEA2EDB36E} - No CLSID value found.
O2 - BHO: (no name) - {979C9B28-D9DD-45D2-A910-642990B3DACD} - No CLSID value found.
O2 - BHO: (no name) - {9C2F459E-AA22-4CD2-B56D-E3D8878117A5} - No CLSID value found.
O2 - BHO: (no name) - {9DA61E8E-66C6-4576-8B9D-DCB3EAAF13C2} - No CLSID value found.
O2 - BHO: (no name) - {A0584506-0BC5-4623-8702-83E1EB3934D9} - No CLSID value found.
O2 - BHO: (no name) - {A0A17DFB-BD47-4618-B187-1A0E1B799EA9} - No CLSID value found.
O2 - BHO: (no name) - {A19120DB-8D7D-4BF2-A126-6C58DEEB04AD} - No CLSID value found.
O2 - BHO: (no name) - {A230C57E-46FE-4278-88DC-FFC3F296F16C} - No CLSID value found.
O2 - BHO: (no name) - {A3081139-B6D2-4DF3-B460-7DC729729457} - No CLSID value found.
O2 - BHO: (no name) - {A377CB11-8F15-4DAE-BB3E-ABBD65B1002D} - No CLSID value found.
O2 - BHO: (no name) - {A5C775ED-DFA0-417F-A84D-1850A3484F9E} - No CLSID value found.
O2 - BHO: (no name) - {A7788911-F6E2-42A1-BEEC-739001DDC8FD} - No CLSID value found.
O2 - BHO: (no name) - {A9F1B5BD-99CB-4280-AD15-F59808DE8FAF} - No CLSID value found.
O2 - BHO: (no name) - {AC10C684-C169-469F-8F8E-D057CD5FD0B9} - No CLSID value found.
O2 - BHO: (no name) - {AF912E8A-CA9E-4A9F-AA86-190C6AE9CFDE} - No CLSID value found.
O2 - BHO: (no name) - {B1387124-3580-4FC6-B866-3090489DEE59} - No CLSID value found.
O2 - BHO: (no name) - {B23E8909-C3F4-43F7-833A-9403598D6066} - No CLSID value found.
O2 - BHO: (no name) - {B309E0DF-A0FB-4391-8DD4-AF1F901AB0C3} - No CLSID value found.
O2 - BHO: (no name) - {B324C745-5811-40DF-962D-4BBCE6031155} - No CLSID value found.
O2 - BHO: (no name) - {B4672FFB-E4C6-40E2-9013-F8EDAB6F3B89} - No CLSID value found.
O2 - BHO: (no name) - {B4AA5C1C-31B4-472C-8B69-1415FC0F9AA4} - No CLSID value found.
O2 - BHO: (no name) - {B7F1CA51-A658-4824-8034-538C96E86BE8} - No CLSID value found.
O2 - BHO: (no name) - {BB4531ED-E666-4F13-B0D1-BFFAB935B300} - No CLSID value found.
O2 - BHO: (no name) - {C85B854A-A280-4B4C-8D36-2D8E3B83F591} - No CLSID value found.
O2 - BHO: (no name) - {CF2038DD-3204-4FD1-9AD1-C2B532E42779} - No CLSID value found.
O2 - BHO: (no name) - {D1AAECDA-9484-4226-B7E3-B2D718B3D076} - No CLSID value found.
O2 - BHO: (no name) - {D32943BD-A447-45DC-9F0A-27FF4E826B30} - No CLSID value found.
O2 - BHO: (no name) - {D701BC89-4050-49FC-A78B-933E976411BC} - No CLSID value found.
O2 - BHO: (no name) - {D9C33BF9-5318-4B94-9DBC-B6F1F3BB585E} - No CLSID value found.
O2 - BHO: (no name) - {DAB439E3-70F7-492A-9E1A-D3612E066DB5} - No CLSID value found.
O2 - BHO: (no name) - {DB135C85-892F-44FF-B5BC-25F3CE421C85} - No CLSID value found.
O2 - BHO: (no name) - {DBD21D7E-DCD3-477B-B6A7-06123403BC48} - No CLSID value found.
O2 - BHO: (no name) - {DDAF548A-4E81-4FF6-A5C7-BF5CA6721465} - No CLSID value found.
O2 - BHO: (no name) - {DFA0C81E-4192-4B00-8541-01D024C20998} - No CLSID value found.
O2 - BHO: (no name) - {E0E5477E-5B2E-4566-A967-52A27FF39768} - No CLSID value found.
O2 - BHO: (no name) - {E21D36C8-AC9B-4A98-8084-8E71BB61B123} - No CLSID value found.
O2 - BHO: (no name) - {E5DC1D5C-BC91-459A-85B3-97F481B05B5A} - No CLSID value found.
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O2 - BHO: (no name) - {EAFAFB62-C6FF-4B95-A0C0-756A17327F48} - No CLSID value found.
O2 - BHO: (no name) - {F1A449AC-5AC7-4B4D-BD32-DCCB6BE57F89} - No CLSID value found.
O2 - BHO: (no name) - {FF715C15-D67C-4CC2-A66D-69426256129F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No CLSID value found.
O3 - HKLM\..\Toolbar: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\ShellBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [a0fa9d1c] C:\WINDOWS\System32\smooroaa.DLL File not found
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (AOL LLC)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [COMODO Firewall Pro] C:\Program Files\COMODO\Firewall\cfp.exe ()
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1229762181\ee\AOLSoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\System32\ps2.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()
O4 - HKLM..\Run: [SiSPower] C:\WINDOWS\System32\SiSPower.DLL (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKLM..\RunOnce: [Spybot - Search & Destroy] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\RunOnce: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKCU..\RunOnce: [SpybotDeletingB2047] C:\WINDOWS\System32\command.com ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe (America Online, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL Toolbar search - C:\Program Files\AOL Toolbar\toolbar.dll File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Value error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/01/01 09:58:38 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 22:01:14 | 00,000,053 | -HS- | M] () - D:\AUTORUN.FCB – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/07/29 21:31:53 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2009/07/14 15:48:23 | 53,620,3264 | -HS- | C] () – C:\hiberfil.sys
[2009/07/14 06:25:09 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/07/12 22:40:40 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/07/08 19:35:54 | 00,000,432 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\user.zip
[2009/07/01 16:09:16 | 00,101,636 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\SystemLook.exe
[2009/04/09 21:32:30 | 00,143,104 | —- | C] () – C:\WINDOWS\System32\guard32.dll
[2009/03/05 20:27:26 | 00,086,016 | —- | C] () – C:\WINDOWS\System32\sdbgsaun.dll
[2009/03/05 09:01:38 | 00,011,264 | —- | C] () – C:\WINDOWS\System32\nfr.dll
[2009/02/19 18:11:25 | 00,000,029 | —- | C] () – C:\WINDOWS\DEBUGSM.INI
[2009/02/17 02:12:40 | 00,000,072 | —- | C] () – C:\WINDOWS\System32\epDPE.ini
[2009/02/17 02:11:01 | 00,000,022 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2009/02/17 02:08:32 | 00,000,025 | —- | C] () – C:\WINDOWS\CDE CX6600E.ini
[2009/01/29 22:08:55 | 00,000,665 | —- | C] () – C:\WINDOWS\wininit.ini
[2009/01/04 20:25:18 | 00,000,081 | —- | C] () – C:\WINDOWS\DVDConverter.INI
[2009/01/04 20:24:51 | 00,765,952 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/01/04 20:24:51 | 00,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/12/23 15:16:33 | 00,000,162 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/12/19 17:58:21 | 00,000,004 | —- | C] () – C:\WINDOWS\msoffice.ini
[2008/12/18 22:06:10 | 00,000,540 | —- | C] () – C:\WINDOWS\AppRun.ini
[2006/03/06 11:41:02 | 00,073,728 | —- | C] () – C:\WINDOWS\System32\AMV_DecDLL.dll
[2006/01/04 19:19:27 | 00,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2006/01/04 19:18:08 | 00,081,920 | —- | C] () – C:\WINDOWS\System32\ieencode.dll
[2005/01/02 01:00:19 | 00,103,579 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2005/01/02 01:00:19 | 00,095,249 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2005/01/01 16:45:30 | 00,000,548 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/01/01 16:45:11 | 00,000,695 | —- | C] () – C:\WINDOWS\win.ini
[2005/01/01 16:45:09 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2005/01/01 13:08:44 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/01/01 11:48:20 | 00,013,779 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2005/01/01 11:48:11 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2005/01/01 10:43:52 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\RTCOMDLL.dll
[2005/01/01 10:43:52 | 00,156,160 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2005/01/01 10:38:35 | 00,163,840 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll
[2005/01/01 10:14:45 | 00,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2005/01/01 10:14:45 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2005/01/01 10:14:30 | 00,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2005/01/01 10:02:20 | 00,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/09/16 14:26:40 | 00,012,634 | —- | C] () – C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/08/20 04:14:46 | 00,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/08/20 04:14:46 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/11 00:04:00 | 00,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[2009/07/30 16:10:55 | 00,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2009/07/30 16:07:18 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/07/30 16:07:16 | 53,620,3264 | -HS- | M] () – C:\hiberfil.sys
[2009/07/30 15:13:32 | 00,002,204 | —- | M] () – C:\WINDOWS\pggrkatg
[2009/07/29 21:31:54 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2009/07/28 10:54:10 | 00,278,221 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\gmer.zip
[2009/07/27 17:01:13 | 00,000,695 | —- | M] () – C:\WINDOWS\win.ini
[2009/07/23 09:20:51 | 00,311,525 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/07/19 11:35:08 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/07/16 07:25:48 | 04,317,612 | -H– | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\IconCache.db
[2009/07/12 23:50:21 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/07/12 22:36:58 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/07/12 22:36:30 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090723-092051.backup
[2009/07/08 19:35:55 | 00,000,432 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\user.zip
[2009/07/01 16:09:16 | 00,101,636 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\SystemLook.exe
< End of report >

jun23

Post #53July 30, 2009, 3:32 PM UTC

And here is the extras.txt

OTL Extras logfile created on: 30/07/2009 16:21:04 - Run 1
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\HP_Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

511.29 Mb Total Physical Memory | 201.16 Mb Available Physical Memory | 39.34% Memory free
1.22 Gb Paging File | 0.96 Gb Available in Paging File | 78.73% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 181.71 Gb Total Space | 130.39 Gb Free Space | 71.76% Space Free | Partition Type: NTFS
Drive D: | 4.58 Gb Total Space | 0.96 Gb Free Space | 20.93% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-A52C34C618
Current User Name: HP_Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3587:TCP" = 3587:TCP:*:Enabled:Windows Peer-to-Peer Grouping
"3540:UDP" = 3540:UDP:*:Enabled:Peer Name Resolution Protocol (PNRP)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3587:TCP" = 3587:TCP:*:Enabled:Windows Peer-to-Peer Grouping
"3540:UDP" = 3540:UDP:*:Enabled:Peer Name Resolution Protocol (PNRP)
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"7070:TCP" = 7070:TCP:*:Enabled:nfr

