What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Win32.PornPopUp & RightMedia removal

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I ran Spybot three times some in safe mode, some regular mode. The Win32.PornPopUp & RightMedia "cookies" showed up all times, but wouldn't be deleted. I have Windows Defender, Norton Firewall, Ad-Aware by Lavasoft, & Spybot but only S&D found these. I'm not getting any popups that I can see. Popup blocker is set to max. All filesharing has been turned off. But when I go to regular pages like yahoo.com I now get a lot of messages about a Medium Risk internet access issue by some program like svchost.exe and I am given the choice to Block (This one time) or Allow (this one time). I block them all even if 5 in a row come up, and finally I get to the page I'm going to. The detailed info shows the IP address which googles as worldsex.com. Here's a copy of part of one of the many messages like this I get now: svchost.exe is attmpting to acces the Internet using one or more unrecognized modules: Module: C:\WINDOWS\system32\shfolder.dll Module: C:\WINDOWS\system32\qmgr.dll TCP Outbound Remote Address: [removed] : http: (80) A www.worldsex.com www.worldsex.com www.worldsex.com ns1.servicios-dns.com [removed] and [removed] Again I get no popups, just these messages, and as long as I operate in Safe Mode with Networking, my computer runs pretty fast. But if I go to regular mode, it gets all boogered up and slow. I followed your steps using dds, and am posting the dds.txt file and posting the zipped attach.zip file. DDS.TXT : DDS (Ver_09-06-26.01) - NTFSx86 NETWORK Run by [removed] at 2:36:41.71 on Tue 06/29/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.570 [GMT -5:00] AV: Norton AntiVirus *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Personal Firewall *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\taskmgr.exe C:\Documents and Settings\HP_Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://finance.yahoo.com/q/cq?d=v1&s=GSB+RAX+AMD+LLL+BRKA+EEM+IACI+APA+ZN+CTCH+TCX+DAP-U.V+TOOT.OB+ATSX.OB+NIHK .PK+IAIC.OB+GDTI.OB+DSNY.OB+YOO.V+YOOIF.PK+OPBL.OB+EBOF.OB+NMCX.PK+T+CMCSA+ALU uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q404&bd=pavilion&pf=desktop uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=pavilion&pf=desktop uInternet Settings,ProxyOverride = *.local BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: ExplorerView by GetData: {6e48a5af-4ee0-42e4-ac31-6ba0d9572285} - c:\progra~1\getdata\explor~1\EXPLOR~1.DLL BHO: CNisExtBho Class: {9ecb9560-04f9-4bbc-943d-298ddf1699e1} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: HP view: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hp\digital imaging\bin\HPDTLK02.dll TB: Norton Personal Firewall: {0b53eac3-8d69-4b9e-9b19-a37c9a5676a7} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet mRun: [AlcxMonitor] ALCXMNTR.EXE mRun: [VTTimer] VTTimer.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [HPHUPD06] c:\program files\hp\{aac4fc36-8f89-4587-8dd3-ebc57c83374d}\hphupd06.exe mRun: [HPHmon06] c:\windows\system32\hphmon06.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [Symantec NetDriver Monitor] c:\progra~1\symnet~1\SNDMon.exe /Consumer mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: linkshare.com Trusted Zone: linksynergy.com Trusted Zone: quote.com Trusted Zone: yahoo.com Trusted Zone: yahoo.com\*.games DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/OnlineScanner.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-1-29 64160] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 1029456] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] S2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\CCEVTMGR.EXE [2004-8-27 197992] S2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\CCPROXY.EXE [2004-8-27 235168] S2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\CCSETMGR.EXE [2004-8-27 181608] S2 CWMonitor;Symantec Crimeware Protection Driver;\??\c:\program files\common files\symantec shared\coshared\cw\1.0\monitor.sys –> c:\program files\common files\symantec shared\coshared\cw\1.0\Monitor.sys [?] S2 SanaSafeConnectAgent;SanaSafeConnectAgent;"c:\program files\sana security\primary response safeconnect\agent\bin\sanaagent.exe" sanasafeconnectagent –> c:\program files\sana security\primary response safeconnect\agent\bin\SanaAgent.exe [?] S2 SanaSafeConnectWatcher;SanaSafeConnectWatcher;c:\program files\sana security\primary response safeconnect\agent\bin\sanasafeconnectwatcher.exe –> c:\program files\sana security\primary response safeconnect\agent\bin\SanaSafeConnectWatcher.exe [?] S2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2010-6-6 819352] S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\CCPWDSVC.EXE [2004-8-27 79208] S3 SanaSafeConnectDriver;SanaSafeConnectDriver;\??\c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\safeconnectdriver.sys –> c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\SafeConnectDriver.sys [?] S3 SanaSafeConnectFilter;SanaSafeConnectFilter;\??\c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\safeconnectfilter.sys –> c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\SafeConnectFilter.sys [?] S3 SanaSafeConnectShim;SanaSafeConnectShim;\??\c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\safeconnectshim.sys –> c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\SafeConnectShim.sys [?] =============== Created Last 30 ================ 2010-06-26 17:23 161,296 a——- c:\windows\system32\drivers\tmcomm.sys 2010-06-26 17:23 –d—– c:\documents and settings\hp_owner\log 2010-06-26 05:12 14,592 ac—— c:\windows\system32\dllcache\kbdhid.sys 2010-06-26 05:12 14,592 a——- c:\windows\system32\drivers\kbdhid.sys 2010-06-26 05:12 32,128 ac—— c:\windows\system32\dllcache\usbccgp.sys 2010-06-26 05:12 32,128 a——- c:\windows\system32\drivers\usbccgp.sys 2010-06-20 07:56 –d—– c:\program files\GetData 2010-06-12 23:28 599,040 a——- c:\windows\system32\SET8A.tmp 2010-06-12 23:28 55,296 a——- c:\windows\system32\SET89.tmp 2010-06-12 23:28 25,600 a——- c:\windows\system32\SET8C.tmp 2010-06-12 23:28 916,480 a——- c:\windows\system32\SET7E.tmp 2010-06-12 23:28 184,320 a——- c:\windows\system32\SET92.tmp 2010-06-12 23:28 743,424 -c—— c:\windows\system32\dllcache\iedvtool.dll 2010-06-12 23:28 1,985,536 a——- c:\windows\system32\SET91.tmp 2010-06-12 23:28 1,209,344 a——- c:\windows\system32\SET80.tmp 2010-06-12 23:28 5,950,976 a——- c:\windows\system32\SET88.tmp 2010-06-12 23:28 11,076,096 a——- c:\windows\system32\SET93.tmp 2010-06-06 20:16 –d—– c:\program files\SymNetDrv 2010-06-06 19:35 –d—– c:\program files\Norton Personal Firewall 2010-06-06 19:35 4,608 a——- c:\windows\system32\drivers\symlcbrd.sys 2010-06-06 19:33 124,016 a——- c:\windows\system32\drivers\SYMEVENT.SYS 2010-06-06 19:33 91,904 a——- c:\windows\system32\S32EVNT1.DLL 2010-06-05 03:30 –d—– c:\program files\Norton Confidential 2010-06-05 03:27 –d—– c:\program files\Symantec 2010-06-03 01:04 –d—– c:\documents and settings\hp_owner\advfn 2010-06-03 01:03 411,368 a——- c:\windows\system32\deployJava1.dll ==================== Find3M ==================== 2010-05-21 14:14 221,568 ——– c:\windows\system32\MpSigStub.exe 2010-05-07 02:30 0 a—h— c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf 2010-05-07 02:30 0 a—h— c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2010-05-05 08:30 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe 2010-05-02 00:22 1,851,264 a——- c:\windows\system32\win32k.sys 2010-04-20 00:30 285,696 a——- c:\windows\system32\atmfd.dll 2008-07-16 23:17 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008071620080717\index.dat 2008-07-26 10:05 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008072620080727\index.dat 2009-02-24 15:55 16,384 a–sh— c:\windows\temp\cookies\index.dat 2009-02-24 15:55 16,384 a–sh— c:\windows\temp\history\history.ie5\index.dat 2009-02-24 15:55 49,152 a–sh— c:\windows\temp\temporary internet files\content.ie5\index.dat ============= FINISH: 2:37:08.35 ===============

