[Resolved] Possible Rootkit/trojan trouble

Hello,

I recently had this problem with my computer and now I find the same behavior with my wife's machine.

Problem:
Shortly after startup there is a notice that the services and controller app has encountered a problem and needs to close. Then a window appears warning me that the computer will restart in 60 seconds. Sometimes this does not come up, but when that happens the computer functions but is unstable, and then whenever you try to shut it down it starts up on its own.

I know from my previous trouble that I can prevent the shutdown and give myself time to work on the computer by running "shutdown -a" from the RUN box. I have done that. I also went ahead and ran GMER and OTL, as suggested by whatthe tech when I had this problem before. I am pasting the logs below. If someone could direct me where to go next, I would be grateful

GMER:

GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2010-01-24 21:57:12
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\angie13\LOCALS~1\Temp\uxtdrpod.sys


—- System - GMER 1.0.15 —-

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xEDC1978A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xEDC19821]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xEDC19738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xEDC1974C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xEDC19835]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xEDC19861]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xEDC198CF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xEDC198B9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xEDC197CA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xEDC198FB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xEDC1980D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xEDC19710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xEDC19724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xEDC1979E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xEDC19937]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xEDC198A3]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xEDC1988D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xEDC1984B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xEDC19923]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xEDC1990F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xEDC19776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xEDC19762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xEDC19877]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xEDC197F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xEDC198E5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xEDC197E0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xEDC197B4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwYieldExecution 805021FC 7 Bytes JMP EDC197B8 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtCreateFile 8056DF7C 5 Bytes JMP EDC1978E \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtMapViewOfSection 805A70D6 7 Bytes JMP EDC197CE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 805A7EEC 5 Bytes JMP EDC197E4 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 805AD66E 7 Bytes JMP EDC197A2 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenProcess 805C0DD6 5 Bytes JMP EDC19714 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenThread 805C1062 5 Bytes JMP EDC19728 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtSetInformationProcess 805C3894 5 Bytes JMP EDC19766 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 805C6E90 7 Bytes JMP EDC19750 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcess 805C6F46 5 Bytes JMP EDC1973C \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwSetContextThread 805C7450 5 Bytes JMP EDC1977A \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwTerminateProcess 805C8726 5 Bytes JMP EDC197FD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwQueryValueKey 80617F32 7 Bytes JMP EDC19891 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwRestoreKey 80618280 5 Bytes JMP EDC19913 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwSetValueKey 80618538 7 Bytes JMP EDC1987B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnloadKey 80618800 7 Bytes JMP EDC198E9 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwQueryMultipleValueKey 80619046 7 Bytes JMP EDC198A7 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwRenameKey 8061989E 7 Bytes JMP EDC1984F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateKey 80619E78 5 Bytes JMP EDC19825 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwDeleteKey 8061A308 7 Bytes JMP EDC19839 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwDeleteValueKey 8061A4D8 7 Bytes JMP EDC19865 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwEnumerateKey 8061A6B8 7 Bytes JMP EDC198D3 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwEnumerateValueKey 8061A922 7 Bytes JMP EDC198BD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwOpenKey 8061B20E 5 Bytes JMP EDC19811 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwQueryKey 8061B532 7 Bytes JMP EDC1993B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwReplaceKey 8061BA58 5 Bytes JMP EDC19927 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwNotifyChangeKey 8061BB72 5 Bytes JMP EDC198FF \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\spoolsv.exe[324] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 012B2FBB
.text C:\WINDOWS\system32\spoolsv.exe[324] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 012B2F86
.text C:\WINDOWS\system32\spoolsv.exe[324] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 012B1CE5
.text C:\WINDOWS\system32\spoolsv.exe[324] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 012B1BC3
.text C:\WINDOWS\system32\spoolsv.exe[324] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 012B2CC9
.text C:\WINDOWS\system32\spoolsv.exe[324] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 012B2BFF
.text C:\WINDOWS\system32\spoolsv.exe[324] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 012B2E21
.text C:\WINDOWS\system32\spoolsv.exe[324] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 012B2E3B
.text C:\WINDOWS\system32\spoolsv.exe[324] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 012B1C54
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[380] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00A02FBB
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[380] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00A02F86
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[380] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00A01CE5
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[380] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00A01BC3
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[380] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00A02CC9
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[380] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00A02BFF
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[380] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00A02E21
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[380] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00A02E3B
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[380] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00A01C54
.text C:\Program Files\McAfee\MPF\MPFSrv.exe[456] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 015B2FBB
.text C:\Program Files\McAfee\MPF\MPFSrv.exe[456] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 015B2F86
.text C:\Program Files\McAfee\MPF\MPFSrv.exe[456] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 015B1CE5
.text C:\Program Files\McAfee\MPF\MPFSrv.exe[456] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 015B1BC3
.text C:\Program Files\McAfee\MPF\MPFSrv.exe[456] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 015B2CC9
.text C:\Program Files\McAfee\MPF\MPFSrv.exe[456] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 015B2BFF
.text C:\Program Files\McAfee\MPF\MPFSrv.exe[456] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 015B2E21
.text C:\Program Files\McAfee\MPF\MPFSrv.exe[456] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 015B2E3B
.text C:\Program Files\McAfee\MPF\MPFSrv.exe[456] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 015B1C54
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 007A0000
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 007A0073
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 007A0062
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 007A0051
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 007A0F94
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 007A0036
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 007A0F46
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 007A008E
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 007B2FBB
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 007B2F86
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 007A00CE
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 007A0FB9
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 007A0011
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 007A0F63
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 007A0FCA
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 007A0FDB
.text C:\WINDOWS\system32\svchost.exe[460] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 007A0F2B
.text C:\WINDOWS\system32\svchost.exe[460] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00750025
.text C:\WINDOWS\system32\svchost.exe[460] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00750F7C
.text C:\WINDOWS\system32\svchost.exe[460] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00750FD4
.text C:\WINDOWS\system32\svchost.exe[460] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0075000A
.text C:\WINDOWS\system32\svchost.exe[460] ADVAPI32.dll!RegCreateKeyExA 77DDE9D4 5 Bytes JMP 00750F8D
.text C:\WINDOWS\system32\svchost.exe[460] ADVAPI32.dll!RegOpenKeyA 77DDEFA8 5 Bytes JMP 00750FEF
.text C:\WINDOWS\system32\svchost.exe[460] ADVAPI32.dll!RegCreateKeyW 77DFBA3D 2 Bytes JMP 00750F9E
.text C:\WINDOWS\system32\svchost.exe[460] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA40 2 Bytes [95, 88]
.text C:\WINDOWS\system32\svchost.exe[460] ADVAPI32.dll!RegCreateKeyA 77DFBCDB 5 Bytes JMP 00750FAF
.text C:\WINDOWS\system32\svchost.exe[460] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00740042
.text C:\WINDOWS\system32\svchost.exe[460] msvcrt.dll!system 77C293C7 5 Bytes JMP 00740FB7
.text C:\WINDOWS\system32\svchost.exe[460] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0074001D
.text C:\WINDOWS\system32\svchost.exe[460] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00740FEF
.text C:\WINDOWS\system32\svchost.exe[460] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00740FC8
.text C:\WINDOWS\system32\svchost.exe[460] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0074000C
.text C:\WINDOWS\system32\svchost.exe[460] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00720FE5
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!InternetOpenW 771BAEED 5 Bytes JMP 0073001B
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 007B1CE5
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!InternetOpenA 771C573E 5 Bytes JMP 0073000A
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!InternetOpenUrlA 771C59F1 5 Bytes JMP 0073002C
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 007B1BC3
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 007B2CC9
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!InternetOpenUrlW 771D5B3A 5 Bytes JMP 00730FD9
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 007B2BFF
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 007B2E21
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 007B2E3B
.text C:\WINDOWS\system32\svchost.exe[460] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 007B1C54
.text C:\Program Files\McAfee\MSK\MskSrver.exe[576] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01682FBB
.text C:\Program Files\McAfee\MSK\MskSrver.exe[576] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01682F86
.text C:\Program Files\McAfee\MSK\MskSrver.exe[576] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 01681CE5
.text C:\Program Files\McAfee\MSK\MskSrver.exe[576] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 01681BC3
.text C:\Program Files\McAfee\MSK\MskSrver.exe[576] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 01682CC9
.text C:\Program Files\McAfee\MSK\MskSrver.exe[576] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 01682BFF
.text C:\Program Files\McAfee\MSK\MskSrver.exe[576] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 01682E21
.text C:\Program Files\McAfee\MSK\MskSrver.exe[576] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 01682E3B
.text C:\Program Files\McAfee\MSK\MskSrver.exe[576] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 01681C54
.text C:\WINDOWS\system32\HPZipm12.exe[636] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00A02FBB
.text C:\WINDOWS\system32\HPZipm12.exe[636] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00A02F86
.text C:\WINDOWS\system32\HPZipm12.exe[636] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00A01CE5
.text C:\WINDOWS\system32\HPZipm12.exe[636] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00A01BC3
.text C:\WINDOWS\system32\HPZipm12.exe[636] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00A02CC9
.text C:\WINDOWS\system32\HPZipm12.exe[636] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00A02BFF
.text C:\WINDOWS\system32\HPZipm12.exe[636] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00A02E21
.text C:\WINDOWS\system32\HPZipm12.exe[636] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00A02E3B
.text C:\WINDOWS\system32\HPZipm12.exe[636] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00A01C54
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[788] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00822FBB
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[788] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00822F86
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[788] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00821CE5
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[788] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00821BC3
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[788] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00822CC9
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[788] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00822BFF
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[788] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00822E21
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[788] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00822E3B
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[788] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00821C54
.text C:\Program Files\Bonjour\mDNSResponder.exe[808] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00852FBB
.text C:\Program Files\Bonjour\mDNSResponder.exe[808] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00852F86
.text C:\Program Files\Bonjour\mDNSResponder.exe[808] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00851CE5
.text C:\Program Files\Bonjour\mDNSResponder.exe[808] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00851BC3
.text C:\Program Files\Bonjour\mDNSResponder.exe[808] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00852CC9
.text C:\Program Files\Bonjour\mDNSResponder.exe[808] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00852BFF
.text C:\Program Files\Bonjour\mDNSResponder.exe[808] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00852E21
.text C:\Program Files\Bonjour\mDNSResponder.exe[808] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00852E3B
.text C:\Program Files\Bonjour\mDNSResponder.exe[808] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00851C54
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 009C0000
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 009C0F7B
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 009C007A
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 009C005F
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 009C0FAC
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 009C003D
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 009C00A8
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 009C008B
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00A52FBB
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00A52F86
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 009C0F05
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 009C004E
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 009C0FDB
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 009C0F6A
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 009C002C
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 009C001B
.text C:\WINDOWS\system32\svchost.exe[812] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 009C00B9
.text C:\WINDOWS\system32\svchost.exe[812] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 009B0FCA
.text C:\WINDOWS\system32\svchost.exe[812] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 009B0F6F
.text C:\WINDOWS\system32\svchost.exe[812] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 009B0011
.text C:\WINDOWS\system32\svchost.exe[812] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 009B0000
.text C:\WINDOWS\system32\svchost.exe[812] ADVAPI32.dll!RegCreateKeyExA 77DDE9D4 5 Bytes JMP 009B0F94
.text C:\WINDOWS\system32\svchost.exe[812] ADVAPI32.dll!RegOpenKeyA 77DDEFA8 5 Bytes JMP 009B0FE5
.text C:\WINDOWS\system32\svchost.exe[812] ADVAPI32.dll!RegCreateKeyW 77DFBA3D 5 Bytes JMP 009B0036
.text C:\WINDOWS\system32\svchost.exe[812] ADVAPI32.dll!RegCreateKeyA 77DFBCDB 5 Bytes JMP 009B0FB9
.text C:\WINDOWS\system32\svchost.exe[812] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 009A0069
.text C:\WINDOWS\system32\svchost.exe[812] msvcrt.dll!system 77C293C7 5 Bytes JMP 009A004E
.text C:\WINDOWS\system32\svchost.exe[812] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 009A002C
.text C:\WINDOWS\system32\svchost.exe[812] msvcrt.dll!_open 77C2F566 5 Bytes JMP 009A0000
.text C:\WINDOWS\system32\svchost.exe[812] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 009A003D
.text C:\WINDOWS\system32\svchost.exe[812] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 009A0011
.text C:\WINDOWS\system32\svchost.exe[812] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00990FEF
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!InternetOpenW 771BAEED 5 Bytes JMP 00B60025
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00A51CE5
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!InternetOpenA 771C573E 5 Bytes JMP 00B6000A
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!InternetOpenUrlA 771C59F1 5 Bytes JMP 00B60036
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00A51BC3
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00A52CC9
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!InternetOpenUrlW 771D5B3A 5 Bytes JMP 00B60047
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00A52BFF
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00A52E21
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00A52E3B
.text C:\WINDOWS\system32\svchost.exe[812] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00A51C54
.text C:\WINDOWS\system32\winlogon.exe[848] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01452FBB
.text C:\WINDOWS\system32\winlogon.exe[848] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01452F86
.text C:\WINDOWS\system32\winlogon.exe[848] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 01451CE5
.text C:\WINDOWS\system32\winlogon.exe[848] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 01451BC3
.text C:\WINDOWS\system32\winlogon.exe[848] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 01452CC9
.text C:\WINDOWS\system32\winlogon.exe[848] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 01452BFF
.text C:\WINDOWS\system32\winlogon.exe[848] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 01452E21
.text C:\WINDOWS\system32\winlogon.exe[848] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 01452E3B
.text C:\WINDOWS\system32\winlogon.exe[848] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 01451C54
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 01060FEF
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 010600BF
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 010600AE
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 01060093
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 01060076
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 01060040
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 010600F5
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 01060FB9
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 011F2FBB
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 011F2F86
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 01060F48
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 0106005B
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 0106000A
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 010600DA
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 01060FD4
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 0106001B
.text C:\WINDOWS\system32\lsass.exe[908] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 01060106
.text C:\WINDOWS\system32\lsass.exe[908] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01050FC3
.text C:\WINDOWS\system32\lsass.exe[908] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01050F83
.text C:\WINDOWS\system32\lsass.exe[908] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01050014
.text C:\WINDOWS\system32\lsass.exe[908] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01050FD4
.text C:\WINDOWS\system32\lsass.exe[908] ADVAPI32.dll!RegCreateKeyExA 77DDE9D4 5 Bytes JMP 01050040
.text C:\WINDOWS\system32\lsass.exe[908] ADVAPI32.dll!RegOpenKeyA 77DDEFA8 5 Bytes JMP 01050FEF
.text C:\WINDOWS\system32\lsass.exe[908] ADVAPI32.dll!RegCreateKeyW 77DFBA3D 5 Bytes JMP 0105002F
.text C:\WINDOWS\system32\lsass.exe[908] ADVAPI32.dll!RegCreateKeyA 77DFBCDB 5 Bytes JMP 01050FA8
.text C:\WINDOWS\system32\lsass.exe[908] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00D30053
.text C:\WINDOWS\system32\lsass.exe[908] msvcrt.dll!system 77C293C7 5 Bytes JMP 00D30038
.text C:\WINDOWS\system32\lsass.exe[908] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00D30FD2
.text C:\WINDOWS\system32\lsass.exe[908] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00D3000C
.text C:\WINDOWS\system32\lsass.exe[908] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00D30027
.text C:\WINDOWS\system32\lsass.exe[908] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00D30FE3
.text C:\WINDOWS\system32\lsass.exe[908] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00CE0000
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!InternetOpenW 771BAEED 5 Bytes JMP 01300000
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 011F1CE5
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!InternetOpenA 771C573E 5 Bytes JMP 01300FE5
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!InternetOpenUrlA 771C59F1 5 Bytes JMP 01300011
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 011F1BC3
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 011F2CC9
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!InternetOpenUrlW 771D5B3A 5 Bytes JMP 01300FB4
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 011F2BFF
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 011F2E21
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 011F2E3B
.text C:\WINDOWS\system32\lsass.exe[908] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 011F1C54
.text C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe[940] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00E42FBB
.text C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe[940] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00E42F86
.text C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe[940] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00E41CE5
.text C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe[940] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00E41BC3
.text C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe[940] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 00E42CC9
.text C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe[940] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00E42BFF
.text C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe[940] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00E42E21
.text C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe[940] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00E42E3B
.text C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe[940] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00E41C54
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[1036] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00F52FBB
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[1036] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00F52F86
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[1036] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00F51CE5
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[1036] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00F51BC3
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[1036] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 00F52CC9
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[1036] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00F52BFF
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[1036] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00F52E21
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[1036] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00F52E3B
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[1036] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00F51C54
.text C:\WINDOWS\system32\Ati2evxx.exe[1088] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00EC2FBB
.text C:\WINDOWS\system32\Ati2evxx.exe[1088] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00EC2F86
.text C:\WINDOWS\system32\Ati2evxx.exe[1088] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00EC1CE5
.text C:\WINDOWS\system32\Ati2evxx.exe[1088] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00EC1BC3
.text C:\WINDOWS\system32\Ati2evxx.exe[1088] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00EC2CC9
.text C:\WINDOWS\system32\Ati2evxx.exe[1088] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00EC2BFF
.text C:\WINDOWS\system32\Ati2evxx.exe[1088] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00EC2E21
.text C:\WINDOWS\system32\Ati2evxx.exe[1088] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00EC2E3B
.text C:\WINDOWS\system32\Ati2evxx.exe[1088] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00EC1C54
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00CE0FEF
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00CE0093
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00CE0F9E
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00CE006C
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00CE005B
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00CE0FAF
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00CE00D5
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00CE00B8
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00CF2FBB
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00CF2F86
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 00CE0F57
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 00CE0036
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 00CE0FDE
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 00CE0F8D
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 00CE001B
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 00CE000A
.text C:\WINDOWS\system32\svchost.exe[1104] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00CE00E6
.text C:\WINDOWS\system32\svchost.exe[1104] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00CD0FCA
.text C:\WINDOWS\system32\svchost.exe[1104] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00CD004A
.text C:\WINDOWS\system32\svchost.exe[1104] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00CD0025
.text C:\WINDOWS\system32\svchost.exe[1104] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00CD0FEF
.text C:\WINDOWS\system32\svchost.exe[1104] ADVAPI32.dll!RegCreateKeyExA 77DDE9D4 5 Bytes JMP 00CD0F8D
.text C:\WINDOWS\system32\svchost.exe[1104] ADVAPI32.dll!RegOpenKeyA 77DDEFA8 5 Bytes JMP 00CD000A
.text C:\WINDOWS\system32\svchost.exe[1104] ADVAPI32.dll!RegCreateKeyW 77DFBA3D 2 Bytes JMP 00CD0F9E
.text C:\WINDOWS\system32\svchost.exe[1104] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA40 2 Bytes [ED, 88]
.text C:\WINDOWS\system32\svchost.exe[1104] ADVAPI32.dll!RegCreateKeyA 77DFBCDB 5 Bytes JMP 00CD0FB9
.text C:\WINDOWS\system32\svchost.exe[1104] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00CC0031
.text C:\WINDOWS\system32\svchost.exe[1104] msvcrt.dll!system 77C293C7 5 Bytes JMP 00CC0F9C
.text C:\WINDOWS\system32\svchost.exe[1104] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00CC0FC8
.text C:\WINDOWS\system32\svchost.exe[1104] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00CC0000
.text C:\WINDOWS\system32\svchost.exe[1104] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00CC0FB7
.text C:\WINDOWS\system32\svchost.exe[1104] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00CC0FE3
.text C:\WINDOWS\system32\svchost.exe[1104] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00B30FE5
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!InternetOpenW 771BAEED 5 Bytes JMP 00D00025
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00CF1CE5
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!InternetOpenA 771C573E 5 Bytes JMP 00D0000A
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!InternetOpenUrlA 771C59F1 5 Bytes JMP 00D00FE3
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00CF1BC3
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00CF2CC9
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!InternetOpenUrlW 771D5B3A 5 Bytes JMP 00D00040
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00CF2BFF
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00CF2E21
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00CF2E3B
.text C:\WINDOWS\system32\svchost.exe[1104] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00CF1C54
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00B70FEF
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00B70F83
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00B70F94
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00B70062
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00B70051
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00B70036
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00B70F66
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00B700AE
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00942FBB
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00942F86
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 00B700EE
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 00B70FAF
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 00B70FDE
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 00B7009D
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 00B70025
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 00B7000A
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00B700C9
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00B60FC3
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00B60054
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00B6000A
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00B60FD4
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyExA 77DDE9D4 5 Bytes JMP 00B60F97
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyA 77DDEFA8 5 Bytes JMP 00B60FE5
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyW 77DFBA3D 5 Bytes JMP 00B60039
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyA 77DFBCDB 5 Bytes JMP 00B60FB2
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00B50044
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!system 77C293C7 5 Bytes JMP 00B50029
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00B50018
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00B50FEF
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00B50FB9
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00B50FDE
.text C:\WINDOWS\system32\svchost.exe[1184] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00B40000
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!InternetOpenW 771BAEED 5 Bytes JMP 00950FDE
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00941CE5
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!InternetOpenA 771C573E 5 Bytes JMP 00950FEF
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!InternetOpenUrlA 771C59F1 5 Bytes JMP 00950FB7
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00941BC3
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00942CC9
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!InternetOpenUrlW 771D5B3A 5 Bytes JMP 0095000A
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00942BFF
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00942E21
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00942E3B
.text C:\WINDOWS\system32\svchost.exe[1184] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00941C54
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1272] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 007B2FBB
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1272] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 007B2F86
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1272] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 007B1CE5
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1272] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 007B1BC3
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1272] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 007B2CC9
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1272] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 007B2BFF
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1272] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 007B2E21
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1272] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 007B2E3B
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[1272] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 007B1C54
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00A00FEF
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00A00084
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00A00073
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00A00062
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00A00051
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00A00FAF
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00A000B2
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00A00095
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00A12FBB
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00A12F86
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 00A000F2
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 00A00036
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 00A0000A
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 00A00F74
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 00A0001B
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 00A00FD4
.text C:\WINDOWS\system32\svchost.exe[1416] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00A00F4F
.text C:\WINDOWS\system32\svchost.exe[1416] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 009F0025
.text C:\WINDOWS\system32\svchost.exe[1416] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 009F0F72
.text C:\WINDOWS\system32\svchost.exe[1416] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 009F0FD4
.text C:\WINDOWS\system32\svchost.exe[1416] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 009F000A
.text C:\WINDOWS\system32\svchost.exe[1416] ADVAPI32.dll!RegCreateKeyExA 77DDE9D4 5 Bytes JMP 009F0F8D
.text C:\WINDOWS\system32\svchost.exe[1416] ADVAPI32.dll!RegOpenKeyA 77DDEFA8 5 Bytes JMP 009F0FEF
.text C:\WINDOWS\system32\svchost.exe[1416] ADVAPI32.dll!RegCreateKeyW 77DFBA3D 2 Bytes JMP 009F0F9E
.text C:\WINDOWS\system32\svchost.exe[1416] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA40 2 Bytes [BF, 88]
.text C:\WINDOWS\system32\svchost.exe[1416] ADVAPI32.dll!RegCreateKeyA 77DFBCDB 5 Bytes JMP 009F0FAF
.text C:\WINDOWS\system32\svchost.exe[1416] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 009E004E
.text C:\WINDOWS\system32\svchost.exe[1416] msvcrt.dll!system 77C293C7 5 Bytes JMP 009E003D
.text C:\WINDOWS\system32\svchost.exe[1416] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 009E0FD7
.text C:\WINDOWS\system32\svchost.exe[1416] msvcrt.dll!_open 77C2F566 5 Bytes JMP 009E0000
.text C:\WINDOWS\system32\svchost.exe[1416] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 009E0022
.text C:\WINDOWS\system32\svchost.exe[1416] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 009E0011
.text C:\WINDOWS\system32\svchost.exe[1416] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 009D0000
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!InternetOpenW 771BAEED 5 Bytes JMP 00B20FEF
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00A11CE5
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!InternetOpenA 771C573E 5 Bytes JMP 00B2000A
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!InternetOpenUrlA 771C59F1 5 Bytes JMP 00B20FDE
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00A11BC3
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00A12CC9
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!InternetOpenUrlW 771D5B3A 5 Bytes JMP 00B2002F
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00A12BFF
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00A12E21
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00A12E3B
.text C:\WINDOWS\system32\svchost.exe[1416] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00A11C54
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[1460] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01742FBB
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[1460] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01742F86
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[1460] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 01741CE5
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[1460] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 01741BC3
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[1460] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 01742CC9
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[1460] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 01742BFF
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[1460] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 01742E21
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[1460] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 01742E3B
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[1460] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 01741C54
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1548] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 02E92FBB
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1548] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 02E92F86
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1548] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 02E91CE5
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1548] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 02E91BC3
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1548] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 02E92CC9
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1548] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 02E92BFF
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1548] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 02E92E21
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1548] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 02E92E3B
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[1548] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 02E91C54
.text C:\Program Files\Logitech\SetPoint\SetPoint.exe[1588] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00142FBB
.text C:\Program Files\Logitech\SetPoint\SetPoint.exe[1588] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00142F86
.text C:\Program Files\Logitech\SetPoint\SetPoint.exe[1588] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00141CE5
.text C:\Program Files\Logitech\SetPoint\SetPoint.exe[1588] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00141BC3
.text C:\Program Files\Logitech\SetPoint\SetPoint.exe[1588] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00142CC9
.text C:\Program Files\Logitech\SetPoint\SetPoint.exe[1588] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00142BFF
.text C:\Program Files\Logitech\SetPoint\SetPoint.exe[1588] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00142E21
.text C:\Program Files\Logitech\SetPoint\SetPoint.exe[1588] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00142E3B
.text C:\Program Files\Logitech\SetPoint\SetPoint.exe[1588] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00141C54