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%ProgramFiles%\iTunes\iTunes.exe" = %ProgramFiles%\iTunes\iTunes.exe:*:enabled:iTunes – File not found
"C:\Program Files\AOL 9.0a\waol.exe" = C:\Program Files\AOL 9.0a\waol.exe:*:Enabled:AOL 9.0a – File not found
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL – (AOL LLC)
"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0 – (America Online, Inc.)
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL – (AOL LLC)
"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0 – (America Online, Inc.)
"C:\Program Files\Common Files\AOL\1229762181\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1229762181\ee\aolsoftware.exe:*:Enabled:AOL Shared Components – (America Online, Inc.)
"C:\Program Files\Messenger\msmsgs.exe" = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote – (Microsoft Corporation)
"C:\Program Files\ABC\abc.exe" = C:\Program Files\ABC\abc.exe:*:Enabled:abc – ()
"C:\Program Files\THQ\Dawn of War - Soulstorm\Soulstorm.exe" = C:\Program Files\THQ\Dawn of War - Soulstorm\Soulstorm.exe:*:Enabled:Soulstorm – (THQ Canada Inc.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype – (Skype Technologies S.A.)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger – (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0C66761E-497A-4BE3-AE0D-8EC30FC9A9AA}" = PC-Doctor for Windows
"{0D182A5E-AEE0-42ca-BD1D-4EEB2FFA256D}" = HP Image Zone Plus 4.2.3
"{109D28C7-FB38-483A-9C91-001CB59E2699}" = EPSON CardMonitor
"{1F63ED0B-EDD2-4037-B6AB-1358C624AF48}" = Scan
"{20533183-D42D-4261-A125-956736FBEA8C}" = Dawn of War - Soulstorm
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21E75254-410E-49C4-8981-2E1A2A2221F2}" = HP Diagnostic Assistant
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23B59ED4-C360-11D7-875B-0090CC005647}" = EPSON PRINT Image Framer Tool2.1
"{267868CE-6DFF-40F7-9C58-C01119B7B117}" = Fax
"{2BBC9458-07CA-4843-848B-5C8146E5EFA8}" = CreativeProjects
"{34A59AC3-6C5C-4A09-A7F5-369A37176C8A}" = AiOSoftware
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3AE681E0-4E8D-453F-950A-48534D3C0724}" = Copy
"{3AEF2F6C-F1D3-47CD-BF3B-A327F1FABE58}" = PSPrinters06
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{41254D7B-EADF-4078-AE4A-BD73B300EE86}" = Unload
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{457791C5-D702-4143-A7B2-2744BE9573F2}" = HP Software Update
"{49FC50FC-F965-40D9-89B4-CBFF80941033}" = Windows Movie Maker 2.0
"{4C04DF1B-6A39-4299-9DD1-1FA60000266E}" = HP Photosmart Cameras 4.0
"{5435FF3C-48CF-4B34-85E1-2C95673EB254}" = Dawn of War - Soulstorm
"{561A9B4E-2E48-4149-B977-59C7AFF62B52}" = HPIZ423
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{65F5B7AF-3363-11D7-BB6B-00018021113F}" = EPSON PhotoQuicker3.5
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{725249C3-B94C-4141-8799-0D3BA43D0812}" = CameraDrivers
"{7BD0A2D8-4EA0-43C6-BDF8-DDA87B8031C6}" = PIF DESIGNER2.1
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"{83F12F73-D52E-40C0-93B1-463C311C4E17}" = Dawn Of War
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" =
"{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}" = MP3 Player Utilities 4.17
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{90120000-0054-0409-0000-0000000FF1CE}" = Microsoft Office Visio MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{981FB376-8418-4EA8-BBED-9DE5AA63E7D5}" = SkinsHP1
"{9CB2512B-3EC4-43DF-8002-46BDAB5EDD1B}" = QuickProjects
"{9EEBF8D5-8712-4D1D-88F4-4CDC2D270BC3}" = PrintScreen
"{A1062847-0846-427A-92A1-BB8251A91E91}" = HP PSC & OfficeJet 4.0
"{A1DCC235-DACC-4E1F-8D11-D630634B4AEF}" = PhotoGallery
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2500497-FD32-493e-B8E5-28D6728DBEF5}" = Readme
"{A4EA3AB4-E78C-4286-96DF-26035507CE55}" = AiO_Scan
"{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}" = Photosmart 320,370,7400,8100,8400 Series
"{AC76BA86-0000-0000-0000-6028747ADE01}" = Adobe Acrobat - Reader 6.0.2 Update
"{AC76BA86-7AD7-1033-7B44-A00000000001}" = Adobe Reader 6.0.1
"{B32C75F2-7495-4D01-9431-C11E97D66F8C}" = DocProc
"{B3D5D4E0-E965-41C4-ABFD-A7B1AD0663C2}" = Director
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B45D9FEE-1AF4-46F3-9A83-2545F81547F5}" = CreativeProjectsTemplates
"{B56D5B09-C4FB-4EA0-8EAD-7BC3E2715A2D}" = DocumentViewer
"{BCC992E5-5C81-4066-9B55-03DC10B24D21}" = InstantShare
"{BF018D2F-C788-4AB1-AB95-1280EAB8F13E}" = TrayApp
"{C3F058C0-A21C-452D-8D99-95B1A45F417D}" = InterVideo DiscLabel
"{C48817E7-AA05-4151-A99D-1E1E550CE801}" = EPSON PhotoStarter3.1
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DD8408E9-9421-484F-979D-DB6361E3E828}" = Dawn Of War - Winter Assault
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{EC8673DA-F96B-497E-B2DB-BC7B029FD680}" = BufferChm
"{F419D20A-7719-4639-8E30-C073A040D878}" = HP Deskjet Preloaded Printer Drivers
"{F4F47155-5B4D-42AA-97F8-490BC52EA7F3}" = Destinations
"{F65787F3-B356-45EC-8DD0-0E6758EDBCEE}" = WebReg
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FF26F7EA-BCEE-478C-9A1B-6B4F88717D73}" = CueTour
"{FF39FC01-819B-42E4-AE49-1968AF12DDD4}" = Dawn of War - Dark Crusade
"ABC" = ABC (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"AOL Uninstaller" = AOL Uninstaller
"AOLCoach uk" = AOL Coach Version 1.0(Build:20040229.1 uk)
"ATI Display Driver" = ATI Display Driver
"CCleaner" = CCleaner (remove only)
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2008-09-21 16:18
"COMODO Firewall Pro" = COMODO Firewall Pro
"DG834" = DG834
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"ESCX6600 Reference Guide" = ESCX6600 Reference Guide
"ESCX6600 Software Guide" = ESCX6600 Software Guide
"Help and Support Additions" = Help and Support Additions
"HijackThis" = HijackThis 2.0.2
"HP Photo & Imaging" = HP Image Zone 4.2.3
"InstallShield_{0C66761E-497A-4BE3-AE0D-8EC30FC9A9AA}" = PC-Doctor for Windows
"InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"Mozilla Firefox (3.0.12)" = Mozilla Firefox (3.0.12)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PS2" = PS2
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Python 2.2.1" = Python 2.2.1
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer Basic
"RemoveIT Pro v4 - SE" = RemoveIT Pro v4 - SE
"SiS VGA Driver" = SiS VGA Utilities
"StreetPlugin" = Learn2 Player (Uninstall Only)
"ViewpointMediaPlayer" = Viewpoint Media Player
"VISPRO" = Microsoft Office Visio Professional 2007
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR" = WinRAR
"WinRAR archiver" = WinRAR archiver
"winusb0100" = Microsoft WinUsb 1.0
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 13/07/2009 10:00:27 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 13/07/2009 10:00:40 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 17/07/2009 15:38:35 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 17/07/2009 15:39:24 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 19/07/2009 07:30:11 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 20/07/2009 09:40:04 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 21/07/2009 11:29:06 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 25/07/2009 11:59:13 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 25/07/2009 12:00:46 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 28/07/2009 06:20:49 | Computer Name = YOUR-A52C34C618 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

[ OSession Events ]
Error - 23/01/2009 15:39:05 | Computer Name = YOUR-A52C34C618 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 81
seconds with 60 seconds of active time. This session ended with a crash.

Error - 23/01/2009 15:39:23 | Computer Name = YOUR-A52C34C618 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.

Error - 10/03/2009 14:51:56 | Computer Name = YOUR-A52C34C618 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 631
seconds with 60 seconds of active time. This session ended with a crash.

Error - 20/04/2009 02:12:01 | Computer Name = YOUR-A52C34C618 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 446
seconds with 300 seconds of active time. This session ended with a crash.

Error - 20/04/2009 02:12:23 | Computer Name = YOUR-A52C34C618 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4
seconds with 0 seconds of active time. This session ended with a crash.

Error - 26/04/2009 14:07:08 | Computer Name = YOUR-A52C34C618 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 6
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 24/07/2009 15:23:30 | Computer Name = YOUR-A52C34C618 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.2 for the Network Card with network
address 0011D858243C has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 25/07/2009 09:09:14 | Computer Name = YOUR-A52C34C618 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.2 for the Network Card with network
address 0011D858243C has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 26/07/2009 06:08:52 | Computer Name = YOUR-A52C34C618 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.2 for the Network Card with network
address 0011D858243C has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 29/07/2009 11:26:19 | Computer Name = YOUR-A52C34C618 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.2 for the Network Card with network
address 0011D858243C has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 29/07/2009 11:26:25 | Computer Name = YOUR-A52C34C618 | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 29/07/2009 11:26:25 | Computer Name = YOUR-A52C34C618 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 30/07/2009 05:54:06 | Computer Name = YOUR-A52C34C618 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.2 for the Network Card with network
address 0011D858243C has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 30/07/2009 06:39:25 | Computer Name = YOUR-A52C34C618 | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC000009A'
while processing the file 'Credentials.db.new' on the volume 'HarddiskVolume2'.
It has stopped monitoring the volume.

Error - 30/07/2009 07:22:00 | Computer Name = YOUR-A52C34C618 | Source = Srv | ID = 2019
Description = The server was unable to allocate from the system nonpaged pool because
the pool was empty.

Error - 30/07/2009 07:23:15 | Computer Name = YOUR-A52C34C618 | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC000009A'
while processing the file 'dn0_up3.ico' on the volume 'HarddiskVolume2'. It has
stopped monitoring the volume.

< End of report >

oldman960

Post #54July 31, 2009, 5:21 AM UTC last edited July 31, 2009, 1:44 PM UTC

Hi Jun23,

It looks like combofix crippled most of it. There are several Windows services stopped and a proxy has been added. That would account for the problems you were having with FireFox, copy and paste and the internet.

There is also a rootkit that we will need to use combofix for.

We'll clean out what we can, then run combofix again. So we'll get you set up.

Locate combofix.exe on your desktop, right click it and select delete.

Download a new copy from either of the 2 links below. Save it to your desktop, but do not run it yet, we will use it later.