Attachments:

Post #2
Hello, Gregre
Welcome to the WhatTheTech Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.



Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Please set your system to show all files.
    Click Start, open My Computer, select the Tools menu and click Folder Options.
    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
    Uncheck: Hide file extensions for known file types
    Uncheck the Hide protected operating system files (recommended) option.
    Click Yes to confirm.





  • Please download OTL from one of the following mirrors:
    • This is THE Mirror
  • Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
  • Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    /md5stop
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
  • Push the Quick Scan button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <– Will be opened
    • Extra.txt <– Will be minimized





Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "No", save the log and post back the results.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select all drives that are connected to your system to be scanned.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.log and copy/paste the contents in your next reply.
  • Exit the program and re-enable all active protection when done.
Post #3
OTL logfile created on: 6/30/2010 1:49:34 AM - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\HP_Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,015.00 Mb Total Physical Memory | 510.00 Mb Available Physical Memory | 50.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2000 4000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 31.48 Gb Total Space | 13.63 Gb Free Space | 43.31% Space Free | Partition Type: NTFS
Drive D: | 5.77 Gb Total Space | 0.76 Gb Free Space | 13.15% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DESKTOPG1
Current User Name: HP_Owner
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/06/30 01:39:56 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
PRC - [2010/03/04 01:18:30 | 001,029,456 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2010/03/04 01:18:30 | 000,524,632 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2004/08/04 07:00:00 | 000,114,688 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\calc.exe
PRC - [2004/08/04 07:00:00 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\freecell.exe


========== Modules (SafeList) ==========

MOD - [2010/06/30 01:39:56 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
MOD - [2008/04/13 19:10:20 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – – (SanaSafeConnectWatcher)
SRV - File not found [Auto | Stopped] – – (SanaSafeConnectAgent)
SRV - File not found [Auto | Stopped] – – (CLTNetCnService)
SRV - [2010/06/06 19:35:05 | 000,819,352 | —- | M] (Symantec Corporation) [Auto | Stopped] – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe – (Symantec Core LC)
SRV - [2010/03/04 01:18:30 | 001,029,456 | —- | M] (Lavasoft) [Auto | Running] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2008/01/29 16:09:02 | 000,394,704 | —- | M] (Symantec, Inc.) [Disabled | Stopped] – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe – (Symantec RemoteAssist)
SRV - [2008/01/17 11:42:04 | 000,181,608 | —- | M] (Symantec Corporation) [Auto | Stopped] – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe – (ccSetMgr)
SRV - [2008/01/17 11:42:04 | 000,079,208 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe – (ccPwdSvc)
SRV - [2008/01/17 11:42:02 | 000,197,992 | —- | M] (Symantec Corporation) [Auto | Stopped] – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe – (ccEvtMgr)
SRV - [2007/03/28 18:41:56 | 000,206,552 | —- | M] (Symantec Corporation) [Auto | Stopped] – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe – (SNDSrvc)
SRV - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2006/09/02 18:36:33 | 002,528,960 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE – (LiveUpdate)
SRV - [2006/09/02 18:36:33 | 000,198,336 | —- | M] (Symantec Corporation) [Auto | Stopped] – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe – (Automatic LiveUpdate Scheduler)
SRV - [2006/06/14 13:48:42 | 000,235,168 | —- | M] (Symantec Corporation) [Auto | Stopped] – C:\Program Files\Common Files\Symantec Shared\ccProxy.exe – (ccProxy)
SRV - [2005/07/29 09:49:06 | 000,083,584 | —- | M] (Symantec Corporation) [Auto | Stopped] – C:\Program Files\Norton Personal Firewall\ISSVC.exe – (ISSVC)
SRV - [2004/07/21 11:24:03 | 000,173,160 | —- | M] (Symantec Corporation) [Auto | Stopped] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe – (SPBBCSvc)


