Spyware / Malware / Virus Removal

[Resolved] braviax

13 min read

Looking for the outcome? Ask AI

madvet2 Topic Starter

Post #1August 31, 2009, 1:54 PM UTC

Hello again,
I've rescanned with the updated HJT.
I am getting popups telling me my computer is infected and wanting me to download software to repair it.
I humbly request your assistance.
Fred

Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks\osCheck.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00130000-B1BA-11CE-ABC6-F5B2E79D9E3F} (LEAD Main Control (13.0)) - http://www.vetpacs.com/ltocx13n.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {3CBA13C3-58C7-47F1-9758-D4B255A50D52} (SESSearchCtrl Class) - file:///D:/WVC-Encore_Notes_2008/data/index/ses_ocx/sessearch.ocx
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} (PCPitstop AntiVirus) - http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/…101/CTSUEng.cab
O16 - DPF: {7D7D0CF0-BB7C-473E-8B35-7590F7D86671} (eFilmX Image Retrieval Module) - http://209.143.230.217/FusionServer/ActiveX/coefir.cab
O16 - DPF: {B1B22D8C-30F6-4BD5-8291-7C855D5CF2FC} (eFilmX Image Viewer) - http://209.143.230.217/FusionServer/ActiveX/eFilmX.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup162.cab
O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://gis.cityofmadison.com/ACGM_7146/Acgm.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/…15105/CTPID.cab
O16 - DPF: {FAA26872-BB40-4AB2-8A6D-A49183581AAA} (TSBnwCam Control) - http://132.216.45.146/user/TSBnwCam.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{35268EAD-4A81-4C4D-A717-F389B13A71E7}: NameServer = 4.2.2.4,4.2.2.5
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: Google Update Service (gupdate1c9ce5bbaa9c4e6) (gupdate1c9ce5bbaa9c4e6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

–
End of file - 12511 bytes

chamber

Post #2August 31, 2009, 4:14 PM UTC

Hi,

Lets see if we can get you cleaned up.

1) Win32Diag

Please download Win32Diag from one of the links below and save it to your desktop.

Link 1
Link 2
Link 3

Double-click on Win32Diag.exe to run it. If you are using Windows Vista, please right-click and select Run As Administrator
A black command prompt window shall appear.
It will now begin to scan. This may take a while, please be paitent until the scan is complete.
Once it's done, in the black screen it will say "Finished! Press any key to exit…. Press any key to exit.
A log file called Win32KDiag.txt will be created on your desktop.
Please copy and paste the contents of that log file here in your next reply please.

2) ComboFix

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".
During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

———————————————————–
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  ———————————————————–
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
———————————————————–
Double click on combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" along with a new OTL log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

In your reply I would like to see copied and pasted,

1) Win32Diag log
2) ComboFix log

madvet2

Post #3August 31, 2009, 5:32 PM UTC

Ran windiag Did I do something wrong all I get is.. Log file is located at: C:\Documents and Settings\Nothnagel\Desktop\Win32kDiag.txt WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'… Finished!

chamber

Post #4August 31, 2009, 5:35 PM UTC

No, That just lets me know that it's not a specific infection. Please carry on with ComboFix if possible.

madvet2

Post #5August 31, 2009, 5:57 PM UTC

ok combo-fix is scanning,had to get recovery console first. You mentioned OTL log? I'm being dense today, what's otl? Fred

chamber

Post #6August 31, 2009, 6:02 PM UTC

That would be my fault, I forgot to take that part out. Don't worry about it for now.