Link 1
Link 2

Next, download the attached file user1.zip and save it to your desktop

📎user1.zip

Extract the files to your desktop. You will now have 2 new notepads on your desktop. One will be named OTLScript.txt and the other will be named CFScript.txt

Locate OTLScript.txt

double click it to open it.
It will open in notepad, right click anywhere in it and select select all
Right click anywhere on the now highlighted text and select copy

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, right click and select paste

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Next locate CFScript.txt on your desktop and follow these instructions.

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Next

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Set the Services section to All
Uncheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will a notepad window. OTL.Txt

Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply. You may need two posts to fit them all in.

Please post back with

OTL fix log
combofix log
new OTL log taken after all other steps are completed

note there will only be an OTL.txt this time.

Please tell us of any issues you are having, ie copy and paste, firefox etc.

Thanks

jun23

Post #55August 3, 2009, 9:58 AM UTC

Hi,
Here is the OTL fix log

Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret > in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\\GrpConv not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\a0fa9d1c deleted successfully.
========== FILES ==========
========== COMMANDS ==========
Error: Unable to interpret <> in the current context!

OTL by OldTimer - Version 3.0.10.3 log created on 08022009_114833

The Combofix log

ComboFix 09-08-01.06 - HP_Owner 02/08/2009 11:59.3.2 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Owner\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\mlJArsRK.dll.vir"
"c:\windows\System32\sdbgsaun.dll"
"c:\windows\System32\smooroaa.DLL"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\System32\sdbgsaun.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PGGRKATG
——-\Service_pggrkatg

((((((((((((((((((((((((( Files Created from 2009-07-02 to 2009-08-02 )))))))))))))))))))))))))))))))
.

2009-08-02 10:48 . 2009-08-02 10:48 ——– d—–w- C:\_OTL
2009-07-12 18:58 . 2009-07-12 19:00 20798256 —-a-w- c:\documents and settings\HP_Owner\Application Data\Adobe\Acrobat\6.0\Updater\AdbeRdr70_enu_full.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-02 10:59 . 2009-01-13 21:43 297472 —-a-w- c:\windows\system32\mlJArsRK.dll.vir
2009-07-23 10:07 . 2008-12-20 08:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-12 18:58 . 2008-12-20 10:47 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\AdobeUM
2009-06-27 16:39 . 2008-12-20 09:11 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\.ABC
2009-07-25 15:54 . 2008-12-20 08:53 134648 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-07-12_21.36.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-01-01 09:00 . 2009-08-02 10:38 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2005-01-01 09:00 . 2009-04-08 22:18 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-01-01 09:00 . 2009-08-02 10:38 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2005-01-01 09:00 . 2009-04-08 22:18 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2005-01-01 32881]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2008-12-18 26112]
"PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HostManager"="c:\program files\Common Files\AOL\1229762181\ee\AOLSoftware.exe" [2006-09-26 50736]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-04-09 1655552]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-09 344064]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2007-12-07 71008]
"a0fa9d1c"="c:\windows\system32\smooroaa.dll" [BU]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-07-29 77824]
"SiSPower"="SiSPower.dll" - c:\windows\system32\SiSPower.dll [2004-09-24 49152]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2004-07-29 2551808]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
"SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2008-11-13 5287768]

c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AOL 9.0 Tray Icon.lnk - c:\program files\AOL 9.0\aoltray.exe [2008-12-19 156784]
AOL Companion.lnk - c:\program files\AOL Companion\companion.exe [2008-12-19 250992]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-29 241664]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\1229762181\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\ABC\\abc.exe"=
"c:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"7070:TCP"= 7070:TCP:nfr

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [09/04/2009 21:32 87056]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [09/04/2009 21:32 24208]
R3 PhTVTune;ASUS WDM TV Tuner;c:\windows\system32\drivers\PhTVTune.sys [01/01/2005 10:48 24544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
- - - - ORPHANS REMOVED - - - -

BHO-{001B00AE-7860-4251-AB09-F5084B6016EC} - (no file)
BHO-{051C4D78-98FA-4B6D-ADF3-79904CC8B7AF} - (no file)
BHO-{09EABA3C-397E-4F2C-8840-5AD3D8BDDFDB} - (no file)
BHO-{0C8A0741-B54F-4CFA-85F8-494662FE8E41} - (no file)
BHO-{0EDF10DE-12F8-44B7-83F4-E2AFEEDC0183} - (no file)
BHO-{1CE272AD-E408-451E-A08B-B0048D907B33} - (no file)
BHO-{1E1949F7-B16A-47EA-85B2-A89939417F61} - (no file)
BHO-{1EF042BE-1F1F-44AC-B301-E6E794691394} - (no file)
BHO-{1F0DB968-B499-4C0F-84A7-A5D30660E822} - (no file)
BHO-{216187C0-423C-4123-908E-7246D86886A0} - (no file)
BHO-{216D8D75-DEE0-499F-8F87-DDE12FE03DF8} - (no file)
BHO-{27BD3C51-BC2E-49E0-9C6B-F0D0D010CE80} - (no file)
BHO-{2FC7A6B7-EFAA-4AFC-989D-02310398F83A} - (no file)
BHO-{303B270C-AA0A-4DE6-91A7-FD452C9631DC} - (no file)
BHO-{3081BC85-2BB3-4238-BB8E-0D5F930892C3} - (no file)
BHO-{33A4125A-0E9E-4959-B46E-A34689E8DD73} - (no file)
BHO-{340DA371-C36E-4C98-85B4-3A29C3A5A0F9} - (no file)
BHO-{350A958B-8897-4FA6-BA8E-C0202CD3F30E} - (no file)
BHO-{35A71AF0-50BA-4074-93E6-6F097384689F} - (no file)
BHO-{36B0CE3B-2389-48E4-92E4-00ED8579DC74} - (no file)
BHO-{3B31C0ED-586A-408E-9CF3-D12DCD23376E} - (no file)
BHO-{40167E6E-9DF0-423B-9094-9578D043C432} - (no file)
BHO-{444B7843-A646-4525-A5E7-6F4CD7CE0628} - (no file)
BHO-{46AAF4BD-32DD-4E49-91B8-33B70119D9AC} - (no file)
BHO-{46CB60B7-610C-4A58-9E1A-32B16F37B211} - (no file)
BHO-{511512CB-CFAC-49E0-BD1D-F5DF656A1C8A} - (no file)
BHO-{538DF27D-F49D-40B1-9644-A696C2071B78} - (no file)
BHO-{5817FDBD-3462-4B7B-9E8A-7842189010BE} - (no file)
BHO-{633808CA-C1BE-4EA7-9279-1C8282BF07FF} - (no file)
BHO-{67520427-1A9C-44CE-A679-BAC8122D8746} - (no file)
BHO-{690E9E38-8FDB-48C7-8CD1-534E73F2666B} - (no file)
BHO-{69432058-704F-4E6E-B1A4-493C1F3723F3} - (no file)
BHO-{6EF9FD7C-C8B9-4F63-9271-26015961B294} - (no file)
BHO-{74ED29C2-3B04-491F-B00E-3B1383159E91} - (no file)
BHO-{75E0D66C-5620-4BCF-9962-AA78188164EC} - (no file)
BHO-{765402F7-A14D-4279-88A8-EE51096F18D3} - (no file)
BHO-{7A1F6839-AA47-4EF9-A879-E83E6AABB99A} - (no file)
BHO-{7A4C7266-E6EF-4361-8A86-696BD89C7239} - (no file)
BHO-{81125015-08af-4a04-9512-f21ec33a1f93} - (no file)
BHO-{841FDACB-8EC2-4512-A9A7-51E090448A11} - (no file)
BHO-{882F2FE5-61B3-4765-845A-485582732E33} - (no file)
BHO-{887A2277-9875-4300-90B0-E56D56791EC3} - (no file)
BHO-{8EDC0272-3960-41BC-91BF-1E3B32615FF0} - (no file)
BHO-{90BE6A4A-895D-46D4-9051-6EE6465390DC} - (no file)
BHO-{9731BF4D-69EA-46F8-9F1E-8AAEA2EDB36E} - (no file)
BHO-{979C9B28-D9DD-45D2-A910-642990B3DACD} - (no file)
BHO-{9C2F459E-AA22-4CD2-B56D-E3D8878117A5} - (no file)
BHO-{9DA61E8E-66C6-4576-8B9D-DCB3EAAF13C2} - (no file)
BHO-{A0584506-0BC5-4623-8702-83E1EB3934D9} - (no file)
BHO-{A0A17DFB-BD47-4618-B187-1A0E1B799EA9} - (no file)
BHO-{A19120DB-8D7D-4BF2-A126-6C58DEEB04AD} - (no file)
BHO-{A230C57E-46FE-4278-88DC-FFC3F296F16C} - (no file)
BHO-{A3081139-B6D2-4DF3-B460-7DC729729457} - (no file)
BHO-{A377CB11-8F15-4DAE-BB3E-ABBD65B1002D} - (no file)
BHO-{A5C775ED-DFA0-417F-A84D-1850A3484F9E} - (no file)
BHO-{A7788911-F6E2-42A1-BEEC-739001DDC8FD} - (no file)
BHO-{A9F1B5BD-99CB-4280-AD15-F59808DE8FAF} - (no file)
BHO-{AC10C684-C169-469F-8F8E-D057CD5FD0B9} - (no file)
BHO-{AF912E8A-CA9E-4A9F-AA86-190C6AE9CFDE} - (no file)
BHO-{B1387124-3580-4FC6-B866-3090489DEE59} - (no file)
BHO-{B23E8909-C3F4-43F7-833A-9403598D6066} - (no file)
BHO-{B309E0DF-A0FB-4391-8DD4-AF1F901AB0C3} - (no file)
BHO-{B324C745-5811-40DF-962D-4BBCE6031155} - (no file)
BHO-{B4672FFB-E4C6-40E2-9013-F8EDAB6F3B89} - (no file)
BHO-{B4AA5C1C-31B4-472C-8B69-1415FC0F9AA4} - (no file)
BHO-{B7F1CA51-A658-4824-8034-538C96E86BE8} - (no file)
BHO-{BB4531ED-E666-4F13-B0D1-BFFAB935B300} - (no file)
BHO-{C85B854A-A280-4B4C-8D36-2D8E3B83F591} - (no file)
BHO-{CF2038DD-3204-4FD1-9AD1-C2B532E42779} - (no file)
BHO-{D1AAECDA-9484-4226-B7E3-B2D718B3D076} - (no file)
BHO-{D32943BD-A447-45DC-9F0A-27FF4E826B30} - (no file)
BHO-{D701BC89-4050-49FC-A78B-933E976411BC} - (no file)
BHO-{D9C33BF9-5318-4B94-9DBC-B6F1F3BB585E} - (no file)
BHO-{DAB439E3-70F7-492A-9E1A-D3612E066DB5} - (no file)
BHO-{DB135C85-892F-44FF-B5BC-25F3CE421C85} - (no file)
BHO-{DBD21D7E-DCD3-477B-B6A7-06123403BC48} - (no file)
BHO-{DDAF548A-4E81-4FF6-A5C7-BF5CA6721465} - (no file)
BHO-{DFA0C81E-4192-4B00-8541-01D024C20998} - (no file)
BHO-{E0E5477E-5B2E-4566-A967-52A27FF39768} - (no file)
BHO-{E21D36C8-AC9B-4A98-8084-8E71BB61B123} - (no file)
BHO-{E5DC1D5C-BC91-459A-85B3-97F481B05B5A} - (no file)
BHO-{EAFAFB62-C6FF-4B95-A0C0-756A17327F48} - (no file)
BHO-{F1A449AC-5AC7-4B4D-BD32-DCCB6BE57F89} - (no file)
BHO-{FF715C15-D67C-4CC2-A66D-69426256129F} - (no file)
HKLM-RunOnce- - (no file)