========== Driver Services (SafeList) ==========

DRV - [2010/06/23 14:37:11 | 000,264,568 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20100623.001\SymIDSCo.sys – (SYMIDSCO)
DRV - [2010/06/06 19:35:05 | 000,004,608 | —- | M] (Symantec Corporation) [Kernel | Auto | Stopped] – C:\WINDOWS\system32\drivers\symlcbrd.sys – (symlcbrd)
DRV - [2009/08/14 08:45:24 | 000,021,248 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MREMP50.sys – (MREMP50)
DRV - [2009/08/14 08:45:24 | 000,020,096 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MRESP50.sys – (MRESP50)
DRV - [2009/05/09 01:14:20 | 000,014,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nuidfltr.sys – (NuidFltr)
DRV - [2009/04/22 17:22:35 | 000,064,160 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\WINDOWS\system32\DRIVERS\Lbd.sys – (Lbd)
DRV - [2007/03/28 18:41:26 | 000,266,552 | —- | M] (Symantec Corporation) [Kernel | System | Stopped] – C:\WINDOWS\System32\Drivers\SYMTDI.SYS – (SYMTDI)
DRV - [2007/03/28 18:41:24 | 000,018,904 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS – (SYMREDRV)
DRV - [2007/03/28 18:41:20 | 000,037,016 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\SYMIDS.SYS – (SYMIDS)
DRV - [2007/03/28 18:41:18 | 000,047,192 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS – (SYMNDIS)
DRV - [2007/03/28 18:41:14 | 000,171,928 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\SYMFW.SYS – (SYMFW)
DRV - [2007/03/28 18:41:12 | 000,011,480 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\SYMDNS.SYS – (SYMDNS)
DRV - [2006/09/15 22:52:12 | 000,124,016 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Program Files\Symantec\SYMEVENT.SYS – (SymEvent)
DRV - [2004/10/01 11:24:00 | 002,279,424 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ALCXWDM.SYS – (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/07/21 11:24:02 | 000,341,096 | —- | M] (Symantec Corporation) [Kernel | System | Stopped] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys – (SPBBCDrv)
DRV - [2004/06/29 19:07:18 | 001,268,204 | —- | M] (Agere Systems) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2003/12/12 08:54:14 | 000,391,424 | —- | M] (Sensaura Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ALCXSENS.SYS – (ALCXSENS)
DRV - [2003/07/02 13:42:00 | 000,027,904 | —- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\viaagp1.sys – (viaagp1)
DRV - [2002/10/04 19:04:10 | 000,046,976 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\R8139n51.sys – (rtl8139)
DRV - [2001/06/04 16:00:00 | 000,014,112 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\PS2.sys – (Ps2)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://finance.yahoo.com/q/cq?d=v1&s;=G….PK+T+CMCSA+ALU
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2010/06/03 01:03:03 | 000,000,000 | —D | M]

[2008/12/17 00:49:01 | 000,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions
[2008/12/17 00:49:01 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