madvet2

Post #7August 31, 2009, 8:00 PM UTC

OK, here's the combo-fix report ComboFix 09-08-30.04 - Nothnagel 08/31/2009 12:55.2.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.398 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe AV: Norton AntiVirus *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton AntiVirus *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\NOTHNA~1\LOCALS~1\Temp\catchme.dll c:\documents and settings\Nothnagel\Local Settings\temp\catchme.dll c:\documents and settings\Nothnagel\My Documents\PreBufferChange.reg c:\recycler\NPROTECT\00000000.DAT c:\recycler\NPROTECT\00000001.DAT c:\recycler\NPROTECT\00000002 c:\recycler\NPROTECT\00000003 c:\recycler\NPROTECT\00000004 c:\recycler\NPROTECT\00000005 c:\recycler\NPROTECT\00000006 c:\recycler\NPROTECT\00000007 c:\recycler\NPROTECT\00000009 c:\recycler\NPROTECT\00000011 c:\recycler\NPROTECT\00000012 c:\recycler\NPROTECT\00000013 c:\recycler\NPROTECT\00000014 c:\recycler\NPROTECT\00000017.DAT c:\recycler\NPROTECT\00000018 c:\recycler\NPROTECT\00000019 c:\recycler\NPROTECT\00000020 c:\recycler\NPROTECT\00000021 c:\recycler\NPROTECT\00000022 c:\recycler\NPROTECT\00000023 c:\recycler\NPROTECT\00000024 c:\recycler\NPROTECT\00000027 c:\recycler\NPROTECT\00000028.DAT c:\recycler\NPROTECT\00000029 c:\recycler\NPROTECT\00000030 c:\recycler\NPROTECT\00000031 c:\recycler\NPROTECT\00000032 c:\recycler\NPROTECT\00000033 c:\recycler\NPROTECT\00000034 c:\recycler\NPROTECT\00000035 c:\recycler\NPROTECT\00000036 c:\recycler\NPROTECT\00000037 c:\recycler\NPROTECT\00000038 c:\recycler\NPROTECT\00000039 c:\recycler\NPROTECT\00000040 c:\recycler\NPROTECT\00000041 c:\recycler\NPROTECT\00000042 c:\recycler\NPROTECT\00000043 c:\recycler\NPROTECT\00000044 c:\recycler\NPROTECT\00000047 c:\recycler\NPROTECT\00000048 c:\recycler\NPROTECT\00000050 c:\recycler\NPROTECT\00000051 c:\recycler\NPROTECT\00000052 c:\recycler\NPROTECT\00000053 c:\recycler\NPROTECT\00000054 c:\recycler\NPROTECT\00000056 c:\recycler\NPROTECT\00000057 c:\recycler\NPROTECT\00000058 c:\recycler\NPROTECT\00000059 c:\recycler\NPROTECT\00000060 c:\recycler\NPROTECT\00000061 c:\recycler\NPROTECT\00000062 c:\recycler\NPROTECT\00000063 c:\recycler\NPROTECT\00000064 c:\recycler\NPROTECT\00000065 c:\recycler\NPROTECT\00000066 c:\recycler\NPROTECT\00000067 c:\recycler\NPROTECT\00000068 c:\recycler\NPROTECT\00000069 c:\recycler\NPROTECT\00000071 c:\recycler\NPROTECT\00000072 c:\recycler\NPROTECT\00000074 c:\recycler\NPROTECT\00000076 c:\recycler\NPROTECT\00000078 c:\recycler\NPROTECT\00000079 c:\recycler\NPROTECT\00000080 c:\recycler\NPROTECT\00000081 c:\recycler\NPROTECT\00000084 c:\recycler\NPROTECT\00000085 c:\recycler\NPROTECT\00000086 c:\recycler\NPROTECT\00000087 c:\recycler\NPROTECT\00000089 c:\recycler\NPROTECT\00000091 c:\recycler\NPROTECT\00000092 c:\recycler\NPROTECT\00000093 c:\recycler\NPROTECT\00000094 c:\recycler\NPROTECT\00000095 c:\recycler\NPROTECT\00000101 c:\recycler\NPROTECT\00000102 c:\recycler\NPROTECT\00000103 c:\recycler\NPROTECT\00000104 c:\recycler\NPROTECT\00000105 c:\recycler\NPROTECT\00000106 c:\recycler\NPROTECT\00000107 c:\recycler\NPROTECT\00000108 c:\recycler\NPROTECT\00000109 c:\recycler\NPROTECT\00000111 c:\recycler\NPROTECT\00000112 c:\recycler\NPROTECT\00000113 c:\recycler\NPROTECT\00000115 c:\recycler\NPROTECT\00000116 c:\recycler\NPROTECT\00000117 c:\recycler\NPROTECT\00000118 c:\recycler\NPROTECT\00000120 c:\recycler\NPROTECT\00000121 c:\recycler\NPROTECT\00000122 c:\recycler\NPROTECT\00000123 c:\recycler\NPROTECT\00000124 c:\recycler\NPROTECT\00000125 c:\recycler\NPROTECT\00000127 c:\recycler\NPROTECT\00000128 c:\recycler\NPROTECT\00000129 c:\recycler\NPROTECT\00000130 c:\recycler\NPROTECT\00000131 c:\recycler\NPROTECT\00000133 c:\recycler\NPROTECT\00000134 c:\recycler\NPROTECT\00000135 c:\recycler\NPROTECT\00000136 c:\recycler\NPROTECT\00000137 c:\recycler\NPROTECT\00000138 c:\recycler\NPROTECT\00000139 c:\recycler\NPROTECT\00000140 c:\recycler\NPROTECT\00000141 c:\recycler\NPROTECT\00000142 c:\recycler\NPROTECT\00000143 c:\recycler\NPROTECT\00000144 c:\recycler\NPROTECT\00000148 c:\recycler\NPROTECT\00000149.dat c:\recycler\NPROTECT\00000150.dat c:\recycler\NPROTECT\00000151 c:\recycler\NPROTECT\00000152 c:\recycler\NPROTECT\00000153 c:\recycler\NPROTECT\00000154 c:\recycler\NPROTECT\00000155 c:\recycler\NPROTECT\00000156 c:\recycler\NPROTECT\00000157 c:\recycler\NPROTECT\00000158 c:\recycler\NPROTECT\00000160 c:\recycler\NPROTECT\00000162.dat c:\recycler\NPROTECT\00000166 c:\recycler\NPROTECT\00000167.bat c:\recycler\NPROTECT\00000168 c:\recycler\NPROTECT\00000169 c:\recycler\NPROTECT\00000170 c:\recycler\NPROTECT\00000171 c:\recycler\NPROTECT\00000172 c:\recycler\NPROTECT\00000173 c:\recycler\NPROTECT\00000175 c:\recycler\NPROTECT\00000176 c:\recycler\NPROTECT\00000178 c:\recycler\NPROTECT\00000179 c:\recycler\NPROTECT\00000180 c:\recycler\NPROTECT\00000183 c:\recycler\NPROTECT\00000184 c:\recycler\NPROTECT\00000185 c:\recycler\NPROTECT\00000186 c:\recycler\NPROTECT\00000187 c:\recycler\NPROTECT\00000188 c:\recycler\NPROTECT\00000189 c:\recycler\NPROTECT\00000191 c:\recycler\NPROTECT\00000192 c:\recycler\NPROTECT\00000193 c:\recycler\NPROTECT\00000194 c:\recycler\NPROTECT\00000195 c:\recycler\NPROTECT\00000196 c:\recycler\NPROTECT\00000197 c:\recycler\NPROTECT\00000198 c:\recycler\NPROTECT\00000199 c:\recycler\NPROTECT\00000200 c:\recycler\NPROTECT\00000201 c:\recycler\NPROTECT\00000202 c:\recycler\NPROTECT\00000203 c:\recycler\NPROTECT\00000204 c:\recycler\NPROTECT\00000205 c:\recycler\NPROTECT\00000206 c:\recycler\NPROTECT\00000207 c:\recycler\NPROTECT\00000208 c:\recycler\NPROTECT\00000209 c:\recycler\NPROTECT\00000210 c:\recycler\NPROTECT\00000211 c:\recycler\NPROTECT\00000212 c:\recycler\NPROTECT\00000213 c:\recycler\NPROTECT\00000214 c:\recycler\NPROTECT\00000215 c:\recycler\NPROTECT\00000216 c:\recycler\NPROTECT\00000217 c:\recycler\NPROTECT\00000218 c:\recycler\NPROTECT\00000219 c:\recycler\NPROTECT\00000220 c:\recycler\NPROTECT\00000221 c:\recycler\NPROTECT\00000222 c:\recycler\NPROTECT\00000223 c:\recycler\NPROTECT\00000224 c:\recycler\NPROTECT\00000225 c:\recycler\NPROTECT\00000227 c:\recycler\NPROTECT\00000228 c:\recycler\NPROTECT\00000229 c:\recycler\NPROTECT\00000230 c:\recycler\NPROTECT\00000233 c:\recycler\NPROTECT\00000236 c:\recycler\NPROTECT\00000237 c:\recycler\NPROTECT\00000238 c:\recycler\NPROTECT\00000239 c:\recycler\NPROTECT\00000240 c:\recycler\NPROTECT\00000241 c:\recycler\NPROTECT\00000242.dat c:\recycler\NPROTECT\00000243 c:\recycler\NPROTECT\00000244.bad c:\recycler\NPROTECT\00000245 c:\recycler\NPROTECT\00000246 c:\recycler\NPROTECT\00000247 c:\recycler\NPROTECT\00000248 c:\recycler\NPROTECT\00000249 c:\recycler\NPROTECT\00000255 c:\recycler\NPROTECT\00000256 c:\recycler\NPROTECT\00000258.md5 c:\recycler\NPROTECT\00000266 c:\windows\Installer\17fcd4a.msp c:\windows\Installer\190d0f.msp c:\windows\Installer\2199f.msp c:\windows\Installer\403360d.msp c:\windows\Installer\403360e.msp c:\windows\Installer\403360f.msp c:\windows\Installer\4033610.msp c:\windows\Installer\4033611.msp c:\windows\Installer\4033612.msp c:\windows\Installer\4033613.msp c:\windows\Installer\4033614.msp c:\windows\Installer\4033615.msp c:\windows\Installer\5430b.msi c:\windows\Installer\588a6ce.msp c:\windows\Installer\84c40a5.msp c:\windows\Installer\84c40b8.msp c:\windows\Installer\84c40ca.msp c:\windows\Installer\85b968f.msp c:\windows\Installer\85b96a7.msp c:\windows\Installer\85b96b9.msp c:\windows\Installer\85b96d1.msp c:\windows\Installer\85b96e3.msp c:\windows\Installer\85b96f5.msp c:\windows\Installer\85b9708.msp c:\windows\Installer\92a5835.msp c:\windows\Installer\9cc34f9.msp c:\windows\Installer\b21d4.msp c:\windows\Installer\e4a1.msp c:\windows\Installer\f7a7ca3.msp c:\windows\system32\braviax.exe c:\windows\system32\wisdstr.exe c:\recycler\NPROTECT . . . . failed to delete c:\recycler\NPROTECT\NPROTECT.LOG . . . . failed to delete f:\recycler\NPROTECT\NPROTECT.LOG . . . . failed to delete . ((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-31 ))))))))))))))))))))))))))))))) . 2009-08-31 13:50 . 2009-08-31 13:50 ——– d—–w- c:\program files\Trend Micro 2009-08-13 08:24 . 2009-07-10 13:27 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll 2009-08-12 05:07 . 2009-08-12 05:07 570672 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\mlhttps10.dll 2009-08-12 05:07 . 2009-08-12 05:07 496944 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\mlrsa10.dll 2009-08-12 05:07 . 2009-08-12 05:07 296240 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\mlsock10.dll 2009-08-12 05:07 . 2009-08-12 05:07 263472 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\mlcrsa10.dll 2009-08-12 05:07 . 2009-08-12 05:07 850736 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\dblgen11.dll 2009-08-12 05:07 . 2009-08-12 05:07 787760 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dblgen10.dll 2009-08-12 05:07 . 2009-08-12 05:07 763184 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dblib10.dll 2009-08-12 05:07 . 2009-08-12 05:07 423216 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dbmlsync.exe 2009-08-12 05:07 . 2009-08-12 05:07 394544 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dbcon10.dll 2009-08-12 05:07 . 2009-08-12 05:07 2151728 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\iAnywhere.Data.SQLAnywhere.dll 2009-08-12 05:07 . 2009-08-12 05:07 1152304 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Sybase10\dbtool10.dll 2009-08-08 20:27 . 2009-08-08 21:07 ——– d—–w- c:\documents and settings\Nothnagel\Application Data\skypePM 2009-08-08 20:27 . 2009-08-08 20:27 56 —ha-w- c:\windows\system32\ezsidmv.dat 2009-08-08 20:10 . 2009-08-08 20:10 ——– d—–w- c:\program files\Common Files\Skype 2009-08-08 20:10 . 2009-08-08 20:10 ——– d—–r- c:\program files\Skype 2009-08-08 20:10 . 2009-08-08 20:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype 2009-08-08 20:07 . 2009-08-08 20:07 1962544 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe 2009-08-08 19:34 . 2009-08-10 13:21 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS 2009-08-08 19:34 . 2009-08-10 13:21 ——– d—–w- c:\program files\NOS 2009-08-08 19:12 . 2009-08-08 19:12 ——– d—–w- c:\program files\Common Files\xing shared 2009-08-07 13:31 . 2009-08-07 13:31 ——– d—–w- c:\documents and settings\Nothnagel\Local Settings\Application Data\PCHealth 2009-08-07 08:07 . 2009-08-07 08:07 ——– d—–w- c:\windows\system32\XPSViewer 2009-08-07 08:07 . 2009-08-07 08:07 ——– d—–w- c:\program files\MSBuild 2009-08-07 08:07 . 2009-08-07 08:07 ——– d—–w- c:\program files\Reference Assemblies 2009-08-07 08:05 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-08-07 08:05 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll 2009-08-07 08:05 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll 2009-08-07 08:05 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll 2009-08-07 08:05 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-08-07 08:05 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll 2009-08-07 08:05 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll 2009-08-05 19:48 . 2008-09-29 11:09 1290584 —-a-w- c:\documents and settings\All Users\Application Data\Symantec\SyKnAppS\Freezer\CAV\SyKnAppS.dll 2009-08-05 09:01 . 2009-08-05 09:01 204800 -c—-w- c:\windows\system32\dllcache\mswebdvd.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-31 18:02 . 2006-07-20 02:43 26275 —-a-w- c:\windows\system32\tablet.dat 2009-08-31 18:02 . 2006-06-22 17:22 ——– d—–w- c:\program files\Common Files\Symantec Shared 2009-08-31 17:02 . 2008-08-05 03:40 ——– d—–w- c:\program files\Norton SystemWorks 2009-08-31 05:30 . 2006-11-11 19:21 ——– d—–w- c:\program files\Eraser 2009-08-29 18:38 . 2009-06-06 16:27 2711 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\qbbackup.sys 2009-08-18 14:09 . 2006-09-19 22:18 ——– d—–w- c:\documents and settings\Nothnagel\Application Data\ArcSoft 2009-08-12 05:07 . 2009-06-06 20:43 976648 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\IntuitSyncManager.exe 2009-08-12 05:07 . 2009-06-06 20:43 195848 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\IntuitSyncManagerPatch.exe 2009-08-08 21:48 . 2006-10-19 13:34 ——– d—–w- c:\documents and settings\Nothnagel\Application Data\Skype 2009-08-08 19:41 . 2009-01-22 16:17 411368 —-a-w- c:\windows\system32\deploytk.dll 2009-08-08 19:12 . 2006-07-28 16:57 ——– d—–w- c:\program files\Common Files\Real 2009-08-08 19:12 . 2003-02-21 04:42 348160 —-a-w- c:\windows\system32\msvcr71.dll 2009-08-08 13:31 . 2006-06-22 14:38 37616 —-a-w- c:\documents and settings\Nothnagel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-08-07 06:26 . 2009-06-06 20:41 869640 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\DownloadQB19\Patch\qbpatch.exe 2009-08-06 15:17 . 2008-08-05 03:59 ——– d—–w- c:\program files\Norton AntiVirus 2009-08-05 09:01 . 2006-06-22 13:58 204800 —-a-w- c:\windows\system32\mswebdvd.dll 2009-07-30 14:19 . 2009-07-30 14:19 ——– d—–w- c:\program files\OverDrive Media Console 2009-07-28 13:17 . 2009-07-28 13:17 ——– d—–w- c:\program files\iTunes 2009-07-28 13:17 . 2009-07-28 13:17 ——– d—–w- c:\program files\iPod 2009-07-28 13:17 . 2008-09-30 14:56 ——– d—–w- c:\program files\Common Files\Apple 2009-07-28 13:11 . 2009-07-28 13:11 75040 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe 2009-07-17 22:42 . 2006-07-25 23:30 ——– d—–w- c:\program files\Motorola Phone Tools 2009-07-17 22:41 . 2006-12-09 19:41 ——– d—–w- c:\program files\Avanquest update 2009-07-17 21:44 . 2009-07-17 21:44 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motport_01005.Wdf 2009-07-17 21:44 . 2009-07-17 21:44 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf 2009-07-17 21:44 . 2009-07-17 21:44 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgp_01005.Wdf 2009-07-17 19:01 . 2003-03-31 12:00 58880 —-a-w- c:\windows\system32\atl.dll 2009-07-14 04:43 . 2006-06-22 14:03 286208 —-a-w- c:\windows\system32\wmpdxm.dll 2009-07-13 17:18 . 2006-09-02 18:12 ——– d—–w- c:\documents and settings\Nothnagel\Application Data\Apple Computer 2009-07-13 17:07 . 2009-07-13 17:07 ——– d—–w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-07-13 17:05 . 2009-07-13 17:05 ——– d—–w- c:\program files\QuickTime 2009-07-13 17:02 . 2007-07-12 20:21 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple 2009-07-05 02:38 . 2009-07-05 02:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-07-05 02:36 . 2006-07-27 14:08 ——– d—–w- c:\program files\Lavasoft 2009-06-29 16:12 . 2003-03-31 12:00 827392 —-a-w- c:\windows\system32\wininet.dll 2009-06-29 16:12 . 2006-06-22 14:03 78336 —-a-w- c:\windows\system32\ieencode.dll 2009-06-29 16:12 . 2003-03-31 12:00 17408 —-a-w- c:\windows\system32\corpol.dll 2009-06-16 14:36 . 2003-03-31 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2003-03-31 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll 2009-06-12 12:31 . 2003-03-31 12:00 80896 —-a-w- c:\windows\system32\tlntsess.exe 2009-06-12 12:31 . 2003-03-31 12:00 76288 —-a-w- c:\windows\system32\telnet.exe 2009-06-10 14:19 . 2006-06-22 13:33 2066432 —-a-w- c:\windows\system32\mstscax.dll 2009-06-10 14:13 . 2003-03-31 12:00 84992 —-a-w- c:\windows\system32\avifil32.dll 2009-06-10 06:14 . 2003-03-31 12:00 132096 —-a-w- c:\windows\system32\wkssvc.dll 2009-06-06 20:43 . 2009-06-06 20:43 34056 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Interop.QBInstanceFinder.dll 2009-06-06 20:43 . 2009-06-06 20:43 192512 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\ICSharpCode.SharpZipLib.dll 2009-06-06 20:41 . 2009-06-06 20:41 499712 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\DownloadQB19\Patch\msvcp71.dll 2009-06-06 20:41 . 2009-06-06 20:41 348160 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2009\Components\DownloadQB19\Patch\msvcr71.dll 2009-06-05 16:42 . 2009-03-18 17:01 2060288 —-a-w- c:\windows\system32\usbaaplrc.dll 2009-06-05 16:42 . 2008-09-30 14:57 39424 —-a-w- c:\windows\system32\drivers\usbaapl.sys 2009-06-03 19:09 . 2006-06-22 13:58 1291264 —-a-w- c:\windows\system32\quartz.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Eraser"="c:\program files\Eraser\eraser.exe" [2006-08-07 634880] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] "NSWosCheck"="c:\program files\Norton SystemWorks\osCheck.exe" [2007-09-18 25472] "osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2007-08-25 714608] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648] "Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2008-09-09 623880] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-08-08 198160] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-08 149280] "CTHelper"="CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2005-12-08 16384] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-7-16 25214] Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-7-16 110592] QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-7-16 984352] TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2006-7-19 106496] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Audible Download Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Audible Download Manager.lnk backup=c:\windows\pss\Audible Download Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [1/10/2009 4:20 PM 28544] R1 GhPciScan;GhostPciScanner;c:\program files\Symantec\Norton Ghost 2003\GhPciScan.sys [8/14/2002 3:11 PM 5632] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [8/25/2007 12:07 AM 149352] R2 NProtectService;Norton UnErase Protection;c:\progra~1\NORTON~1\NORTON~1\NPROTECT.EXE [11/3/2005 10:08 PM 95832] R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\pfmodnt.sys [12/8/2005 12:20 PM 8192] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/5/2009 6:09 AM 101936] S2 gupdate1c9ce5bbaa9c4e6;Google Update Service (gupdate1c9ce5bbaa9c4e6);c:\program files\Google\Update\GoogleUpdate.exe [5/6/2009 10:02 AM 133104] S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [5/29/2007 3:55 PM 23888] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [6/17/2007 4:04 PM 17792] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [6/17/2007 4:04 PM 7680] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [6/17/2007 4:04 PM 21504] S3 Vssprot_1c;Vssprot_1c; [x] . Contents of the 'Scheduled Tasks' folder 2009-08-25 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34] 2009-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-06 15:02] 2009-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-06 15:02] 2009-08-25 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Nothnagel.job - c:\program files\Norton AntiVirus\Navw32.exe [2007-08-27 01:19] 2009-08-31 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job - c:\program files\Norton SystemWorks\OBC.exe [2007-09-18 13:22] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com mStart Page = hxxp://www.google.com uInternet Settings,ProxyOverride = 127.0.0.1;*.local IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Trusted Zone: aol.com\free TCP: {35268EAD-4A81-4C4D-A717-F389B13A71E7} = 4.2.2.4,4.2.2.5 Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dll DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: {3CBA13C3-58C7-47F1-9758-D4B255A50D52} - file:///D:/WVC-Encore_Notes_2008/data/index/ses_ocx/sessearch.ocx DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} - hxxp://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll DPF: {7D7D0CF0-BB7C-473E-8B35-7590F7D86671} - hxxp://209.143.230.217/FusionServer/ActiveX/coefir.cab DPF: {B1B22D8C-30F6-4BD5-8291-7C855D5CF2FC} - hxxp://209.143.230.217/FusionServer/ActiveX/eFilmX.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {FAA26872-BB40-4AB2-8A6D-A49183581AAA} - hxxp://132.216.45.146/user/TSBnwCam.CAB . ************************************************************************** disk not found C:\ please note that you need administrator rights to perform deep scan scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-1645522239-1390067357-1801674531-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'explorer.exe'(3064) c:\windows\system32\WININET.dll c:\windows\system32\tabhook.dll c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\ieframe.dll c:\program files\Common Files\Symantec Shared\NPC\2.0\NPCEXT.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ———————— Other Running Processes ———————— . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\progra~1\Symantec\NORTON~1\GHOSTS~2.EXE c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\HPZipm12.exe c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe c:\windows\system32\Tablet.exe c:\windows\system32\MsPMSPSv.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2009-08-31 13:05 - machine was rebooted ComboFix-quarantined-files.txt 2009-08-31 18:05 Pre-Run: 43,814,166,528 bytes free Post-Run: 43,793,903,616 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 520 — E O F — 2009-08-26 08:00 And the WinDiag log Log file is located at: C:\Documents and Settings\Nothnagel\Desktop\Win32kDiag.txt WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'… Finished! Let me know what you need next, Fred