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_GB&c;=Q105&bd;=pavilion&pf;=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_GB&c;=Q105&bd;=pavilion&pf;=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_GB&c;=Q105&bd;=pavilion&pf;=desktop
IE: &AOL; Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
FF - ProfilePath - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\17ibpqgm.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.explosm.net/comics
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-02 12:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\COMODO\Firewall\cmdagent.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-08-02 12:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-02 11:09
ComboFix2.txt 2009-07-12 21:40
ComboFix3.txt 2009-06-23 17:08

Pre-Run: 139,919,654,912 bytes free
Post-Run: 139,872,694,272 bytes free

239

jun23

Post #56August 3, 2009, 10:01 AM UTC

Here is the last OTL log

OTL logfile created on: 02/08/2009 12:29:36 - Run 2
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\HP_Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

511.29 Mb Total Physical Memory | 266.16 Mb Available Physical Memory | 52.06% Memory free
1.22 Gb Paging File | 1.06 Gb Available in Paging File | 86.68% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 181.71 Gb Total Space | 130.30 Gb Free Space | 71.71% Space Free | Partition Type: NTFS
Drive D: | 4.58 Gb Total Space | 0.96 Gb Free Space | 20.93% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-A52C34C618
Current User Name: HP_Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
PRC - C:\Program Files\COMODO\Firewall\cmdagent.exe ()
PRC - C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\wscntfy.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\HP_Owner\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (All) ==========

SRV - (6to4 [Auto | Running]) – C:\WINDOWS\System32\6to4svc.dll (Microsoft Corporation)
SRV - (Alerter [Disabled | Stopped]) – C:\WINDOWS\System32\alrsvc.dll (Microsoft Corporation)
SRV - (ALG [On_Demand | Running]) – C:\WINDOWS\System32\alg.exe (Microsoft Corporation)
SRV - (AOL ACS [Auto | Running]) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (AppMgmt [On_Demand | Stopped]) – C:\WINDOWS\System32\svchost.exe (Microsoft Corporation)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Running]) – C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (AudioSrv [Auto | Running]) – C:\WINDOWS\System32\audiosrv.dll (Microsoft Corporation)
SRV - (BITS [Auto | Running]) – C:\WINDOWS\System32\qmgr.dll (Microsoft Corporation)
SRV - (Browser [Auto | Stopped]) – C:\WINDOWS\System32\browser.dll (Microsoft Corporation)
SRV - (CiSvc [On_Demand | Stopped]) – C:\WINDOWS\System32\cisvc.exe (Microsoft Corporation)
SRV - (ClipSrv [Disabled | Stopped]) – C:\WINDOWS\System32\clipsrv.exe (Microsoft Corporation)
SRV - (cmdAgent [Auto | Running]) – C:\Program Files\COMODO\Firewall\cmdagent.exe ()
SRV - (COMSysApp [On_Demand | Stopped]) – C:\WINDOWS\System32\dllhost.exe (Microsoft Corporation)
SRV - (CryptSvc [Auto | Running]) – C:\WINDOWS\System32\cryptsvc.dll (Microsoft Corporation)
SRV - (DcomLaunch [Auto | Running]) – C:\WINDOWS\System32\rpcss.dll (Microsoft Corporation)
SRV - (Dhcp [Auto | Running]) – C:\WINDOWS\System32\dhcpcsvc.dll (Microsoft Corporation)
SRV - (dmadmin [On_Demand | Stopped]) – C:\WINDOWS\System32\dmadmin.exe (Microsoft Corp., Veritas Software)
SRV - (dmserver [On_Demand | Stopped]) – C:\WINDOWS\System32\dmserver.dll (Microsoft Corp.)
SRV - (Dnscache [Auto | Running]) – C:\WINDOWS\System32\dnsrslvr.dll (Microsoft Corporation)
SRV - (ERSvc [Auto | Running]) – C:\WINDOWS\System32\ersvc.dll (Microsoft Corporation)
SRV - (Eventlog [Auto | Running]) – C:\WINDOWS\System32\services.exe (Microsoft Corporation)
SRV - (EventSystem [On_Demand | Running]) – C:\WINDOWS\System32\es.dll (Microsoft Corporation)
SRV - (FastUserSwitchingCompatibility [On_Demand | Running]) – C:\WINDOWS\System32\shsvcs.dll (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (HidServ [Auto | Running]) – C:\WINDOWS\System32\hidserv.dll (Microsoft Corporation)
SRV - (HTTPFilter [On_Demand | Running]) – C:\WINDOWS\System32\w3ssl.dll (Microsoft Corporation)
SRV - (ImapiService [On_Demand | Stopped]) – C:\WINDOWS\System32\imapi.exe (Microsoft Corporation)
SRV - (lanmanserver [Auto | Running]) – C:\WINDOWS\System32\srvsvc.dll (Microsoft Corporation)
SRV - (lanmanworkstation [Auto | Running]) – C:\WINDOWS\System32\wkssvc.dll (Microsoft Corporation)
SRV - (LmHosts [Auto | Running]) – C:\WINDOWS\System32\lmhsvc.dll (Microsoft Corporation)
SRV - (LPDSVC [On_Demand | Stopped]) – C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
SRV - (Messenger [Disabled | Stopped]) – C:\WINDOWS\System32\msgsvc.dll (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service [On_Demand | Stopped]) – C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (mnmsrvc [On_Demand | Stopped]) – C:\WINDOWS\System32\mnmsrvc.exe (Microsoft Corporation)
SRV - (MSDTC [On_Demand | Stopped]) – C:\WINDOWS\System32\msdtc.exe (Microsoft Corporation)
SRV - (MSIServer [On_Demand | Stopped]) – C:\WINDOWS\System32\msiexec.exe (Microsoft Corporation)
SRV - (NetDDE [Disabled | Stopped]) – C:\WINDOWS\System32\netdde.exe (Microsoft Corporation)
SRV - (NetDDEdsdm [Disabled | Stopped]) – C:\WINDOWS\System32\netdde.exe (Microsoft Corporation)
SRV - (Netlogon [On_Demand | Stopped]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (Netman [On_Demand | Running]) – C:\WINDOWS\System32\netman.dll (Microsoft Corporation)
SRV - (Nla [On_Demand | Running]) – C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
SRV - (NtLmSsp [On_Demand | Stopped]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (NtmsSvc [On_Demand | Stopped]) – C:\WINDOWS\System32\ntmssvc.dll (Microsoft Corporation)
SRV - (odserv [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (p2pgasvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2pgasvc.dll (Microsoft Corporation)
SRV - (p2pimsvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2psvc.dll (Microsoft Corporation)
SRV - (p2psvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2psvc.dll (Microsoft Corporation)
SRV - (PlugPlay [Auto | Running]) – C:\WINDOWS\System32\services.exe (Microsoft Corporation)
SRV - (PNRPSvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2psvc.dll (Microsoft Corporation)
SRV - (PolicyAgent [Auto | Running]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (ProtectedStorage [Auto | Running]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (RasAuto [On_Demand | Stopped]) – C:\WINDOWS\System32\rasauto.dll (Microsoft Corporation)
SRV - (RasMan [On_Demand | Running]) – C:\WINDOWS\System32\rasmans.dll (Microsoft Corporation)
SRV - (RDSessMgr [On_Demand | Stopped]) – C:\WINDOWS\System32\sessmgr.exe (Microsoft Corporation)
SRV - (RemoteAccess [Disabled | Stopped]) – C:\WINDOWS\System32\mprdim.dll (Microsoft Corporation)
SRV - (RpcLocator [On_Demand | Stopped]) – C:\WINDOWS\System32\locator.exe (Microsoft Corporation)
SRV - (RpcSs [Auto | Running]) – C:\WINDOWS\System32\rpcss.dll (Microsoft Corporation)
SRV - (RSVP [On_Demand | Stopped]) – C:\WINDOWS\System32\rsvp.exe (Microsoft Corporation)
SRV - (SamSs [Auto | Running]) – C:\WINDOWS\System32\lsass.exe (Microsoft Corporation)
SRV - (SCardSvr [On_Demand | Stopped]) – C:\WINDOWS\System32\SCardSvr.exe (Microsoft Corporation)
SRV - (Schedule [Auto | Running]) – C:\WINDOWS\System32\schedsvc.dll (Microsoft Corporation)
SRV - (seclogon [Auto | Running]) – C:\WINDOWS\System32\seclogon.dll (Microsoft Corporation)
SRV - (SENS [Auto | Running]) – C:\WINDOWS\System32\sens.dll (Microsoft Corporation)
SRV - (SharedAccess [Auto | Running]) – C:\WINDOWS\System32\ipnathlp.dll (Microsoft Corporation)
SRV - (ShellHWDetection [Auto | Running]) – C:\WINDOWS\System32\shsvcs.dll (Microsoft Corporation)
SRV - (SimpTcp [Auto | Running]) – C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
SRV - (Spooler [Auto | Running]) – C:\WINDOWS\System32\spoolsv.exe (Microsoft Corporation)
SRV - (srservice [Auto | Running]) – C:\WINDOWS\System32\srsvc.dll (Microsoft Corporation)
SRV - (SSDPSRV [On_Demand | Running]) – C:\WINDOWS\System32\ssdpsrv.dll (Microsoft Corporation)
SRV - (stisvc [Auto | Running]) – C:\WINDOWS\System32\wiaservc.dll (Microsoft Corporation)
SRV - (SwPrv [On_Demand | Stopped]) – C:\WINDOWS\System32\dllhost.exe (Microsoft Corporation)
SRV - (SysmonLog [On_Demand | Stopped]) – C:\WINDOWS\System32\smlogsvc.exe (Microsoft Corporation)
SRV - (TapiSrv [On_Demand | Running]) – C:\WINDOWS\System32\tapisrv.dll (Microsoft Corporation)
SRV - (TermService [On_Demand | Running]) – C:\WINDOWS\System32\termsrv.dll (Microsoft Corporation)
SRV - (Themes [Auto | Running]) – C:\WINDOWS\System32\shsvcs.dll (Microsoft Corporation)
SRV - (TrkWks [Auto | Running]) – C:\WINDOWS\System32\trkwks.dll (Microsoft Corporation)
SRV - (upnphost [On_Demand | Stopped]) – C:\WINDOWS\System32\upnphost.dll (Microsoft Corporation)
SRV - (UPS [On_Demand | Stopped]) – C:\WINDOWS\System32\ups.exe (Microsoft Corporation)
SRV - (VSS [On_Demand | Stopped]) – C:\WINDOWS\System32\vssvc.exe (Microsoft Corporation)
SRV - (W32Time [Auto | Running]) – C:\WINDOWS\System32\w32time.dll (Microsoft Corporation)
SRV - (WebClient [Auto | Running]) – C:\WINDOWS\System32\webclnt.dll (Microsoft Corporation)
SRV - (winmgmt [Auto | Running]) – C:\WINDOWS\System32\wbem\WMIsvc.dll (Microsoft Corporation)
SRV - (WmdmPmSN [On_Demand | Stopped]) – C:\WINDOWS\System32\MsPMSNSv.dll (Microsoft Corporation)
SRV - (WmiApSrv [On_Demand | Stopped]) – C:\WINDOWS\System32\wbem\wmiapsrv.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (wscsvc [Auto | Running]) – C:\WINDOWS\System32\wscsvc.dll (Microsoft Corporation)
SRV - (wuauserv [Auto | Running]) – C:\WINDOWS\System32\wuauserv.dll (Microsoft Corporation)
SRV - (WudfSvc [Auto | Running]) – C:\WINDOWS\System32\WUDFSvc.dll (Microsoft Corporation)
SRV - (WZCSVC [Auto | Running]) – C:\WINDOWS\System32\wzcsvc.dll (Microsoft Corporation)
SRV - (xmlprov [On_Demand | Stopped]) – C:\WINDOWS\System32\xmlprov.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AgereSoftModem [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\AGRSM.sys (Agere Systems)
DRV - (ASCTRM [Auto | Running]) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (ati2mtag [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Cap7134 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\Cap7134.sys (ASUSTek)
DRV - (catchme [On_Demand | Running]) – File not found
DRV - (cmdGuard [System | Running]) – C:\WINDOWS\System32\DRIVERS\cmdguard.sys (COMODO)
DRV - (cmdHlp [System | Running]) – C:\WINDOWS\System32\DRIVERS\cmdhlp.sys (COMODO)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (ialm [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (Inspect [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (IntcAzAudAddService [On_Demand | Running]) – C:\WINDOWS\System32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Iviaspi [On_Demand | Running]) – C:\WINDOWS\System32\drivers\iviaspi.sys (InterVideo, Inc.)
DRV - (PhTVTune [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\PhTVTune.sys (ASUSTek)
DRV - (Ps2 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (rtl8139 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation )
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys ()
DRV - (SiS315 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp [System | Running]) – C:\WINDOWS\System32\DRIVERS\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (Tcpip6 [System | Running]) – C:\WINDOWS\System32\DRIVERS\tcpip6.sys (Microsoft Corporation)
DRV - (viaagp1 [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (viagfx [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics Co, Ltd.)
DRV - (wanatw [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\wanatw4.sys (America Online, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…ER}&ar;=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=localhost:7070