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[1648] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 02F62FBB
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[1648] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 02F62F86
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[1648] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 02F61CE5
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[1648] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 02F61BC3
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[1648] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 02F62CC9
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[1648] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 02F62BFF
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[1648] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 02F62E21
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[1648] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 02F62E3B
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[1648] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 02F61C54
.text C:\WINDOWS\system32\wdfmgr.exe[1664] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00922FBB
.text C:\WINDOWS\system32\wdfmgr.exe[1664] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00922F86
.text C:\WINDOWS\system32\wdfmgr.exe[1664] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00921CE5
.text C:\WINDOWS\system32\wdfmgr.exe[1664] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00921BC3
.text C:\WINDOWS\system32\wdfmgr.exe[1664] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00922CC9
.text C:\WINDOWS\system32\wdfmgr.exe[1664] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00922BFF
.text C:\WINDOWS\system32\wdfmgr.exe[1664] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00922E21
.text C:\WINDOWS\system32\wdfmgr.exe[1664] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00922E3B
.text C:\WINDOWS\system32\wdfmgr.exe[1664] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00921C54
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 007F0FEF
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 007F0F81
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 007F0076
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 007F0FA8
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 007F005B
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 007F0040
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 007F009D
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 007F0F55
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00A32FBB
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00A32F86
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 007F00D3
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 007F0FB9
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 007F000A
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 007F0F70
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 007F0025
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 007F0FD4
.text C:\WINDOWS\system32\svchost.exe[1672] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 007F0F3A
.text C:\WINDOWS\system32\svchost.exe[1672] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 007E0FDE
.text C:\WINDOWS\system32\svchost.exe[1672] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 007E0087
.text C:\WINDOWS\system32\svchost.exe[1672] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 007E002F
.text C:\WINDOWS\system32\svchost.exe[1672] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 007E0FEF
.text C:\WINDOWS\system32\svchost.exe[1672] ADVAPI32.dll!RegCreateKeyExA 77DDE9D4 5 Bytes JMP 007E0076
.text C:\WINDOWS\system32\svchost.exe[1672] ADVAPI32.dll!RegOpenKeyA 77DDEFA8 5 Bytes JMP 007E0000
.text C:\WINDOWS\system32\svchost.exe[1672] ADVAPI32.dll!RegCreateKeyW 77DFBA3D 5 Bytes JMP 007E0065
.text C:\WINDOWS\system32\svchost.exe[1672] ADVAPI32.dll!RegCreateKeyA 77DFBCDB 5 Bytes JMP 007E0054
.text C:\WINDOWS\system32\svchost.exe[1672] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 007D0027
.text C:\WINDOWS\system32\svchost.exe[1672] msvcrt.dll!system 77C293C7 5 Bytes JMP 007D0016
.text C:\WINDOWS\system32\svchost.exe[1672] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 007D0FC1
.text C:\WINDOWS\system32\svchost.exe[1672] msvcrt.dll!_open 77C2F566 5 Bytes JMP 007D0FE3
.text C:\WINDOWS\system32\svchost.exe[1672] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 007D0FA6
.text C:\WINDOWS\system32\svchost.exe[1672] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 007D0FD2
.text C:\WINDOWS\system32\svchost.exe[1672] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 007B0FEF
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!InternetOpenW 771BAEED 5 Bytes JMP 00B40FE5
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00A31CE5
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!InternetOpenA 771C573E 5 Bytes JMP 00B4000A
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!InternetOpenUrlA 771C59F1 5 Bytes JMP 00B4001B
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00A31BC3
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00A32CC9
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!InternetOpenUrlW 771D5B3A 5 Bytes JMP 00B40038
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00A32BFF
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00A32E21
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00A32E3B
.text C:\WINDOWS\system32\svchost.exe[1672] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00A31C54
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 015F2FBB
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 015F2F86
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 015F1CE5
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 015F1BC3
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 015F2CC9
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 015F2BFF
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 015F2E21
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 015F2E3B
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1708] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 015F1C54
.text C:\Program Files\Microsoft Office\Office\OSA.EXE[1736] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00322FBB
.text C:\Program Files\Microsoft Office\Office\OSA.EXE[1736] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00322F86
.text C:\Program Files\Microsoft Office\Office\OSA.EXE[1736] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00321CE5
.text C:\Program Files\Microsoft Office\Office\OSA.EXE[1736] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00321BC3
.text C:\Program Files\Microsoft Office\Office\OSA.EXE[1736] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00322CC9
.text C:\Program Files\Microsoft Office\Office\OSA.EXE[1736] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00322BFF
.text C:\Program Files\Microsoft Office\Office\OSA.EXE[1736] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00322E21
.text C:\Program Files\Microsoft Office\Office\OSA.EXE[1736] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00322E3B
.text C:\Program Files\Microsoft Office\Office\OSA.EXE[1736] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00321C54
.text C:\Program Files\Creative\Shared Files\CTSched.exe[1748] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00BE2FBB
.text C:\Program Files\Creative\Shared Files\CTSched.exe[1748] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00BE2F86
.text C:\Program Files\Creative\Shared Files\CTSched.exe[1748] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00BE1CE5
.text C:\Program Files\Creative\Shared Files\CTSched.exe[1748] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00BE1BC3
.text C:\Program Files\Creative\Shared Files\CTSched.exe[1748] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00BE2CC9
.text C:\Program Files\Creative\Shared Files\CTSched.exe[1748] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00BE2BFF
.text C:\Program Files\Creative\Shared Files\CTSched.exe[1748] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00BE2E21
.text C:\Program Files\Creative\Shared Files\CTSched.exe[1748] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00BE2E3B
.text C:\Program Files\Creative\Shared Files\CTSched.exe[1748] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00BE1C54
.text C:\Program Files\Microsoft Office\Office\FINDFAST.EXE[1776] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00CC2FBB
.text C:\Program Files\Microsoft Office\Office\FINDFAST.EXE[1776] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00CC2F86
.text C:\Program Files\Microsoft Office\Office\FINDFAST.EXE[1776] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00CC1CE5
.text C:\Program Files\Microsoft Office\Office\FINDFAST.EXE[1776] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00CC1BC3
.text C:\Program Files\Microsoft Office\Office\FINDFAST.EXE[1776] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00CC2CC9
.text C:\Program Files\Microsoft Office\Office\FINDFAST.EXE[1776] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00CC2BFF
.text C:\Program Files\Microsoft Office\Office\FINDFAST.EXE[1776] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00CC2E21
.text C:\Program Files\Microsoft Office\Office\FINDFAST.EXE[1776] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00CC2E3B
.text C:\Program Files\Microsoft Office\Office\FINDFAST.EXE[1776] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00CC1C54
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[2128] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 007C2FBB
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[2128] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 007C2F86
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[2128] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 007C1CE5
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[2128] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 007C1BC3
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[2128] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 007C2CC9
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[2128] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 007C2BFF
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[2128] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 007C2E21
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[2128] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 007C2E3B
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[2128] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 007C1C54
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[2168] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00D12FBB
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[2168] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00D12F86
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[2168] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00D11CE5
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[2168] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00D11BC3
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[2168] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00D12CC9
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[2168] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00D12BFF
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[2168] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00D12E21
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[2168] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00D12E3B
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[2168] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00D11C54
.text C:\WINDOWS\system32\dwwin.exe[2176] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00AC2FBB
.text C:\WINDOWS\system32\dwwin.exe[2176] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00AC2F86
.text C:\WINDOWS\system32\dwwin.exe[2176] WININET.DLL!InternetCloseHandle 771C4D3C 5 Bytes JMP 00AC1CE5
.text C:\WINDOWS\system32\dwwin.exe[2176] WININET.DLL!HttpSendRequestA 771C60C9 5 Bytes JMP 00AC1BC3
.text C:\WINDOWS\system32\dwwin.exe[2176] WININET.DLL!InternetReadFile 771C827C 5 Bytes JMP 00AC2CC9
.text C:\WINDOWS\system32\dwwin.exe[2176] WININET.DLL!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00AC2BFF
.text C:\WINDOWS\system32\dwwin.exe[2176] WININET.DLL!InternetReadFileExA 771F868E 5 Bytes JMP 00AC2E21
.text C:\WINDOWS\system32\dwwin.exe[2176] WININET.DLL!InternetReadFileExW 771F90DE 8 Bytes JMP 00AC2E3B
.text C:\WINDOWS\system32\dwwin.exe[2176] WININET.DLL!HttpSendRequestW 772123AC 5 Bytes JMP 00AC1C54
.text C:\Program Files\Logitech\Video\FxSvr2.exe[2480] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01012FBB
.text C:\Program Files\Logitech\Video\FxSvr2.exe[2480] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01012F86
.text C:\Program Files\Logitech\Video\FxSvr2.exe[2480] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 01011CE5
.text C:\Program Files\Logitech\Video\FxSvr2.exe[2480] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 01011BC3
.text C:\Program Files\Logitech\Video\FxSvr2.exe[2480] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 01012CC9
.text C:\Program Files\Logitech\Video\FxSvr2.exe[2480] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 01012BFF
.text C:\Program Files\Logitech\Video\FxSvr2.exe[2480] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 01012E21
.text C:\Program Files\Logitech\Video\FxSvr2.exe[2480] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 01012E3B
.text C:\Program Files\Logitech\Video\FxSvr2.exe[2480] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 01011C54
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2532] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01522FBB
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2532] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01522F86
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2532] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 01521CE5
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2532] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 01521BC3
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2532] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 01522CC9
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2532] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 01522BFF
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2532] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 01522E21
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2532] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 01522E3B
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2532] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 01521C54
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2928] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00CF2FBB
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2928] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00CF2F86
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2928] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00CF1CE5
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2928] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00CF1BC3
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2928] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00CF2CC9
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2928] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00CF2BFF
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2928] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00CF2E21
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2928] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00CF2E3B
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2928] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00CF1C54
.text C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe[2984] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00152FBB
.text C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe[2984] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00152F86
.text C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe[2984] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00151CE5
.text C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe[2984] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00151BC3
.text C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe[2984] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 00152CC9
.text C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe[2984] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00152BFF
.text C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe[2984] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00152E21
.text C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe[2984] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00152E3B
.text C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe[2984] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00151C54
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3012] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01572FBB
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3012] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01572F86
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3012] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 01571CE5
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3012] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 01571BC3
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3012] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 01572CC9
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3012] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 01572BFF
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3012] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 01572E21
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3012] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 01572E3B
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3012] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 01571C54
.text C:\Program Files\HP\QuickPlay\QPService.exe[3096] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00E22FBB
.text C:\Program Files\HP\QuickPlay\QPService.exe[3096] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00E22F86
.text C:\Program Files\HP\QuickPlay\QPService.exe[3096] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00E21CE5
.text C:\Program Files\HP\QuickPlay\QPService.exe[3096] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00E21BC3
.text C:\Program Files\HP\QuickPlay\QPService.exe[3096] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00E22CC9
.text C:\Program Files\HP\QuickPlay\QPService.exe[3096] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00E22BFF
.text C:\Program Files\HP\QuickPlay\QPService.exe[3096] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00E22E21
.text C:\Program Files\HP\QuickPlay\QPService.exe[3096] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00E22E3B
.text C:\Program Files\HP\QuickPlay\QPService.exe[3096] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00E21C54
.text C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe[3160] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00DF2FBB
.text C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe[3160] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00DF2F86
.text C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe[3160] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00DF1CE5
.text C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe[3160] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00DF1BC3
.text C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe[3160] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 00DF2CC9
.text C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe[3160] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00DF2BFF
.text C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe[3160] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00DF2E21
.text C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe[3160] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00DF2E3B
.text C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe[3160] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00DF1C54
.text C:\Program Files\iPod\bin\iPodService.exe[3188] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00CB2FBB
.text C:\Program Files\iPod\bin\iPodService.exe[3188] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00CB2F86
.text C:\Program Files\iPod\bin\iPodService.exe[3188] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00CB1CE5
.text C:\Program Files\iPod\bin\iPodService.exe[3188] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00CB1BC3
.text C:\Program Files\iPod\bin\iPodService.exe[3188] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00CB2CC9
.text C:\Program Files\iPod\bin\iPodService.exe[3188] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00CB2BFF
.text C:\Program Files\iPod\bin\iPodService.exe[3188] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00CB2E21
.text C:\Program Files\iPod\bin\iPodService.exe[3188] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00CB2E3B
.text C:\Program Files\iPod\bin\iPodService.exe[3188] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00CB1C54
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[3228] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01382FBB
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[3228] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01382F86
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[3228] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 01381CE5
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[3228] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 01381BC3
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[3228] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 01382CC9
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[3228] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 01382BFF
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[3228] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 01382E21
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[3228] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 01382E3B
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[3228] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 01381C54
.text C:\WINDOWS\system32\LVCOMSX.EXE[3288] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 016C2FBB
.text C:\WINDOWS\system32\LVCOMSX.EXE[3288] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 016C2F86
.text C:\WINDOWS\system32\LVCOMSX.EXE[3288] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 016C1CE5
.text C:\WINDOWS\system32\LVCOMSX.EXE[3288] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 016C1BC3
.text C:\WINDOWS\system32\LVCOMSX.EXE[3288] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 016C2CC9
.text C:\WINDOWS\system32\LVCOMSX.EXE[3288] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 016C2BFF
.text C:\WINDOWS\system32\LVCOMSX.EXE[3288] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 016C2E21
.text C:\WINDOWS\system32\LVCOMSX.EXE[3288] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 016C2E3B
.text C:\WINDOWS\system32\LVCOMSX.EXE[3288] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 016C1C54
.text C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe[3328] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 010F2FBB
.text C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe[3328] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 010F2F86
.text C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe[3328] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 010F1CE5
.text C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe[3328] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 010F1BC3
.text C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe[3328] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 010F2CC9
.text C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe[3328] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 010F2BFF
.text C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe[3328] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 010F2E21
.text C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe[3328] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 010F2E3B
.text C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe[3328] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 010F1C54
.text C:\Program Files\Logitech\Video\LogiTray.exe[3420] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 012F2FBB
.text C:\Program Files\Logitech\Video\LogiTray.exe[3420] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 012F2F86
.text C:\Program Files\Logitech\Video\LogiTray.exe[3420] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 012F1CE5
.text C:\Program Files\Logitech\Video\LogiTray.exe[3420] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 012F1BC3
.text C:\Program Files\Logitech\Video\LogiTray.exe[3420] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 012F2CC9
.text C:\Program Files\Logitech\Video\LogiTray.exe[3420] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 012F2BFF
.text C:\Program Files\Logitech\Video\LogiTray.exe[3420] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 012F2E21
.text C:\Program Files\Logitech\Video\LogiTray.exe[3420] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 012F2E3B
.text C:\Program Files\Logitech\Video\LogiTray.exe[3420] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 012F1C54
.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3712] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01262FBB
.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3712] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01262F86
.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3712] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 01261CE5
.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3712] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 01261BC3
.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3712] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 01262CC9
.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3712] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 01262BFF
.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3712] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 01262E21
.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3712] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 01262E3B
.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3712] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 01261C54
.text C:\Program Files\iTunes\iTunesHelper.exe[3752] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 09F12FBB
.text C:\Program Files\iTunes\iTunesHelper.exe[3752] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 09F12F86
.text C:\Program Files\iTunes\iTunesHelper.exe[3752] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 09F11CE5
.text C:\Program Files\iTunes\iTunesHelper.exe[3752] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 09F11BC3
.text C:\Program Files\iTunes\iTunesHelper.exe[3752] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 09F12CC9
.text C:\Program Files\iTunes\iTunesHelper.exe[3752] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 09F12BFF
.text C:\Program Files\iTunes\iTunesHelper.exe[3752] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 09F12E21
.text C:\Program Files\iTunes\iTunesHelper.exe[3752] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 09F12E3B
.text C:\Program Files\iTunes\iTunesHelper.exe[3752] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 09F11C54
.text C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe[3816] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 015F2FBB
.text C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe[3816] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 015F2F86
.text C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe[3816] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 015F1CE5
.text C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe[3816] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 015F1BC3
.text C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe[3816] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 015F2CC9
.text C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe[3816] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 015F2BFF
.text C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe[3816] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 015F2E21
.text C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe[3816] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 015F2E3B
.text C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe[3816] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 015F1C54
.text C:\WINDOWS\V0415Mon.exe[3836] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00BC2FBB
.text C:\WINDOWS\V0415Mon.exe[3836] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00BC2F86
.text C:\WINDOWS\V0415Mon.exe[3836] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00BC1CE5
.text C:\WINDOWS\V0415Mon.exe[3836] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00BC1BC3
.text C:\WINDOWS\V0415Mon.exe[3836] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00BC2CC9
.text C:\WINDOWS\V0415Mon.exe[3836] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00BC2BFF
.text C:\WINDOWS\V0415Mon.exe[3836] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00BC2E21
.text C:\WINDOWS\V0415Mon.exe[3836] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00BC2E3B
.text C:\WINDOWS\V0415Mon.exe[3836] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00BC1C54
.text C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe[3892] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00BF2FBB
.text C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe[3892] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00BF2F86
.text C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe[3892] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00BF1CE5
.text C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe[3892] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00BF1BC3
.text C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe[3892] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 00BF2CC9
.text C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe[3892] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00BF2BFF
.text C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe[3892] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00BF2E21
.text C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe[3892] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00BF2E3B
.text C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe[3892] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00BF1C54
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 001A0FE5
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001A009F
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 001A008E
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 001A007D
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 001A006C
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 001A0FD4
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 001A00D0
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 001A0F88
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001A0F52
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 001A00EB
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!GetProcAddress 7C80ADB0 5 Bytes JMP 001A0F41
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!LoadLibraryW 7C80AE5B 5 Bytes JMP 001A005B
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 001A0000
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!CreatePipe 7C81E0D7 5 Bytes JMP 001A0F99
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!CreateNamedPipeW 7C82F0EF 5 Bytes JMP 001A0040
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!CreateNamedPipeA 7C85FE94 5 Bytes JMP 001A0025
.text C:\WINDOWS\explorer.exe[3916] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 001A0F6D
.text C:\WINDOWS\explorer.exe[3916] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00280FB9
.text C:\WINDOWS\explorer.exe[3916] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0028004A
.text C:\WINDOWS\explorer.exe[3916] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0028000A
.text C:\WINDOWS\explorer.exe[3916] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00280FD4
.text C:\WINDOWS\explorer.exe[3916] ADVAPI32.dll!RegCreateKeyExA 77DDE9D4 5 Bytes JMP 00280039
.text C:\WINDOWS\explorer.exe[3916] ADVAPI32.dll!RegOpenKeyA 77DDEFA8 5 Bytes JMP 00280FEF
.text C:\WINDOWS\explorer.exe[3916] ADVAPI32.dll!RegCreateKeyW 77DFBA3D 2 Bytes JMP 00280F8D
.text C:\WINDOWS\explorer.exe[3916] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA40 2 Bytes [48, 88]
.text C:\WINDOWS\explorer.exe[3916] ADVAPI32.dll!RegCreateKeyA 77DFBCDB 5 Bytes JMP 00280F9E
.text C:\WINDOWS\explorer.exe[3916] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00290F92
.text C:\WINDOWS\explorer.exe[3916] msvcrt.dll!system 77C293C7 5 Bytes JMP 00290FA3
.text C:\WINDOWS\explorer.exe[3916] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0029001D
.text C:\WINDOWS\explorer.exe[3916] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00290000
.text C:\WINDOWS\explorer.exe[3916] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00290FC8
.text C:\WINDOWS\explorer.exe[3916] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00290FEF
.text C:\WINDOWS\explorer.exe[3916] WININET.dll!InternetOpenW 771BAEED 5 Bytes JMP 002B000A
.text C:\WINDOWS\explorer.exe[3916] WININET.dll!InternetOpenA 771C573E 5 Bytes JMP 002B0FEF
.text C:\WINDOWS\explorer.exe[3916] WININET.dll!InternetOpenUrlA 771C59F1 5 Bytes JMP 002B0FDE
.text C:\WINDOWS\explorer.exe[3916] WININET.dll!InternetOpenUrlW 771D5B3A 5 Bytes JMP 002B0FC3
.text C:\WINDOWS\explorer.exe[3916] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 003C0FEF
.text C:\Program Files\Skype\Phone\Skype.exe[4052] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 03482FBB
.text C:\Program Files\Skype\Phone\Skype.exe[4052] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 03482F86
.text C:\Program Files\Skype\Phone\Skype.exe[4052] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 03481CE5
.text C:\Program Files\Skype\Phone\Skype.exe[4052] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 03481BC3
.text C:\Program Files\Skype\Phone\Skype.exe[4052] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 03482CC9
.text C:\Program Files\Skype\Phone\Skype.exe[4052] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 03482BFF
.text C:\Program Files\Skype\Phone\Skype.exe[4052] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 03482E21
.text C:\Program Files\Skype\Phone\Skype.exe[4052] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 03482E3B
.text C:\Program Files\Skype\Phone\Skype.exe[4052] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 03481C54
.text C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE[4072] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 010A2FBB
.text C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE[4072] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 010A2F86
.text C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE[4072] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 010A1CE5
.text C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE[4072] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 010A1BC3
.text C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE[4072] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 010A2CC9
.text C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE[4072] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 010A2BFF
.text C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE[4072] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 010A2E21
.text C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE[4072] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 010A2E3B
.text C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE[4072] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 010A1C54
.text C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe[4560] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00142FBB
.text C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe[4560] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00142F86
.text C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe[4560] WININET.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00141CE5
.text C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe[4560] WININET.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00141BC3
.text C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe[4560] WININET.dll!InternetReadFile 771C827C 5 Bytes JMP 00142CC9
.text C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe[4560] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00142BFF
.text C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe[4560] WININET.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00142E21
.text C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe[4560] WININET.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00142E3B
.text C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe[4560] WININET.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00141C54
.text C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE[4668] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00142FBB
.text C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE[4668] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00142F86
.text C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE[4668] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00141CE5
.text C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE[4668] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00141BC3
.text C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE[4668] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00142CC9
.text C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE[4668] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00142BFF
.text C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE[4668] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00142E21
.text C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE[4668] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00142E3B
.text C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE[4668] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00141C54
.text C:\Program Files\Skype\Plugin Manager\skypePM.exe[4728] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00152FBB
.text C:\Program Files\Skype\Plugin Manager\skypePM.exe[4728] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00152F86
.text C:\Program Files\Skype\Plugin Manager\skypePM.exe[4728] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00151CE5
.text C:\Program Files\Skype\Plugin Manager\skypePM.exe[4728] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00151BC3
.text C:\Program Files\Skype\Plugin Manager\skypePM.exe[4728] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00152CC9
.text C:\Program Files\Skype\Plugin Manager\skypePM.exe[4728] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00152BFF
.text C:\Program Files\Skype\Plugin Manager\skypePM.exe[4728] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00152E21
.text C:\Program Files\Skype\Plugin Manager\skypePM.exe[4728] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00152E3B
.text C:\Program Files\Skype\Plugin Manager\skypePM.exe[4728] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00151C54
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5508] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00142FBB
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5508] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00142F86
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5508] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00141CE5
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5508] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00141BC3
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5508] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00142CC9
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5508] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00142BFF
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5508] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00142E21
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5508] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00142E3B
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5508] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00141C54
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[5712] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 00142FBB
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[5712] KERNEL32.dll!CreateProcessA 7C802367 5 Bytes JMP 00142F86
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[5712] wininet.dll!InternetCloseHandle 771C4D3C 5 Bytes JMP 00141CE5
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[5712] wininet.dll!HttpSendRequestA 771C60C9 5 Bytes JMP 00141BC3
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[5712] wininet.dll!InternetReadFile 771C827C 5 Bytes JMP 00142CC9
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[5712] wininet.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00142BFF
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[5712] wininet.dll!InternetReadFileExA 771F868E 5 Bytes JMP 00142E21
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[5712] wininet.dll!InternetReadFileExW 771F90DE 8 Bytes JMP 00142E3B
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[5712] wininet.dll!HttpSendRequestW 772123AC 5 Bytes JMP 00141C54