chamber

Post #8August 31, 2009, 10:51 PM UTC

Hi,

1) TFC

Download TFC to your desktop

Open the file and close any other windows.
It will close all programs itself when run, make sure to let it run uninterrupted.
Click the Start button to begin the process. The program should not take long to finish its job
Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

2) Malwarebytes

[external image: Posted Image] Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

3) OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

In your reply I would like to see copied and pasted,

1) Malwarebytes log
2) OTL log
3) Extras log

madvet2

Post #9September 1, 2009, 5:13 PM UTC

OK,
I've run everything between appointments. I think all the reports are here.
Fred

Malwarebytes' Anti-Malware 1.40
Database version: 2725
Windows 5.1.2600 Service Pack 3

9/1/2009 11:37:09 AM
mbam-log-2009-09-01 (11-37-09).txt

Scan type: Quick Scan
Objects scanned: 100753
Time elapsed: 6 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e596df5f-4239-4d40-8367-ebadf0165917} (Rogue.Installer) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Settings\Nothnagel\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.23 Mb Total Physical Memory | 622.19 Mb Available Physical Memory | 60.81% Memory free
2.40 Gb Paging File | 2.09 Gb Available in Paging File | 86.99% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 40.87 Gb Free Space | 71.38% Space Free | Partition Type: NTFS
Drive D: | 4.92 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
Drive F: | 298.09 Gb Total Space | 264.65 Gb Free Space | 88.78% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
Drive H: | 74.53 Gb Total Space | 57.39 Gb Free Space | 77.01% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: DRN
Current User Name: Nothnagel
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe (Symantec Corporation)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE (Symantec Corporation)
PRC - C:\WINDOWS\System32\HPZipm12.exe (HP)
PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
PRC - C:\WINDOWS\System32\Tablet.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\System32\MsPMSPSv.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\CTHELPER.EXE (Creative Technology Ltd)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Eraser\eraser.exe (Heidi Computers Ltd)
PRC - C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
PRC - C:\WINDOWS\System32\WTablet\TabUserW.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Documents and Settings\Nothnagel\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Adobe LM Service [On_Demand | Stopped]) – C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (AdobeVersionCue [On_Demand | Stopped]) – C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe (Adobe Sytems)
SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Automatic LiveUpdate Scheduler [Auto | Running]) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (Bonjour Service [Auto | Running]) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (ccEvtMgr [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccSetMgr [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CLTNetCnService [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (GhostStartService [Auto | Running]) – C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe (Symantec Corporation)
SRV - (gupdate1c9ce5bbaa9c4e6 [Auto | Stopped]) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (gusvc [On_Demand | Stopped]) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LiveUpdate [On_Demand | Stopped]) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (LiveUpdate Notice [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (NProtectService [Auto | Running]) – C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE (Symantec Corporation)
SRV - (NVSvc [On_Demand | Stopped]) – C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [Auto | Running]) – C:\WINDOWS\System32\HPZipm12.exe (HP)
SRV - (QBCFMonitorService [Auto | Running]) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
SRV - (QBFCService [On_Demand | Stopped]) – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)
SRV - (Speed Disk service [On_Demand | Stopped]) – C:\Program Files\Norton SystemWorks\Norton Utilities\Speed Disk\NOPDB.exe (Symantec Corporation)
SRV - (Symantec Core LC [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (Symantec RemoteAssist [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (TabletService [Auto | Running]) – C:\WINDOWS\System32\Tablet.exe (Wacom Technology, Corp.)
SRV - (Vssprot_1c [On_Demand | Stopped]) – File not found
SRV - (WMDM PMSP Service [Auto | Running]) – C:\WINDOWS\System32\MsPMSPSv.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc [Auto | Running]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (Aspi32 [Auto | Running]) – C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec)
DRV - (COH_Mon [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\COH_Mon.sys (Symantec Corporation)
DRV - (ctac32k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (ctaud2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctdvda2k [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (eeCtrl [System | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EIO [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\EIO.sys (ASUSTeK Computer Inc.)
DRV - (emupia [On_Demand | Running]) – C:\WINDOWS\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (EraserUtilRebootDrv [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (gameenum [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (GhPciScan [System | Running]) – C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys (Symantec Corporation)
DRV - (ha10kx2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (hap16v2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\hap16v2k.sys (Creative Technology Ltd)
DRV - (hap17v2k [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\hap17v2k.sys (Creative Technology Ltd)
DRV - (motccgp [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motccgp.sys (Motorola)
DRV - (motccgpfl [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motccgpfl.sys (Motorola)
DRV - (motmodem [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motmodem.sys (Motorola)
DRV - (motport [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motport.sys (Motorola)
DRV - (NAVENG [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090804.040\NAVENG.SYS (Symantec Corporation)
DRV - (NAVEX15 [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090804.040\NAVEX15.SYS (Symantec Corporation)
DRV - (NPDriver [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\NPDRIVER.SYS (Symantec Corporation)
DRV - (nv [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (ossrv [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (pavboot [Boot | Running]) – C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (PenClass [Boot | Running]) – C:\WINDOWS\system32\drivers\PenClass.sys (Wacom Technology Corporation)
DRV - (PfDetNT [Auto | Running]) – C:\WINDOWS\System32\drivers\PfModNT.sys (Creative Technology Ltd.)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (ROOTMODEM [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\RootMdm.sys (Microsoft Corporation)
DRV - (SDdriver [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\sddriver.sys (Symantec Corporation)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SPBBCDrv [System | Running]) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SRTSP [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPL [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\SRTSPL.SYS (Symantec Corporation)
DRV - (SRTSPX [System | Running]) – C:\WINDOWS\System32\Drivers\SRTSPX.SYS (Symantec Corporation)
DRV - (StillCam [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\serscan.sys (Microsoft Corporation)
DRV - (SYMDNS [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMDNS.SYS (Symantec Corporation)
DRV - (SymEvent [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMFW [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMFW.SYS (Symantec Corporation)
DRV - (SYMIDS [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMIDS.SYS (Symantec Corporation)
DRV - (SYMIDSCO [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\20090730.002\SymIDSCo.sys (Symantec Corporation)
DRV - (SymIM [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SymIMMP [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SYMNDIS [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS (Symantec Corporation)
DRV - (SYMREDRV [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMTDI [System | Running]) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (USBAAPL [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbser [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\usbser.sys (Microsoft Corporation)
DRV - (usbsermpt [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\usbsermpt.sys (Microsoft Corporation)
DRV - (yukonwxp [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\yk51x86.sys (Marvell)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;*.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/07 03:08:48 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/08/08 14:12:53 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/08/08 14:41:55 | 00,000,000 | —D | M]