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.explosm.net/comics"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:6.0
FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:3.1.20081127W
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.4.4
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.12
FF - prefs.js..network.proxy.http_port: 7070

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/30 10:58:54 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/07/25 16:54:21 | 00,000,000 | —D | M]

[2008/12/20 09:53:38 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Extensions
[2008/12/20 09:53:38 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/08/02 11:51:50 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions
[2009/01/20 16:35:54 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/01/27 21:42:31 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009/02/11 01:34:02 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\[removed]
[2009/04/04 19:40:17 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\[removed]
[2009/08/02 11:51:50 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/07/25 16:54:21 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/01/04 20:39:03 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
[2009/07/25 16:54:05 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/07/25 16:54:06 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/07/25 16:54:12 | 00,065,528 | —- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2006/10/26 21:12:16 | 00,016,192 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL
[2008/01/04 16:36:50 | 00,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2006/07/05 19:47:38 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/01/04 16:36:50 | 00,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2008/03/08 10:35:22 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/09/22 20:14:04 | 00,000,759 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2008/04/16 05:08:20 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/03/28 19:11:14 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/01/04 16:36:50 | 00,000,831 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No CLSID value found.
O3 - HKLM\..\Toolbar: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\ShellBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [a0fa9d1c] C:\WINDOWS\System32\smooroaa.DLL File not found
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (AOL LLC)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [COMODO Firewall Pro] C:\Program Files\COMODO\Firewall\cfp.exe ()
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1229762181\ee\AOLSoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\System32\ps2.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()
O4 - HKLM..\Run: [SiSPower] C:\WINDOWS\System32\SiSPower.DLL (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKLM..\RunOnce: [] File not found
O4 - HKLM..\RunOnce: [GrpConv] C:\WINDOWS\System32\grpconv.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe (America Online, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL; Toolbar search - C:\Program Files\AOL Toolbar\toolbar.dll File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Value error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/01/01 09:58:38 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 22:01:14 | 00,000,053 | -HS- | M] () - D:\AUTORUN.FCB – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/08/02 12:28:01 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/08/02 12:09:54 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/08/02 11:52:06 | 00,002,774 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\user1.zip
[2009/08/02 11:48:33 | 00,000,000 | —D | C] – C:\_OTL
[2009/08/02 11:45:33 | 03,152,783 | R— | C] () – C:\Documents and Settings\HP_Owner\Desktop\ComboFix.exe
[2009/07/29 21:31:53 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2009/07/14 15:48:23 | 53,620,3264 | -HS- | C] () – C:\hiberfil.sys
[2009/07/08 19:35:54 | 00,000,432 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\user.zip
[2009/04/09 21:32:30 | 00,143,104 | —- | C] () – C:\WINDOWS\System32\guard32.dll
[2009/03/05 09:01:38 | 00,011,264 | —- | C] () – C:\WINDOWS\System32\nfr.dll
[2009/02/19 18:11:25 | 00,000,029 | —- | C] () – C:\WINDOWS\DEBUGSM.INI
[2009/02/17 02:12:40 | 00,000,072 | —- | C] () – C:\WINDOWS\System32\epDPE.ini
[2009/02/17 02:11:01 | 00,000,022 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2009/02/17 02:08:32 | 00,000,025 | —- | C] () – C:\WINDOWS\CDE CX6600E.ini
[2009/01/29 22:08:55 | 00,000,665 | —- | C] () – C:\WINDOWS\wininit.ini
[2009/01/13 22:43:06 | 00,297,472 | —- | C] () – C:\WINDOWS\System32\mlJArsRK.dll.vir
[2009/01/04 20:25:18 | 00,000,081 | —- | C] () – C:\WINDOWS\DVDConverter.INI
[2009/01/04 20:24:51 | 00,765,952 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/01/04 20:24:51 | 00,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/12/23 15:16:33 | 00,000,162 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/12/19 17:58:21 | 00,000,004 | —- | C] () – C:\WINDOWS\msoffice.ini
[2008/12/18 22:06:10 | 00,000,540 | —- | C] () – C:\WINDOWS\AppRun.ini
[2006/03/06 11:41:02 | 00,073,728 | —- | C] () – C:\WINDOWS\System32\AMV_DecDLL.dll
[2006/01/04 19:19:27 | 00,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2006/01/04 19:18:08 | 00,081,920 | —- | C] () – C:\WINDOWS\System32\ieencode.dll
[2005/01/02 01:00:19 | 00,103,579 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2005/01/02 01:00:19 | 00,095,249 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2005/01/01 16:45:30 | 00,000,548 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/01/01 16:45:11 | 00,000,695 | —- | C] () – C:\WINDOWS\win.ini
[2005/01/01 16:45:09 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2005/01/01 13:08:44 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/01/01 11:48:20 | 00,013,779 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2005/01/01 11:48:11 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2005/01/01 10:43:52 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\RTCOMDLL.dll
[2005/01/01 10:43:52 | 00,156,160 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2005/01/01 10:38:35 | 00,163,840 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll
[2005/01/01 10:14:45 | 00,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2005/01/01 10:14:45 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2005/01/01 10:14:30 | 00,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2005/01/01 10:02:20 | 00,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/09/16 14:26:40 | 00,012,634 | —- | C] () – C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/08/20 04:14:46 | 00,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/08/20 04:14:46 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/11 00:04:00 | 00,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[2009/08/02 12:06:10 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/08/02 12:05:26 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/08/02 12:05:19 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/08/02 12:05:17 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/08/02 12:05:15 | 53,620,3264 | -HS- | M] () – C:\hiberfil.sys
[2009/08/02 12:04:36 | 00,002,204 | —- | M] () – C:\WINDOWS\pggrkatg
[2009/08/02 11:59:38 | 00,297,472 | —- | M] () – C:\WINDOWS\System32\mlJArsRK.dll.vir
[2009/08/02 11:52:07 | 00,002,774 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\user1.zip
[2009/08/02 11:45:44 | 03,152,783 | R— | M] () – C:\Documents and Settings\HP_Owner\Desktop\ComboFix.exe
[2009/08/02 11:38:14 | 00,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2009/07/29 21:31:54 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2009/07/28 10:54:10 | 00,278,221 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\gmer.zip
[2009/07/27 17:01:13 | 00,000,695 | —- | M] () – C:\WINDOWS\win.ini
[2009/07/19 11:35:08 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/07/16 07:25:48 | 04,317,612 | -H– | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\IconCache.db
[2009/07/13 05:48:54 | 00,219,648 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/07/12 22:36:30 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090723-092051.backup
[2009/07/08 19:35:55 | 00,000,432 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\user.zip
< End of report >

Copy and paste is working in Firefox now

and sound is working again

oldman960

Post #57August 3, 2009, 4:44 PM UTC

Hi Jun23,

Copy and paste is working in Firefox now and sound is working again

Good. It looks like combofix got the bad driver and the services are now running.

Can you connect the the internet normally with bothe Firefox and Internet Explorer?

Let's remove the old vulnerable java and update it.

Go to http://java.sun.com/javase/downloads/index.jsp
Scroll down to "Java Runtime Environment (JRE) 6 Update 14
Click the download button on the right.

If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.

Select the platform (Windows, in your case), mutli language.
Accept the license agreement, click continue.

You do not have to install the Java Web Start ActiveX Control

Scroll down and click on Windows Offline Installation,
Save the file jre-6u14-windows-i586-p.exe to your desktop;

Do not select Run . Do not install it yet.

When the download is complete, close your browser.

Open Control Panel > Add/Remove Programs and uninstall

Java 2 Runtime Environment, SE v1.4.2_03

Do not uninstall Java TM 6 Update 14 if found!

Reboot your computer.

Double-click on the saved file ( jre-6u14-windows-i586-p.exe) to install the update.
Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No CLSID value found.
O4 - HKLM..\Run: [a0fa9d1c] C:\WINDOWS\System32\smooroaa.DLL File not found
O4 - HKLM..\RunOnce: [] File not found
[2009/08/02 11:52:06 | 00,002,774 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\user1.zip
[2009/07/08 19:35:54 | 00,000,432 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\user.zip
[2009/08/02 12:04:36 | 00,002,204 | —- | M] () – C:\WINDOWS\pggrkatg
[2009/08/02 11:59:38 | 00,297,472 | —- | M] () – C:\WINDOWS\System32\mlJArsRK.dll.vir

:Services

:Reg

:Files
C:\WINDOWS\system32\drivers\rrwpczyg.sys

:Commands
[emptytemp]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Please post the OTL log

Next

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

Please post back with

OTL fix log
new OTL log
answers to any questions

What problems are you still experiencing?