O1 HOSTS File: ([2010/05/24 04:52:21 | 000,395,292 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.123haustiereundmehr.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 13652 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (ExplorerView by GetData) - {6E48A5AF-4EE0-42E4-AC31-6BA0D9572285} - C:\Program Files\GetData\Explorer View\ExplorerView.dll (GetData Pty Ltd)
O2 - BHO: (CNisExtBho Class) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Personal Firewall) - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\ShellBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address;) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Personal Firewall) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links;) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links;) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [AlcxMonitor] C:\WINDOWS\ALCXMNTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\WINDOWS\system\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\kbd.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Symantec NetDriver Monitor] C:\Program Files\SymNetDrv\SNDMon.exe (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VTTimer] File not found
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: linkshare.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: linksynergy.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: quote.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([*.games] * in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab (Windows Live Safety Center Base Module)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.1.254
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 20:12:53 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 22:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\D\Shell\AutoRun\command - "" = C:\WINDOWS\System32\shell32.dll – [2008/06/17 14:02:19 | 008,461,312 | —- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/06/30 01:39:55 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2010/06/29 03:01:57 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2010/06/26 17:23:56 | 000,161,296 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2010/06/26 17:23:56 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\log
[2010/06/20 07:56:11 | 000,000,000 | —D | C] – C:\Program Files\GetData
[2010/06/20 05:22:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/06/06 20:16:30 | 000,000,000 | —D | C] – C:\Program Files\SymNetDrv
[2010/06/06 19:35:31 | 000,000,000 | —D | C] – C:\Program Files\Norton Personal Firewall
[2010/06/06 19:35:05 | 000,004,608 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\symlcbrd.sys
[2010/06/06 19:33:45 | 000,124,016 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/06/06 19:33:45 | 000,091,904 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/06/05 03:30:36 | 000,000,000 | —D | C] – C:\Program Files\Norton Confidential
[2010/06/05 03:27:56 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2010/06/03 01:04:11 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\advfn
[2010/06/03 01:03:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/06/03 01:03:20 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/03 01:03:20 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/03 01:03:20 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/03 01:03:20 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/05/24 03:58:05 | 001,446,053 | —- | C] (Mozilla) – C:\Documents and Settings\HP_Owner\Desktop\Firefox Setup 3.6.3.exe
[2010/05/24 03:33:51 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2010/05/24 03:33:51 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/05/23 21:56:50 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\Downloads
[2010/05/23 00:18:00 | 000,000,000 | —D | C] – C:\Program Files\PokerStars
[2010/05/21 22:04:23 | 000,000,000 | —D | C] – C:\Program Files\PokerStars.NET
[2010/05/18 14:47:12 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Application Data\Motive
[2010/05/13 07:58:56 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft(2)
[2010/05/13 07:51:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/05/10 18:21:52 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NAV
[2010/05/10 18:21:52 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NAV\1000000.07D
[2010/05/10 18:21:49 | 000,000,000 | —D | C] – C:\Program Files\Windows Sidebar
[2010/05/10 18:21:49 | 000,000,000 | —D | C] – C:\Program Files\Norton AntiVirus
[2010/05/10 18:20:38 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/05/09 02:41:48 | 000,014,112 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\drivers\PS2.sys
[2010/05/09 02:38:33 | 003,513,168 | —- | C] (Hewlett-Packard Development Company, L.P. ) – C:\Documents and Settings\HP_Owner\Desktop\sp26752.exe
[2010/05/09 00:29:25 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/05/01 16:15:42 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Desktop\ProcessExplorer
[2010/04/20 00:30:08 | 000,285,696 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\dllcache\atmfd.dll
[95 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[63 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/06/30 01:39:56 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2010/06/29 12:08:15 | 010,223,616 | —- | M] () – C:\Documents and Settings\HP_Owner\ntuser.dat
[2010/06/29 10:27:20 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/06/29 10:23:43 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/29 03:13:55 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\HP_Owner\ntuser.ini
[2010/06/29 02:31:37 | 000,359,929 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\dds.scr
[2010/06/28 23:56:13 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/28 23:55:24 | 000,000,186 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2010/06/28 09:15:47 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/27 21:37:36 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/26 17:23:56 | 000,161,296 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2010/06/21 04:26:54 | 000,000,826 | —- | M] () – C:\Documents and Settings\HP_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/06/20 07:56:14 | 000,000,848 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\Explorer View.lnk
[2010/06/13 11:33:23 | 000,000,104 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\Internet.lnk
[2010/06/13 10:25:27 | 000,000,000 | -H– | M] () – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\Default.rdp
[2010/06/13 07:02:26 | 000,004,566 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/06/13 06:58:58 | 000,441,028 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/13 06:58:58 | 000,382,000 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/13 06:58:58 | 000,053,552 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/13 05:08:41 | 000,000,228 | —- | M] () – C:\WINDOWS\win.ini
[2010/06/13 05:02:11 | 000,388,314 | —- | M] () – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\IEbookmarks.htm
[2010/06/11 08:31:25 | 000,173,080 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/10 01:20:29 | 000,000,282 | -HS- | M] () – C:\boot.ini
[2010/06/10 01:20:29 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/06/06 19:36:23 | 000,001,797 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\Norton Personal Firewall.lnk
[2010/06/06 19:36:23 | 000,001,797 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton Personal Firewall.lnk
[2010/06/06 19:35:05 | 000,004,608 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\symlcbrd.sys
[2010/06/03 01:03:00 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/03 01:02:59 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/03 01:02:59 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/03 01:02:59 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/06/03 01:02:59 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/05/27 07:42:54 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/05/27 00:29:02 | 000,000,054 | —- | M] () – C:\WINDOWS\System32\rp_stats.dat