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [NSWosCheck] C:\Program Files\Norton SystemWorks\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [osCheck] C:\Program Files\Norton AntiVirus\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKCU..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe (Heidi Computers Ltd)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TabUserW.exe.lnk = C:\WINDOWS\System32\WTablet\TabUserW.exe (Wacom Technology, Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk ()
O9 - Extra 'Tools' menuitem : Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKCU\..Trusted Domains: shp-frontdesk ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {00130000-B1BA-11CE-ABC6-F5B2E79D9E3F} http://www.vetpacs.com/ltocx13n.cab (LEAD Main Control (13.0))
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {3CBA13C3-58C7-47F1-9758-D4B255A50D52} file:///D:/WVC-Encore_Notes_2008/data/index/ses_ocx/sessearch.ocx (SESSearchCtrl Class)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} http://www.creative.com/softwareupdate/su/…101/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {7D7D0CF0-BB7C-473E-8B35-7590F7D86671} http://209.143.230.217/FusionServer/ActiveX/coefir.cab (MetaData Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B1B22D8C-30F6-4BD5-8291-7C855D5CF2FC} http://209.143.230.217/FusionServer/ActiveX/eFilmX.cab (EFilmX Control)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} http://download.abacast.com/download/files/abasetup162.cab (Reg Error: Key error.)
O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} http://www.pcpitstop.com/antivirus/PitPav.cab (AV Class)
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} http://gis.cityofmadison.com/ACGM_7146/Acgm.cab (ActiveCGM Control)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/softwareupdate/su/…15105/CTPID.cab (Creative Software AutoUpdate Support Package)
O16 - DPF: {FAA26872-BB40-4AB2-8A6D-A49183581AAA} http://132.216.45.146/user/TSBnwCam.CAB (TSBnwCam Control)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\intu-help-qb2 {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/06/22 08:36:57 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - Unable to obtain root file information for disk H:\
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/09/01 11:50:31 | 00,514,048 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Nothnagel\Desktop\OTL.exe
[2009/09/01 11:00:45 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/01 11:00:42 | 00,038,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/09/01 11:00:41 | 00,019,096 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/09/01 11:00:41 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/01 10:59:16 | 03,942,048 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Nothnagel\Desktop\mbam-setup.exe
[2009/09/01 10:01:40 | 00,272,384 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Nothnagel\Desktop\TFC.exe
[2009/08/31 13:04:58 | 00,167,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\appmgmts.dll
[2009/08/31 13:04:58 | 00,142,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\aec.sys
[2009/08/31 13:04:58 | 00,135,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\shsvcs.dll
[2009/08/31 13:04:58 | 00,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\regsvc.dll
[2009/08/31 13:04:57 | 01,614,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfcfiles.dll
[2009/08/31 13:04:57 | 00,927,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mfc40u.dll
[2009/08/31 13:04:57 | 00,792,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comres.dll
[2009/08/31 13:04:57 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comctl32.dll
[2009/08/31 13:04:57 | 00,574,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntfs.sys
[2009/08/31 13:04:57 | 00,435,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntmssvc.dll
[2009/08/31 13:04:57 | 00,409,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\qmgr.dll
[2009/08/31 13:04:57 | 00,407,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\netlogon.dll
[2009/08/31 13:04:57 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rpcss.dll
[2009/08/31 13:04:57 | 00,253,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\es.dll
[2009/08/31 13:04:57 | 00,249,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\tapisrv.dll
[2009/08/31 13:04:57 | 00,245,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mswsock.dll
[2009/08/31 13:04:57 | 00,198,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\netman.dll
[2009/08/31 13:04:57 | 00,192,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\schedsvc.dll
[2009/08/31 13:04:57 | 00,185,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\upnphost.dll
[2009/08/31 13:04:57 | 00,181,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\scecli.dll
[2009/08/31 13:04:57 | 00,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\srsvc.dll
[2009/08/31 13:04:57 | 00,129,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\xmlprov.dll
[2009/08/31 13:04:57 | 00,088,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rasauto.dll
[2009/08/31 13:04:57 | 00,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\browser.dll
[2009/08/31 13:04:57 | 00,071,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ssdpsrv.dll
[2009/08/31 13:04:57 | 00,062,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\cryptsvc.dll
[2009/08/31 13:04:57 | 00,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\eventlog.dll
[2009/08/31 13:04:57 | 00,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\msgsvc.dll
[2009/08/31 13:04:57 | 00,027,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mspmsnsv.dll
[2009/08/31 13:04:57 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lpk.dll
[2009/08/31 13:04:57 | 00,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\linkinfo.dll
[2009/08/31 13:04:57 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\asyncmac.sys
[2009/08/31 13:04:57 | 00,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wscntfy.exe
[2009/08/31 13:04:57 | 00,011,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\acpiec.sys
[2009/08/31 13:04:57 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfc.dll
[2009/08/31 13:04:57 | 00,004,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\beep.sys
[2009/08/31 13:04:57 | 00,002,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\null.sys
[2009/08/31 13:04:56 | 03,597,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mshtml.dll
[2009/08/31 13:04:56 | 02,145,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntoskrnl.exe
[2009/08/31 13:04:56 | 02,023,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntkrnlpa.exe
[2009/08/31 13:04:56 | 01,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\explorer.exe
[2009/08/31 13:04:56 | 00,989,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kernel32.dll
[2009/08/31 13:04:56 | 00,827,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wininet.dll
[2009/08/31 13:04:56 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\user32.dll
[2009/08/31 13:04:56 | 00,507,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\winlogon.exe
[2009/08/31 13:04:56 | 00,361,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\tcpip.sys
[2009/08/31 13:04:56 | 00,295,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\termsrv.dll
[2009/08/31 13:04:56 | 00,182,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ndis.sys
[2009/08/31 13:04:56 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\services.exe
[2009/08/31 13:04:56 | 00,110,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\imm32.dll
[2009/08/31 13:04:56 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ws2_32.dll
[2009/08/31 13:04:56 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\spoolsv.exe
[2009/08/31 13:04:56 | 00,051,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wuauclt.exe
[2009/08/31 13:04:56 | 00,036,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ip6fw.sys
[2009/08/31 13:04:56 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\userinit.exe
[2009/08/31 13:04:56 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kbdclass.sys
[2009/08/31 13:04:56 | 00,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\powrprof.dll
[2009/08/31 13:04:56 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ctfmon.exe
[2009/08/31 13:04:56 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\svchost.exe
[2009/08/31 13:04:56 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lsass.exe
[2009/08/31 13:04:56 | 00,000,000 | —D | C] – C:\WINDOWS\System32\dllcache\cache
[2009/08/31 13:00:23 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/08/31 12:49:24 | 00,000,211 | —- | C] () – C:\Boot.bak
[2009/08/31 12:49:21 | 00,260,272 | —- | C] () – C:\cmldr
[2009/08/31 12:49:18 | 00,000,000 | RHSD | C] – C:\cmdcons
[2009/08/31 12:47:19 | 00,229,376 | —- | C] () – C:\WINDOWS\PEV.exe
[2009/08/31 12:47:19 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/08/31 12:47:19 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/08/31 12:47:19 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/08/31 12:47:18 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/08/31 12:47:18 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/08/31 12:47:18 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/08/31 12:47:18 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/08/31 12:47:08 | 04,958,588 | —- | C] () – C:\WINDOWS\{00000002-00000000-0000000D-00001102-00000004-20021102}.BAK
[2009/08/31 12:47:07 | 00,000,000 | —D | C] – C:\Qoobox
[2009/08/31 12:38:31 | 03,188,213 | R— | C] () – C:\Documents and Settings\Nothnagel\Desktop\Combo-Fix.exe
[2009/08/31 12:26:43 | 00,046,080 | —- | C] () – C:\Documents and Settings\Nothnagel\Desktop\Win32kDiag.exe
[2009/08/31 08:50:30 | 00,001,734 | —- | C] () – C:\Documents and Settings\Nothnagel\Desktop\HijackThis.lnk
[2009/08/31 08:50:29 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/08/31 08:49:57 | 00,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Nothnagel\My Documents\HJTInstall.exe
[2009/08/22 13:18:32 | 00,010,533 | -HS- | C] () – C:\Documents and Settings\Nothnagel\My Documents\Folder.jpg
[2009/08/22 13:18:32 | 00,002,603 | -HS- | C] () – C:\Documents and Settings\Nothnagel\My Documents\AlbumArtSmall.jpg
[2009/08/13 03:24:30 | 00,128,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2009/08/13 03:24:22 | 01,315,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoe.dll
[2009/08/08 15:27:17 | 00,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2009/08/08 15:27:17 | 00,000,000 | —D | C] – C:\Documents and Settings\Nothnagel\Application Data\skypePM
[2009/08/08 15:10:52 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2009/08/08 15:10:48 | 00,000,000 | R–D | C] – C:\Program Files\Skype
[2009/08/08 15:10:38 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Skype
[2009/08/08 14:45:02 | 20,327,264 | -H– | C] () – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\IconCache.db
[2009/08/08 14:42:10 | 00,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/08/08 14:42:10 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/08/08 14:42:10 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/08/08 14:42:10 | 00,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/08/08 14:34:19 | 00,000,000 | —D | C] – C:\Program Files\NOS
[2009/08/08 14:34:19 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS
[2009/08/08 14:12:56 | 00,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2009/08/07 08:31:20 | 00,000,000 | —D | C] – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\PCHealth
[2009/08/07 08:29:05 | 01,089,593 | —- | C] () – C:\WINDOWS\System32\dllcache\ntprint.cat
[2009/08/07 03:07:26 | 00,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2009/08/07 03:07:22 | 00,000,000 | —D | C] – C:\Program Files\MSBuild
[2009/08/07 03:07:15 | 00,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2009/08/07 03:05:49 | 00,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2009/08/07 03:05:49 | 00,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2009/08/07 03:05:48 | 00,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2009/08/07 03:05:48 | 00,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsshhdr.dll
[2009/08/07 03:05:48 | 00,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2009/08/07 03:05:47 | 01,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2009/08/07 03:05:47 | 01,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2009/08/05 04:01:48 | 00,204,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mswebdvd.dll
[2009/06/06 11:11:54 | 00,000,090 | —- | C] () – C:\WINDOWS\QBChanUtil_Trigger.ini
[2008/07/04 12:08:16 | 00,000,037 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2008/05/16 14:01:00 | 01,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/16 14:01:00 | 01,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 14:01:00 | 00,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2008/04/28 16:36:05 | 00,022,528 | —- | C] () – C:\WINDOWS\exeshl.dll
[2008/04/28 16:36:05 | 00,000,144 | —- | C] () – C:\WINDOWS\netctrl.ini
[2007/12/10 11:37:16 | 00,000,026 | —- | C] () – C:\WINDOWS\MINIvue.INI
[2006/12/30 16:35:03 | 00,000,202 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/09/19 17:19:31 | 00,000,032 | —- | C] () – C:\WINDOWS\album.ini
[2006/07/30 18:29:06 | 00,003,399 | R— | C] () – C:\WINDOWS\System32\hptcpmon.ini
[2006/07/30 18:29:06 | 00,000,143 | —- | C] () – C:\WINDOWS\System32\AddPort.ini
[2006/07/30 18:28:31 | 00,000,637 | —- | C] () – C:\WINDOWS\hpntwksetup.ini
[2006/07/19 21:43:02 | 00,015,744 | —- | C] () – C:\WINDOWS\System32\Wintab.dll
[2006/07/18 10:13:05 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/06/23 16:58:58 | 00,000,067 | —- | C] () – C:\WINDOWS\iltwain.ini
[2006/06/22 11:38:33 | 00,050,410 | —- | C] () – C:\WINDOWS\System32\e10kxwdm.ini
[2006/06/22 11:38:33 | 00,000,193 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2006/06/22 08:58:35 | 00,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2006/06/22 08:54:14 | 00,000,011 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2006/06/22 08:49:36 | 00,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/06/22 08:49:35 | 01,486,848 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/06/22 08:49:17 | 00,000,618 | R— | C] () – C:\WINDOWS\Anvshell.ini
[2006/06/22 08:43:29 | 00,002,881 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2006/06/22 08:43:28 | 00,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2006/01/11 00:07:54 | 00,204,800 | —- | C] () – C:\WINDOWS\swplay.dll
[2005/12/08 12:24:52 | 00,038,400 | —- | C] () – C:\WINDOWS\System32\CTBURST.DLL
[2005/12/08 12:17:46 | 00,033,792 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2005/11/24 17:25:02 | 00,208,896 | —- | C] () – C:\WINDOWS\System32\HPPAPR01.DLL
[2005/06/16 18:17:16 | 00,071,680 | —- | C] () – C:\WINDOWS\System32\CTMMACTL.DLL
[2004/07/27 23:44:08 | 00,040,960 | —- | C] () – C:\WINDOWS\SPARKEY.DLL
[2003/08/07 14:01:50 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2003/03/31 07:00:00 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2003/03/31 07:00:00 | 00,000,090 | —- | C] () – C:\WINDOWS\win.ini
[2003/03/21 17:56:12 | 00,000,194 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/08/13 19:09:48 | 00,659,520 | —- | C] () – C:\WINDOWS\System32\vbid3lib.dll
[2001/03/29 02:37:14 | 00,000,033 | —- | C] () – C:\WINDOWS\hppcap.ini
[1998/08/16 05:00:00 | 00,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll

========== Files - Modified Within 30 Days ==========

[2009/09/01 11:50:36 | 00,514,048 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Nothnagel\Desktop\OTL.exe
[2009/09/01 11:40:42 | 00,186,097 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2009/09/01 11:40:38 | 00,002,335 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
[2009/09/01 11:40:30 | 00,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/09/01 11:40:22 | 00,026,275 | —- | M] () – C:\WINDOWS\System32\tablet.dat
[2009/09/01 11:40:21 | 00,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009/09/01 11:40:04 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/09/01 11:39:55 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/09/01 11:39:01 | 00,031,056 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,031,056 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,030,528 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,030,528 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,011,564 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2009/09/01 11:39:01 | 00,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2009/09/01 11:38:37 | 20,327,264 | -H– | M] () – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\IconCache.db
[2009/09/01 11:38:30 | 04,958,588 | —- | M] () – C:\WINDOWS\{00000002-00000000-0000000D-00001102-00000004-20021102}.CDF
[2009/09/01 11:38:30 | 04,958,588 | —- | M] () – C:\WINDOWS\{00000002-00000000-0000000D-00001102-00000004-20021102}.BAK
[2009/09/01 11:00:45 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/01 10:59:29 | 03,942,048 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Nothnagel\Desktop\mbam-setup.exe
[2009/09/01 10:55:00 | 00,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2009/09/01 10:01:51 | 00,272,384 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Nothnagel\Desktop\TFC.exe
[2009/09/01 08:18:26 | 00,000,067 | —- | M] () – C:\WINDOWS\iltwain.ini
[2009/09/01 08:17:17 | 00,000,564 | —- | M] () – C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Nothnagel.job
[2009/08/31 19:00:01 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/08/31 13:03:08 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/08/31 13:02:54 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/08/31 12:49:24 | 00,000,281 | RHS- | M] () – C:\boot.ini
[2009/08/31 12:38:41 | 03,188,213 | R— | M] () – C:\Documents and Settings\Nothnagel\Desktop\Combo-Fix.exe
[2009/08/31 12:26:43 | 00,046,080 | —- | M] () – C:\Documents and Settings\Nothnagel\Desktop\Win32kDiag.exe
[2009/08/31 12:02:42 | 00,000,300 | —- | M] () – C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
[2009/08/31 08:50:30 | 00,001,734 | —- | M] () – C:\Documents and Settings\Nothnagel\Desktop\HijackThis.lnk
[2009/08/31 08:49:59 | 00,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Nothnagel\My Documents\HJTInstall.exe
[2009/08/30 22:44:37 | 00,000,202 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2009/08/23 03:09:13 | 00,229,376 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/08/22 13:30:08 | 00,010,533 | -HS- | M] () – C:\Documents and Settings\Nothnagel\My Documents\Folder.jpg
[2009/08/22 13:30:08 | 00,002,603 | -HS- | M] () – C:\Documents and Settings\Nothnagel\My Documents\AlbumArtSmall.jpg
[2009/08/11 10:55:20 | 00,014,336 | —- | M] () – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/08 15:27:17 | 00,000,056 | -H– | M] () – C:\WINDOWS\System32\ezsidmv.dat
[2009/08/08 15:10:52 | 00,001,878 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2009/08/08 14:41:53 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2009/08/08 14:41:53 | 00,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/08/08 14:41:53 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/08/08 14:41:53 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/08/08 14:41:53 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/08/08 14:12:47 | 00,185,920 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\rmoc3260.dll
[2009/08/08 14:12:34 | 00,006,656 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5016.dll
[2009/08/08 14:12:34 | 00,005,632 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5032.dll
[2009/08/08 14:12:30 | 00,348,160 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msvcr71.dll
[2009/08/08 14:12:30 | 00,278,528 | —- | M] (Real Networks, Inc) – C:\WINDOWS\System32\pncrt.dll
[2009/08/08 09:05:49 | 00,000,090 | —- | M] () – C:\WINDOWS\QBChanUtil_Trigger.ini
[2009/08/08 08:31:04 | 00,037,616 | —- | M] () – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/08/07 08:26:25 | 00,192,184 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/08/07 03:12:51 | 00,505,234 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/08/07 03:12:51 | 00,444,028 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/08/07 03:12:51 | 00,071,904 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/08/05 04:01:48 | 00,204,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mswebdvd.dll
[2009/08/05 04:01:48 | 00,204,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mswebdvd.dll
[2009/08/03 13:36:28 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/08/03 13:36:06 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys

========== LOP Check ==========

[2009/08/15 10:00:47 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2009/03/18 12:06:55 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/07/13 12:07:37 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2004/12/28 13:33:56 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ahead
[2006/07/25 17:51:53 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avanquest Software
[2006/12/09 14:41:59 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2009/01/04 16:33:18 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/01/04 17:25:07 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonIJEGV
[2009/06/06 11:11:52 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\COMMON FILES
[2009/06/09 08:28:32 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Intuit
[2006/07/16 18:56:56 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Macrovision
[2006/10/22 13:07:59 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Motive
[2006/12/07 19:37:52 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/08/13 12:42:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/03/07 20:11:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2009/06/06 11:24:16 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SQL Anywhere 10
[2009/08/08 15:27:17 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Nothnagel\Application Data
[2008/03/26 09:39:27 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Ahead
[2009/08/18 09:09:53 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\ArcSoft
[2008/05/30 16:33:56 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\IDX Imagecast iPACS Viewer
[2006/10/22 13:09:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Motive
[2009/05/14 19:12:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Move Networks
[2007/01/01 18:08:41 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\NCH Swift Sound
[2007/07/05 15:28:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\OverDrive
[2006/12/07 19:37:52 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\RecordPad
[2006/08/07 17:56:18 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Roxio
[2008/11/13 19:56:16 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\SanDisk
[2008/08/13 12:38:05 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Uniblue
[2009/08/31 19:00:01 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2003/03/31 07:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/09/01 11:40:21 | 00,000,882 | —- | M] () – C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
[2009/09/01 10:55:00 | 00,000,886 | —- | M] () – C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
[2009/09/01 08:17:17 | 00,000,564 | —- | M] () – C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Nothnagel.job
[2009/08/31 12:02:42 | 00,000,300 | —- | M] () – C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
[2009/09/01 11:40:04 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

OTL Extras logfile created on: 9/1/2009 11:52:06 AM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = C:\Documents and Settings\Nothnagel\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.23 Mb Total Physical Memory | 622.19 Mb Available Physical Memory | 60.81% Memory free
2.40 Gb Paging File | 2.09 Gb Available in Paging File | 86.99% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 40.87 Gb Free Space | 71.38% Space Free | Partition Type: NTFS
Drive D: | 4.92 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
Drive F: | 298.09 Gb Total Space | 264.65 Gb Free Space | 88.78% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
Drive H: | 74.53 Gb Total Space | 57.39 Gb Free Space | 77.01% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: DRN
Current User Name: Nothnagel
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Intuit\QuickBooks 2006\QBDBMgrN.exe" = C:\Program Files\Intuit\QuickBooks 2006\QBDBMgrN.exe:*:Enabled:QuickBooks 2006 Data Manager – (Intuit, Inc.)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour – (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype – (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01ADCC5D-45B4-45E4-AC5C-C06E044B16DF}" = hppIOFiles
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0EF45FEA-E3C1-4660-854A-810C1BA169E2}" = hppLJ3390
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP3600_series" = Canon iP3600 series Printer Driver
"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update
"{173D5E9E-8ABC-4EB2-B371-18AF8812A91D}" = hppFaxUtility
"{1C02D187-9256-4B08-92D1-82922DBE4D52}" = DAK Wave MP3 Editor PRO v3.6b
"{20C53FA2-4307-4671-A93F-9463B29DFCF1}" = Symantec Technical Support Web Controls
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java™ 6 Update 15
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}" = Component Framework
"{3324A5DC-C7F6-430A-ACC8-F251CD8F4FC7}" = Motorola Driver Installation
"{34EEB1F5-E939-40A1-A6BA-957282A4B2C8}" = Norton AntiVirus Help
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}" = ccCommon
"{4D82392D-AF90-4159-9A14-887BBC835191}" = hpp3390usg
"{5A3F6A80-7913-475E-8B96-477A952CFA43}" = SupportSoft Assisted Service
"{606E5C0D-6039-42A7-988E-9D51DE773AFF}" = hppFonts
"{62120008-8E1E-4807-860D-A8B48F8552DB}" = Norton Protection Center
"{663D8AAF-CB71-4056-8C60-1D85BC576C6E}" = hppTooCool
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6975E810-C92F-45F0-0BFD-187B312F10E8}" = Norton Ghost
"{6A7867BA-B7CA-4CC9-ACAB-85BA46865EE5}" = Norton Utilities
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71E7B3F5-CFAF-4C1E-B494-528E28707937}" = Norton SystemWorks
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{77364F85-6219-4CB8-AAA0-6D53368D683D}" = Connection Keep Alive
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit
"{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" = Norton AntiVirus
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{895F4870-FDD0-4725-9DE2-5D35CFD1F89F}" = Group Shot
"{8B677453-F9D2-4387-B030-E669B28B8A08}" = hppToolBoxFX
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{91490409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Primary Interop Assemblies
"{993CD8D4-AED6-45E2-8AA5-D7DFAA60DE6F}" = hppScanTo
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}" = Norton Protection Center
"{9A2F0810-3622-4E86-9072-973FBE1679C5}" = QuickBooks Pro 2009
"{9A2F0810-369F-4E86-9072-973FBE1679C5}" = QuickBooks
"{9E23C48E-5483-4971-BA50-089F2FABCD66}" = Norton SystemWorks
"{A0B42136-C813-4FB4-84A1-C41E6F12410B}" = hppSendFax
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5A93185-26A8-4F02-B021-D6E6A4396441}" = hppManuals3390
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-1033-0000-7760-000000000002}" = Adobe Acrobat 7.0 Professional
"{B24E05CC-46FF-4787-BBB8-5CD516AFB118}" = ccCommon
"{B535B621-5559-11DE-A7A1-005056806466}" = Google Earth Plugin
"{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1" = Eraser 5.8
"{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}" = Motorola Phone Tools
"{BD29EBAC-AD7D-4b27-B727-4CC6AC52D36B}" = MarketResearch
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}" = Apple Mobile Device Support
"{C7239ACC-601B-46BC-B48D-3998303A326D}" = OverDrive Media Console
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CA31120D-2101-484D-9FF1-195DE96FE346}" = Norton Cleanup
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC016F21-3970-11DE-B878-005056806466}" = Google Earth
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D1725BDB-BA2B-4503-A8CB-F5C835D743FA}" = MSRedist
"{D52ECEBC-9B20-41A5-81C4-A62DE2367419}" = Adobe Creative Suite
"{D5E31EEE-CD8A-4E01-87F1-119C4A3201FD}" = hppscan3390
"{DB7F1657-6164-40AE-8A94-8F785C0C3E3F}" = hppFaxDrv3390
"{DD768D96-E5EB-4AC7-ADFC-6FECE02EB5CB}" = IDX Imagecast iPACS Viewer
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{E94E150C-762B-4cd1-8A54-7228A07C0710}" = HP LaserJet 3050/3052/3055/3390/3392 2.0
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{EFC2DF31-704F-4C4D-9155-E1D87859079C}" = SymNet
"{F20CE777-7AC1-4AAD-813B-4EE63236384E}" = Symantec Real Time Storage Protection Component
"{F2270CE2-0373-4D39-8783-2F1542B7D310}" = hpzTLBXFX
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6468E85-9784-41F7-AC45-85B763A21E01}" = ScreenWatch Windows Media Player Plug-in
"{FB55BB78-2BC2-43E9-80FF-517A8D1AE3AD}" = Norton SystemWorks
"{FE3F3C9B-2C29-4FEE-A74F-11E436729F2C}" = Scan
"Abacast Client" = Abacast Client
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Acrobat 7.0 Professional" = Adobe Acrobat 7.1.0 Professional
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"AudibleDownloadManager" = Audible Download Manager
"AudioConSole" = Creative Audio Console
"Canon iP3600 series User Registration" = Canon iP3600 series User Registration
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner (remove only)
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"ERUNT_is1" = ERUNT 1.1j
"HijackThis" = HijackThis 2.0.2
"Hijackthis_is1" = Hijackthis 1.99.1
"hp deskjet 950c series" = hp deskjet 950c series (Remove only)
"HPExtendedCapabilities" = HP Extended Capabilities 4.7
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{F6468E85-9784-41F7-AC45-85B763A21E01}" = ScreenWatch Windows Media Player Plug-in
"LiveReg" = LiveReg (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PC Pitstop Exterminate2_is1" = PC Pitstop Exterminate2 2.0
"PCPitstop Panda AntiVirus Scan" = PCPitstop Panda AntiVirus Scan (remove only)
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"RealPlayer 6.0" = RealPlayer
"RegScrubXP_is1" = RegScrubXP 3.25
"SymSetup.{71E7B3F5-CFAF-4C1E-B494-528E28707937}" = Norton SystemWorks (Symantec Corporation)
"SymSetup.{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" = Norton AntiVirus (Symantec Corporation)
"SysInfo" = Creative System Information
"System Security Suite 1.04" = System Security Suite 1.04
"SystemRequirementsLab" = System Requirements Lab
"Tablet Driver" = Tablet
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.0.0.320
"Move Media Player" = Move Media Player
"Sansa Updater" = Sansa Updater