Thanks

jun23

Post #58August 5, 2009, 9:33 AM UTC

Hi,
Everything seems to be working properly again. I can connect with firefox and internet explorer.

Here is the OTL fix log

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{4982D40A-C53B-4615-B15B-B5B5E98D167C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\a0fa9d1c deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ not found.
File C:\Documents and Settings\HP_Owner\Desktop\user1.zip not found.
File C:\Documents and Settings\HP_Owner\Desktop\user.zip not found.
C:\WINDOWS\pggrkatg moved successfully.
C:\WINDOWS\System32\mlJArsRK.dll.vir moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\WINDOWS\system32\drivers\rrwpczyg.sys not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 58658 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: HP_Owner
->Temp folder emptied: 444517 bytes
->Temporary Internet Files folder emptied: 702431 bytes
->Java cache emptied: 573880 bytes
->FireFox cache emptied: 54369958 bytes

User: LocalService
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
->Temp folder emptied: 65716 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 3152783 bytes

Total Files Cleaned = 56.71 mb

OTL by OldTimer - Version 3.0.10.3 log created on 08052009_095924

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

Here is the new OTL log

OTL logfile created on: 05/08/2009 10:04:44 - Run 3
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\HP_Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

511.29 Mb Total Physical Memory | 23.41 Mb Available Physical Memory | 4.58% Memory free
1.22 Gb Paging File | 0.78 Gb Available in Paging File | 63.89% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 181.71 Gb Total Space | 130.24 Gb Free Space | 71.67% Space Free | Partition Type: NTFS
Drive D: | 4.58 Gb Total Space | 0.96 Gb Free Space | 20.93% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-A52C34C618
Current User Name: HP_Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
PRC - C:\Program Files\COMODO\Firewall\cmdagent.exe ()
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\wscntfy.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
PRC - C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Common Files\AOL\1229762181\ee\AOLSoftware.exe (America Online, Inc.)
PRC - C:\Program Files\COMODO\Firewall\cfp.exe ()
PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (AOL LLC)
PRC - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
PRC - c:\program files\common files\aol\1229762181\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe ()
PRC - C:\WINDOWS\System32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - c:\program files\common files\aol\1229762181\ee\aolsoftware.exe (America Online, Inc.)
PRC - C:\Program Files\AOL Companion\companion.exe ()
PRC - C:\Documents and Settings\HP_Owner\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (6to4 [Auto | Running]) – C:\WINDOWS\System32\6to4svc.dll (Microsoft Corporation)
SRV - (AOL ACS [Auto | Running]) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Running]) – C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (cmdAgent [Auto | Running]) – C:\Program Files\COMODO\Firewall\cmdagent.exe ()
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LPDSVC [On_Demand | Stopped]) – C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service [On_Demand | Stopped]) – C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (odserv [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (p2pgasvc [On_Demand | Stopped]) – C:\WINDOWS\System32\p2pgasvc.dll (Microsoft Corporation)
SRV - (SimpTcp [Auto | Running]) – C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AgereSoftModem [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\AGRSM.sys (Agere Systems)
DRV - (ASCTRM [Auto | Running]) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (ati2mtag [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Cap7134 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\Cap7134.sys (ASUSTek)
DRV - (cmdGuard [System | Running]) – C:\WINDOWS\System32\DRIVERS\cmdguard.sys (COMODO)
DRV - (cmdHlp [System | Running]) – C:\WINDOWS\System32\DRIVERS\cmdhlp.sys (COMODO)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (ialm [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (Inspect [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (IntcAzAudAddService [On_Demand | Running]) – C:\WINDOWS\System32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Iviaspi [On_Demand | Running]) – C:\WINDOWS\System32\drivers\iviaspi.sys (InterVideo, Inc.)
DRV - (PhTVTune [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\PhTVTune.sys (ASUSTek)
DRV - (Ps2 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (rtl8139 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation )
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys ()
DRV - (SiS315 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp [System | Running]) – C:\WINDOWS\System32\DRIVERS\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (Tcpip6 [System | Running]) – C:\WINDOWS\System32\DRIVERS\tcpip6.sys (Microsoft Corporation)
DRV - (viaagp1 [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (viagfx [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics Co, Ltd.)
DRV - (wanatw [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\wanatw4.sys (America Online, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…ER}&ar;=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=localhost:7070

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.explosm.net/comics"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:6.0
FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:3.1.20081127W
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.4.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.13
FF - prefs.js..network.proxy.http_port: 7070

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/08/05 08:19:52 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/08/05 07:28:03 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/08/05 08:20:11 | 00,000,000 | —D | M]