[2010/05/27 00:29:02 | 000,000,039 | —- | M] () – C:\WINDOWS\System32\rp_rules.dat
[2010/05/24 04:52:21 | 000,395,292 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/05/24 04:10:17 | 001,446,053 | —- | M] (Mozilla) – C:\Documents and Settings\HP_Owner\Desktop\Firefox Setup 3.6.3.exe
[2010/05/24 03:39:33 | 001,107,216 | -H– | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\IconCache.db
[2010/05/24 01:05:10 | 000,395,292 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100524-045221.backup
[2010/05/13 08:11:42 | 000,700,238 | —- | M] () – C:\WINDOWS\System32\drivers\NAV\1000000.07D\Cat.DB
[2010/05/09 02:38:45 | 003,513,168 | —- | M] (Hewlett-Packard Development Company, L.P. ) – C:\Documents and Settings\HP_Owner\Desktop\sp26752.exe
[2010/05/09 00:28:32 | 002,672,312 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\esetsmartinstaller_enu.exe
[2010/05/07 02:30:44 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/05/07 02:30:42 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/05/01 16:13:39 | 001,728,943 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\ProcessExplorer.zip
[2010/04/30 12:36:39 | 000,393,062 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100524-010510.backup
[2010/04/20 00:30:08 | 000,285,696 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\dllcache\atmfd.dll
[2010/04/20 00:30:08 | 000,285,696 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\atmfd.dll
[95 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[63 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/29 02:31:36 | 000,359,929 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\dds.scr
[2010/06/21 04:26:54 | 000,000,826 | —- | C] () – C:\Documents and Settings\HP_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/06/20 07:56:14 | 000,000,848 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\Explorer View.lnk
[2010/06/13 11:33:23 | 000,000,104 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\Internet.lnk
[2010/06/13 10:25:27 | 000,000,000 | -H– | C] () – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\Default.rdp
[2010/06/13 05:02:03 | 000,388,314 | —- | C] () – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\IEbookmarks.htm
[2010/06/10 22:42:46 | 000,001,797 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\Norton Personal Firewall.lnk
[2010/06/06 19:36:23 | 000,001,797 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton Personal Firewall.lnk
[2010/05/24 03:37:56 | 000,000,054 | —- | C] () – C:\WINDOWS\System32\rp_stats.dat
[2010/05/24 03:37:56 | 000,000,039 | —- | C] () – C:\WINDOWS\System32\rp_rules.dat
[2010/05/16 07:29:21 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/05/13 08:05:31 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/05/10 19:01:14 | 000,700,238 | —- | C] () – C:\WINDOWS\System32\drivers\NAV\1000000.07D\Cat.DB
[2010/05/09 00:28:25 | 002,672,312 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\esetsmartinstaller_enu.exe
[2010/05/07 02:30:44 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/05/07 02:30:42 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/05/01 16:13:32 | 001,728,943 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\ProcessExplorer.zip
[2008/12/29 14:43:15 | 000,156,672 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2008/09/04 01:36:04 | 000,000,092 | —- | C] () – C:\WINDOWS\dellstat.ini
[2008/09/04 01:36:02 | 000,000,283 | —- | C] () – C:\WINDOWS\lexstat.ini
[2008/09/04 01:33:49 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxczvs.dll
[2008/09/04 01:32:56 | 000,000,270 | —- | C] () – C:\WINDOWS\System32\lxczcoin.ini
[2008/05/07 11:00:36 | 000,000,078 | —- | C] () – C:\WINDOWS\qwimp.ini
[2008/05/07 11:00:35 | 000,001,323 | —- | C] () – C:\WINDOWS\intuprof.ini
[2008/05/07 10:40:02 | 000,001,333 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2008/03/28 00:12:05 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2008/02/19 13:55:46 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/02/19 13:55:46 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/02/19 13:55:46 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/02/19 13:55:46 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/02/19 13:55:46 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/02/19 13:55:46 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2007/08/06 13:17:40 | 000,019,456 | —- | C] () – C:\WINDOWS\System32\OnlineScannerLang.dll
[2007/08/02 18:11:28 | 000,253,952 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLA.dll
[2007/08/02 18:11:14 | 000,241,664 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLW.dll
[2007/07/27 15:49:02 | 000,225,355 | —- | C] () – C:\WINDOWS\System32\lnod32apiW.dll
[2007/07/27 15:49:02 | 000,196,683 | —- | C] () – C:\WINDOWS\System32\lnod32apiA.dll
[2005/12/05 20:25:22 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\lnod32umc.dll
[2005/12/05 13:37:10 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\lnod32upd.dll
[2004/08/12 01:30:03 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/11 23:25:35 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2004/08/11 23:25:07 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/08/11 23:25:07 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2004/08/11 23:21:02 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2004/08/11 23:14:51 | 000,026,941 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2004/08/11 23:14:13 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2004/08/11 23:05:12 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/08/11 22:14:18 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/11 21:25:38 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2004/08/11 21:25:38 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2004/08/11 21:25:16 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2004/08/11 20:16:20 | 000,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/11 20:00:08 | 000,000,549 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/06/29 07:58:50 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/03/07 00:53:16 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\hpnvr82.dll
[2003/01/08 00:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2008/09/04 01:43:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2009/04/22 17:08:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2008/12/05 06:43:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2010/06/28 23:38:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/02/10 16:53:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2010/05/24 03:33:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/05/24 03:33:53 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2010/05/27 07:42:54 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/06/29 10:27:20 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\$NtServicePackUninstall$\sp3.cab:AGP440.sys
[2004/08/04 14:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\$NtServicePackUninstall$\sp3.cab:atapi.sys
[2004/08/04 14:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 07:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 07:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 07:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD5BCD16
< End of report >
SRV - (SanaSafeConnectWatcher) – File not found
SRV - (SanaSafeConnectAgent) – File not found
SRV - (CLTNetCnService) – File not found
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (Symantec RemoteAssist) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccPwdSvc) – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (SNDSrvc) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (ccProxy) – C:\Program Files\Common Files\Symantec Shared\ccProxy.exe (Symantec Corporation)
SRV - (ISSVC) – C:\Program Files\Norton Personal Firewall\ISSVC.exe (Symantec Corporation)
SRV - (SPBBCSvc) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)