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/31/2009 9:28:12 AM | Computer Name = DRN | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 8/31/2009 9:28:12 AM | Computer Name = DRN | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 8/31/2009 9:28:12 AM | Computer Name = DRN | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 8/31/2009 9:28:12 AM | Computer Name = DRN | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 8/31/2009 9:28:30 AM | Computer Name = DRN | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2009": Connection
Error:Invalid user ID or passwo

Error - 8/31/2009 9:28:30 AM | Computer Name = DRN | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2009": Connection
String:CON=QBConnectionPool-Probe-QB_data_engine_19; ;DBF=C:\Documents and Settings\All
Users\Documents\Intuit\QuickBooks\Company Files\SANDHILL PET CLINIC, INC.QBW;ENG=QB_data_engine_19;DBN=2b46b375906a4d3fba49fe34e7b356

Error - 8/31/2009 9:28:30 AM | Computer Name = DRN | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2009": DBConnPool::HandleConnectionError
errorCode:-6069, dbCode:-103 from file:'.\.\src\ConnPool.cpp' at line 994 from
function:'DBMgr::DBConnPool::ini

Error - 8/31/2009 10:18:31 AM | Computer Name = DRN | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2009": Trying to
process a record 62 : CUNA CHECKING for List Review edlist without actually being
in a write transacti

Error - 9/1/2009 11:34:28 AM | Computer Name = DRN | Source = Userenv | ID = 1512
Description = Windows cannot unload your registry file. The memory used by the registry
has not been freed. This is often caused by services running as a user account,
try configuring the services to run in either the LocalService or NetworkService
account. If this problem persists, contact your administrator. DETAIL - Insufficient
system resources exist to complete the requested service.

Error - 9/1/2009 12:38:43 PM | Computer Name = DRN | Source = Userenv | ID = 1512
Description = Windows cannot unload your registry file. The memory used by the registry
has not been freed. This is often caused by services running as a user account,
try configuring the services to run in either the LocalService or NetworkService
account. If this problem persists, contact your administrator. DETAIL - Insufficient
system resources exist to complete the requested service.

[ System Events ]
Error - 9/1/2009 11:02:11 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 9/1/2009 11:02:11 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7034
Description = The Bonjour Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/1/2009 11:02:11 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7034
Description = The GhostStartService service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/1/2009 11:02:11 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7034
Description = The Pml Driver HPZ12 service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/1/2009 11:02:11 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/1/2009 11:02:11 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7034
Description = The QBCFMonitorService service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/1/2009 11:02:11 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7034
Description = The WMDM PMSP Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/1/2009 11:02:11 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7034
Description = The TabletService service terminated unexpectedly. It has done this
1 time(s).

Error - 9/1/2009 11:02:11 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7031
Description = The Windows Media Player Network Sharing Service service terminated
unexpectedly. It has done this 1 time(s). The following corrective action will
be taken in 30000 milliseconds: Restart the service.

Error - 9/1/2009 11:02:12 AM | Computer Name = DRN | Source = Service Control Manager | ID = 7034
Description = The iPod Service service terminated unexpectedly. It has done this
1 time(s).

< End of report >

chamber

Post #10September 1, 2009, 10:49 PM UTC

Hi,

1) OTL

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
SRV - (Vssprot_1c [On_Demand | Stopped]) – File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done

2) JavaRa

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

3) Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, adware, dialers, and other riskware
- Archives
- E-mail databases
Click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View report… at the bottom.
Click the Save report… button.

[external image: Posted Image]
Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

In your reply I would like to see copied and pasted,

1) OTL fix log
2) Kaspersky scan results
3) How is the computer running now?

madvet2

Post #11September 2, 2009, 1:15 PM UTC

I think I've got it all. ThatKaspersky scan takes a while.
Computer seems to be behaving itself.

OTL logfile created on: 9/1/2009 11:52:06 AM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = C:\Documents and Settings\Nothnagel\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.23 Mb Total Physical Memory | 622.19 Mb Available Physical Memory | 60.81% Memory free
2.40 Gb Paging File | 2.09 Gb Available in Paging File | 86.99% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 40.87 Gb Free Space | 71.38% Space Free | Partition Type: NTFS
Drive D: | 4.92 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
Drive F: | 298.09 Gb Total Space | 264.65 Gb Free Space | 88.78% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
Drive H: | 74.53 Gb Total Space | 57.39 Gb Free Space | 77.01% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: DRN
Current User Name: Nothnagel
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe (Symantec Corporation)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE (Symantec Corporation)
PRC - C:\WINDOWS\System32\HPZipm12.exe (HP)
PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
PRC - C:\WINDOWS\System32\Tablet.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\System32\MsPMSPSv.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\CTHELPER.EXE (Creative Technology Ltd)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Eraser\eraser.exe (Heidi Computers Ltd)
PRC - C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
PRC - C:\WINDOWS\System32\WTablet\TabUserW.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Documents and Settings\Nothnagel\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Adobe LM Service [On_Demand | Stopped]) – C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (AdobeVersionCue [On_Demand | Stopped]) – C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe (Adobe Sytems)
SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Automatic LiveUpdate Scheduler [Auto | Running]) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (Bonjour Service [Auto | Running]) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (ccEvtMgr [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccSetMgr [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CLTNetCnService [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (GhostStartService [Auto | Running]) – C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe (Symantec Corporation)
SRV - (gupdate1c9ce5bbaa9c4e6 [Auto | Stopped]) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (gusvc [On_Demand | Stopped]) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LiveUpdate [On_Demand | Stopped]) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (LiveUpdate Notice [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (NProtectService [Auto | Running]) – C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE (Symantec Corporation)
SRV - (NVSvc [On_Demand | Stopped]) – C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [Auto | Running]) – C:\WINDOWS\System32\HPZipm12.exe (HP)
SRV - (QBCFMonitorService [Auto | Running]) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
SRV - (QBFCService [On_Demand | Stopped]) – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)
SRV - (Speed Disk service [On_Demand | Stopped]) – C:\Program Files\Norton SystemWorks\Norton Utilities\Speed Disk\NOPDB.exe (Symantec Corporation)
SRV - (Symantec Core LC [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (Symantec RemoteAssist [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (TabletService [Auto | Running]) – C:\WINDOWS\System32\Tablet.exe (Wacom Technology, Corp.)
SRV - (Vssprot_1c [On_Demand | Stopped]) – File not found
SRV - (WMDM PMSP Service [Auto | Running]) – C:\WINDOWS\System32\MsPMSPSv.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc [Auto | Running]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (Aspi32 [Auto | Running]) – C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec)
DRV - (COH_Mon [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\COH_Mon.sys (Symantec Corporation)
DRV - (ctac32k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (ctaud2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctdvda2k [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (eeCtrl [System | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EIO [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\EIO.sys (ASUSTeK Computer Inc.)
DRV - (emupia [On_Demand | Running]) – C:\WINDOWS\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (EraserUtilRebootDrv [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (gameenum [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (GhPciScan [System | Running]) – C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys (Symantec Corporation)
DRV - (ha10kx2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (hap16v2k [On_Demand | Running]) – C:\WINDOWS\System32\drivers\hap16v2k.sys (Creative Technology Ltd)
DRV - (hap17v2k [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\hap17v2k.sys (Creative Technology Ltd)
DRV - (motccgp [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motccgp.sys (Motorola)
DRV - (motccgpfl [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motccgpfl.sys (Motorola)
DRV - (motmodem [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motmodem.sys (Motorola)
DRV - (motport [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motport.sys (Motorola)
DRV - (NAVENG [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090804.040\NAVENG.SYS (Symantec Corporation)
DRV - (NAVEX15 [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090804.040\NAVEX15.SYS (Symantec Corporation)
DRV - (NPDriver [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\NPDRIVER.SYS (Symantec Corporation)
DRV - (nv [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (ossrv [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (pavboot [Boot | Running]) – C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (PenClass [Boot | Running]) – C:\WINDOWS\system32\drivers\PenClass.sys (Wacom Technology Corporation)
DRV - (PfDetNT [Auto | Running]) – C:\WINDOWS\System32\drivers\PfModNT.sys (Creative Technology Ltd.)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (ROOTMODEM [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\RootMdm.sys (Microsoft Corporation)
DRV - (SDdriver [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\sddriver.sys (Symantec Corporation)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SPBBCDrv [System | Running]) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SRTSP [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPL [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\SRTSPL.SYS (Symantec Corporation)
DRV - (SRTSPX [System | Running]) – C:\WINDOWS\System32\Drivers\SRTSPX.SYS (Symantec Corporation)
DRV - (StillCam [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\serscan.sys (Microsoft Corporation)
DRV - (SYMDNS [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMDNS.SYS (Symantec Corporation)
DRV - (SymEvent [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMFW [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMFW.SYS (Symantec Corporation)
DRV - (SYMIDS [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMIDS.SYS (Symantec Corporation)
DRV - (SYMIDSCO [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\20090730.002\SymIDSCo.sys (Symantec Corporation)
DRV - (SymIM [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SymIMMP [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SYMNDIS [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS (Symantec Corporation)
DRV - (SYMREDRV [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMTDI [System | Running]) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (USBAAPL [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbser [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\usbser.sys (Microsoft Corporation)
DRV - (usbsermpt [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\usbsermpt.sys (Microsoft Corporation)
DRV - (yukonwxp [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\yk51x86.sys (Marvell)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;*.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/07 03:08:48 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/08/08 14:12:53 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/08/08 14:41:55 | 00,000,000 | —D | M]