[2008/12/20 09:53:38 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Extensions
[2008/12/20 09:53:38 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/08/05 10:03:28 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions
[2009/01/20 16:35:54 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/01/27 21:42:31 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009/02/11 01:34:02 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\[removed]
[2009/04/04 19:40:17 | 00,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\mozilla\Firefox\Profiles\17ibpqgm.default\extensions\[removed]
[2009/08/05 10:03:24 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/08/05 07:28:02 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/01/04 20:39:03 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
[2009/08/05 08:20:14 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/05 07:27:56 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/08/05 07:27:56 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/08/05 08:19:51 | 00,410,984 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2009/08/05 07:27:58 | 00,065,528 | —- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2006/10/26 21:12:16 | 00,016,192 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL
[2008/01/04 16:36:50 | 00,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2006/07/05 19:47:38 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/01/04 16:36:50 | 00,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2008/03/08 10:35:22 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/09/22 20:14:04 | 00,000,759 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2008/04/16 05:08:20 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/03/28 19:11:14 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/01/04 16:36:50 | 00,000,831 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {001B00AE-7860-4251-AB09-F5084B6016EC} - No CLSID value found.
O2 - BHO: (no name) - {051C4D78-98FA-4B6D-ADF3-79904CC8B7AF} - No CLSID value found.
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {09EABA3C-397E-4F2C-8840-5AD3D8BDDFDB} - No CLSID value found.
O2 - BHO: (no name) - {0C8A0741-B54F-4CFA-85F8-494662FE8E41} - No CLSID value found.
O2 - BHO: (no name) - {0EDF10DE-12F8-44B7-83F4-E2AFEEDC0183} - No CLSID value found.
O2 - BHO: (no name) - {1CE272AD-E408-451E-A08B-B0048D907B33} - No CLSID value found.
O2 - BHO: (no name) - {1E1949F7-B16A-47EA-85B2-A89939417F61} - No CLSID value found.
O2 - BHO: (no name) - {1EF042BE-1F1F-44AC-B301-E6E794691394} - No CLSID value found.
O2 - BHO: (no name) - {1F0DB968-B499-4C0F-84A7-A5D30660E822} - No CLSID value found.
O2 - BHO: (no name) - {216187C0-423C-4123-908E-7246D86886A0} - No CLSID value found.
O2 - BHO: (no name) - {216D8D75-DEE0-499F-8F87-DDE12FE03DF8} - No CLSID value found.
O2 - BHO: (no name) - {27BD3C51-BC2E-49E0-9C6B-F0D0D010CE80} - No CLSID value found.
O2 - BHO: (no name) - {2FC7A6B7-EFAA-4AFC-989D-02310398F83A} - No CLSID value found.
O2 - BHO: (no name) - {303B270C-AA0A-4DE6-91A7-FD452C9631DC} - No CLSID value found.
O2 - BHO: (no name) - {3081BC85-2BB3-4238-BB8E-0D5F930892C3} - No CLSID value found.
O2 - BHO: (no name) - {33A4125A-0E9E-4959-B46E-A34689E8DD73} - No CLSID value found.
O2 - BHO: (no name) - {340DA371-C36E-4C98-85B4-3A29C3A5A0F9} - No CLSID value found.
O2 - BHO: (no name) - {350A958B-8897-4FA6-BA8E-C0202CD3F30E} - No CLSID value found.
O2 - BHO: (no name) - {35A71AF0-50BA-4074-93E6-6F097384689F} - No CLSID value found.
O2 - BHO: (no name) - {36B0CE3B-2389-48E4-92E4-00ED8579DC74} - No CLSID value found.
O2 - BHO: (no name) - {3B31C0ED-586A-408E-9CF3-D12DCD23376E} - No CLSID value found.
O2 - BHO: (no name) - {40167E6E-9DF0-423B-9094-9578D043C432} - No CLSID value found.
O2 - BHO: (no name) - {444B7843-A646-4525-A5E7-6F4CD7CE0628} - No CLSID value found.
O2 - BHO: (no name) - {46AAF4BD-32DD-4E49-91B8-33B70119D9AC} - No CLSID value found.
O2 - BHO: (no name) - {46CB60B7-610C-4A58-9E1A-32B16F37B211} - No CLSID value found.
O2 - BHO: (no name) - {511512CB-CFAC-49E0-BD1D-F5DF656A1C8A} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {538DF27D-F49D-40B1-9644-A696C2071B78} - No CLSID value found.
O2 - BHO: (no name) - {5817FDBD-3462-4B7B-9E8A-7842189010BE} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {633808CA-C1BE-4EA7-9279-1C8282BF07FF} - No CLSID value found.
O2 - BHO: (no name) - {67520427-1A9C-44CE-A679-BAC8122D8746} - No CLSID value found.
O2 - BHO: (no name) - {690E9E38-8FDB-48C7-8CD1-534E73F2666B} - No CLSID value found.
O2 - BHO: (no name) - {69432058-704F-4E6E-B1A4-493C1F3723F3} - No CLSID value found.
O2 - BHO: (no name) - {6EF9FD7C-C8B9-4F63-9271-26015961B294} - No CLSID value found.
O2 - BHO: (no name) - {74ED29C2-3B04-491F-B00E-3B1383159E91} - No CLSID value found.
O2 - BHO: (no name) - {75E0D66C-5620-4BCF-9962-AA78188164EC} - No CLSID value found.
O2 - BHO: (no name) - {765402F7-A14D-4279-88A8-EE51096F18D3} - No CLSID value found.
O2 - BHO: (no name) - {7A1F6839-AA47-4EF9-A879-E83E6AABB99A} - No CLSID value found.
O2 - BHO: (no name) - {7A4C7266-E6EF-4361-8A86-696BD89C7239} - No CLSID value found.
O2 - BHO: (no name) - {81125015-08af-4a04-9512-f21ec33a1f93} - No CLSID value found.
O2 - BHO: (no name) - {841FDACB-8EC2-4512-A9A7-51E090448A11} - No CLSID value found.
O2 - BHO: (no name) - {882F2FE5-61B3-4765-845A-485582732E33} - No CLSID value found.
O2 - BHO: (no name) - {887A2277-9875-4300-90B0-E56D56791EC3} - No CLSID value found.
O2 - BHO: (no name) - {8EDC0272-3960-41BC-91BF-1E3B32615FF0} - No CLSID value found.
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (no name) - {90BE6A4A-895D-46D4-9051-6EE6465390DC} - No CLSID value found.
O2 - BHO: (no name) - {9731BF4D-69EA-46F8-9F1E-8AAEA2EDB36E} - No CLSID value found.
O2 - BHO: (no name) - {979C9B28-D9DD-45D2-A910-642990B3DACD} - No CLSID value found.
O2 - BHO: (no name) - {9C2F459E-AA22-4CD2-B56D-E3D8878117A5} - No CLSID value found.
O2 - BHO: (no name) - {9DA61E8E-66C6-4576-8B9D-DCB3EAAF13C2} - No CLSID value found.
O2 - BHO: (no name) - {A0584506-0BC5-4623-8702-83E1EB3934D9} - No CLSID value found.
O2 - BHO: (no name) - {A0A17DFB-BD47-4618-B187-1A0E1B799EA9} - No CLSID value found.
O2 - BHO: (no name) - {A19120DB-8D7D-4BF2-A126-6C58DEEB04AD} - No CLSID value found.
O2 - BHO: (no name) - {A230C57E-46FE-4278-88DC-FFC3F296F16C} - No CLSID value found.
O2 - BHO: (no name) - {A3081139-B6D2-4DF3-B460-7DC729729457} - No CLSID value found.
O2 - BHO: (no name) - {A377CB11-8F15-4DAE-BB3E-ABBD65B1002D} - No CLSID value found.
O2 - BHO: (no name) - {A5C775ED-DFA0-417F-A84D-1850A3484F9E} - No CLSID value found.
O2 - BHO: (no name) - {A7788911-F6E2-42A1-BEEC-739001DDC8FD} - No CLSID value found.
O2 - BHO: (no name) - {A9F1B5BD-99CB-4280-AD15-F59808DE8FAF} - No CLSID value found.
O2 - BHO: (no name) - {AC10C684-C169-469F-8F8E-D057CD5FD0B9} - No CLSID value found.
O2 - BHO: (no name) - {AF912E8A-CA9E-4A9F-AA86-190C6AE9CFDE} - No CLSID value found.
O2 - BHO: (no name) - {B1387124-3580-4FC6-B866-3090489DEE59} - No CLSID value found.
O2 - BHO: (no name) - {B23E8909-C3F4-43F7-833A-9403598D6066} - No CLSID value found.
O2 - BHO: (no name) - {B309E0DF-A0FB-4391-8DD4-AF1F901AB0C3} - No CLSID value found.
O2 - BHO: (no name) - {B324C745-5811-40DF-962D-4BBCE6031155} - No CLSID value found.
O2 - BHO: (no name) - {B4672FFB-E4C6-40E2-9013-F8EDAB6F3B89} - No CLSID value found.
O2 - BHO: (no name) - {B4AA5C1C-31B4-472C-8B69-1415FC0F9AA4} - No CLSID value found.
O2 - BHO: (no name) - {B7F1CA51-A658-4824-8034-538C96E86BE8} - No CLSID value found.
O2 - BHO: (no name) - {BB4531ED-E666-4F13-B0D1-BFFAB935B300} - No CLSID value found.
O2 - BHO: (no name) - {C85B854A-A280-4B4C-8D36-2D8E3B83F591} - No CLSID value found.
O2 - BHO: (no name) - {CF2038DD-3204-4FD1-9AD1-C2B532E42779} - No CLSID value found.
O2 - BHO: (no name) - {D1AAECDA-9484-4226-B7E3-B2D718B3D076} - No CLSID value found.
O2 - BHO: (no name) - {D32943BD-A447-45DC-9F0A-27FF4E826B30} - No CLSID value found.
O2 - BHO: (no name) - {D701BC89-4050-49FC-A78B-933E976411BC} - No CLSID value found.
O2 - BHO: (no name) - {D9C33BF9-5318-4B94-9DBC-B6F1F3BB585E} - No CLSID value found.
O2 - BHO: (no name) - {DAB439E3-70F7-492A-9E1A-D3612E066DB5} - No CLSID value found.
O2 - BHO: (no name) - {DB135C85-892F-44FF-B5BC-25F3CE421C85} - No CLSID value found.
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {DBD21D7E-DCD3-477B-B6A7-06123403BC48} - No CLSID value found.
O2 - BHO: (no name) - {DDAF548A-4E81-4FF6-A5C7-BF5CA6721465} - No CLSID value found.
O2 - BHO: (no name) - {DFA0C81E-4192-4B00-8541-01D024C20998} - No CLSID value found.
O2 - BHO: (no name) - {E0E5477E-5B2E-4566-A967-52A27FF39768} - No CLSID value found.
O2 - BHO: (no name) - {E21D36C8-AC9B-4A98-8084-8E71BB61B123} - No CLSID value found.
O2 - BHO: (no name) - {E5DC1D5C-BC91-459A-85B3-97F481B05B5A} - No CLSID value found.
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O2 - BHO: (no name) - {EAFAFB62-C6FF-4B95-A0C0-756A17327F48} - No CLSID value found.
O2 - BHO: (no name) - {F1A449AC-5AC7-4B4D-BD32-DCCB6BE57F89} - No CLSID value found.
O2 - BHO: (no name) - {FF715C15-D67C-4CC2-A66D-69426256129F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\ShellBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [a0fa9d1c] C:\WINDOWS\System32\smooroaa.DLL File not found
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (AOL LLC)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [COMODO Firewall Pro] C:\Program Files\COMODO\Firewall\cfp.exe ()
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1229762181\ee\AOLSoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\System32\ps2.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()
O4 - HKLM..\Run: [SiSPower] C:\WINDOWS\System32\SiSPower.DLL (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKLM..\RunOnce: [Spybot - Search & Destroy] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\RunOnce: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKCU..\RunOnce: [SpybotDeletingB2047] C:\WINDOWS\System32\command.com ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe (America Online, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL; Toolbar search - C:\Program Files\AOL Toolbar\toolbar.dll File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Value error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/01/01 09:58:38 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 22:01:14 | 00,000,053 | -HS- | M] () - D:\AUTORUN.FCB – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/08/05 08:20:11 | 00,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/08/05 08:20:10 | 00,410,984 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2009/08/05 08:20:10 | 00,148,888 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/08/05 08:20:10 | 00,144,792 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/08/05 08:20:10 | 00,144,792 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/08/03 17:46:39 | 16,254,360 | —- | C] (Sun Microsystems, Inc.) – C:\Documents and Settings\HP_Owner\Desktop\jre-6u14-windows-i586.exe
[2009/08/02 12:37:49 | 00,073,728 | —- | C] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.EXE
[2009/08/02 12:28:01 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/08/02 12:09:54 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/08/02 11:48:33 | 00,000,000 | —D | C] – C:\_OTL
[2009/07/29 21:31:53 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2009/07/14 15:48:23 | 53,620,3264 | -HS- | C] () – C:\hiberfil.sys
[2009/04/09 21:32:30 | 00,143,104 | —- | C] () – C:\WINDOWS\System32\guard32.dll
[2009/03/05 09:01:38 | 00,011,264 | —- | C] () – C:\WINDOWS\System32\nfr.dll
[2009/02/19 18:11:25 | 00,000,029 | —- | C] () – C:\WINDOWS\DEBUGSM.INI
[2009/02/17 02:12:40 | 00,000,072 | —- | C] () – C:\WINDOWS\System32\epDPE.ini
[2009/02/17 02:11:01 | 00,000,022 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2009/02/17 02:08:32 | 00,000,025 | —- | C] () – C:\WINDOWS\CDE CX6600E.ini
[2009/01/29 22:08:55 | 00,000,665 | —- | C] () – C:\WINDOWS\wininit.ini
[2009/01/04 20:25:18 | 00,000,081 | —- | C] () – C:\WINDOWS\DVDConverter.INI
[2009/01/04 20:24:51 | 00,765,952 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/01/04 20:24:51 | 00,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/12/23 15:16:33 | 00,000,162 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/12/19 17:58:21 | 00,000,004 | —- | C] () – C:\WINDOWS\msoffice.ini
[2008/12/18 22:06:10 | 00,000,540 | —- | C] () – C:\WINDOWS\AppRun.ini
[2006/03/06 11:41:02 | 00,073,728 | —- | C] () – C:\WINDOWS\System32\AMV_DecDLL.dll
[2006/01/04 19:19:27 | 00,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2006/01/04 19:18:08 | 00,081,920 | —- | C] () – C:\WINDOWS\System32\ieencode.dll
[2005/01/02 01:00:19 | 00,103,579 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2005/01/02 01:00:19 | 00,095,249 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2005/01/01 16:45:30 | 00,000,548 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/01/01 16:45:11 | 00,000,695 | —- | C] () – C:\WINDOWS\win.ini
[2005/01/01 16:45:09 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2005/01/01 13:08:44 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/01/01 11:48:20 | 00,013,779 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2005/01/01 11:48:11 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2005/01/01 10:43:52 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\RTCOMDLL.dll
[2005/01/01 10:43:52 | 00,156,160 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2005/01/01 10:38:35 | 00,163,840 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll
[2005/01/01 10:14:45 | 00,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2005/01/01 10:14:45 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2005/01/01 10:14:30 | 00,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2005/01/01 10:02:20 | 00,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/09/16 14:26:40 | 00,012,634 | —- | C] () – C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/08/20 04:14:46 | 00,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/08/20 04:14:46 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/11 00:04:00 | 00,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll

========== Files - Modified Within 30 Days ==========

[2009/08/05 10:02:09 | 00,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2009/08/05 10:01:07 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/08/05 10:01:05 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/08/05 10:01:03 | 53,620,3264 | -HS- | M] () – C:\hiberfil.sys
[2009/08/05 08:19:50 | 00,148,888 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/08/05 08:19:50 | 00,144,792 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/08/05 08:19:50 | 00,144,792 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/08/05 08:19:50 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/08/05 08:19:49 | 00,410,984 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2009/08/03 17:47:16 | 16,254,360 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\HP_Owner\Desktop\jre-6u14-windows-i586.exe
[2009/08/02 14:23:45 | 00,000,695 | —- | M] () – C:\WINDOWS\win.ini
[2009/08/02 12:37:49 | 00,073,728 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.VER
[2009/08/02 12:37:49 | 00,073,728 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.EXE
[2009/08/02 12:06:10 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/08/02 12:05:26 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/07/29 21:31:54 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2009/07/19 11:35:08 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/07/16 07:25:48 | 04,317,612 | -H– | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\IconCache.db
[2009/07/13 05:48:54 | 00,219,648 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/07/12 22:36:30 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090723-092051.backup
< End of report >

oldman960

Post #59August 5, 2009, 1:52 PM UTC last edited August 5, 2009, 1:54 PM UTC

H Jun23,

Make sure this program is disabled. It keeps restoring old registry keys. Leave it disabled until we are done.