========== Driver Services (SafeList) ==========

DRV - (SYMIDSCO) – C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20100623.001\SymIDSCo.sys (Symantec Corporation)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (MREMP50) – C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) – C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NuidFltr) – C:\WINDOWS\system32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMIDS) – C:\WINDOWS\System32\Drivers\SYMIDS.SYS (Symantec Corporation)
DRV - (SYMNDIS) – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS (Symantec Corporation)
DRV - (SYMFW) – C:\WINDOWS\System32\Drivers\SYMFW.SYS (Symantec Corporation)
DRV - (SYMDNS) – C:\WINDOWS\System32\Drivers\SYMDNS.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (viaagp1) – C:\WINDOWS\system32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\R8139n51.sys (Realtek Semiconductor Corporation )
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://finance.yahoo.com/q/cq?d=v1&s;=G….PK+T+CMCSA+ALU
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2010/06/03 01:03:03 | 000,000,000 | —D | M]

[2008/12/17 00:49:01 | 000,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions
[2008/12/17 00:49:01 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

O1 HOSTS File: ([2010/05/24 04:52:21 | 000,395,292 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.123haustiereundmehr.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 13652 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (ExplorerView by GetData) - {6E48A5AF-4EE0-42E4-AC31-6BA0D9572285} - C:\Program Files\GetData\Explorer View\ExplorerView.dll (GetData Pty Ltd)
O2 - BHO: (CNisExtBho Class) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Personal Firewall) - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\ShellBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address;) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Personal Firewall) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links;) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links;) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [AlcxMonitor] C:\WINDOWS\ALCXMNTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\WINDOWS\system\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\kbd.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Symantec NetDriver Monitor] C:\Program Files\SymNetDrv\SNDMon.exe (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VTTimer] File not found
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: linkshare.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: linksynergy.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: quote.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([*.games] * in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab (Windows Live Safety Center Base Module)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.1.254
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 20:12:53 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 22:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\D\Shell\AutoRun\command - "" = C:\WINDOWS\System32\shell32.dll – [2008/06/17 14:02:19 | 008,461,312 | —- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/06/30 01:39:55 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2010/06/26 17:23:56 | 000,161,296 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2010/06/06 19:35:05 | 000,004,608 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\symlcbrd.sys
[2010/06/06 19:33:45 | 000,124,016 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/06/06 19:33:45 | 000,091,904 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/06/03 01:03:20 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/03 01:03:20 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/03 01:03:20 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/03 01:03:20 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/05/24 03:58:05 | 001,446,053 | —- | C] (Mozilla) – C:\Documents and Settings\HP_Owner\Desktop\Firefox Setup 3.6.3.exe
[2010/05/23 21:56:50 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\Downloads
[2010/05/10 18:21:52 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NAV
[2010/05/10 18:21:52 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NAV\1000000.07D
[2010/05/09 02:41:48 | 000,014,112 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\drivers\PS2.sys
[2010/05/09 02:38:33 | 003,513,168 | —- | C] (Hewlett-Packard Development Company, L.P. ) – C:\Documents and Settings\HP_Owner\Desktop\sp26752.exe
[2010/05/01 16:15:42 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Desktop\ProcessExplorer
[2010/04/20 00:30:08 | 000,285,696 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\dllcache\atmfd.dll
[95 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[63 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/06/30 01:39:56 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2010/06/29 12:08:15 | 010,223,616 | —- | M] () – C:\Documents and Settings\HP_Owner\ntuser.dat
[2010/06/29 10:27:20 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/06/29 10:23:43 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/29 03:13:55 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\HP_Owner\ntuser.ini
[2010/06/29 02:31:37 | 000,359,929 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\dds.scr
[2010/06/28 23:56:13 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/28 23:55:24 | 000,000,186 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2010/06/28 09:15:47 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/27 21:37:36 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/26 17:23:56 | 000,161,296 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2010/06/21 04:26:54 | 000,000,826 | —- | M] () – C:\Documents and Settings\HP_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/06/20 07:56:14 | 000,000,848 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\Explorer View.lnk
[2010/06/13 11:33:23 | 000,000,104 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\Internet.lnk
[2010/06/13 10:25:27 | 000,000,000 | -H– | M] () – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\Default.rdp
[2010/06/13 07:02:26 | 000,004,566 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/06/13 06:58:58 | 000,441,028 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/13 06:58:58 | 000,382,000 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/13 06:58:58 | 000,053,552 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/13 05:08:41 | 000,000,228 | —- | M] () – C:\WINDOWS\win.ini
[2010/06/13 05:02:11 | 000,388,314 | —- | M] () – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\IEbookmarks.htm
[2010/06/11 08:31:25 | 000,173,080 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/10 01:20:29 | 000,000,282 | -HS- | M] () – C:\boot.ini
[2010/06/10 01:20:29 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/06/06 19:36:23 | 000,001,797 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\Norton Personal Firewall.lnk
[2010/06/06 19:36:23 | 000,001,797 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton Personal Firewall.lnk
[2010/06/06 19:35:05 | 000,004,608 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\symlcbrd.sys