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [NSWosCheck] C:\Program Files\Norton SystemWorks\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [osCheck] C:\Program Files\Norton AntiVirus\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKCU..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe (Heidi Computers Ltd)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TabUserW.exe.lnk = C:\WINDOWS\System32\WTablet\TabUserW.exe (Wacom Technology, Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk ()
O9 - Extra 'Tools' menuitem : Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKCU\..Trusted Domains: shp-frontdesk ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {00130000-B1BA-11CE-ABC6-F5B2E79D9E3F} http://www.vetpacs.com/ltocx13n.cab (LEAD Main Control (13.0))
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {3CBA13C3-58C7-47F1-9758-D4B255A50D52} file:///D:/WVC-Encore_Notes_2008/data/index/ses_ocx/sessearch.ocx (SESSearchCtrl Class)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} http://www.creative.com/softwareupdate/su/…101/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {7D7D0CF0-BB7C-473E-8B35-7590F7D86671} http://209.143.230.217/FusionServer/ActiveX/coefir.cab (MetaData Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B1B22D8C-30F6-4BD5-8291-7C855D5CF2FC} http://209.143.230.217/FusionServer/ActiveX/eFilmX.cab (EFilmX Control)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} http://download.abacast.com/download/files/abasetup162.cab (Reg Error: Key error.)
O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} http://www.pcpitstop.com/antivirus/PitPav.cab (AV Class)
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} http://gis.cityofmadison.com/ACGM_7146/Acgm.cab (ActiveCGM Control)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/softwareupdate/su/…15105/CTPID.cab (Creative Software AutoUpdate Support Package)
O16 - DPF: {FAA26872-BB40-4AB2-8A6D-A49183581AAA} http://132.216.45.146/user/TSBnwCam.CAB (TSBnwCam Control)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\intu-help-qb2 {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/06/22 08:36:57 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - Unable to obtain root file information for disk H:\
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/09/01 11:50:31 | 00,514,048 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Nothnagel\Desktop\OTL.exe
[2009/09/01 11:00:45 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/01 11:00:42 | 00,038,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/09/01 11:00:41 | 00,019,096 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/09/01 11:00:41 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/01 10:59:16 | 03,942,048 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Nothnagel\Desktop\mbam-setup.exe
[2009/09/01 10:01:40 | 00,272,384 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Nothnagel\Desktop\TFC.exe
[2009/08/31 13:04:58 | 00,167,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\appmgmts.dll
[2009/08/31 13:04:58 | 00,142,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\aec.sys
[2009/08/31 13:04:58 | 00,135,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\shsvcs.dll
[2009/08/31 13:04:58 | 00,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\regsvc.dll
[2009/08/31 13:04:57 | 01,614,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfcfiles.dll
[2009/08/31 13:04:57 | 00,927,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mfc40u.dll
[2009/08/31 13:04:57 | 00,792,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comres.dll
[2009/08/31 13:04:57 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comctl32.dll
[2009/08/31 13:04:57 | 00,574,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntfs.sys
[2009/08/31 13:04:57 | 00,435,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntmssvc.dll
[2009/08/31 13:04:57 | 00,409,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\qmgr.dll
[2009/08/31 13:04:57 | 00,407,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\netlogon.dll
[2009/08/31 13:04:57 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rpcss.dll
[2009/08/31 13:04:57 | 00,253,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\es.dll
[2009/08/31 13:04:57 | 00,249,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\tapisrv.dll
[2009/08/31 13:04:57 | 00,245,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mswsock.dll
[2009/08/31 13:04:57 | 00,198,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\netman.dll
[2009/08/31 13:04:57 | 00,192,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\schedsvc.dll
[2009/08/31 13:04:57 | 00,185,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\upnphost.dll
[2009/08/31 13:04:57 | 00,181,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\scecli.dll
[2009/08/31 13:04:57 | 00,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\srsvc.dll
[2009/08/31 13:04:57 | 00,129,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\xmlprov.dll
[2009/08/31 13:04:57 | 00,088,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rasauto.dll
[2009/08/31 13:04:57 | 00,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\browser.dll
[2009/08/31 13:04:57 | 00,071,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ssdpsrv.dll
[2009/08/31 13:04:57 | 00,062,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\cryptsvc.dll
[2009/08/31 13:04:57 | 00,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\eventlog.dll
[2009/08/31 13:04:57 | 00,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\msgsvc.dll
[2009/08/31 13:04:57 | 00,027,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mspmsnsv.dll
[2009/08/31 13:04:57 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lpk.dll
[2009/08/31 13:04:57 | 00,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\linkinfo.dll
[2009/08/31 13:04:57 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\asyncmac.sys
[2009/08/31 13:04:57 | 00,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wscntfy.exe
[2009/08/31 13:04:57 | 00,011,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\acpiec.sys
[2009/08/31 13:04:57 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfc.dll
[2009/08/31 13:04:57 | 00,004,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\beep.sys
[2009/08/31 13:04:57 | 00,002,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\null.sys
[2009/08/31 13:04:56 | 03,597,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mshtml.dll
[2009/08/31 13:04:56 | 02,145,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntoskrnl.exe
[2009/08/31 13:04:56 | 02,023,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntkrnlpa.exe
[2009/08/31 13:04:56 | 01,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\explorer.exe
[2009/08/31 13:04:56 | 00,989,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kernel32.dll
[2009/08/31 13:04:56 | 00,827,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wininet.dll
[2009/08/31 13:04:56 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\user32.dll
[2009/08/31 13:04:56 | 00,507,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\winlogon.exe
[2009/08/31 13:04:56 | 00,361,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\tcpip.sys
[2009/08/31 13:04:56 | 00,295,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\termsrv.dll
[2009/08/31 13:04:56 | 00,182,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ndis.sys
[2009/08/31 13:04:56 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\services.exe
[2009/08/31 13:04:56 | 00,110,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\imm32.dll
[2009/08/31 13:04:56 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ws2_32.dll
[2009/08/31 13:04:56 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\spoolsv.exe
[2009/08/31 13:04:56 | 00,051,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wuauclt.exe
[2009/08/31 13:04:56 | 00,036,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ip6fw.sys
[2009/08/31 13:04:56 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\userinit.exe
[2009/08/31 13:04:56 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kbdclass.sys
[2009/08/31 13:04:56 | 00,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\powrprof.dll
[2009/08/31 13:04:56 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ctfmon.exe
[2009/08/31 13:04:56 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\svchost.exe
[2009/08/31 13:04:56 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lsass.exe
[2009/08/31 13:04:56 | 00,000,000 | —D | C] – C:\WINDOWS\System32\dllcache\cache
[2009/08/31 13:00:23 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/08/31 12:49:24 | 00,000,211 | —- | C] () – C:\Boot.bak
[2009/08/31 12:49:21 | 00,260,272 | —- | C] () – C:\cmldr
[2009/08/31 12:49:18 | 00,000,000 | RHSD | C] – C:\cmdcons
[2009/08/31 12:47:19 | 00,229,376 | —- | C] () – C:\WINDOWS\PEV.exe
[2009/08/31 12:47:19 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/08/31 12:47:19 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/08/31 12:47:19 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/08/31 12:47:18 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/08/31 12:47:18 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/08/31 12:47:18 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/08/31 12:47:18 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/08/31 12:47:08 | 04,958,588 | —- | C] () – C:\WINDOWS\{00000002-00000000-0000000D-00001102-00000004-20021102}.BAK
[2009/08/31 12:47:07 | 00,000,000 | —D | C] – C:\Qoobox
[2009/08/31 12:38:31 | 03,188,213 | R— | C] () – C:\Documents and Settings\Nothnagel\Desktop\Combo-Fix.exe
[2009/08/31 12:26:43 | 00,046,080 | —- | C] () – C:\Documents and Settings\Nothnagel\Desktop\Win32kDiag.exe
[2009/08/31 08:50:30 | 00,001,734 | —- | C] () – C:\Documents and Settings\Nothnagel\Desktop\HijackThis.lnk
[2009/08/31 08:50:29 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/08/31 08:49:57 | 00,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Nothnagel\My Documents\HJTInstall.exe
[2009/08/22 13:18:32 | 00,010,533 | -HS- | C] () – C:\Documents and Settings\Nothnagel\My Documents\Folder.jpg
[2009/08/22 13:18:32 | 00,002,603 | -HS- | C] () – C:\Documents and Settings\Nothnagel\My Documents\AlbumArtSmall.jpg
[2009/08/13 03:24:30 | 00,128,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2009/08/13 03:24:22 | 01,315,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoe.dll
[2009/08/08 15:27:17 | 00,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2009/08/08 15:27:17 | 00,000,000 | —D | C] – C:\Documents and Settings\Nothnagel\Application Data\skypePM
[2009/08/08 15:10:52 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2009/08/08 15:10:48 | 00,000,000 | R–D | C] – C:\Program Files\Skype
[2009/08/08 15:10:38 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Skype
[2009/08/08 14:45:02 | 20,327,264 | -H– | C] () – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\IconCache.db
[2009/08/08 14:42:10 | 00,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/08/08 14:42:10 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/08/08 14:42:10 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/08/08 14:42:10 | 00,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/08/08 14:34:19 | 00,000,000 | —D | C] – C:\Program Files\NOS
[2009/08/08 14:34:19 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS
[2009/08/08 14:12:56 | 00,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2009/08/07 08:31:20 | 00,000,000 | —D | C] – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\PCHealth
[2009/08/07 08:29:05 | 01,089,593 | —- | C] () – C:\WINDOWS\System32\dllcache\ntprint.cat
[2009/08/07 03:07:26 | 00,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2009/08/07 03:07:22 | 00,000,000 | —D | C] – C:\Program Files\MSBuild
[2009/08/07 03:07:15 | 00,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2009/08/07 03:05:49 | 00,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2009/08/07 03:05:49 | 00,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2009/08/07 03:05:48 | 00,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2009/08/07 03:05:48 | 00,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsshhdr.dll
[2009/08/07 03:05:48 | 00,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2009/08/07 03:05:47 | 01,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2009/08/07 03:05:47 | 01,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2009/08/05 04:01:48 | 00,204,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mswebdvd.dll
[2009/06/06 11:11:54 | 00,000,090 | —- | C] () – C:\WINDOWS\QBChanUtil_Trigger.ini
[2008/07/04 12:08:16 | 00,000,037 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2008/05/16 14:01:00 | 01,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/16 14:01:00 | 01,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 14:01:00 | 00,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2008/04/28 16:36:05 | 00,022,528 | —- | C] () – C:\WINDOWS\exeshl.dll
[2008/04/28 16:36:05 | 00,000,144 | —- | C] () – C:\WINDOWS\netctrl.ini
[2007/12/10 11:37:16 | 00,000,026 | —- | C] () – C:\WINDOWS\MINIvue.INI
[2006/12/30 16:35:03 | 00,000,202 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/09/19 17:19:31 | 00,000,032 | —- | C] () – C:\WINDOWS\album.ini
[2006/07/30 18:29:06 | 00,003,399 | R— | C] () – C:\WINDOWS\System32\hptcpmon.ini
[2006/07/30 18:29:06 | 00,000,143 | —- | C] () – C:\WINDOWS\System32\AddPort.ini
[2006/07/30 18:28:31 | 00,000,637 | —- | C] () – C:\WINDOWS\hpntwksetup.ini
[2006/07/19 21:43:02 | 00,015,744 | —- | C] () – C:\WINDOWS\System32\Wintab.dll
[2006/07/18 10:13:05 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/06/23 16:58:58 | 00,000,067 | —- | C] () – C:\WINDOWS\iltwain.ini
[2006/06/22 11:38:33 | 00,050,410 | —- | C] () – C:\WINDOWS\System32\e10kxwdm.ini
[2006/06/22 11:38:33 | 00,000,193 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2006/06/22 08:58:35 | 00,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2006/06/22 08:54:14 | 00,000,011 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2006/06/22 08:49:36 | 00,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/06/22 08:49:35 | 01,486,848 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/06/22 08:49:17 | 00,000,618 | R— | C] () – C:\WINDOWS\Anvshell.ini
[2006/06/22 08:43:29 | 00,002,881 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2006/06/22 08:43:28 | 00,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2006/01/11 00:07:54 | 00,204,800 | —- | C] () – C:\WINDOWS\swplay.dll
[2005/12/08 12:24:52 | 00,038,400 | —- | C] () – C:\WINDOWS\System32\CTBURST.DLL
[2005/12/08 12:17:46 | 00,033,792 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2005/11/24 17:25:02 | 00,208,896 | —- | C] () – C:\WINDOWS\System32\HPPAPR01.DLL
[2005/06/16 18:17:16 | 00,071,680 | —- | C] () – C:\WINDOWS\System32\CTMMACTL.DLL
[2004/07/27 23:44:08 | 00,040,960 | —- | C] () – C:\WINDOWS\SPARKEY.DLL
[2003/08/07 14:01:50 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2003/03/31 07:00:00 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2003/03/31 07:00:00 | 00,000,090 | —- | C] () – C:\WINDOWS\win.ini
[2003/03/21 17:56:12 | 00,000,194 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/08/13 19:09:48 | 00,659,520 | —- | C] () – C:\WINDOWS\System32\vbid3lib.dll
[2001/03/29 02:37:14 | 00,000,033 | —- | C] () – C:\WINDOWS\hppcap.ini
[1998/08/16 05:00:00 | 00,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll

========== Files - Modified Within 30 Days ==========

[2009/09/01 11:50:36 | 00,514,048 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Nothnagel\Desktop\OTL.exe
[2009/09/01 11:40:42 | 00,186,097 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2009/09/01 11:40:38 | 00,002,335 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
[2009/09/01 11:40:30 | 00,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/09/01 11:40:22 | 00,026,275 | —- | M] () – C:\WINDOWS\System32\tablet.dat
[2009/09/01 11:40:21 | 00,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009/09/01 11:40:04 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/09/01 11:39:55 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/09/01 11:39:01 | 00,031,056 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,031,056 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,030,528 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,030,528 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,011,564 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000002-00000000-0000000D-00001102-00000004-20021102}.rfx
[2009/09/01 11:39:01 | 00,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2009/09/01 11:39:01 | 00,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2009/09/01 11:38:37 | 20,327,264 | -H– | M] () – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\IconCache.db
[2009/09/01 11:38:30 | 04,958,588 | —- | M] () – C:\WINDOWS\{00000002-00000000-0000000D-00001102-00000004-20021102}.CDF
[2009/09/01 11:38:30 | 04,958,588 | —- | M] () – C:\WINDOWS\{00000002-00000000-0000000D-00001102-00000004-20021102}.BAK
[2009/09/01 11:00:45 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/01 10:59:29 | 03,942,048 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Nothnagel\Desktop\mbam-setup.exe
[2009/09/01 10:55:00 | 00,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2009/09/01 10:01:51 | 00,272,384 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Nothnagel\Desktop\TFC.exe
[2009/09/01 08:18:26 | 00,000,067 | —- | M] () – C:\WINDOWS\iltwain.ini
[2009/09/01 08:17:17 | 00,000,564 | —- | M] () – C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Nothnagel.job
[2009/08/31 19:00:01 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/08/31 13:03:08 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/08/31 13:02:54 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/08/31 12:49:24 | 00,000,281 | RHS- | M] () – C:\boot.ini
[2009/08/31 12:38:41 | 03,188,213 | R— | M] () – C:\Documents and Settings\Nothnagel\Desktop\Combo-Fix.exe
[2009/08/31 12:26:43 | 00,046,080 | —- | M] () – C:\Documents and Settings\Nothnagel\Desktop\Win32kDiag.exe
[2009/08/31 12:02:42 | 00,000,300 | —- | M] () – C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
[2009/08/31 08:50:30 | 00,001,734 | —- | M] () – C:\Documents and Settings\Nothnagel\Desktop\HijackThis.lnk
[2009/08/31 08:49:59 | 00,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Nothnagel\My Documents\HJTInstall.exe
[2009/08/30 22:44:37 | 00,000,202 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2009/08/23 03:09:13 | 00,229,376 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/08/22 13:30:08 | 00,010,533 | -HS- | M] () – C:\Documents and Settings\Nothnagel\My Documents\Folder.jpg
[2009/08/22 13:30:08 | 00,002,603 | -HS- | M] () – C:\Documents and Settings\Nothnagel\My Documents\AlbumArtSmall.jpg
[2009/08/11 10:55:20 | 00,014,336 | —- | M] () – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/08 15:27:17 | 00,000,056 | -H– | M] () – C:\WINDOWS\System32\ezsidmv.dat
[2009/08/08 15:10:52 | 00,001,878 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2009/08/08 14:41:53 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2009/08/08 14:41:53 | 00,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/08/08 14:41:53 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/08/08 14:41:53 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/08/08 14:41:53 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/08/08 14:12:47 | 00,185,920 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\rmoc3260.dll
[2009/08/08 14:12:34 | 00,006,656 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5016.dll
[2009/08/08 14:12:34 | 00,005,632 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5032.dll
[2009/08/08 14:12:30 | 00,348,160 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msvcr71.dll
[2009/08/08 14:12:30 | 00,278,528 | —- | M] (Real Networks, Inc) – C:\WINDOWS\System32\pncrt.dll
[2009/08/08 09:05:49 | 00,000,090 | —- | M] () – C:\WINDOWS\QBChanUtil_Trigger.ini
[2009/08/08 08:31:04 | 00,037,616 | —- | M] () – C:\Documents and Settings\Nothnagel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/08/07 08:26:25 | 00,192,184 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/08/07 03:12:51 | 00,505,234 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/08/07 03:12:51 | 00,444,028 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/08/07 03:12:51 | 00,071,904 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/08/05 04:01:48 | 00,204,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mswebdvd.dll
[2009/08/05 04:01:48 | 00,204,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mswebdvd.dll
[2009/08/03 13:36:28 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/08/03 13:36:06 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys

========== LOP Check ==========

[2009/08/15 10:00:47 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2009/03/18 12:06:55 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/07/13 12:07:37 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2004/12/28 13:33:56 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ahead
[2006/07/25 17:51:53 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avanquest Software
[2006/12/09 14:41:59 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2009/01/04 16:33:18 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/01/04 17:25:07 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonIJEGV
[2009/06/06 11:11:52 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\COMMON FILES
[2009/06/09 08:28:32 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Intuit
[2006/07/16 18:56:56 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Macrovision
[2006/10/22 13:07:59 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Motive
[2006/12/07 19:37:52 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/08/13 12:42:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/03/07 20:11:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2009/06/06 11:24:16 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SQL Anywhere 10
[2009/08/08 15:27:17 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Nothnagel\Application Data
[2008/03/26 09:39:27 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Ahead
[2009/08/18 09:09:53 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\ArcSoft
[2008/05/30 16:33:56 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\IDX Imagecast iPACS Viewer
[2006/10/22 13:09:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Motive
[2009/05/14 19:12:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Move Networks
[2007/01/01 18:08:41 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\NCH Swift Sound
[2007/07/05 15:28:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\OverDrive
[2006/12/07 19:37:52 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\RecordPad
[2006/08/07 17:56:18 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Roxio
[2008/11/13 19:56:16 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\SanDisk
[2008/08/13 12:38:05 | 00,000,000 | —D | M] – C:\Documents and Settings\Nothnagel\Application Data\Uniblue
[2009/08/31 19:00:01 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2003/03/31 07:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/09/01 11:40:21 | 00,000,882 | —- | M] () – C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
[2009/09/01 10:55:00 | 00,000,886 | —- | M] () – C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
[2009/09/01 08:17:17 | 00,000,564 | —- | M] () – C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Nothnagel.job
[2009/08/31 12:02:42 | 00,000,300 | —- | M] () – C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
[2009/09/01 11:40:04 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

< End of report >

All processes killed
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33543 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Nothnagel
->Temp folder emptied: 1078 bytes
->Temporary Internet Files folder emptied: 4900840 bytes
->Java cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\WINDOWS\temp\JETA75B.tmp scheduled to be deleted on reboot.
Windows Temp folder emptied: 59243 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 4.76 mb

OTL by OldTimer - Version 3.0.10.7 log created on 09012009_182030

Files\Folders moved on Reboot…
File\Folder C:\WINDOWS\temp\JETA75B.tmp not found!

Registry entries deleted on Reboot…

JavaRa 1.15 Removal Log.

Report follows after line.

————————————

The JavaRa removal process was started on Tue Sep 01 18:30:16 2009

Found and removed: C:\Program Files\Java\jre1.5.0_07

Found and removed: C:\Documents and Settings\Nothnagel\Application Data\Sun\Java\jre1.6.0_11

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_07\

————————————

Finished reporting.

JavaRa 1.15 Removal Log.

Report follows after line.

————————————

The JavaRa removal process was started on Tue Sep 01 18:30:50 2009

————————————

Finished reporting.
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, September 2, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, September 02, 2009 01:24:24
Records in database: 2738642
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\

Scan statistics:
Objects scanned: 94381
Threats found: 23
Infected objects found: 36
Suspicious objects found: 0
Scan duration: 02:17:41

File name / Threat / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09E73A3D.htm Infected: Trojan-Downloader.JS.Agent.cd 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0E467105.dll Infected: Trojan-Proxy.Win32.Xorpix.u 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0E467105.exe Infected: Trojan-Downloader.Win32.Tiny.cl 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0E491B01.dll Infected: Trojan-Proxy.Win32.Agent.ji 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0E491B01.exe Infected: Trojan-Proxy.Win32.Agent.kn 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1672096B.zip Infected: Exploit.Java.ByteVerify 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1672096B.zip Infected: Trojan-Downloader.Java.OpenConnection.aa 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\19645B5C.cla Infected: Trojan.Java.ClassLoader.i 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B6E7A9B.htm Infected: Trojan-Downloader.JS.Agent.hv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\20781242.htm Infected: Trojan-Downloader.JS.Agent.bx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2DE70006.exe Infected: Trojan-Dropper.Win32.Agent.asd 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2F834CB7.tmp Infected: Trojan.Java.ClassLoader.i 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34BC1397.tmp Infected: Trojan-Downloader.Java.OpenConnection.ao 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34BC1397.tmp Infected: Trojan.Java.ClassLoader.au 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3AA57921.tmp Infected: Trojan-Downloader.Java.OpenStream.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A9375CF.exe Infected: Trojan-Proxy.Win32.Agent.ji 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4AFC649F.htm Infected: Trojan-Downloader.VBS.Mscount.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4C4D681A.htm Infected: Trojan-Downloader.JS.Agent.hv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4C501216.htm Infected: Trojan-Downloader.JS.Agent.hv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\502A6188.tmp Infected: Trojan-Dropper.Win32.Small.aps 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50913711.tmp Infected: Trojan.Java.ClassLoader.k 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52D61723.tmp Infected: Trojan-Proxy.Win32.Xorpix.v 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\55B94D8A.tmp Infected: Trojan-Proxy.Win32.Xorpix.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5B890F35.tmp Infected: Exploit.Java.Gimsh.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D075840.tmp Infected: Trojan-Downloader.Java.OpenConnection.ao 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D075840.tmp Infected: Trojan.Java.ClassLoader.au 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\625D20CE.cla Infected: Trojan.Java.ClassLoader.k 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\631C7248.tmp Infected: Trojan-Proxy.Win32.Xorpix.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6382291F.htm Infected: Trojan-Downloader.VBS.Agent.au 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64984BB7.wmf Infected: Exploit.Win32.IMG-WMF.bx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\68834FE8.tmp Infected: Trojan-Dropper.Win32.Small.aps 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\wisdstr.exe.vir Infected: Trojan.Win32.FraudPack.rcj 1
C:\System Volume Information\_restore{F80F0429-F1EA-40F8-996A-D8E115D86AB2}\RP1\A0000038.exe Infected: Trojan.Win32.FraudPack.rcj 1

Selected area has been scanned.

Thanks,
Fred

chamber

Post #12September 2, 2009, 3:14 PM UTC

It may look bad but it's actually ok,

All the threats are in quarantine.

Start Norton AntiVirus. If Norton AntiVirus is installed as part of Norton SystemWorks or Norton Internet Security, then start that program and click Norton AntiVirus.
In the left pane, click Reports.
Click View Norton Quarantined and Restore.
In the left pane, select the type of risk that you want to remove.
In the right pane, select the files that you want to remove.
Click Delete Item.
When you see the message "Warning! Are you sure that you want to remove this item from Quarantine," click Yes.
Close the Quarantine window, and then exit Norton AntiVirus.

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

madvet2

Post #13September 2, 2009, 4:41 PM UTC

Hi , In my version of Norton Antivirus I "View History" and select the quarrantine view. All that is listed there is "Packed generic.182" and it says that was removed 9/19/2008. Under Reports and Statistics my only choices are "View Activity Log" or "View Online Virus Encyclopedia." And yet the last report I sent shows all those things in quarrantine. What gives? Also I was wondering about the last item listed. The 'System Volume Information\restore……Infected Trojan.win32. Sorry to be so obtuse, I'll continue trying to find those items in Norton AV. Fred

chamber

Post #14September 2, 2009, 5:15 PM UTC

The last item is in the system restore folder. It will not become active unless you use that specific point. Once you are clean we will remove all the old restore points and set a new clean one. Also how many user accounts are on the system?

madvet2

Post #15September 2, 2009, 5:22 PM UTC

Just me, only user on this machine. It seems Norton AV is not looking in the correct place for those files an I can see them in that file. Since I can't do it the way you described should I manually move those items into quarrantine? Fred

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] braviax

✨ Ask AI

Ask AI