SPYBOT TEATIMER

Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
On the left hand side, click on Tools, then click on the Resident Icon in the list.
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
Click on the "System Startup" icon in the List
Uncheck the "TeaTimer" box and "OK" any prompts.
If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
Exit Spybot S&D when done.
(When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:OTL
O2 - BHO: (no name) - {001B00AE-7860-4251-AB09-F5084B6016EC} - No CLSID value found.
O2 - BHO: (no name) - {051C4D78-98FA-4B6D-ADF3-79904CC8B7AF} - No CLSID value found
O2 - BHO: (no name) - {09EABA3C-397E-4F2C-8840-5AD3D8BDDFDB} - No CLSID value found.
O2 - BHO: (no name) - {0C8A0741-B54F-4CFA-85F8-494662FE8E41} - No CLSID value found.
O2 - BHO: (no name) - {0EDF10DE-12F8-44B7-83F4-E2AFEEDC0183} - No CLSID value found.
O2 - BHO: (no name) - {1CE272AD-E408-451E-A08B-B0048D907B33} - No CLSID value found.
O2 - BHO: (no name) - {1E1949F7-B16A-47EA-85B2-A89939417F61} - No CLSID value found.
O2 - BHO: (no name) - {1EF042BE-1F1F-44AC-B301-E6E794691394} - No CLSID value found.
O2 - BHO: (no name) - {1F0DB968-B499-4C0F-84A7-A5D30660E822} - No CLSID value found.
O2 - BHO: (no name) - {216187C0-423C-4123-908E-7246D86886A0} - No CLSID value found.
O2 - BHO: (no name) - {216D8D75-DEE0-499F-8F87-DDE12FE03DF8} - No CLSID value found.
O2 - BHO: (no name) - {27BD3C51-BC2E-49E0-9C6B-F0D0D010CE80} - No CLSID value found.
O2 - BHO: (no name) - {2FC7A6B7-EFAA-4AFC-989D-02310398F83A} - No CLSID value found.
O2 - BHO: (no name) - {303B270C-AA0A-4DE6-91A7-FD452C9631DC} - No CLSID value found.
O2 - BHO: (no name) - {3081BC85-2BB3-4238-BB8E-0D5F930892C3} - No CLSID value found.
O2 - BHO: (no name) - {33A4125A-0E9E-4959-B46E-A34689E8DD73} - No CLSID value found.
O2 - BHO: (no name) - {340DA371-C36E-4C98-85B4-3A29C3A5A0F9} - No CLSID value found.
O2 - BHO: (no name) - {350A958B-8897-4FA6-BA8E-C0202CD3F30E} - No CLSID value found.
O2 - BHO: (no name) - {35A71AF0-50BA-4074-93E6-6F097384689F} - No CLSID value found.
O2 - BHO: (no name) - {36B0CE3B-2389-48E4-92E4-00ED8579DC74} - No CLSID value found.
O2 - BHO: (no name) - {3B31C0ED-586A-408E-9CF3-D12DCD23376E} - No CLSID value found.
O2 - BHO: (no name) - {40167E6E-9DF0-423B-9094-9578D043C432} - No CLSID value found.
O2 - BHO: (no name) - {444B7843-A646-4525-A5E7-6F4CD7CE0628} - No CLSID value found.
O2 - BHO: (no name) - {46AAF4BD-32DD-4E49-91B8-33B70119D9AC} - No CLSID value found.
O2 - BHO: (no name) - {46CB60B7-610C-4A58-9E1A-32B16F37B211} - No CLSID value found.
O2 - BHO: (no name) - {511512CB-CFAC-49E0-BD1D-F5DF656A1C8A} - No CLSID value found.
O2 - BHO: (no name) - {538DF27D-F49D-40B1-9644-A696C2071B78} - No CLSID value found.
O2 - BHO: (no name) - {5817FDBD-3462-4B7B-9E8A-7842189010BE} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {633808CA-C1BE-4EA7-9279-1C8282BF07FF} - No CLSID value found.
O2 - BHO: (no name) - {67520427-1A9C-44CE-A679-BAC8122D8746} - No CLSID value found.
O2 - BHO: (no name) - {690E9E38-8FDB-48C7-8CD1-534E73F2666B} - No CLSID value found.
O2 - BHO: (no name) - {69432058-704F-4E6E-B1A4-493C1F3723F3} - No CLSID value found.
O2 - BHO: (no name) - {6EF9FD7C-C8B9-4F63-9271-26015961B294} - No CLSID value found.
O2 - BHO: (no name) - {74ED29C2-3B04-491F-B00E-3B1383159E91} - No CLSID value found.
O2 - BHO: (no name) - {75E0D66C-5620-4BCF-9962-AA78188164EC} - No CLSID value found.
O2 - BHO: (no name) - {765402F7-A14D-4279-88A8-EE51096F18D3} - No CLSID value found.
O2 - BHO: (no name) - {7A1F6839-AA47-4EF9-A879-E83E6AABB99A} - No CLSID value found.
O2 - BHO: (no name) - {7A4C7266-E6EF-4361-8A86-696BD89C7239} - No CLSID value found.
O2 - BHO: (no name) - {81125015-08af-4a04-9512-f21ec33a1f93} - No CLSID value found.
O2 - BHO: (no name) - {841FDACB-8EC2-4512-A9A7-51E090448A11} - No CLSID value found.
O2 - BHO: (no name) - {882F2FE5-61B3-4765-845A-485582732E33} - No CLSID value found.
O2 - BHO: (no name) - {887A2277-9875-4300-90B0-E56D56791EC3} - No CLSID value found.
O2 - BHO: (no name) - {8EDC0272-3960-41BC-91BF-1E3B32615FF0} - No CLSID value found.
O2 - BHO: (no name) - {90BE6A4A-895D-46D4-9051-6EE6465390DC} - No CLSID value found.
O2 - BHO: (no name) - {9731BF4D-69EA-46F8-9F1E-8AAEA2EDB36E} - No CLSID value found.
O2 - BHO: (no name) - {979C9B28-D9DD-45D2-A910-642990B3DACD} - No CLSID value found.
O2 - BHO: (no name) - {9C2F459E-AA22-4CD2-B56D-E3D8878117A5} - No CLSID value found.
O2 - BHO: (no name) - {9DA61E8E-66C6-4576-8B9D-DCB3EAAF13C2} - No CLSID value found.
O2 - BHO: (no name) - {A0584506-0BC5-4623-8702-83E1EB3934D9} - No CLSID value found.
O2 - BHO: (no name) - {A0A17DFB-BD47-4618-B187-1A0E1B799EA9} - No CLSID value found.
O2 - BHO: (no name) - {A19120DB-8D7D-4BF2-A126-6C58DEEB04AD} - No CLSID value found.
O2 - BHO: (no name) - {A230C57E-46FE-4278-88DC-FFC3F296F16C} - No CLSID value found.
O2 - BHO: (no name) - {A3081139-B6D2-4DF3-B460-7DC729729457} - No CLSID value found.
O2 - BHO: (no name) - {A377CB11-8F15-4DAE-BB3E-ABBD65B1002D} - No CLSID value found.
O2 - BHO: (no name) - {A5C775ED-DFA0-417F-A84D-1850A3484F9E} - No CLSID value found.
O2 - BHO: (no name) - {A7788911-F6E2-42A1-BEEC-739001DDC8FD} - No CLSID value found.
O2 - BHO: (no name) - {A9F1B5BD-99CB-4280-AD15-F59808DE8FAF} - No CLSID value found.
O2 - BHO: (no name) - {AC10C684-C169-469F-8F8E-D057CD5FD0B9} - No CLSID value found.
O2 - BHO: (no name) - {AF912E8A-CA9E-4A9F-AA86-190C6AE9CFDE} - No CLSID value found.
O2 - BHO: (no name) - {B1387124-3580-4FC6-B866-3090489DEE59} - No CLSID value found.
O2 - BHO: (no name) - {B23E8909-C3F4-43F7-833A-9403598D6066} - No CLSID value found.
O2 - BHO: (no name) - {B309E0DF-A0FB-4391-8DD4-AF1F901AB0C3} - No CLSID value found.
O2 - BHO: (no name) - {B324C745-5811-40DF-962D-4BBCE6031155} - No CLSID value found.
O2 - BHO: (no name) - {B4672FFB-E4C6-40E2-9013-F8EDAB6F3B89} - No CLSID value found.
O2 - BHO: (no name) - {B4AA5C1C-31B4-472C-8B69-1415FC0F9AA4} - No CLSID value found.
O2 - BHO: (no name) - {B7F1CA51-A658-4824-8034-538C96E86BE8} - No CLSID value found.
O2 - BHO: (no name) - {BB4531ED-E666-4F13-B0D1-BFFAB935B300} - No CLSID value found.
O2 - BHO: (no name) - {C85B854A-A280-4B4C-8D36-2D8E3B83F591} - No CLSID value found.
O2 - BHO: (no name) - {CF2038DD-3204-4FD1-9AD1-C2B532E42779} - No CLSID value found.
O2 - BHO: (no name) - {D1AAECDA-9484-4226-B7E3-B2D718B3D076} - No CLSID value found.
O2 - BHO: (no name) - {D32943BD-A447-45DC-9F0A-27FF4E826B30} - No CLSID value found.
O2 - BHO: (no name) - {D701BC89-4050-49FC-A78B-933E976411BC} - No CLSID value found.
O2 - BHO: (no name) - {D9C33BF9-5318-4B94-9DBC-B6F1F3BB585E} - No CLSID value found.
O2 - BHO: (no name) - {DAB439E3-70F7-492A-9E1A-D3612E066DB5} - No CLSID value found.
O2 - BHO: (no name) - {DB135C85-892F-44FF-B5BC-25F3CE421C85} - No CLSID value found.
O2 - BHO: (no name) - {DBD21D7E-DCD3-477B-B6A7-06123403BC48} - No CLSID value found.
O2 - BHO: (no name) - {DDAF548A-4E81-4FF6-A5C7-BF5CA6721465} - No CLSID value found.
O2 - BHO: (no name) - {DFA0C81E-4192-4B00-8541-01D024C20998} - No CLSID value found.
O2 - BHO: (no name) - {E0E5477E-5B2E-4566-A967-52A27FF39768} - No CLSID value found.
O2 - BHO: (no name) - {E21D36C8-AC9B-4A98-8084-8E71BB61B123} - No CLSID value found.
O2 - BHO: (no name) - {E5DC1D5C-BC91-459A-85B3-97F481B05B5A} - No CLSID value found.
O2 - BHO: (no name) - {EAFAFB62-C6FF-4B95-A0C0-756A17327F48} - No CLSID value found.
O2 - BHO: (no name) - {F1A449AC-5AC7-4B4D-BD32-DCCB6BE57F89} - No CLSID value found.
O2 - BHO: (no name) - {FF715C15-D67C-4CC2-A66D-69426256129F} - No CLSID value found.
O4 - HKLM..\Run: [a0fa9d1c] C:\WINDOWS\System32\smooroaa.DLL File not found

:Services

:Reg

:Files

:Commands

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions.
You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
- Mail databases
Click on My Computerr under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Change the Files of type to Text file (.txt)
Set the Save In to Desktop
click the Save button.
Please post this log in your next reply along with a new OTL log.

Please post back with

MBAM log
Kaspersky log
new OTL log taken last

Everything still ok?

Thanks

jun23

Post #60August 6, 2009, 11:12 AM UTC

Hi, I've done the first OTL scan/fix but I can't find mbam-setup.exe on the website. Please help, thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] what happened? (failtechie)

✨ Ask AI

Ask AI