[2010/06/03 01:03:00 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/03 01:02:59 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/03 01:02:59 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/03 01:02:59 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/06/03 01:02:59 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/05/27 07:42:54 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/05/27 00:29:02 | 000,000,054 | —- | M] () – C:\WINDOWS\System32\rp_stats.dat
[2010/05/27 00:29:02 | 000,000,039 | —- | M] () – C:\WINDOWS\System32\rp_rules.dat
[2010/05/24 04:52:21 | 000,395,292 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/05/24 04:10:17 | 001,446,053 | —- | M] (Mozilla) – C:\Documents and Settings\HP_Owner\Desktop\Firefox Setup 3.6.3.exe
[2010/05/24 03:39:33 | 001,107,216 | -H– | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\IconCache.db
[2010/05/24 01:05:10 | 000,395,292 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100524-045221.backup
[2010/05/13 08:11:42 | 000,700,238 | —- | M] () – C:\WINDOWS\System32\drivers\NAV\1000000.07D\Cat.DB
[2010/05/09 02:38:45 | 003,513,168 | —- | M] (Hewlett-Packard Development Company, L.P. ) – C:\Documents and Settings\HP_Owner\Desktop\sp26752.exe
[2010/05/09 00:28:32 | 002,672,312 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\esetsmartinstaller_enu.exe
[2010/05/07 02:30:44 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/05/07 02:30:42 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/05/01 16:13:39 | 001,728,943 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\ProcessExplorer.zip
[2010/04/30 12:36:39 | 000,393,062 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100524-010510.backup
[2010/04/20 00:30:08 | 000,285,696 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\dllcache\atmfd.dll
[2010/04/20 00:30:08 | 000,285,696 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\atmfd.dll
[95 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[63 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/29 02:31:36 | 000,359,929 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\dds.scr
[2010/06/21 04:26:54 | 000,000,826 | —- | C] () – C:\Documents and Settings\HP_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/06/20 07:56:14 | 000,000,848 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\Explorer View.lnk
[2010/06/13 11:33:23 | 000,000,104 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\Internet.lnk
[2010/06/13 10:25:27 | 000,000,000 | -H– | C] () – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\Default.rdp
[2010/06/13 05:02:03 | 000,388,314 | —- | C] () – C:\Documents and Settings\HP_Owner\Start Menu\My Documents\IEbookmarks.htm
[2010/06/10 22:42:46 | 000,001,797 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\Norton Personal Firewall.lnk
[2010/06/06 19:36:23 | 000,001,797 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton Personal Firewall.lnk
[2010/05/24 03:37:56 | 000,000,054 | —- | C] () – C:\WINDOWS\System32\rp_stats.dat
[2010/05/24 03:37:56 | 000,000,039 | —- | C] () – C:\WINDOWS\System32\rp_rules.dat
[2010/05/16 07:29:21 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/05/13 08:05:31 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/05/10 19:01:14 | 000,700,238 | —- | C] () – C:\WINDOWS\System32\drivers\NAV\1000000.07D\Cat.DB
[2010/05/09 00:28:25 | 002,672,312 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\esetsmartinstaller_enu.exe
[2010/05/07 02:30:44 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/05/07 02:30:42 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/05/01 16:13:32 | 001,728,943 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\ProcessExplorer.zip
[2008/12/29 14:43:15 | 000,156,672 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2008/09/04 01:36:04 | 000,000,092 | —- | C] () – C:\WINDOWS\dellstat.ini
[2008/09/04 01:36:02 | 000,000,283 | —- | C] () – C:\WINDOWS\lexstat.ini
[2008/09/04 01:33:49 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxczvs.dll
[2008/09/04 01:32:56 | 000,000,270 | —- | C] () – C:\WINDOWS\System32\lxczcoin.ini
[2008/05/07 11:00:36 | 000,000,078 | —- | C] () – C:\WINDOWS\qwimp.ini
[2008/05/07 11:00:35 | 000,001,323 | —- | C] () – C:\WINDOWS\intuprof.ini
[2008/05/07 10:40:02 | 000,001,333 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2008/03/28 00:12:05 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2008/02/19 13:55:46 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/02/19 13:55:46 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/02/19 13:55:46 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/02/19 13:55:46 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/02/19 13:55:46 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/02/19 13:55:46 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2007/08/06 13:17:40 | 000,019,456 | —- | C] () – C:\WINDOWS\System32\OnlineScannerLang.dll
[2007/08/02 18:11:28 | 000,253,952 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLA.dll
[2007/08/02 18:11:14 | 000,241,664 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLW.dll
[2007/07/27 15:49:02 | 000,225,355 | —- | C] () – C:\WINDOWS\System32\lnod32apiW.dll
[2007/07/27 15:49:02 | 000,196,683 | —- | C] () – C:\WINDOWS\System32\lnod32apiA.dll
[2005/12/05 20:25:22 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\lnod32umc.dll
[2005/12/05 13:37:10 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\lnod32upd.dll
[2004/08/12 01:30:03 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/11 23:25:35 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2004/08/11 23:25:07 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/08/11 23:25:07 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2004/08/11 23:21:02 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2004/08/11 23:14:51 | 000,026,941 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2004/08/11 23:14:13 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2004/08/11 23:05:12 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/08/11 22:14:18 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/11 21:25:38 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2004/08/11 21:25:38 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2004/08/11 21:25:16 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2004/08/11 20:16:20 | 000,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/11 20:00:08 | 000,000,549 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/06/29 07:58:50 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/03/07 00:53:16 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\hpnvr82.dll
[2003/01/08 00:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/05/27 07:42:54 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/06/29 10:27:20 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\$NtServicePackUninstall$\sp3.cab:AGP440.sys
[2004/08/04 14:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\$NtServicePackUninstall$\sp3.cab:atapi.sys
[2004/08/04 14:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 07:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 07:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 07:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD5BCD16

< End of report >

< MD5 for: [2004/08/04 07:00:00 | 000,055,808 | —- | M] (MICROSOFT CORPORATION) >
[2004/08/04 07:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: [2004/08/04 07:00:00 | 000,095,360 | —- | M] (MICROSOFT CORPORATION) >
[2004/08/04 07:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: [2004/08/04 07:00:00 | 000,180,224 | —- | M] (MICROSOFT CORPORATION) >
[2004/08/04 07:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