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG04.00.00.01SERVER 4E5160FCD1F67281D0B08AB1798E69BAD1147E13547311A7BAC3CEB1C824DA25D73412E96CDE0EE2
0A6CB6D923494765CAF930E40AAD448F00ED6D4EB2C48BC5FEBC9E127BECC74CFEBC9E127BECC74CF
EBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A9
C6AECB7A5D14075D575E7D6A3B9808FEBC9E127BECC74C9F5B5EFC7D2826EE55051DBD49156B69AD2
F7567026086A9B6D3039AFB559F88E19967A7908D0CACD5D4CAA7D5B56E20931C219A2C6F288369E9
3FA91A331ACDBBCF4D647AD0B195923770197979CC7485B363BF5D566CF3EBE9C1E9A639AC8AE17C3
951FB509F2D1D917DE3E274E6EB13E412765206A41EE96A626E0C5041A7407F2C13488B75BDBEAD35
5E33632DCF018155E4B910BA6FC5E64F4C2605D2CEF39BF8518A29E152F23AB05F81A1A6AEC841AB3
5B6AA289395BD8A1E4385F2EF517BC3B6DEF0ABBA684659C258B2ED57953C63145F32FC7DA0B3E984
2928C4BDDEAA0AF45750AB0C03C7F06B33BA30E0497323B5BF25DB63E770172010E280AFD4191A3EF
7D7CF1D591A8ABB0706B1A2F5C6634CD6A6FBBF1A7E8F1922517402A39B15C9393C188BB8F78E1FB7
81463BE6FE7093957C2A501E4D251880B4FDB16DEA735489D61A379E05387F21BED90B17446BC9E69
244178CB1FDCE3FF0138388A27F9D48240143414596CE10726A3

—- EOF - GMER 1.0.15 —-


OTL.TXT:

OTL logfile created on: 1/26/2010 8:35:59 AM - Run 1
OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\angie13\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 221.00 Mb Available Physical Memory | 25.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 83.74 Gb Total Space | 49.70 Gb Free Space | 59.35% Space Free | Partition Type: NTFS
Drive D: | 8.39 Gb Total Space | 1.33 Gb Free Space | 15.81% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ANGIE
Current User Name: angie13
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\angie13\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\McAfee\MSC\mcupdmgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
PRC - C:\Program Files\Skype\Plugin Manager\skypePM.exe (Skype Technologies)
PRC - C:\Documents and Settings\angie13\Application Data\Dropbox\bin\Dropbox.exe ()
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee\MSC\mcupdui.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSK\msksrver.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe (Creative Technology Ltd.)
PRC - C:\WINDOWS\V0415Mon.exe (Creative Technology Ltd.)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG)
PRC - C:\Program Files\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
PRC - C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe (Yahoo! Inc.)
PRC - C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe (Hewlett-Packard )
PRC - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\HP\QuickPlay\QPService.exe (CyberLink Corp.)
PRC - C:\Program Files\HPQ\shared\HpqToaster.exe ()
PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\Program Files\Logitech\Video\LogiTray.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\Video\FxSvr2.exe (Logitech Inc.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE (Logitech Inc.)
PRC - C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe (TODO: )
PRC - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
PRC - C:\Program Files\Microsoft Office\Office\OSA.EXE ()


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\angie13\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Logitech\SetPoint\lgscroll.dll (Logitech Inc.)
MOD - C:\WINDOWS\system32\msvcp71.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr71.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (0290491264478820mcinstcleanup) McAfee Application Installer Cleanup (0290491264478820) – C:\WINDOWS\Temp\0290491264478820mcinst.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (MBackMonitor) – C:\Program Files\McAfee\MBK\MBackMonitor.exe (McAfee)
SRV - (MSK80Service) – C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (NBService) – C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (Nero AG)
SRV - (NMIndexingService) – C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG)
SRV - (hpqwmiex) – C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
SRV - (LightScribeService) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (Ati HotKey Poller) – C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (aspnet_state) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (USBAAPL) – C:\WINDOWS\system32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (V0415Vid) – C:\WINDOWS\system32\drivers\V0415Vid.sys (Creative Technology Ltd.)
DRV - (CtClsFlt) – C:\WINDOWS\system32\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV - (V0415Afx) – C:\WINDOWS\system32\drivers\V0415Afx.sys (Creative Technology Ltd.)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SCDEmu) – C:\WINDOWS\system32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (RLDesignVirtualAudioCableWdm) – C:\WINDOWS\system32\drivers\livecamv.sys ()
DRV - (MCSTRM) – C:\WINDOWS\system32\drivers\mcstrm.sys (RealNetworks, Inc.)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\eengine\eectrl.sys (Symantec Corporation)
DRV - (MxlW2k) – C:\WINDOWS\system32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWATI) – C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (CAMCHALA) – C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)
DRV - (CAMCAUD) – C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (PID_08A0) QuickCam IM(PID_08A0) – C:\WINDOWS\system32\drivers\LV302AV.SYS (Logitech Inc.)
DRV - (pepifilter) – C:\WINDOWS\system32\drivers\lv302af.sys (Logitech Inc.)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (PxHelp20) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (LHidKe) – C:\WINDOWS\system32\drivers\LHidKE.Sys (Logitech, Inc.)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (LHidUsbK) – C:\WINDOWS\system32\drivers\LHidUsbK.sys (Logitech, Inc.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (HPZius12) – C:\WINDOWS\system32\drivers\HPZius12.sys (HP)
DRV - (HPZipr12) – C:\WINDOWS\system32\drivers\HPZipr12.sys (HP)
DRV - (HPZid412) – C:\WINDOWS\system32\drivers\HPZid412.sys (HP)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (hookint) – C:\WINDOWS\system32\hookint.sys ()
DRV - (mdmxsdk) – C:\WINDOWS\system32\drivers\mdmxsdk.sys (Conexant)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (SONYPVU1) Sony USB Filter Driver (SONYPVU1) – C:\WINDOWS\system32\drivers\SONYPVU1.SYS (Sony Corporation)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (PCANDIS5) – C:\Linksys\printserver\PCANDIS5.SYS (Printing Communications Assoc., Inc. (PCAUSA))


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.bbc.co.uk/worldservice"


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Zango\bin\10.0.370.0\firefox\extensions
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/01/25 20:24:11 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/09/01 21:46:51 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/09/01 22:20:32 | 00,000,000 | —D | M]

[2009/10/27 19:15:36 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Mozilla\Firefox\Profiles\2mzv4hwt.default\extensions
[2009/10/30 09:25:57 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Mozilla\Firefox\Profiles\2mzv4hwt.default\extensions\[removed]
[2006/11/07 11:30:57 | 00,002,386 | —- | M] () – C:\Documents and Settings\angie13\Application Data\Mozilla\Firefox\Profiles\2mzv4hwt.default\searchplugins\siteadvisor.xml
[2009/10/27 17:51:17 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/01/26 08:28:57 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/12/28 08:55:04 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/12/28 08:53:20 | 00,067,688 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\jar50.dll
[2008/12/28 08:53:22 | 00,054,368 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\jsd3250.dll
[2008/12/28 08:53:23 | 00,034,944 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\myspell.dll
[2008/12/28 08:53:29 | 00,046,712 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\spellchk.dll
[2008/12/28 08:53:31 | 00,172,136 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\xpinstal.dll
[2008/11/04 16:00:51 | 00,221,184 | —- | M] (CNN) – C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll

O1 HOSTS File: ([2004/08/04 02:00:00 | 00,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [hpWirelessAssistant] C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [Live! Central] C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [McENUI] C:\Program Files\McAfee\MHN\McENUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mmtask] c:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe (TODO: )
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [personalguard] C:\Program Files\Personal Guard 2009\personalguard.exe File not found
O4 - HKLM..\Run: [QPService] C:\Program Files\HP\QuickPlay\QPService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [rihetusuy] C:\WINDOWS\System32\nasikaje.DLL File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKLM..\Run: [V0415Mon.exe] C:\WINDOWS\V0415Mon.exe (Creative Technology Ltd.)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [CreativeTaskScheduler] C:\Program Files\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [LogitechSoftwareUpdate] C:\Program Files\Logitech\Video\ManifestEngine.exe (Logitech Inc.)
O4 - HKCU..\Run: [mserv] C:\Documents and Settings\angie13\Application Data\svcst.exe File not found
O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKCU..\Run: [svchost] C:\Documents and Settings\angie13\Application Data\svcst.exe File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [ttool] C:\WINDOWS\sa23sl.exe File not found
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\NPSWF32_FlashUtil.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE ()
O4 - Startup: C:\Documents and Settings\angie13\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\angie13\Application Data\Dropbox\bin\Dropbox.exe ()
O4 - Startup: C:\Documents and Settings\angie13\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BackupNoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\NPJPI150_09.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} Reg Error: Key error. (Java Plug-in 1.5.0_09)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (tokibete.dll) - File not found
O20 - AppInit_DLLs: (c:\windows\system32\nasikaje.dll) - C:\WINDOWS\System32\nasikaje.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O21 - SSODL: jehuvetir - {a2a35f13-4ce1-4b08-8cd3-706cf3fa72d5} - C:\WINDOWS\System32\nasikaje.dll File not found
O21 - SSODL: SysNet - {D668BA7A-978B-48BA-8C68-3AE7BDCC9561} - C:\Documents and Settings\All Users\Microsoft AData\sysnet.dll File not found
O22 - SharedTaskScheduler: {a2a35f13-4ce1-4b08-8cd3-706cf3fa72d5} - mujuzedij - C:\WINDOWS\System32\nasikaje.dll File not found
O24 - Desktop WallPaper: C:\Documents and Settings\angie13\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\angie13\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {93994DE8-8239-4655-B1D1-5F4E91300429} - C:\PROGRA~1\DVDREG~1\DVDShell.dll File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 22:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 14:01:14 | 00,000,053 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

File not found – C:\WINDOWS\System32\wuruteli.dll
File not found – C:\WINDOWS\System32\womezila.dll
File not found – C:\WINDOWS\System32\winsc.exe
File not found – C:\WINDOWS\System32\volosejo.dll
File not found – C:\WINDOWS\System32\vewalimu.dll
File not found – C:\WINDOWS\System32\nazehogi.dll
File not found – C:\WINDOWS\System32\muwesoli.dll
File not found – C:\WINDOWS\System32\mojujebu.dll
File not found – C:\WINDOWS\System32\logon.exe
File not found – C:\WINDOWS\System32\legadeto.dll
File not found – C:\Documents and Settings\angie13\Desktop\keygenpatch.exe
File not found – C:\WINDOWS\System32\dayarado.dll
File not found – C:\WINDOWS\System32\betakoso.dll
[2010/01/26 08:31:42 | 00,548,352 | —- | C] (OldTimer Tools) – C:\Documents and Settings\angie13\Desktop\OTL.exe
[2010/01/25 22:06:20 | 00,000,000 | —D | C] – C:\WINDOWS\LastGood
[2010/01/24 08:57:36 | 00,000,000 | —D | C] – C:\Documents and Settings\angie13\Desktop\gmer
[2010/01/24 08:40:04 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\SACore
[2008/10/23 12:33:05 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2006/04/17 07:06:58 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2006/04/17 07:06:58 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2006/04/17 07:06:57 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2006/04/17 07:06:57 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2005/09/24 01:49:16 | 00,012,288 | —- | C] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\Fonts\RandFont.dll
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/01/26 08:43:47 | 00,000,296 | —- | M] () – C:\WINDOWS\tasks\mgmwelgj.job
[2010/01/26 08:36:07 | 00,006,456 | -H– | M] () – C:\WINDOWS\System32\fojodene
[2010/01/26 08:31:10 | 00,548,352 | —- | M] (OldTimer Tools) – C:\Documents and Settings\angie13\Desktop\OTL.exe
[2010/01/26 08:29:36 | 00,010,623 | —- | M] () – C:\WINDOWS\System32\Config.MPF
[2010/01/26 08:16:05 | 00,001,389 | -HS- | M] () – C:\hpqp.ini
[2010/01/25 22:02:05 | 00,000,296 | —- | M] () – C:\WINDOWS\tasks\khqnkpsd.job
[2010/01/25 22:00:06 | 00,000,296 | —- | M] () – C:\WINDOWS\tasks\pcqsstyd.job
[2010/01/25 22:00:05 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/25 21:58:26 | 00,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/01/25 21:58:14 | 00,000,039 | —- | M] () – C:\XP_TV.ini
[2010/01/25 21:57:55 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/25 21:57:50 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/25 21:57:44 | 93,767,6800 | -HS- | M] () – C:\hiberfil.sys
[2010/01/25 21:46:13 | 03,775,058 | -H– | M] () – C:\Documents and Settings\angie13\Local Settings\Application Data\IconCache.db
[2010/01/25 20:56:08 | 00,446,272 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/01/25 20:56:08 | 00,385,574 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/01/25 20:56:08 | 00,055,046 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/01/24 23:03:51 | 13,107,200 | —- | M] () – C:\Documents and Settings\angie13\NTUSER.DAT
[2010/01/24 23:03:51 | 00,000,278 | -HS- | M] () – C:\Documents and Settings\angie13\ntuser.ini
[2010/01/24 08:56:58 | 00,284,153 | —- | M] () – C:\Documents and Settings\angie13\Desktop\gmer(2).zip
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/24 08:57:01 | 00,284,153 | —- | C] () – C:\Documents and Settings\angie13\Desktop\gmer(2).zip
[2009/10/30 17:54:59 | 00,018,941 | —- | C] () – C:\WINDOWS\microsoftdef.dll
[2009/10/15 08:30:20 | 00,000,014 | —- | C] () – C:\Documents and Settings\angie13\Application Data\iniasd.txt
[2009/08/30 15:31:05 | 00,031,616 | —- | C] () – C:\WINDOWS\System32\drivers\livecamv.sys
[2009/02/24 17:34:29 | 00,002,174 | —- | C] () – C:\Documents and Settings\angie13\Application Data\wklnhst.dat
[2007/10/24 12:16:52 | 00,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/06/23 11:58:01 | 00,000,040 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2007/02/25 12:35:34 | 00,000,321 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2007/01/07 11:12:11 | 00,000,067 | —- | C] () – C:\WINDOWS\DVDRegionFree.INI
[2006/11/28 08:53:30 | 00,002,243 | —- | C] () – C:\WINDOWS\hpdj5100.ini
[2006/10/12 09:50:21 | 00,002,125 | —- | C] () – C:\Documents and Settings\angie13\Application Data\HPSU_48BitScanUpdate.log
[2006/10/03 11:37:38 | 00,005,686 | —- | C] () – C:\Documents and Settings\angie13\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
[2006/10/03 11:37:38 | 00,000,206 | —- | C] () – C:\WINDOWS\HPGdiPlus.ini
[2006/10/03 11:36:30 | 00,098,643 | —- | C] () – C:\Documents and Settings\angie13\Application Data\Update_HP_RedboxHprblog_HPSU.log
[2006/10/03 11:36:30 | 00,000,221 | —- | C] () – C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2006/09/26 14:13:42 | 00,008,704 | —- | C] () – C:\WINDOWS\System32\CNMVS75.DLL
[2006/09/17 16:41:51 | 00,089,600 | —- | C] () – C:\Documents and Settings\angie13\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/08/28 08:05:49 | 00,009,255 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2006/08/28 07:56:30 | 00,090,592 | —- | C] () – C:\WINDOWS\System32\hookint.sys
[2006/08/27 20:39:03 | 00,000,022 | —- | C] () – C:\WINDOWS\exchng.ini
[2006/08/19 11:58:59 | 00,000,050 | —- | C] () – C:\WINDOWS\group.ini
[2006/08/19 11:58:59 | 00,000,000 | —- | C] () – C:\WINDOWS\Biutil.INI
[2006/08/19 11:55:24 | 00,000,691 | —- | C] () – C:\WINDOWS\COMMON.INI
[2006/08/09 21:06:14 | 00,000,737 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/08/09 20:02:27 | 00,000,130 | —- | C] () – C:\Documents and Settings\angie13\Local Settings\Application Data\fusioncache.dat
[2006/04/17 08:11:23 | 00,000,219 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2006/04/17 08:07:23 | 00,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/04/17 07:46:07 | 00,000,222 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/04/17 07:31:40 | 00,028,836 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/04/17 07:24:12 | 00,002,663 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2005/12/02 04:09:10 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/07 07:19:16 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/07 07:12:40 | 00,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/01/07 14:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/06 14:30:00 | 00,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[1999/01/27 12:39:06 | 00,065,024 | —- | C] () – C:\WINDOWS\System32\indounin.dll
[1997/07/10 23:00:00 | 00,031,232 | —- | C] () – C:\WINDOWS\System32\XLREC.DLL
[1997/07/10 23:00:00 | 00,025,600 | —- | C] () – C:\WINDOWS\System32\RECNCL.DLL
[1997/07/10 23:00:00 | 00,022,016 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[1997/07/10 23:00:00 | 00,022,016 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1997/07/10 23:00:00 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL
[1997/06/13 06:56:08 | 00,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll

========== LOP Check ==========

[2007/10/21 04:22:12 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
[2007/05/06 05:57:08 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2009/08/31 19:47:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Citrix
[2007/12/10 06:02:12 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2006/04/17 08:09:46 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2007/06/23 11:59:46 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SlySoft
[2008/01/28 07:04:37 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TERMINAL Studio
[2009/05/07 09:47:28 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2008/07/10 11:11:37 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\7Wonders
[2008/10/26 18:36:58 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Azureus
[2009/03/12 14:42:34 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Canon
[2010/01/25 22:00:55 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Dropbox
[2006/09/20 11:54:39 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\FotoWire
[2006/08/19 15:37:13 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\funkitron
[2007/12/02 04:53:19 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\ICAClient
[2008/06/07 05:53:32 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Image Zone Express
[2007/11/24 14:10:07 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\iWin
[2007/03/16 10:28:29 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Leadertech
[2006/08/19 13:11:51 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Magic Match
[2006/08/19 15:43:06 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Mind Control Software
[2006/10/11 12:41:21 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\muvee Technologies
[2006/08/19 15:43:20 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\PlayFirst
[2007/06/24 09:43:49 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\SlySoft
[2006/10/25 11:52:51 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\Thunderbird
[2008/10/23 16:46:40 | 00,000,000 | —D | M] – C:\Documents and Settings\angie13\Application Data\uTorrent
[2010/01/25 22:02:05 | 00,000,296 | —- | M] () – C:\WINDOWS\Tasks\khqnkpsd.job
[2009/09/03 09:48:28 | 00,000,344 | —- | M] () – C:\WINDOWS\Tasks\McDefragTask.job
[2009/11/01 01:05:21 | 00,000,322 | —- | M] () – C:\WINDOWS\Tasks\McQcTask.job
[2010/01/26 08:43:47 | 00,000,296 | —- | M] () – C:\WINDOWS\Tasks\mgmwelgj.job
[2010/01/25 22:00:06 | 00,000,296 | —- | M] () – C:\WINDOWS\Tasks\pcqsstyd.job

========== Purity Check ==========


< End of report >

OTL Extras:

OTL Extras logfile created on: 1/26/2010 8:35:59 AM - Run 1
OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\angie13\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 221.00 Mb Available Physical Memory | 25.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 83.74 Gb Total Space | 49.70 Gb Free Space | 59.35% Space Free | Partition Type: NTFS
Drive D: | 8.39 Gb Total Space | 1.33 Gb Free Space | 15.81% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ANGIE
Current User Name: angie13
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – C:\PROGRA~1\MOZILL~2\FIREFOX.EXE -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – C:\PROGRA~1\MOZILL~2\FIREFOX.EXE -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe – ()
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe – ()
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe – ( )
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Disabled:Files and Settings Transfer Wizard – (Microsoft Corporation)
"C:\Program Files\Azureus\Azureus.exe" = C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus – (Azureus, Inc)
"C:\Program Files\Ares\Ares.exe" = C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows – File not found
"C:\Documents and Settings\angie13\Desktop\Big torrents\Flight Simulator 2004\No CD Crack\fs9.exe" = C:\Documents and Settings\angie13\Desktop\Big torrents\Flight Simulator 2004\No CD Crack\fs9.exe:*:Enabled:Microsoft Flight Simulator – File not found
"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server – (Microsoft Corporation)
"C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe" = C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe:*:Enabled:Microsoft Flight Simulator – (Microsoft Corporation)
"C:\WINDOWS\system32\LEXPPS.EXE" = C:\WINDOWS\system32\LEXPPS.EXE:*:Enabled:LEXPPS.EXE – File not found
"C:\Documents and Settings\angie13\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe" = C:\Documents and Settings\angie13\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe:*:Enabled:Octoshape add-in for Adobe Flash Player – (Octoshape ApS)
"C:\Program Files\Rhapsody\rhapsody.exe" = C:\Program Files\Rhapsody\rhapsody.exe:*:Enabled:Rhapsody – (RealNetworks, Inc.)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour – (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent – (McAfee, Inc.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype – (Skype Technologies S.A.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{09D8492A-C8E2-421E-927D-46800FB327A3}" = Wireless Home Network Setup
"{0B33B738-AD79-4E32-90C5-E67BFB10BBFF}" = AiO_Scan
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"{175441F9-59F3-4407-9DB6-00B34667831C}" = VoiceOver Kit
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{193DB24F-9A66-4896-8404-22D53EA89075}" = 1400_Help
"{1CB34CE9-0E6B-493F-BB66-3425E5DF76E5}" = CP_CalendarTemplates1
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23B35809-5E4A-4F14-8332-1CDEDDFAC089}" = CP_Package_Variety2
"{24BEBF2E-73F3-4599-840B-EDC612CCDD0D}" = Destinations
"{266959FA-0AEE-41D0-A88E-F1EAC10A7C14}" = 1400
"{2818095F-FB6C-42C8-827E-0A406CC9AFF5}" = Quicken 2006
"{286F29AF-0BE2-4D5F-AB17-B7631A810553}" = muvee autoProducer 4.5
"{2A548002-9042-4083-A270-B67473DE1073}" = SkinsHP1
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{34F3FCF1-817B-4D61-B6AF-19D9486AFEA0}" = Unload
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder
"{3FE0CFAB-584A-4AA5-B8CD-C32284CFA308}" = RandMap
"{4041C245-7099-4C96-9738-5EBC23827B3C}" = BufferChm
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 C1
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 2.0
"{45EBDA59-D33B-433A-956E-B2F236468B56}" = MUSICMATCH® Jukebox
"{47D2103B-FD51-4017-9C20-DD408B17D726}" = Office 2003 Trial Assistant
"{494D17B5-3369-4905-8C4B-80C972C5E0FF}" = CP_Panorama1Config
"{4DA4012B-39AF-48c2-B23B-A4D570D233A6}" = cp_LightScribeConfig
"{522D1D79-9C0A-4361-91F8-2AFF8EC6C2E1}" = CP_Package_Variety1
"{52AE81CB-B786-490E-93CF-240A9891B392}" = HP User Guides 0025
"{5326AB25-7D66-44AB-AB81-F23BF0048DAD}" = FTVO Media Player Full
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{5421155F-B033-49DB-9B33-8F80F233D4D5}" = GdiplusUpgrade
"{54E3707F-808E-4fd4-95C9-15D1AB077E5D}" = NewCopy
"{54F0998F-73C8-4b51-8286-FE903C231BED}" = cp_PosterPrintConfig
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}" = HP PSC & OfficeJet 5.3.B
"{5D601655-6D54-4384-B52C-17EC5385FBBD}" = iTunes
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6BB6627C-694F-4FDC-A3E5-C7F4BED4C724}" = DocProc
"{766633B3-1AFA-44B6-A3FC-1DE991CD9C52}" = CP_Package_Basic1
"{7850A6D2-CBEA-4728-9877-F1BEDEA9F619}" = AiOSoftware
"{79F8E1D4-36C1-439C-95FA-F695050B5B07}" = Sonic_PrimoSDK
"{7B6CF9EB-CB2B-4A1A-81A9-BE1A9044690A}" = TIPCI
"{7C9B95B7-B598-4398-B30F-7F6827192E6C}" = ProductContext
"{7F2F3F8B-2D57-48A3-99D0-1AC23D594C89}" = LightScribe 1.4.56.1
"{80AE27BA-B0ED-4288-A8B9-D8194BCF4115}" = cp_UpdateProjectsConfig
"{8355F970-601D-442D-A79B-1D7DB4F24CAD}" = Apple Mobile Device Support
"{869C3062-4745-4949-B6C9-98AF24D89030}" = PhotoGallery
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{923A7F5A-1E8C-4FBE-8DF6-85940A60A79F}" = Readme
"{9D4ABB0C-F60B-44A6-956C-A4A63D5495C9}" = CueTour
"{A01FC76F-CC09-4658-9E37-5C2F635EE708}" = TourSetup
"{A195B13E-A5E3-4BAF-A995-7F70F445CD06}" = ScannerCopy
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B11E71BA-498C-42D4-9F1A-9D7A89D9DA61}" = CP_AtenaShokunin1Config
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{B57F2FF0-5A25-4332-B503-4592B370C02F}" = CP_Package_Variety3
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{BBD3BF67-5B89-4CBB-BA58-5818ED5F3290}" = cp_OnlineProjectsConfig
"{BC96BBA7-C634-460E-AD18-A0A994213F80}" = HP User Guides–System Recovery
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam Software
"{C506A18C-1469-4678-B094-F4EC9DAE6DB7}" = Scan
"{C510CA36-98D6-4F07-8AFF-81E7399A075B}" = 1400Trb
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE24344F-DFD8-40C8-8FD8-C9740B5F25AC}" = Fax
"{CEB326EC-8F40-47B2-BA22-BB092565D66F}" = Quick Launch Buttons 5.20 G1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{FC8D25A7-FF1B-41BB-BB3B-9A06C0A60AE0}" = InstantShareDevices
"{FC98FBE9-E931-494C-8717-497185371033}" = Nero 7 Ultra Edition
"{FE64AE29-0883-4C70-8388-DC026019C900}" = HP Image Zone Express
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"ATI Display Driver" = ATI Display Driver
"Azureus Vuze" = Azureus Vuze
"Bi-Admin" = Bi-Admin
"CNXT_AUDIO" = Conexant AC-Link Audio
"CNXT_MODEM_PCI_VEN_1002&DEV;_4378" = Soft Data Fax Modem with SmartCP
"Creative Live! Central" = Creative Live! Central
"Creative VF0415" = Creative Live! Cam Video IM Ultra (VF0415) (1.00.03.00)
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.1.5
"Easy-WebPrint" = Easy-WebPrint
"Ekspert CD_is1" = Ekspert CD
"Flight Simulator 9.0" = Microsoft Flight Simulator 2004 A Century of Flight
"Google Updater" = Google Updater
"HP Imaging Device Functions" = HP Imaging Device Functions 6.0
"HP Photo & Imaging" = HP Photosmart Premier Software 6.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3
"InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"InstallShield_{7B6CF9EB-CB2B-4A1A-81A9-BE1A9044690A}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"Logitech Print Service" = Logitech Print Service
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla ActiveX Control v1.7.12" = Mozilla ActiveX Control v1.7.12
"Mozilla Firefox (2.0.0.20)" = Mozilla Firefox (2.0.0.20)
"MSC" = McAfee SecurityCenter
"Netscape Browser" = Netscape Browser (remove only)
"Office8.0" = Microsoft Office 97, Professional Edition
"Personal Guard 2009" = Personal Guard 2009
"PowerISO" = PowerISO
"QcDrv" = Logitech® Camera Driver
"RealPlayer 6.0" = RealPlayer
"Rhapsody" = Rhapsody
"Shipsim2008" = Ship Simulator 2008
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SysInfo" = Creative System Information
"VLC media player" = VideoLAN VLC media player 0.8.6d
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR archiver
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar
"Yahoo! Widget Engine" = Yahoo! Widget Engine

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/25/2010 11:16:40 PM | Computer Name = ANGIE | Source = Application Error | ID = 1000
Description = Faulting application setpoint.exe, version 2.31.546.0, faulting module
unknown, version 0.0.0.0, fault address 0x00b8336d.

Error - 1/25/2010 11:16:45 PM | Computer Name = ANGIE | Source = Application Error | ID = 1000
Description = Faulting application fxsvr2.exe, version 8.4.7.1034, faulting module
unknown, version 0.0.0.0, fault address 0x1000336d.

Error - 1/25/2010 11:16:46 PM | Computer Name = ANGIE | Source = Application Error | ID = 1000
Description = Faulting application logitray.exe, version 8.4.7.1034, faulting module
unknown, version 0.0.0.0, fault address 0x00bd336d.

Error - 1/25/2010 11:16:46 PM | Computer Name = ANGIE | Source = Application Error | ID = 1000
Description = Faulting application osa.exe, version 8.0.0.3414, faulting module
unknown, version 0.0.0.0, fault address 0x1000336d.

Error - 1/25/2010 11:16:46 PM | Computer Name = ANGIE | Source = Application Error | ID = 1000
Description = Faulting application jucheck.exe, version 5.0.90.3, faulting module
unknown, version 0.0.0.0, fault address 0x1000336d.

Error - 1/25/2010 11:16:49 PM | Computer Name = ANGIE | Source = Application Error | ID = 1000
Description = Faulting application qpservice.exe, version 4.5.0.1, faulting module
unknown, version 0.0.0.0, fault address 0x00be336d.

Error - 1/25/2010 11:16:52 PM | Computer Name = ANGIE | Source = Application Error | ID = 1000
Description = Faulting application nmbgmonitor.exe, version 1.7.11.0, faulting module
unknown, version 0.0.0.0, fault address 0x00bb336d.

Error - 1/25/2010 11:44:43 PM | Computer Name = ANGIE | Source = Application Error | ID = 1004
Description = Faulting application services.exe, version 5.1.2600.3520, faulting
module unknown, version 0.0.0.0, fault address 0x8465ec36.

Error - 1/25/2010 11:58:18 PM | Computer Name = ANGIE | Source = Application Error | ID = 1004
Description = Faulting application services.exe, version 5.1.2600.3520, faulting
module unknown, version 0.0.0.0, fault address 0x8465ec36.

Error - 1/26/2010 12:02:04 AM | Computer Name = ANGIE | Source = McLogEvent | ID = 5051
Description = A thread in process C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe took
longer than 90000 ms to complete a request. The process will be terminated. Thread
id : 3380 (0xd34) Thread address : 0x7C90E514 Thread message : Build VSCORE.14.0.0.435
/ 5301.4018 Object being scanned = \Device\HarddiskVolume1\WINDOWS\system32\nazehogi.dll

by C:\WINDOWS\system32\rundll32.exe 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0)

7004(0)(0) 5006(0)(0) 5004(0)(0)

[ System Events ]
Error - 1/25/2010 10:52:56 PM | Computer Name = ANGIE | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the iPod Service service
to connect.

Error - 1/25/2010 10:52:56 PM | Computer Name = ANGIE | Source = Service Control Manager | ID = 7000
Description = The iPod Service service failed to start due to the following error:
%%1053

Error - 1/25/2010 10:56:48 PM | Computer Name = ANGIE | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1460

Error - 1/25/2010 10:58:00 PM | Computer Name = ANGIE | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC000000D'
while processing the file 'BOOT.INI' on the volume 'HarddiskVolume3'. It has stopped
monitoring the volume.

Error - 1/25/2010 11:15:45 PM | Computer Name = ANGIE | Source = Service Control Manager | ID = 7031
Description = The McAfee Real-time Scanner service terminated unexpectedly. It
has done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Restart the service.

Error - 1/25/2010 11:59:03 PM | Computer Name = ANGIE | Source = DCOM | ID = 10010
Description = The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register
with DCOM within the required timeout.

Error - 1/26/2010 12:02:32 AM | Computer Name = ANGIE | Source = Service Control Manager | ID = 7031
Description = The McAfee Real-time Scanner service terminated unexpectedly. It
has done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Restart the service.

Error - 1/26/2010 12:02:59 AM | Computer Name = ANGIE | Source = DCOM | ID = 10010
Description = The server {DC7EF8E1-824F-4110-AB43-1604DA9B4F40} did not register
with DCOM within the required timeout.

Error - 1/26/2010 12:03:44 AM | Computer Name = ANGIE | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1460

Error - 1/26/2010 10:16:00 AM | Computer Name = ANGIE | Source = Dhcp | ID = 1000
Description = Your computer has lost the lease to its IP address 192.168.0.12 on
the Network Card with network address 0016D40491D6.


< End of report >


THANKS IN ADVANCE!!!

Hello, I have completed the instructions. Logs are pasted below, except the second DDS one; the 'attach' file. I put it in a rar archive which I thought was basically the same as zipping it. I was informed that I was not allowed to attach that type of file. If you need that one, please let me know how I should post it. As for the computer's behavior, I still get the services and controller app closing but the last three times the computer started, it did not tryto shutdown right away. Also it is not running so slowly as before. Thanks very much Malwarebytes' Anti-Malware 1.44 Database version: 3662 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 1/30/2010 9:10:05 AM mbam-log-2010-01-30 (09-10-05).txt Scan type: Quick Scan Objects scanned: 124057 Time elapsed: 12 minute(s), 1 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 17 Registry Values Infected: 6 Registry Data Items Infected: 1 Folders Infected: 6 Files Infected: 22 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\srv.coreservices (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\srv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\zango.desktopflash (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\zango.desktopflash.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{1985fce1-4043-4346-ae70-d0a0cd90bdd3} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{dbf00e12-281c-4dc8-a7ec-1ff45182439b} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{dd1cb2d7-161d-4b84-ae5c-08d3faed894f} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1e5b2693-d348-4ca7-8364-4f5e51bf9c6d} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2e54ac53-efa4-4831-a3f6-b47b1a1937cf} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Personal Guard 2009 (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Personal Guard 2009 (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\ZangoSA_df.exe (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\zangosa (Adware.Zango) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rihetusuy (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\personalguard (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\[removed] (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mserv (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttool (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Start Menu\Programs\AntivirusPro_2010 (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully. C:\Program Files\Personal Guard 2009 (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. C:\Program Files\Personal Guard 2009\q (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Start Menu\Programs\Personal Guard 2009 (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Microsoft AData (Rogue.SmartProtector) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\system32\bafepugi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\pejonavi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\peyuweli.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Start Menu\Programs\AntivirusPro_2010\AntivirusPro_2010.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Start Menu\Programs\AntivirusPro_2010\Uninstall.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully. C:\Program Files\Personal Guard 2009\config.scf (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. C:\Program Files\Personal Guard 2009\mmbase.sdb (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. C:\Program Files\Personal Guard 2009\q.sdb (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. C:\Program Files\Personal Guard 2009\vvbase.sdb (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Start Menu\Programs\Personal Guard 2009\Personal Guard 2009.lnk (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Start Menu\Programs\Personal Guard 2009\Uninstall.lnk (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Microsoft AData\t.sid (Rogue.SmartProtector) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Desktop\AntivirusPro_2010.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Desktop\Personal Guard 2009.lnk (Rogue.PersonalGuard) -> Quarantined and deleted successfully. C:\WINDOWS\certSystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\Microsoftdef.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\regred.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\securits.com (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\spoov.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\usExplorer.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Documents and Settings\angie13\Local Settings\Temp\c.exe (Trojan.Dropper) -> Quarantined and deleted successfully. DDS: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 9:58:38.32 on Sat 01/30/2010 Internet Explorer: 6.0.2900.2180 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.255 [GMT -6:00] AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe C:\WINDOWS\V0415Mon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Creative\Shared Files\CTSched.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Microsoft Office\Office\FINDFAST.EXE C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Documents and Settings\angie13\Application Data\Dropbox\bin\Dropbox.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\angie13\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop mDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s mSearchAssistant = hxxp://www.google.com/ie uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_09\bin\ssv.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File uRun: [LogitechSoftwareUpdate] "c:\program files\logitech\video\ManifestEngine.exe" boot uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe" uRun: [CreativeTaskScheduler] "c:\program files\creative\shared files\CTSched.exe" /logon uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.5.0_09\bin\jusched.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe" mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start mRun: [RecGuard] c:\windows\sminst\RecGuard.exe mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE mRun: [mmtask] c:\program files\musicmatch\musicmatch jukebox\mmtask.exe mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Live! Central] "c:\program files\creative\creative live! cam\live! central\CTLVCentral.exe" /mode2 mRun: [V0415Mon.exe] c:\windows\V0415Mon.exe mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [McENUI] c:\progra~1\mcafee\mhn\McENUI.exe /hide mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u StartupFolder: c:\docume~1\angie13\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\angie13\application data\dropbox\bin\Dropbox.exe StartupFolder: c:\docume~1\angie13\startm~1\programs\startup\yahoo!~1.lnk - c:\program files\yahoo!\yahoo! widget engine\YahooWidgetEngine.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_09\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL Trusted Zone: internet Trusted Zone: mcafee.com DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll AppInit_DLLs: tokibete.dll c:\windows\system32\nasikaje.dll SSODL: SysNet - {D668BA7A-978B-48BA-8C68-3AE7BDCC9561} - c:\documents and settings\all users\microsoft adata\sysnet.dll SSODL: jehuvetir - {a2a35f13-4ce1-4b08-8cd3-706cf3fa72d5} - c:\windows\system32\nasikaje.dll STS: mujuzedij: {a2a35f13-4ce1-4b08-8cd3-706cf3fa72d5} - c:\windows\system32\nasikaje.dll SEH: DVDIdleShell Class: {93994de8-8239-4655-b1d1-5f4e91300429} - c:\progra~1\dvdreg~1\DVDShell.dll LSA: Notification Packages = scecli betakoso.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\angie13\applic~1\mozilla\firefox\profiles\2mzv4hwt.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/worldservice FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - component: c:\program files\mozilla firefox\extensions\[removed]\components\Shim.dll FF - component: c:\program files\mozilla firefox\extensions\[removed]\components\qfaservices.dll —- FIREFOX POLICIES —- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service ============= SERVICES / DRIVERS =============== R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-7-8 214664] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-9-3 210216] R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-9-3 359952] R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-9-3 144704] R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2005-8-22 231424] R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-9-3 606736] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-9-3 79816] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-9-3 35272] R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-9-3 40552] R3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\system32\drivers\livecamv.sys [2009-8-30 31616] S0 hookint;hookint;c:\windows\system32\drivers\hookint.sys –> c:\windows\system32\drivers\hookint.sys [?] S2 0290491264478820mcinstcleanup;McAfee Application Installer Cleanup (0290491264478820);c:\windows\temp\029049~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service –> c:\windows\temp\029049~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-30 135664] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2009-8-30 135616] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-9-3 34248] S3 V0415Afx;Creative Camera VF0415 Audio Effects Driver;c:\windows\system32\drivers\V0415Afx.sys [2009-8-30 160768] S3 V0415Vid;Creative Live! Cam Video IM Ultra Driver;c:\windows\system32\drivers\V0415Vid.sys [2009-8-30 282464] =============== Created Last 30 ================ 2010-01-30 08:54 –d—– c:\docume~1\angie13\applic~1\Malwarebytes 2010-01-30 08:54 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-30 08:54 19,160 a——- c:\windows\system32\drivers\mbam.sys 2010-01-30 08:54 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-01-30 08:54 –d—– c:\program files\Malwarebytes' Anti-Malware ==================== Find3M ==================== 2009-08-31 19:22 61,224 a——- c:\documents and settings\angie13\GoToAssistDownloadHelper.exe 2009-03-03 16:55 2,174 ac—— c:\docume~1\angie13\applic~1\wklnhst.dat 2007-11-16 05:42 61 -c-sh— c:\windows\cnerolf.dat ============= FINISH: 9:59:57.04 ===============

Thanks Extremeboy,

Here is the "attach" file from DDS, Followed by the Combofix stuff


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 8/9/2006 9:01:18 PM
System Uptime: 1/30/2010 9:26:15 AM (0 hours ago)

Motherboard: Hewlett-Packard | | 30AE
Processor: AMD Turion™ 64 Mobile Technology ML-34 | U23 | 1794/mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 84 GiB total, 50.051 GiB free.
D: is FIXED (FAT32) - 8 GiB total, 1.327 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP289: 8/31/2009 9:35:59 PM - Removed Ad-Aware SE Personal
RP290: 9/1/2009 10:28:08 PM - System Checkpoint
RP291: 9/1/2009 10:46:48 PM - Removed Citrix Presentation Server Client - Web Only
RP292: 9/1/2009 10:56:24 PM - Configured TBS WMP Plug-in
RP293: 9/3/2009 7:11:07 AM - System Checkpoint
RP294: 9/3/2009 7:44:09 PM - Removed CIT200
RP295: 9/9/2009 1:28:24 AM - Software Distribution Service 3.0
RP296: 9/17/2009 8:32:50 PM - System Checkpoint
RP297: 9/24/2009 10:17:35 PM - System Checkpoint
RP298: 9/26/2009 9:10:13 PM - System Checkpoint
RP299: 10/4/2009 7:55:46 PM - System Checkpoint
RP300: 10/5/2009 8:33:26 PM - System Checkpoint
RP301: 10/11/2009 7:49:38 PM - System Checkpoint
RP302: 10/15/2009 8:36:13 AM - System Checkpoint
RP303: 10/18/2009 1:49:30 AM - System Checkpoint
RP304: 10/18/2009 3:00:23 AM - Software Distribution Service 3.0
RP305: 10/19/2009 8:11:04 AM - System Checkpoint
RP306: 10/22/2009 7:40:15 AM - System Checkpoint
RP307: 10/23/2009 1:46:49 PM - System Checkpoint
RP308: 10/29/2009 3:46:51 PM - System Checkpoint
RP309: 10/30/2009 9:52:47 AM - Restore Operation
RP310: 10/30/2009 10:01:18 AM - Restore Operation
RP311: 10/30/2009 10:21:00 AM - Restore Operation
RP312: 1/25/2010 10:29:50 PM - System Checkpoint

==== Installed Programs ======================

1400
1400_Help
1400Trb
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Reader 8.1.2
Advanced Audio FX Engine
AiO_Scan
AiOSoftware
Apple Mobile Device Support
Apple Software Update
Athlon 64 Processor Driver
ATI Control Panel
ATI Display Driver
Azureus Vuze
Bi-Admin
Bonjour
BufferChm
Conexant AC-Link Audio
CP_AtenaShokunin1Config
CP_CalendarTemplates1
cp_LightScribeConfig
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
CP_Panorama1Config
cp_PosterPrintConfig
cp_UpdateProjectsConfig
Creative Live! Cam Video IM Ultra (VF0415) (1.00.03.00)
Creative Live! Central
Creative System Information
CueTour
Destinations
DivX Content Uploader
DivX Web Player
DocProc
Dropbox
DVD Decrypter (Remove Only)
DVD Shrink 3.1.5
Easy-WebPrint
Ekspert CD
ERUNT 1.1j
eSupportQFolder
Fax
FTVO Media Player Full
FullDPAppQFolder
GdiplusUpgrade
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
HP Help and Support
HP Image Zone Express
HP Imaging Device Functions 6.0
HP Photosmart Premier Software 6.0
HP PSC & OfficeJet 5.3.B
HP QuickPlay 2.0
HP Software Update
HP Solution Center & Imaging Support Tools 5.3
HP User Guides–System Recovery
HP User Guides 0025
HP Wireless Assistant 2.00 C1
HPProductAssistant
HpSdpAppCoreApp
InstantShareDevices
iTunes
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
LightScribe 1.4.56.1
Logitech Desktop Messenger
Logitech Print Service
Logitech QuickCam Software
Logitech SetPoint
Logitech® Camera Driver
Malwarebytes' Anti-Malware
McAfee SecurityCenter
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft Flight Simulator 2004 A Century of Flight
Microsoft Office 97, Professional Edition
Microsoft Office Standard Edition 2003
Microsoft Works
Mozilla ActiveX Control v1.7.12
Mozilla Firefox (2.0.0.20)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MUSICMATCH® Jukebox
muvee autoProducer 4.5
Nero 7 Ultra Edition
Netscape Browser (remove only)
NewCopy
Octoshape add-in for Adobe Flash Player
Office 2003 Trial Assistant
OptionalContentQFolder
PhotoGallery
PowerISO
ProductContext
Quick Launch Buttons 5.20 G1
Quicken 2006
QuickTime
RandMap
Readme
RealPlayer
Rhapsody
Scan
ScannerCopy
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Ship Simulator 2008
SkinsHP1
Skype™ 4.1
Soft Data Fax Modem with SmartCP
SolutionCenter
Sonic Audio Module
Sonic Copy Module
Sonic Data Module
Sonic Express Labeler
Sonic MyDVD Plus
Sonic Update Manager
Sonic_PrimoSDK
Status
Synaptics Pointing Device Driver
TBS WMP Plug-in
Texas Instruments PCIxx21/x515/xx12 drivers.
TIPCI
TourSetup
TrayApp
Unload
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
VideoLAN VLC media player 0.8.6d
VoiceOver Kit
WebFldrs XP
WebReg
Windows Genuine Advantage Notifications (KB905474)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB883667
Windows XP Hotfix - KB884020
Windows XP Hotfix - KB884575
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885464
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885855
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888239
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB888402
Windows XP Hotfix - KB889673
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB892559
WinRAR archiver
Wireless Home Network Setup
Yahoo! Toolbar
Yahoo! Widget Engine

==== Event Viewer Messages From Past Week ========

1/30/2010 9:29:32 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AliIde IntelIde Pcmcia ViaIde
1/25/2010 9:15:45 PM, error: Service Control Manager [7031] - The McAfee Real-time Scanner service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
1/25/2010 8:58:00 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'BOOT.INI' on the volume 'HarddiskVolume3'. It has stopped monitoring the volume.
1/25/2010 8:56:48 PM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: This operation returned because the timeout period expired.
1/25/2010 8:52:56 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.
1/25/2010 8:52:56 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/25/2010 8:52:55 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
1/25/2010 8:26:05 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the mcmscsvc service.

==== End Of File ===========================


ComboFix 10-01-31.05 - angie13 02/01/2010 7:54.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.301 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\angie13\Application Data\iniasd.txt
c:\program files\Mozilla Firefox\components\npclntax.xpt
c:\windows\run.log
c:\windows\system32\oem77.inf
c:\windows\system32\skinboxer43.dll
c:\windows\Tasks\khqnkpsd.job
c:\windows\Tasks\mgmwelgj.job
c:\windows\Tasks\pcqsstyd.job
c:\windows\unins000.dat
c:\windows\unins000.exe
D:\Autorun.inf

—– BITS: Possible infected sites —–

hxxp://77.74.48.111
.
((((((((((((((((((((((((( Files Created from 2010-01-01 to 2010-02-01 )))))))))))))))))))))))))))))))
.

2010-01-30 14:54 . 2010-01-30 14:54 ——– d—–w- c:\documents and settings\angie13\Application Data\Malwarebytes
2010-01-30 14:54 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-30 14:54 . 2010-01-30 14:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-30 14:54 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-30 14:54 . 2010-01-30 14:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-30 14:46 . 2010-01-30 14:46 ——– d—–w- c:\program files\ERUNT
2010-01-30 14:36 . 2010-01-30 14:36 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-01-30 14:31 . 2010-01-30 14:31 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-01 14:06 . 2006-08-10 15:33 ——– d—–w- c:\documents and settings\angie13\Application Data\Skype
2010-02-01 14:04 . 2009-02-19 20:27 ——– d—–w- c:\documents and settings\angie13\Application Data\Dropbox
2010-02-01 14:01 . 2010-02-01 14:01 0 —-a-w- c:\documents and settings\angie13\ntuser.tmp
2010-02-01 13:09 . 2009-10-04 19:14 ——– d—–w- c:\documents and settings\angie13\Application Data\skypePM
2010-02-01 13:07 . 2008-10-23 12:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-30 14:34 . 2006-04-17 14:06 ——– d—–w- c:\program files\Google
2010-01-26 04:06 . 2006-10-05 18:58 ——– d—–w- c:\program files\McAfee
2010-01-24 14:40 . 2008-10-12 11:05 ——– d—–w- c:\documents and settings\LocalService\Application Data\SACore
2008-12-28 14:53 . 2006-11-07 13:22 67688 —-a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-12-28 14:53 . 2006-11-07 13:22 54368 —-a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-28 14:53 . 2006-11-07 13:22 34944 —-a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-12-28 14:53 . 2006-11-07 13:22 46712 —-a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-12-28 14:53 . 2006-11-07 13:22 172136 —-a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2007-11-16 11:42 . 2007-11-16 11:42 61 -csh–w- c:\windows\cnerolf.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-06-27 03:02 77824 —-a-w- c:\documents and settings\angie13\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-06-27 03:02 77824 —-a-w- c:\documents and settings\angie13\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-06-27 03:02 77824 —-a-w- c:\documents and settings\angie13\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"CreativeTaskScheduler"="c:\program files\Creative\Shared Files\CTSched.exe" [2006-11-17 53341]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-11 344064]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-06-19 729178]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2005-12-12 94208]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 405504]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 507904]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-03-10 28160]
"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2004-04-20 53248]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-08-01 233534]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"Live! Central"="c:\program files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe" [2008-08-22 438399]
"V0415Mon.exe"="c:\windows\V0415Mon.exe" [2008-08-07 28672]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-08 1176808]
"McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2009-07-09 5134864]

c:\documents and settings\angie13\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\angie13\Application Data\Dropbox\bin\Dropbox.exe [2009-8-28 26784939]
Yahoo! Widget Engine.lnk - c:\program files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe [2006-5-23 1806336]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2006-8-9 438272]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-7-10 111376]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-7-10 51984]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\Documents and Settings\\angie13\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Rhapsody\\rhapsody.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [9/3/2009 9:55 AM 210216]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [8/22/2005 3:06 AM 231424]
R3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\system32\drivers\livecamv.sys [8/30/2009 3:31 PM 31616]
S0 hookint;hookint;c:\windows\system32\drivers\hookint.sys –> c:\windows\system32\drivers\hookint.sys [?]
S2 0290491264478820mcinstcleanup;McAfee Application Installer Cleanup (0290491264478820);c:\windows\TEMP\029049~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\windows\TEMP\029049~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/30/2010 8:30 AM 135664]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [8/30/2009 3:29 PM 135616]
S3 V0415Afx;Creative Camera VF0415 Audio Effects Driver;c:\windows\system32\drivers\V0415Afx.sys [8/30/2009 3:34 PM 160768]
S3 V0415Vid;Creative Live! Cam Video IM Ultra Driver;c:\windows\system32\drivers\V0415Vid.sys [8/30/2009 3:33 PM 282464]
.
Contents of the 'Scheduled Tasks' folder

2009-10-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-02-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-25 12:49]

2010-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 14:30]

2010-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 14:30]

2009-09-03 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-03 17:22]

2009-11-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-03 17:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
Trusted Zone: internet
Trusted Zone: mcafee.com
FF - ProfilePath - c:\documents and settings\angie13\Application Data\Mozilla\Firefox\Profiles\2mzv4hwt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/worldservice
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[removed]\components\Shim.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[removed]\components\qfaservices.dll

—- FIREFOX POLICIES —-
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
.
- - - - ORPHANS REMOVED - - - -

SharedTaskScheduler-{a2a35f13-4ce1-4b08-8cd3-706cf3fa72d5} - c:\windows\system32\nasikaje.dll
ShellExecuteHooks-{93994DE8-8239-4655-B1D1-5F4E91300429} - c:\progra~1\DVDREG~1\DVDShell.dll
SSODL-SysNet-{D668BA7A-978B-48BA-8C68-3AE7BDCC9561} - c:\documents and settings\All Users\Microsoft AData\sysnet.dll
SSODL-jehuvetir-{a2a35f13-4ce1-4b08-8cd3-706cf3fa72d5} - c:\windows\system32\nasikaje.dll
AddRemove-Ekspert CD_is1 - c:\windows\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-01 08:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe??????????d?n??|?????? ???B?????????????hLC? ??????

scanning hidden files …


c:\windows\system32\wbem\Performance\WmiApRpl_new.ini 3824 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG04.00.00.01SERVER"="4E5160FCD1F67281D0B08AB1798E69BAD1147E13547311A7BAC3CEB1C824DA25D73412E96CD
E0EE20A6CB6D923494765CAF930E40AAD448F00ED6D4EB2C48BC5FEBC9E127BECC74CFEBC9E127BEC
C74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E
667A9C6AECB7A5D14075D575E7D6A3B9808FEBC9E127BECC74C9F5B5EFC7D2826EE55051DBD49156B
69AD2F7567026086A9B6D3039AFB559F88E19967A7908D0CACD5D4CAA7D5B56E20931C219A2C6F288
369E93FA91A331ACDBBCF4D647AD0B195923770197979CC7485B363BF5D566CF3EBE9C1E9A639AC8A
E17C3951FB509F2D1D917DE3E274E6EB13E412765206A41EE96A626E0C5041A7407F2C13488B75BDB
EAD355E33632DCF018155E4B910BA6FC5E64F4C2605D2CEF39BF8518A29E152F23AB05F81A1A6AEC8
41AB35B6AA289395BD8A1E4385F2EF517BC3B6DEF0ABBA684659C258B2ED57953C63145F32FC7DA0B
3E9842928C4BDDEAA0AF45750AB0C03C7F06B33BA30E0497323B5BF25DB63E770172010E280AFD419
1A3EF7D7CF1D591A8ABB0706B1A2F5C6634CD6A6FBBF1A7E8F1922517402A39B15C9393C188BB8F78
E1FB781463BE6FE7093957C2A501E4D251880B4FDB16DEA735489D61A379E05387F21BED90B17446B
C9E69244178CB1FDCE3FF0138388A27F9D48240143414596CE10726A3838A6482F2277BD5B33E093E
CE60DBA7D00C458E74C45081985A28E02C6F8892BAD18D009985F1EA494F6B42AF23593EB9133F0FC
5EFE00E309695712FBCE5F90906FA1A28C9E0044657301C2D2394BDC31380E263ABB501499CC7DF85
717A3D9ADE42B48B431144A103B70726A8D29A403004CB41285705D3C61603B791626BD849933CCBC
B79C0EAF13CBFD934982D8631A9A7B890FEF39A7A0335A743649324A0F508443F1F02998A8B0AB192
9C356617C3BD2BBAD6D62C6E7FE604D8503F7E62CF049DA4AFC784F0A10C63B8D6FBB3DFC45953459
1ED9B9789DDA7DB5DC0E78B9D5FA0C483F210C2B321C2DF718EB6F5B2225F3AE4E64D478C0D7F31E7
7B94EE61478D09DCA07BEE3AE7E1893670EA1351362F06F58889EEF6AEE923602846C469328189AC8
54076E74469829188C339029B69280AF93D34D74B52F1EC4BB0D4E917445B8F178BB6AC4CD3C2BFA1
8B555CA0EB869D715E161884C141619701B5A1ECA2F911725655C3672092BF3A3EF4E335731D8EA61
EDE229D07F056D77B8A61F9CA0649BCFC1AAB11876E2FC65DCAE7286439F1590CFE82768A2F4456A3
8D7CC5ED89375B2C1217424712E2058A909699327311A7F11732BBB24123526A372B38C0B26B14D0D
EE1103D80B7F3CBBD750790AA7CC4EF2E232F81DB0E74B3862B4A15E47EDDFFAA86D21809F4E1526F
431370D3F975F69FA8A4E9DC59C40"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(852)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(5744)
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\documents and settings\angie13\Application Data\Dropbox\bin\DropboxExt.3.dll
c:\progra~1\WINDOW~1\wmpband.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\program files\McAfee\MSK\MskSrver.exe
c:\program files\Skype\Phone\Skype.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\Common Files\Logitech\KHAL\KHALMNPR.EXE
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\progra~1\hpq\Shared\HPQTOA~1.EXE
c:\program files\Java\jre1.5.0_09\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-02-01 08:21:03 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-01 14:20

Pre-Run: 53,583,290,368 bytes free
Post-Run: 53,287,784,448 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - F9EF482D7D9D79B70F86872B7C25967C

Ok, Below are the Kaspersky report and the two DDS logs. First, I am not getting any of the unusual behaviors I described previously, but now when the computer starts I get a warning that the system has recovered from a serious error. I don't know if this helps you at all, but I am posting the microsoft error reporting info. BCCode: 100000c5 BCP1: 00083D60 BCP2: 00000002 BCP3: 00000000 BCP4: 805443B2 OSVer: 5_1_2600 SP: 2 Product: 256_1 Now the others: Wednesday, February 3, 2010 Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Wednesday, February 03, 2010 11:15:32 Records in database: 3400636 Scan settings scan using the following database extended Scan archives yes Scan e-mail databases yes Scan area My Computer C:\ D:\ E:\ Scan statistics Objects scanned 125620 Threats found 14 Infected objects found 41 Suspicious objects found 24 Scan duration 03:41:11 File name Threat Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\41727D59.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\418F7739.tmp Infected: Trojan-Clicker.HTML.IFrame.xr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\418F7739.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\56C635E1.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5E74212D.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5EB23EE9.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5EB23EE9.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\606B6304.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\624100FF.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\624100FF.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\62654ED7.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64456AC7.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6F851265.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6F8F105A.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6F8F105A.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7134388B.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\71B41DFF.tmp Suspicious: Exploit.HTML.Iframe.FileDownload 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\71B41DFF.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\71D117DE.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\73FC797B.tmp Infected: Email-Worm.Win32.NetSky.q 1 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.HTML.Bayfraud.ln 1 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\Local Folders\Trash Infected: Trojan-Spy.HTML.Bayfraud.ln 1 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact-3.com\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 12 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact-3.com\Inbox Infected: Trojan-Spy.HTML.Bankfraud.ou 1 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact-3.com\Inbox Infected: Trojan-Spy.HTML.Fraud.f 3 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact-3.com\Inbox Infected: Trojan-Spy.HTML.Bankfraud.pd 3 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact.com\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 6 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact.com\Inbox Infected: Trojan-Downloader.Win32.Small.dzc 1 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact.com\Inbox Infected: Trojan-Spy.HTML.Paylap.ad 1 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact.com\Inbox Infected: Email-Worm.Win32.Luder.a 2 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact.com\Inbox Infected: Email-Worm.Win32.Zhelatin.a 5 C:\Documents and Settings\angie13\Application Data\Thunderbird\Profiles\1h2mzatt.default\Mail\mail.spanishcontact.com\SpamKiller Infected: Email-Worm.Win32.Luder.a 1 C:\Documents and Settings\angie13\Local Settings\Application Data\Identities\{DC40B654-6026-4B52-AAF7-9998CE175EAF}\Microsoft\Outlook Express\Inbox.dbx Infected: Trojan-Spy.HTML.Paylap.ad 1 C:\Documents and Settings\angie13\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Trojan-Spy.HTML.Paylap.ad 3 C:\Documents and Settings\angie13\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2 C:\Documents and Settings\angie13\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Trojan-Spy.HTML.Paylap.cb 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\BFYXE6SH\load-full2[1].exe Infected: Packed.Win32.TDSS.aa 1 Selected area has been scanned. DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 16:19:23.43 on Wed 02/03/2010 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_18 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.448 [GMT -6:00] AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe C:\WINDOWS\V0415Mon.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Creative\Shared Files\CTSched.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Microsoft Office\Office\FINDFAST.EXE C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Documents and Settings\angie13\Application Data\Dropbox\bin\Dropbox.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\angie13\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File uRun: [LogitechSoftwareUpdate] "c:\program files\logitech\video\ManifestEngine.exe" boot uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe" uRun: [CreativeTaskScheduler] "c:\program files\creative\shared files\CTSched.exe" /logon uRun: [Skype] "c:\program files\skype\\phone\Skype.exe" /nosplash /minimized mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe" mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start mRun: [RecGuard] c:\windows\sminst\RecGuard.exe mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE mRun: [mmtask] c:\program files\musicmatch\musicmatch jukebox\mmtask.exe mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Live! Central] "c:\program files\creative\creative live! cam\live! central\CTLVCentral.exe" /mode2 mRun: [V0415Mon.exe] c:\windows\V0415Mon.exe mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [McENUI] c:\progra~1\mcafee\mhn\McENUI.exe /hide mRun: [McAfee Backup] "c:\program files\mcafee\mbk\McAfeeDataBackup.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k StartupFolder: c:\docume~1\angie13\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\angie13\application data\dropbox\bin\Dropbox.exe StartupFolder: c:\docume~1\angie13\startm~1\programs\startup\yahoo!~1.lnk - c:\program files\yahoo!\yahoo! widget engine\YahooWidgetEngine.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL Trusted Zone: internet Trusted Zone: mcafee.com DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\angie13\applic~1\mozilla\firefox\profiles\2mzv4hwt.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/worldservice FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - component: c:\program files\mozilla firefox\extensions\[removed]\components\Shim.dll FF - component: c:\program files\mozilla firefox\extensions\[removed]\components\qfaservices.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service ============= SERVICES / DRIVERS =============== R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-7-8 214664] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-9-3 210216] R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-9-3 359952] R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-9-3 144704] R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2005-8-22 231424] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-9-3 79816] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-9-3 35272] R3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\system32\drivers\livecamv.sys [2009-8-30 31616] S0 hookint;hookint;c:\windows\system32\drivers\hookint.sys –> c:\windows\system32\drivers\hookint.sys [?] S2 0290491264478820mcinstcleanup;McAfee Application Installer Cleanup (0290491264478820);c:\windows\temp\029049~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service –> c:\windows\temp\029049~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-30 135664] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2009-8-30 135616] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-9-3 34248] S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-9-3 40552] S3 V0415Afx;Creative Camera VF0415 Audio Effects Driver;c:\windows\system32\drivers\V0415Afx.sys [2009-8-30 160768] S3 V0415Vid;Creative Live! Cam Video IM Ultra Driver;c:\windows\system32\drivers\V0415Vid.sys [2009-8-30 282464] S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-9-3 606736] =============== Created Last 30 ================ 2010-02-02 21:35 411,368 a——- c:\windows\system32\deploytk.dll 2010-02-02 21:35 73,728 a——- c:\windows\system32\javacpl.cpl 2010-02-01 07:49 a-dshr– C:\cmdcons 2010-02-01 07:48 261,632 a——- c:\windows\PEV.exe 2010-02-01 07:48 161,792 a——- c:\windows\SWREG.exe 2010-02-01 07:48 98,816 a——- c:\windows\sed.exe 2010-02-01 07:48 77,312 a——- c:\windows\MBR.exe 2010-02-01 07:48 –d—– C:\ComboFix 2010-01-30 08:54 –d—– c:\docume~1\angie13\applic~1\Malwarebytes 2010-01-30 08:54 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-30 08:54 19,160 a——- c:\windows\system32\drivers\mbam.sys 2010-01-30 08:54 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-01-30 08:54 –d—– c:\program files\Malwarebytes' Anti-Malware ==================== Find3M ==================== 2009-12-16 06:57 18,432 ——– c:\windows\system32\dllcache\iedw.exe 2009-12-08 03:13 474,112 ——– c:\windows\system32\dllcache\shlwapi.dll 2009-11-21 10:36 470,528 a——- c:\windows\system32\dllcache\aclayers.dll 2009-11-21 10:36 470,528 a——- c:\windows\apppatch\aclayers.dll 2009-08-31 19:22 61,224 a——- c:\documents and settings\angie13\GoToAssistDownloadHelper.exe 2009-03-03 16:55 2,174 ac—— c:\docume~1\angie13\applic~1\wklnhst.dat 2007-11-16 05:42 61 -c-sh— c:\windows\cnerolf.dat ============= FINISH: 16:19:54.57 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 8/9/2006 9:01:18 PM System Uptime: 2/3/2010 7:15:48 AM (9 hours ago) Motherboard: Hewlett-Packard | | 30AE Processor: AMD Turion™ 64 Mobile Technology ML-34 | U23 | 1794/mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 84 GiB total, 50.526 GiB free. D: is FIXED (FAT32) - 8 GiB total, 1.327 GiB free. E: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP312: 1/25/2010 10:29:50 PM - System Checkpoint RP313: 1/30/2010 10:43:55 AM - System Checkpoint RP314: 2/2/2010 10:43:59 AM - Software Distribution Service 3.0 RP315: 2/2/2010 9:25:19 PM - Removed J2SE Runtime Environment 5.0 Update 6 RP316: 2/2/2010 9:26:33 PM - Removed J2SE Runtime Environment 5.0 Update 9 RP317: 2/2/2010 9:34:53 PM - Installed Java™ 6 Update 18 ==== Installed Programs ====================== 1400 1400_Help 1400Trb Adobe Flash Player 10 Plugin Adobe Flash Player 9 ActiveX Adobe Reader 8.1.2 Advanced Audio FX Engine AiO_Scan AiOSoftware Apple Mobile Device Support Apple Software Update Athlon 64 Processor Driver ATI Control Panel ATI Display Driver Azureus Vuze Bi-Admin Bonjour BufferChm Conexant AC-Link Audio CP_AtenaShokunin1Config CP_CalendarTemplates1 cp_LightScribeConfig cp_OnlineProjectsConfig CP_Package_Basic1 CP_Package_Variety1 CP_Package_Variety2 CP_Package_Variety3 CP_Panorama1Config cp_PosterPrintConfig cp_UpdateProjectsConfig Creative Live! Cam Video IM Ultra (VF0415) (1.00.03.00) Creative Live! Central Creative System Information CueTour Destinations DivX Content Uploader DivX Web Player DocProc Dropbox DVD Decrypter (Remove Only) DVD Shrink 3.1.5 Easy-WebPrint ERUNT 1.1j eSupportQFolder Fax FTVO Media Player Full FullDPAppQFolder GdiplusUpgrade Google Earth Google Toolbar for Internet Explorer Google Update Helper Google Updater Hotfix for Windows XP (KB896256) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) HP Help and Support HP Image Zone Express HP Imaging Device Functions 6.0 HP Photosmart Premier Software 6.0 HP PSC & OfficeJet 5.3.B HP QuickPlay 2.0 HP Software Update HP Solution Center & Imaging Support Tools 5.3 HP User Guides–System Recovery HP User Guides 0025 HP Wireless Assistant 2.00 C1 HPProductAssistant HpSdpAppCoreApp InstantShareDevices iTunes Java Auto Updater Java™ 6 Update 18 LightScribe 1.4.56.1 Logitech Desktop Messenger Logitech Print Service Logitech QuickCam Software Logitech SetPoint Logitech® Camera Driver Malwarebytes' Anti-Malware McAfee SecurityCenter Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft Flight Simulator 2004 A Century of Flight Microsoft Office 97, Professional Edition Microsoft Office Standard Edition 2003 Microsoft Works Mozilla ActiveX Control v1.7.12 Mozilla Firefox (2.0.0.20) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MUSICMATCH® Jukebox muvee autoProducer 4.5 Nero 7 Ultra Edition Netscape Browser (remove only) NewCopy Octoshape add-in for Adobe Flash Player Office 2003 Trial Assistant OptionalContentQFolder PhotoGallery PowerISO ProductContext Quick Launch Buttons 5.20 G1 Quicken 2006 QuickTime RandMap Readme RealPlayer Rhapsody Scan ScannerCopy Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901190) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB937894) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB939653) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB942615) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944338) Security Update for Windows XP (KB944533) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB947864) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) Security Update for Windows XP (KB950749) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958470) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB963027) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969897) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971032) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972260) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974455) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Ship Simulator 2008 SkinsHP1 Skype™ 4.1 Soft Data Fax Modem with SmartCP SolutionCenter Sonic Audio Module Sonic Copy Module Sonic Data Module Sonic Express Labeler Sonic MyDVD Plus Sonic Update Manager Sonic_PrimoSDK Status Synaptics Pointing Device Driver TBS WMP Plug-in Texas Instruments PCIxx21/x515/xx12 drivers. TIPCI TourSetup TrayApp Unload Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB912945) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) Update for Windows XP (KB946627) Update for Windows XP (KB951072-v2) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Update for Windows XP (KB978207) VideoLAN VLC media player 0.8.6d VoiceOver Kit WebFldrs XP WebReg Windows Genuine Advantage Notifications (KB905474) Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB884020 Windows XP Hotfix - KB884575 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885464 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885855 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888239 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB888402 Windows XP Hotfix - KB889673 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB892559 WinRAR archiver Wireless Home Network Setup Yahoo! Toolbar Yahoo! Widget Engine ==== Event Viewer Messages From Past Week ======== 2/2/2010 11:36:31 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the mcmscsvc service. 2/1/2010 8:32:41 AM, error: System Error [1003] - Error code 100000c5, parameter1 00083d60, parameter2 00000002, parameter3 00000000, parameter4 805443b2. 2/1/2010 8:32:04 AM, error: System Error [1003] - Error code 10000050, parameter1 ffffffec, parameter2 00000001, parameter3 80522956, parameter4 00000000. 2/1/2010 7:53:33 AM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: This operation returned because the timeout period expired. 2/1/2010 7:06:54 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Google Software Updater service to connect. 2/1/2010 7:06:54 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service gusvc with arguments "" in order to run the server: {B53B7061-6584-46AA-A033-D610EB10BD9B} 1/30/2010 9:29:32 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AliIde IntelIde Pcmcia ViaIde 1/30/2010 8:26:22 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect. 1/30/2010 8:26:22 AM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 1/30/2010 8:26:22 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE} ==== End Of File ===========================