< MD5 for: [2004/08/04 07:00:00 | 000,407,040 | —- | M] (MICROSOFT CORPORATION) >
[2004/08/04 07:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: [2008/04/13 13:36:38 | 000,042,368 | —- | M] (MICROSOFT CORPORATION) >
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: [2008/04/13 13:40:30 | 000,096,512 | —- | M] (MICROSOFT CORPORATION) >
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: [2008/04/13 19:11:53 | 000,056,320 | —- | M] (MICROSOFT CORPORATION) >
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\eventlog.dll

< MD5 for: [2008/04/13 19:12:01 | 000,407,040 | —- | M] (MICROSOFT CORPORATION) >
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\netlogon.dll

< MD5 for: [2008/04/13 19:12:05 | 000,181,248 | —- | M] (MICROSOFT CORPORATION) >
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\scecli.dll

< MD5 for: AGP440.SYS >
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\$NtServicePackUninstall$\sp3.cab:AGP440.sys
[2004/08/04 14:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\$NtServicePackUninstall$\sp3.cab:atapi.sys
[2004/08/04 14:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008/07/16 22:57:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

< %systemroot%\*. /mp /s >

< End of report >

HI I WAS GOING TO minimize extras.exe but WHAT DOES IT MEAN TO MINIMIZE? I am attaching Extras for now, but if you need me to paste it, tell me how to minimize it. I haven't done that before. I can do it on my computer, yes, minimize it, but I dont' know how to post it in minimized form except by just aattaching it. Is there some way to zip it and post it zipped or something so that it appears minimized? Because if you are talking about that I will find it that way, I received THREE popups of notepad with OTL.exe with same time stamps and ONE popup notepad of the Extras.exe. Let me know if you want me to repost the extras.exe and how. I got stuck reading to try to find out how you pasate a minimized text file.

Attachments:

Post #4
Here is the log file from the GMER product:
I'm a nnovice, so am posting the only file the GMER showed the option to save as a log file. The Rootware/Malware comments/results.
This is that printout. Thanks.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-06-30 06:03:41
Windows 5.1.2600 Service Pack 3
Running: GMERek8l2752.exe; Driver: C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\kxlyrpoc.sys


—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-
Post #5
Computer slow inn regular mode. I have been using safe mode so long, I automatically was in safe while opening GMER, so I thought to try and open it today in regular mode. The results are a bit more things. So I'm posting it here now:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-06-30 13:48:04
Windows 5.1.2600 Service Pack 3
Running: GMERek8l2752.exe; Driver: C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\kxlyrpow.sys


—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

—- EOF - GMER 1.0.15 —-

I am now going to the next step to go offline again and run the GMER scan.
Post #6
Ran the GMER scan in regular computer mode, not safe mode, and it ran for about an hour. Also had notepad open with the instruction set for GMER you gave me. I turned away and was reading junk mail to trash when I noticed the GMER scan had stopped, the application had closed, and the notepad was closed. I don't see how that could happen, but only choice now is restart the computer, which is frozen, and rescan.

Okay, done with the scan in regular mode. Here is the log file for Rootkit/Malware:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-30 20:41:24
Windows 5.1.2600 Service Pack 3
Running: GMERek8l2752.exe; Driver: C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\kxlyrpow.sys


—- System - GMER 1.0.15 —-

SSDT 86CC51A8 ZwConnectPort
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF75E687E]
SSDT 86D8BE98 ZwOpenProcess
SSDT 86DAB970 ZwOpenThread
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF75E6BFE]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\ControlSet003\Control\Session Manager@PendingFileRenameOperations ????????????\\?\PCI#VEN_8086&DEV_24C5&SUBSYS_57711462&REV_02#3&13c0b0c5&0&FD#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\Topology????????????????????????????????????????in???????????????????????????????????f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f?f???????????????????????%???????%??????? ???????n???????????????????? ?t?A??????c????t????????????????????~????????????????\Pagefile.sys????????!\???????????????????????)?????%SystemRoot%\Registration\*.clb?\*.crmlog /s??????6?????????????%SystemRoot%\netlogon.chg???????????????????????????\hiberfil.sys????????????????????????s??????????????????????????\System Volume Information\*{3808876B-C176-4e48-B7AE-04046E6CC752} /s?????????6?????????????????%SYSTEMROOT%\schedlgu.txt???????? P??????????????????}????$?????????????????%WINDIR%\debug\*??????\??????X?MP????????????J??%SystemRoot%\SoftwareDistribution\* /s????????J?????????????????%SystemRoot%\System32\CatRoot2\* /s?????-20?????????C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe??????????????????

—- EOF - GMER 1.0.15 —-

:thumbup:
Post #7
Hi :)


Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to before saving it to your desktop.

Link 1
Link 2



——————————————————————–

Double click on the renamed Combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Post #8
Hi , I am reading on how to disable the antimalwares and thought to check the config.sys via Run command to see all that it shows that is set to run at startup. I once had eset scanning, so was gonna look if that was in startup somehow. So I did Run and CONFIG.SYS and entered it, and it said it cannot find config.sys anywhere. I won't worry but just wanted to mention it. I wasn't going to make any changes in there, just look, and then continue with the disabling instructions. So this is kind of a heads up post about the lost/missing config.sys, fyi post. I really appreciate your help, and want to thank you for your many kindnesses to me and all those here you guys/gals are helping.
Post #9
Hi, Thanks for letting me know. Just rightclick the icon of your security software in the taskbar, there should be an option to disable it :).

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI