Imonagent

Hi,
Data from OTL.txt is as Below

OTL logfile created on: 9/3/2010 10:37:43 AM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\prasannaa\Desktop
Windows Server 2003 Enterprise Edition Service Pack 2 (Version = 5.2.3790) - Type = NTServer
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free
14.00 Gb Paging File | 12.00 Gb Available in Paging File | 91.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.53 Gb Total Space | 4.45 Gb Free Space | 22.76% Space Free | Partition Type: NTFS
Drive D: | 73.62 Gb Total Space | 50.82 Gb Free Space | 69.03% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: IFLEXLAPDLBP1S
Current User Name: PrasannaA
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\prasannaa\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
PRC - C:\Program Files\PureSync\PureSyncTray.exe (Jumping Bytes)
PRC - C:\Program Files\Youdao\Dict\YodaoDict.exe (网易公司)
PRC - C:\Program Files\McAfee\Common Framework\naPrdMgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\McTray.exe (McAfee, Inc.)
PRC - d:\app\product\11.2.0\dbhome_1\BIN\oracle.exe (Oracle Corporation)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe (McAfee, Inc.)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Documents and Settings\prasannaa\Desktop\FeiQ.exe (卢本陶)
PRC - C:\Program Files\Utimaco\SafeGuard Easy\ecview.exe (Utimaco Safeware AG)
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Google\Google Talk\googletalk.exe (Google)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe (TOSHIBA CORPORATION.)
PRC - D:\Program Files\TortoiseSVN\bin\TSVNCache.exe (www.tortoisesvn.org)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe (TOSHIBA CORPORATION.)
PRC - D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\system32\SgLogPlayer.exe (Utimaco Safeware AG)
PRC - C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\prasannaa\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.)


========== Win32 Services (SafeList) ==========

SRV - (zvvmza) – C:\WINDOWS\System32\uyyfoc.dll File not found
SRV - (vzpzui) – C:\WINDOWS\System32\hgqicf.dll File not found
SRV - (TrkWkSer) – C:\WINDOWS\System32\edqesh.dll File not found
SRV - (OracleDBConsoleorcl) – D:\oracle\product\10.2.0\db_1\bin\nmesrvc.exe File not found
SRV - (OracleDBConsolefcrdemo) – D:\oracle\product\10.2.0\db_1\bin\nmesrvc.exe File not found
SRV - (GrayPigeonSere) – C:\WINDOWS\G_So.exe File not found
SRV - (appzqx) – C:\WINDOWS\System32\clgktl.dll File not found
SRV - (McAfeeFramework) – C:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
SRV - (OracleServiceFCVCO42) – d:\app\product\11.2.0\dbhome_1\bin\ORACLE.EXE (Oracle Corporation)
SRV - (OracleJobSchedulerFCVCO42) – d:\app\product\11.2.0\dbhome_1\Bin\extjob.exe ()
SRV - (OracleVssWriterFCVCO42) – d:\app\product\11.2.0\dbhome_1\bin\OraVSSW.exe ()
SRV - (OracleMTSRecoveryService) – D:\app\product\11.2.0\dbhome_1\bin\omtsreco.exe (Oracle Corporation)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (McAfee, Inc.)
SRV - (mfevtp) – C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
SRV - (McTaskManager) – C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
SRV - (McAfeeEngineService) – C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe (McAfee, Inc.)
SRV - (OracleOraDb11g_home1ClrAgent) – D:\app\product\11.2.0\dbhome_1\bin\OraClrAgnt.exe (Oracle Corporation)
SRV - (Array_Utility_Service8.3.1.231) – C:\Program Files\Array Networks\Common\8,3,1,231\arr_isrv.exe (Array Networks, Inc.)
SRV - (ArraySSL_VPN_Service8.3.1.231) – C:\Program Files\Array Networks\Array SSL VPN\8,3,1,231\arr_srvs.exe (Array Networks, Inc.)
SRV - (McAfee SiteAdvisor Enterprise Service) – C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe (McAfee, Inc.)
SRV - (CVPND) – C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (smss) – C:\WINDOWS\system32\remote.dll ()
SRV - (WksCfgSrv) – C:\Program Files\Utimaco\SafeGuard Easy\WksCfgSrv.exe (Utimaco Safeware AG)
SRV - (SgeCtl) – C:\Program Files\Utimaco\SafeGuard Easy\SgeCtl.exe (Utimaco Safeware AG)
SRV - (LicenseService) – C:\WINDOWS\system32\llssrv.exe (Microsoft Corporation)
SRV - (Tssdis) – C:\WINDOWS\system32\tssdis.exe (Microsoft Corporation)
SRV - (RSoPProv) – C:\WINDOWS\system32\rsopprov.exe (Microsoft Corporation)
SRV - (NtFrs) – C:\WINDOWS\system32\ntfrs.exe (Microsoft Corporation)
SRV - (IsmServ) – C:\WINDOWS\system32\ismserv.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (Dfs) – C:\WINDOWS\system32\dfssvc.exe (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (EvtEng) Intel® – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (S24EventMonitor) Intel® – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) Intel® – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (IBMPMSVC) – C:\WINDOWS\system32\ibmpmsvc.exe ()
SRV - (TPHDEXLGSVC) – C:\WINDOWS\system32\TPHDEXLG.exe (Lenovo.)
SRV - (SgLogPlayer) – C:\WINDOWS\system32\SgLogPlayer.exe (Utimaco Safeware AG)
SRV - (GSLSRV) – C:\WINDOWS\system32\gslsrvn.exe ()
SRV - (CRPPSRV) – C:\WINDOWS\system32\crppsrvn.exe ()
SRV - (TrkSvr) – C:\WINDOWS\system32\trksvr.dll (Microsoft Corporation)
SRV - (sacsvr) – C:\WINDOWS\system32\sacsvr.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfetdik) – C:\WINDOWS\system32\drivers\mfetdik.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (CVPNDRVA) – C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE) – C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (AES-256) – C:\WINDOWS\SYSTEM32\DRIVERS\AES256.SYS (Utimaco Safeware AG)
DRV - (SgeFlt) – C:\WINDOWS\SYSTEM32\DRIVERS\SGEFLT.SYS (Utimaco Safeware AG)
DRV - (ATP) – C:\WINDOWS\system32\drivers\atpdrvr.sys (Array Networks, Inc.)
DRV - (tosrfbd) – C:\WINDOWS\system32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (Tosrfusb) – C:\WINDOWS\system32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (WLBS) – C:\WINDOWS\system32\drivers\wlbs.sys (Microsoft Corporation)
DRV - (hpcisss) – C:\WINDOWS\System32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (DfsDriver) – C:\WINDOWS\system32\drivers\Dfs.sys (Microsoft Corporation)
DRV - (ClusDisk) – C:\WINDOWS\system32\drivers\clusdisk.sys (Microsoft Corporation)
DRV - (arc) – C:\WINDOWS\System32\drivers\arc.sys (Adaptec, Inc.)
DRV - (CVirtA) – C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (CSRBC) – C:\WINDOWS\system32\drivers\csrbcxp.sys (CSR, plc)
DRV - (TosRfSnd) – C:\WINDOWS\system32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (tosrfbnp) – C:\WINDOWS\system32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (tosporte) – C:\WINDOWS\system32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (Tosrfhid) – C:\WINDOWS\system32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (NETw3x32) Intel® – C:\WINDOWS\system32\drivers\NETw3x32.sys (Intel® Corporation)
DRV - (EGATHDRV) – C:\WINDOWS\system32\EGATHDRV.SYS (IBM Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (e1express) Intel® – C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) – C:\WINDOWS\system32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (Shockprf) – C:\WINDOWS\System32\drivers\shockprf.sys (Lenovo)
DRV - (IBMPMDRV) – C:\WINDOWS\system32\drivers\ibmpmdrv.sys (Lenovo.)
DRV - (UIUSys) – C:\WINDOWS\system32\drivers\UIUSYS.SYS (Conexant Systems, Inc)
DRV - (iastor) – C:\WINDOWS\System32\Drivers\iaStor.sys (Intel Corporation)
DRV - (Tosrfcom) – C:\WINDOWS\system32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (TPHKDRV) – C:\WINDOWS\System32\drivers\TPHKDRV.sys (IBM Corporation)
DRV - (ShockMgr) – C:\WINDOWS\System32\drivers\ShockMgr.sys (Lenovo.)
DRV - (atmeltpm) – C:\WINDOWS\system32\drivers\atmeltpm.sys (Atmel, Inc.)
DRV - (USBCCID) – C:\WINDOWS\system32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (tosrfnds) – C:\WINDOWS\system32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (msloop) – C:\WINDOWS\system32\drivers\loop.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/softAdmin.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = res://shdoclc.dll/softAdmin.htm
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "res://shdoclc.dll/softAdmin.htm"
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0.0.476

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor Enterprise\ [2010/07/20 06:56:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/07 10:15:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/14 17:57:23 | 000,000,000 | —D | M]

[2010/07/20 07:14:10 | 000,000,000 | —D | M] – C:\Documents and Settings\prasannaa\Application Data\Mozilla\Extensions
[2010/07/20 07:14:10 | 000,000,000 | —D | M] – C:\Documents and Settings\prasannaa\Application Data\Mozilla\Firefox\Profiles\gnb5upr8.default\extensions
[2008/10/25 05:22:15 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/03/25 20:07:00 | 000,023,864 | —- | M] (McAfee, Inc.) – C:\Program Files\Mozilla Firefox\components\Scriptff.dll

O1 HOSTS File: ([2007/06/06 22:51:53 | 000,000,879 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 10.22.69.184 localhost
O1 - Hosts: 10.22.69.184 IFLEXLAPDLBP1S
O1 - Hosts: 127.0.0.1 IFLEXLAPDLBP1S
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [FEIQ] C:\Documents and Settings\prasannaa\Desktop\FeiQ.exe (卢本陶)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\McAfee\Common Framework\udaterui.exe (McAfee, Inc.)
O4 - HKLM..\Run: [SgeEcView] C:\Program Files\Utimaco\SafeGuard Easy\Ecview.exe (Utimaco Safeware AG)
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [PureSync] C:\Program Files\PureSync\PureSyncTray.exe (Jumping Bytes)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [YodaoDict] C:\Program Files\Youdao\Dict\RunDict.exe (网易公司)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk = C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\WINDOWS\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico ()
O4 - Startup: C:\Documents and Settings\prasannaa\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: consentpromptbehavioradmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: consentpromptbehavioruser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: enableinstallerdetection = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: enablelua = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: enablesecureuiapaths = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - D:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\NPJPI150_09.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\drivers\imonagent\netconfig.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\System32\drivers\imonagent\netconfig.dll ()
O15 - HKLM\..Trusted Domains: i-flex.com ([livecom] http in Local intranet)
O15 - HKLM\..Trusted Domains: siteadvisor.com ([www] http in Trusted sites)
O15 - HKLM\..Trusted Domains: siteadvisor.com ([www] https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {491B9BED-92C2-4344-9F2E-E7F9CF19E53B} http://202.46.211.40/brn707/flexprnt.cab (Reg Error: Key error.)
O16 - DPF: {595BD78C-E04F-43D9-9539-7453C6370B14} http://202.46.211.40/brn707/flexPress.cab (Flexcube NetCompression Base64 Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1252349806093 (WUWebControl Class)
O16 - DPF: {89BB4389-3259-4405-951D-2A8980396E6B} http://202.46.211.40/brn707/CTI_Interface.cab (CTI_Interface.CTI_Interface_com)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {9B49DE3D-209D-4800-A6CE-82CCEFACAA3F} http://202.46.211.40/brn707/Prototype1.cab (Sample Class)
O16 - DPF: {B6648EB8-2460-484F-9255-9654454C4C70} https://adc-tele-sslvpn.oracle.com/prx/000/…lhost/arr_x.cab (ArrVPNAX Control)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E1991B32-90B7-48AF-A7B7-3DED2B99E9F2} http://202.46.211.40/brn707/prjCardWrapper.cab (prjCardWrapper.clsCardWrapper)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = i-flex.com
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (SGGINA.DLL) - C:\WINDOWS\System32\Sggina.dll (Utimaco Safeware AG)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\AutorunsDisabled: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\NotLog: DllName - SGLogEx.dll - C:\WINDOWS\System32\SGLogEx.dll (Utimaco Safeware AG)
O20 - Winlogon\Notify\SGLogNotification: DllName - SGLogNotification.dll - C:\WINDOWS\System32\SGLogNotification.dll (Utimaco Safeware AG)
O20 - Winlogon\Notify\sgsam: DllName - sgsamn.dll - C:\WINDOWS\System32\sgsamn.dll ()
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/03/11 00:48:34 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/07/24 17:29:47 | 000,000,000 | —D | M] - C:\Autoruns – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: smss - C:\WINDOWS\system32\remote.dll ()
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Remoteaccess - File not found
NetSvcs: Sacsvr - C:\WINDOWS\system32\sacsvr.dll (Microsoft Corporation)
NetSvcs: TrkSvr - C:\WINDOWS\system32\trksvr.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: WmdmPmSNdkjgdnu - File not found
NetSvcs: asolf - File not found
SystemRestore not available.

========== Files/Folders - Created Within 90 Days ==========

[2010/09/03 10:08:20 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\prasannaa\Desktop\OTL.exe
[2010/08/21 14:19:58 | 000,000,000 | -HSD | C] – C:\Documents and Settings\prasannaa\PrivacIE
[2010/08/18 13:39:05 | 000,000,000 | -HSD | C] – C:\Documents and Settings\prasannaa\IETldCache
[2010/08/18 13:25:38 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2010/08/18 13:22:50 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/08/17 09:40:57 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\Microsoft Help
[2010/08/12 23:25:41 | 000,000,000 | —D | C] – C:\Program Files\PureSync
[2010/08/12 23:25:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Jumping Bytes
[2010/08/12 23:25:07 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Jumping Bytes
[2010/08/07 10:15:52 | 000,066,600 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mferkdet.sys
[2010/08/07 10:15:51 | 000,070,728 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\mfevtps.exe
[2010/08/07 09:33:19 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\McAfee
[2010/08/03 07:25:28 | 000,000,000 | —D | C] – C:\Program Files\MSN Messenger
[2010/07/30 15:24:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Youdao
[2010/07/30 15:23:30 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\Yodao
[2010/07/30 15:22:53 | 000,000,000 | —D | C] – C:\Program Files\Youdao
[2010/07/30 09:36:11 | 000,000,000 | –SD | C] – C:\Documents and Settings\prasannaa\My Documents\My Shapes
[2010/07/29 17:13:37 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Deterministic Networks
[2010/07/29 17:00:49 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\imonagent
[2010/07/29 16:03:06 | 000,000,000 | —D | C] – C:\Program Files\Digital Line Detect
[2010/07/28 22:56:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ipmi
[2010/07/28 22:56:29 | 000,000,000 | —D | C] – C:\WINDOWS\adam
[2010/07/28 22:56:12 | 000,043,520 | —- | C] (Adaptec, Inc.) – C:\WINDOWS\System32\drivers\arc.sys
[2010/07/28 22:56:04 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en
[2010/07/28 22:56:04 | 000,000,000 | —D | C] – C:\WINDOWS\adfs
[2010/07/28 22:55:58 | 000,000,000 | —D | C] – C:\Program Files\cmak
[2010/07/28 22:51:47 | 000,000,000 | —D | C] – C:\WINDOWS\ServicePackFiles
[2010/07/28 22:43:02 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstall$
[2010/07/28 22:42:35 | 000,000,000 | —D | C] – C:\WINDOWS\PolicyBackup
[2010/07/27 14:03:33 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Malwarebytes
[2010/07/27 14:03:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/27 14:03:04 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/25 22:50:08 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\My Documents\Simply Super Software
[2010/07/24 17:29:39 | 000,000,000 | —D | C] – C:\Autoruns
[2010/07/24 10:49:39 | 000,000,000 | —D | C] – C:\WINDOWS\ie7updates
[2010/07/23 23:58:18 | 000,000,000 | —D | C] – C:\WINDOWS\pss
[2010/07/23 16:51:01 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Tracing
[2010/07/22 16:26:11 | 000,000,000 | —D | C] – C:\Program Files\IPMsg
[2010/07/22 16:13:23 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\My Documents\Downloads
[2010/07/22 16:11:50 | 000,070,992 | —- | C] (TENCENT) – C:\WINDOWS\System32\ImageOle.dll
[2010/07/22 16:11:50 | 000,000,000 | —D | C] – C:\Program Files\feiq
[2010/07/22 16:09:34 | 003,305,472 | —- | C] (卢本陶) – C:\Documents and Settings\prasannaa\Desktop\FeiQ.exe
[2010/07/20 19:48:14 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Sun
[2010/07/20 07:13:33 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\Mozilla
[2010/07/20 07:13:33 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Mozilla
[2010/07/19 08:14:12 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\My Documents\Bluetooth
[2010/07/16 01:15:06 | 000,000,000 | —D | C] – C:\Program Files\NetWatcherPro
[2010/07/16 01:15:06 | 000,000,000 | —D | C] – C:\Program Files\AdminStudio
[2010/07/16 00:54:25 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\My Documents\OneNote Notebooks
[2010/07/16 00:03:26 | 000,000,000 | —D | C] – C:\OBEO
[2010/07/16 00:02:30 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Subversion
[2010/07/16 00:00:20 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\Toshiba
[2010/07/16 00:00:18 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\ATI
[2010/07/16 00:00:18 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\ATI
[2010/07/16 00:00:16 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\TSVNCache
[2010/07/16 00:00:11 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Identities
[2010/07/15 23:59:06 | 000,000,000 | –SD | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\Microsoft
[2010/07/15 23:59:06 | 000,000,000 | –SD | C] – C:\Documents and Settings\prasannaa\Application Data\Microsoft
[2010/07/15 23:59:06 | 000,000,000 | RH-D | C] – C:\Documents and Settings\prasannaa\SendTo
[2010/07/15 23:59:06 | 000,000,000 | RH-D | C] – C:\Documents and Settings\prasannaa\Recent
[2010/07/15 23:59:06 | 000,000,000 | RH-D | C] – C:\Documents and Settings\prasannaa\Application Data
[2010/07/15 23:59:06 | 000,000,000 | R–D | C] – C:\Documents and Settings\prasannaa\Start Menu
[2010/07/15 23:59:06 | 000,000,000 | R–D | C] – C:\Documents and Settings\prasannaa\My Documents
[2010/07/15 23:59:06 | 000,000,000 | R–D | C] – C:\Documents and Settings\prasannaa\Favorites
[2010/07/15 23:59:06 | 000,000,000 | -HSD | C] – C:\Documents and Settings\prasannaa\Cookies
[2010/07/15 23:59:06 | 000,000,000 | -H-D | C] – C:\Documents and Settings\prasannaa\Templates
[2010/07/15 23:59:06 | 000,000,000 | -H-D | C] – C:\Documents and Settings\prasannaa\PrintHood
[2010/07/15 23:59:06 | 000,000,000 | -H-D | C] – C:\Documents and Settings\prasannaa\NetHood
[2010/07/15 23:59:06 | 000,000,000 | -H-D | C] – C:\Documents and Settings\prasannaa\Local Settings
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\Xobni
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\Temp
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\PLSQL Developer
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Macromedia
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Intel
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\Google
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Google
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Desktop
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\ApplicationHistory
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\AdobeUM
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Local Settings\Application Data\Adobe
[2010/07/15 23:59:06 | 000,000,000 | —D | C] – C:\Documents and Settings\prasannaa\Application Data\Adobe
[2010/07/15 22:25:44 | 000,000,000 | —D | C] – C:\bea
[2010/07/14 18:28:13 | 000,031,848 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mferkdk.sys
[2010/07/14 18:23:37 | 000,343,920 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfehidk.sys
[2010/07/14 18:23:37 | 000,091,832 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfeavfk.sys
[2010/07/14 18:23:37 | 000,075,704 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfeapfk.sys
[2010/07/14 18:23:37 | 000,064,208 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfetdik.sys
[2010/07/14 18:23:37 | 000,043,288 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfebopk.sys
[2010/07/14 18:23:25 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2010/07/14 18:04:26 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2010/07/14 18:03:45 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2010/07/14 18:01:44 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio 8
[2010/07/14 17:55:18 | 000,000,000 | —D | C] – C:\instVPN
[2010/06/22 19:42:26 | 000,019,264 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\obio32.dll
[2010/06/10 11:03:06 | 000,958,736 | —- | C] (Teebo Software Solutions, LLC) – C:\WINDOWS\System32\tssOfficeMenu1d.ocx
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/03 10:12:48 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\prasannaa\Desktop\OTL.exe
[2010/09/03 09:29:01 | 000,018,853 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\DDS.JPG
[2010/09/03 09:17:43 | 000,080,384 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\MBRCheck.exe
[2010/09/03 09:17:38 | 000,525,824 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\dds.pif
[2010/09/03 09:14:12 | 000,525,824 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\dds.scr
[2010/09/02 19:36:06 | 000,002,447 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
[2010/09/02 19:34:18 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/02 19:34:13 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/02 19:34:12 | 2145,509,376 | -HS- | M] () – C:\hiberfil.sys
[2010/09/02 19:34:08 | 136,552,448 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2010/09/02 19:11:33 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/02 14:38:37 | 000,002,433 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\VPN Client.lnk
[2010/09/02 09:25:10 | 000,040,960 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\text2pol.dll
[2010/09/02 09:25:09 | 000,200,762 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\mondll.dll
[2010/09/02 09:25:09 | 000,061,440 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\install_lsp.exe
[2010/09/02 09:25:09 | 000,032,768 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\imonrsrv.exe
[2010/09/02 09:25:09 | 000,025,600 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\ipsecutil.dll
[2010/09/02 09:25:08 | 000,114,688 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\Fport.exe
[2010/09/02 09:25:08 | 000,053,248 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\EnumDev.exe
[2010/09/02 09:25:08 | 000,049,152 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\anti_end.dll
[2010/09/02 09:25:08 | 000,024,576 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\EnumProcessPort.exe
[2010/09/02 09:25:08 | 000,024,576 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\Combine.exe
[2010/08/31 17:30:10 | 000,010,861 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\int_calc.xlsx
[2010/08/24 14:44:20 | 000,098,304 | —- | M] () – C:\WINDOWS\System32\drivers\imonagent\netconfig.dll
[2010/08/24 14:40:39 | 000,000,742 | —- | M] () – C:\Documents and Settings\prasannaa\Application Data\Microsoft\Internet Explorer\Quick Launch\Outlook - Prasanna.lnk
[2010/08/23 02:19:00 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/08/18 18:03:26 | 000,003,423 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/08/18 15:55:06 | 000,000,660 | —- | M] () – C:\WINDOWS\win.ini
[2010/08/18 13:39:10 | 000,000,815 | —- | M] () – C:\Documents and Settings\prasannaa\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/08/18 10:21:08 | 000,060,416 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\Drawing4.vsd
[2010/08/12 23:25:43 | 000,000,684 | —- | M] () – C:\Documents and Settings\All Users\Desktop\PureSync.lnk
[2010/08/12 22:09:58 | 000,267,008 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/12 20:40:18 | 000,546,728 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/08/12 20:40:18 | 000,108,360 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/08/12 20:40:17 | 000,646,880 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/11 16:54:37 | 000,711,005 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\Jilin Bank Data Migration Strategy Ver 1.0 draft 1_tr.docx
[2010/08/08 13:47:40 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/08/06 07:03:26 | 000,000,071 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\Stop Service.bat
[2010/08/06 07:02:34 | 000,000,146 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\Restart Service.bat
[2010/08/04 22:01:56 | 000,001,038 | —- | M] () – C:\WINDOWS\System32\SiteList.xml
[2010/08/03 00:30:27 | 000,000,655 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\PLSQL Developer.lnk
[2010/08/02 09:02:50 | 004,980,736 | -H– | M] () – C:\Documents and Settings\prasannaa\NTUSER.DAT
[2010/08/02 09:01:27 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\prasannaa\ntuser.ini
[2010/07/30 14:45:28 | 000,000,265 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\sqlnet.ora
[2010/07/30 14:28:09 | 000,001,204 | -H– | M] () – C:\Documents and Settings\prasannaa\My Documents\Default.rdp
[2010/07/29 17:14:47 | 000,001,594 | —- | M] () – C:\WINDOWS\VPNInstall.MIF
[2010/07/29 16:03:06 | 000,000,493 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
[2010/07/28 23:43:41 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2010/07/28 22:58:44 | 000,001,367 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Security Configuration Wizard.lnk
[2010/07/28 22:48:01 | 000,297,072 | RHS- | M] () – C:\ntldr
[2010/07/27 21:19:42 | 000,001,594 | —- | M] () – C:\WINDOWS\VPNUnInstall.MIF
[2010/07/25 22:54:39 | 007,472,694 | -H– | M] () – C:\Documents and Settings\prasannaa\Local Settings\Application Data\IconCache.db
[2010/07/25 03:07:37 | 000,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1202660629-796845957-1801674531-89941UA.job
[2010/07/25 03:07:37 | 000,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1202660629-796845957-1801674531-89941Core.job
[2010/07/25 03:07:37 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/25 03:07:37 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/24 13:43:36 | 000,002,316 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\Google Chrome.lnk
[2010/07/24 13:43:36 | 000,002,294 | —- | M] () – C:\Documents and Settings\prasannaa\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/22 16:11:50 | 000,070,992 | —- | M] (TENCENT) – C:\WINDOWS\System32\ImageOle.dll
[2010/07/19 13:20:53 | 000,001,058 | —- | M] () – C:\WINDOWS\ODBC.INI
[2010/07/19 08:13:31 | 000,000,715 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk
[2010/07/16 01:05:55 | 000,028,840 | RHS- | M] () – C:\Documents and Settings\All Users\ntuser.pol
[2010/07/16 00:54:24 | 000,000,805 | —- | M] () – C:\Documents and Settings\prasannaa\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2010/07/16 00:23:35 | 000,000,646 | —- | M] () – C:\Documents and Settings\prasannaa\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2010/07/16 00:22:25 | 000,000,742 | —- | M] () – C:\Documents and Settings\prasannaa\Desktop\Outlook - Prasanna.lnk
[2010/07/16 00:16:49 | 000,001,612 | —- | M] () – C:\Documents and Settings\All Users\Desktop\New Outlook Profile - Beehive.lnk
[2010/07/16 00:00:19 | 000,068,456 | —- | M] () – C:\Documents and Settings\prasannaa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/07/16 00:00:17 | 000,000,132 | —- | M] () – C:\Documents and Settings\prasannaa\Local Settings\Application Data\fusioncache.dat
[2010/07/15 19:02:14 | 000,000,063 | —- | M] () – C:\WINDOWS\vbaddin.ini
[2010/06/22 19:42:26 | 000,019,264 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\obio32.dll
[2010/06/10 11:03:06 | 000,958,736 | —- | M] (Teebo Software Solutions, LLC) – C:\WINDOWS\System32\tssOfficeMenu1d.ocx
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/03 09:29:01 | 000,018,853 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\DDS.JPG
[2010/09/03 09:17:11 | 000,080,384 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\MBRCheck.exe
[2010/09/02 13:55:17 | 000,525,824 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\dds.pif
[2010/09/02 13:54:26 | 000,525,824 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\dds.scr
[2010/08/31 17:12:50 | 000,010,861 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\int_calc.xlsx
[2010/08/24 14:44:20 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\netconfig.dll
[2010/08/24 14:40:39 | 000,000,742 | —- | C] () – C:\Documents and Settings\prasannaa\Application Data\Microsoft\Internet Explorer\Quick Launch\Outlook - Prasanna.lnk
[2010/08/18 10:21:06 | 000,060,416 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\Drawing4.vsd
[2010/08/12 23:25:43 | 000,000,684 | —- | C] () – C:\Documents and Settings\All Users\Desktop\PureSync.lnk
[2010/08/11 16:57:04 | 000,711,005 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\Jilin Bank Data Migration Strategy Ver 1.0 draft 1_tr.docx
[2010/08/07 09:15:45 | 000,002,433 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\VPN Client.lnk
[2010/08/06 07:01:37 | 000,000,146 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\Restart Service.bat
[2010/08/06 07:00:23 | 000,000,071 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\Stop Service.bat
[2010/08/03 00:30:27 | 000,000,655 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\PLSQL Developer.lnk
[2010/07/29 17:13:39 | 000,002,447 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
[2010/07/29 17:00:51 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\netconfig__.dll
[2010/07/29 17:00:51 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\text2pol.dll
[2010/07/29 17:00:51 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\ProcGuard.exe
[2010/07/29 17:00:50 | 000,200,762 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\mondll.dll
[2010/07/29 17:00:50 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\install_lsp.exe
[2010/07/29 17:00:50 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\imonrsrv.exe
[2010/07/29 17:00:50 | 000,025,600 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\ipsecutil.dll
[2010/07/29 17:00:49 | 004,420,798 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\client.exe
[2010/07/29 17:00:49 | 000,114,688 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\Fport.exe
[2010/07/29 17:00:49 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\EnumDev.exe
[2010/07/29 17:00:49 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\anti_end.dll
[2010/07/29 17:00:49 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\EnumProcessPort.exe
[2010/07/29 17:00:49 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\drivers\imonagent\Combine.exe
[2010/07/29 16:03:06 | 000,000,493 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
[2010/07/28 22:58:44 | 000,001,367 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Security Configuration Wizard.lnk
[2010/07/28 22:56:05 | 001,041,920 | —- | C] () – C:\WINDOWS\adfs.msp
[2010/07/28 22:55:57 | 001,158,818 | —- | C] () – C:\WINDOWS\System32\korwbrkr.lex
[2010/07/28 22:55:57 | 001,158,818 | —- | C] () – C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2010/07/25 03:07:33 | 2145,509,376 | -HS- | C] () – C:\hiberfil.sys
[2010/07/24 13:43:36 | 000,002,316 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\Google Chrome.lnk
[2010/07/24 13:43:36 | 000,002,294 | —- | C] () – C:\Documents and Settings\prasannaa\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/23 23:28:12 | 000,000,994 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1202660629-796845957-1801674531-89941UA.job
[2010/07/23 23:28:11 | 000,000,942 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1202660629-796845957-1801674531-89941Core.job
[2010/07/16 00:54:24 | 000,000,805 | —- | C] () – C:\Documents and Settings\prasannaa\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2010/07/16 00:23:35 | 000,000,646 | —- | C] () – C:\Documents and Settings\prasannaa\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2010/07/16 00:21:59 | 000,000,742 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\Outlook - Prasanna.lnk
[2010/07/16 00:16:49 | 000,001,612 | —- | C] () – C:\Documents and Settings\All Users\Desktop\New Outlook Profile - Beehive.lnk
[2010/07/16 00:07:22 | 000,001,204 | -H– | C] () – C:\Documents and Settings\prasannaa\My Documents\Default.rdp
[2010/07/16 00:00:17 | 000,000,132 | —- | C] () – C:\Documents and Settings\prasannaa\Local Settings\Application Data\fusioncache.dat
[2010/07/16 00:00:14 | 000,000,815 | —- | C] () – C:\Documents and Settings\prasannaa\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/07/15 23:59:56 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\prasannaa\ntuser.ini
[2010/07/15 23:59:54 | 000,036,056 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\New batch category named Consistency Checker.pdf
[2010/07/15 23:59:54 | 000,000,327 | —- | C] () – C:\Documents and Settings\prasannaa\Application Data\PrimoPDFSet.xml
[2010/07/15 23:59:06 | 004,980,736 | -H– | C] () – C:\Documents and Settings\prasannaa\NTUSER.DAT
[2010/07/15 23:59:06 | 000,117,047 | —- | C] () – C:\Documents and Settings\prasannaa\My Documents\Final versions of the updated Drop 4 RS - For sign off.pdf
[2010/07/15 23:59:06 | 000,067,484 | —- | C] () – C:\Documents and Settings\prasannaa\My Documents\ES&T; Signoff.pdf
[2010/07/15 23:59:06 | 000,063,923 | —- | C] () – C:\Documents and Settings\prasannaa\My Documents\reports_rptserver.pdf
[2010/07/15 23:59:06 | 000,036,056 | —- | C] () – C:\Documents and Settings\prasannaa\My Documents\New batch category named Consistency Checker.pdf
[2010/07/15 23:59:06 | 000,036,056 | —- | C] () – C:\Documents and Settings\prasannaa\My Documents\Consistency Checker_Scope_Drop3.pdf
[2010/07/15 23:59:06 | 000,028,672 | -H– | C] () – C:\Documents and Settings\prasannaa\NTUSER.DAT.LOG
[2010/07/15 23:59:06 | 000,000,000 | —- | C] () – C:\Documents and Settings\prasannaa\Sti_Trace.log
[2010/07/15 23:54:25 | 000,973,302 | —- | C] () – C:\WINDOWS\Desktop.bmp
[2010/07/15 23:54:24 | 002,585,142 | —- | C] () – C:\WINDOWS\System32\OracleLogo.bmp
[2010/07/15 23:54:24 | 002,585,142 | —- | C] () – C:\WINDOWS\OracleLogo.bmp
[2010/07/15 21:36:49 | 000,000,265 | —- | C] () – C:\Documents and Settings\prasannaa\Desktop\sqlnet.ora
[2010/07/14 20:49:28 | 000,001,038 | —- | C] () – C:\WINDOWS\System32\SiteList.xml
[2009/12/08 02:30:04 | 000,000,098 | —- | C] () – C:\WINDOWS\WirelessFTP.INI
[2009/10/30 21:15:43 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\text2pol.dll
[2009/10/30 21:15:43 | 000,025,600 | —- | C] () – C:\WINDOWS\System32\ipsecutil.dll
[2009/09/29 01:35:27 | 000,133,120 | —- | C] () – C:\WINDOWS\presys64.dll
[2009/09/29 01:35:26 | 000,131,072 | —- | C] () – C:\WINDOWS\mdiwindb.dll
[2009/09/29 01:34:58 | 000,002,430 | —- | C] () – C:\WINDOWS\memsetk.dll
[2009/09/29 01:34:58 | 000,000,000 | —- | C] () – C:\WINDOWS\sntlevel.dll
[2009/09/29 01:34:58 | 000,000,000 | —- | C] () – C:\WINDOWS\javcorbin.dll
[2009/09/29 01:34:58 | 000,000,000 | —- | C] () – C:\WINDOWS\javcorain.dll
[2009/09/18 00:39:41 | 000,000,000 | —- | C] () – C:\WINDOWS\tosOBEX.INI
[2009/09/09 03:11:38 | 000,000,141 | —- | C] () – C:\WINDOWS\iridium.ini
[2009/08/22 00:08:40 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2009/04/27 22:01:58 | 000,036,363 | —- | C] () – C:\WINDOWS\CSTBox.INI
[2009/04/27 12:13:36 | 000,000,314 | —- | C] () – C:\WINDOWS\primopdf.ini
[2008/09/19 17:38:25 | 000,000,408 | —- | C] () – C:\WINDOWS\System32\cardmann.ini
[2008/08/29 13:58:26 | 000,197,408 | —- | C] () – C:\WINDOWS\System32\vpnapi.dll
[2008/06/10 00:18:24 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2008/05/10 23:43:41 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\00048cd8.sys
[2008/05/03 21:16:35 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\0004a9b0.sys
[2008/04/21 06:45:38 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/04/18 18:37:56 | 000,001,052 | —- | C] () – C:\WINDOWS\System32\remote.dll
[2008/04/14 04:19:46 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\0005db9f.sys
[2008/04/12 01:30:19 | 000,000,058 | —- | C] () – C:\WINDOWS\System32\User.ini
[2008/04/01 20:20:44 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\0005ebb2.sys
[2008/04/01 20:20:40 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\00054f9e.sys
[2008/03/24 01:38:51 | 000,000,032 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2008/03/08 01:28:11 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\cuteshell.dll
[2008/02/15 19:58:34 | 000,378,880 | —- | C] () – C:\WINDOWS\System32\KXauth.dll
[2008/02/15 18:28:40 | 000,000,280 | —- | C] () – C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2008/02/06 20:33:48 | 000,020,575 | —- | C] () – C:\WINDOWS\System32\Sgegina040C.Dll
[2008/02/06 20:33:44 | 000,020,575 | —- | C] () – C:\WINDOWS\System32\SgeGina0407.Dll
[2007/08/16 20:33:38 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\loaddlln.dll
[2007/04/19 19:40:09 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2007/04/17 00:28:52 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2007/04/12 19:36:40 | 000,835,584 | —- | C] () – C:\WINDOWS\System32\sgsamn.dll
[2007/04/12 19:35:16 | 000,409,600 | —- | C] () – C:\WINDOWS\System32\sgutimn.dll
[2007/04/12 19:35:06 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\a11layn.dll
[2007/04/05 04:20:32 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\FPCALL.dll
[2007/04/05 04:14:37 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\SynTPCoI.dll
[2007/03/16 18:20:17 | 006,340,608 | —- | C] () – C:\WINDOWS\System32\cricu20.dll
[2007/03/12 22:36:18 | 000,050,666 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2007/03/12 22:36:18 | 000,010,793 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2007/03/12 22:36:17 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2007/03/12 19:39:39 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\omnithread_rt.dll
[2007/03/11 12:31:02 | 000,000,199 | —- | C] () – C:\WINDOWS\mdm.ini
[2007/03/11 11:55:09 | 000,001,058 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/11/27 22:11:46 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\uswerrln.dll
[2006/10/06 11:30:05 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\tphklock.dll
[2006/10/06 11:30:04 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\notifyf2.dll
[2005/09/02 21:44:08 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\TosBtAcc.dll
[2005/07/23 04:30:20 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\TosCommAPI.dll
[2005/03/31 19:27:18 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\SGCleanLocalGPO.dll
[2005/03/25 04:44:26 | 000,179,577 | —- | C] () – C:\WINDOWS\System32\schema.ini
[2005/01/21 14:32:28 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\RMDevice.dll
[2004/07/21 00:04:02 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\TosBtHcrpAPI.dll
[2004/06/02 16:24:42 | 000,131,072 | —- | C] () – C:\WINDOWS\System32\cmapiin.dll
[2004/06/01 23:40:08 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\gscripln.dll
[2004/06/01 23:39:16 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\ssgdefn.dll
[2004/06/01 23:39:14 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\ssgdlln.dll
[2004/06/01 23:38:14 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\srcrspn.dll
[2004/06/01 23:38:12 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\asc1layn.dll
[2004/06/01 23:38:10 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\srcxcln.dll
[2004/06/01 23:38:06 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\srcrdrcn.dll
[2004/06/01 23:38:02 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\srcbasen.dll
[2004/06/01 23:38:00 | 000,163,840 | —- | C] () – C:\WINDOWS\System32\gsrcn.dll
[2004/06/01 23:37:58 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\srcrdrhn.dll
[2004/06/01 23:37:56 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\grsan.dll
[2004/06/01 23:37:52 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\gdesn.dll
[2004/06/01 23:37:50 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\gslbasen.dll
[2004/06/01 23:37:46 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\crppcltn.dll
[2004/06/01 23:37:38 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\crpcscn.dll
[2004/06/01 23:37:24 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\craservn.dll
[2004/06/01 23:37:12 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\cmbase2n.dll
[2004/06/01 23:37:06 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\cmbasen.dll
[2004/01/15 21:43:28 | 000,114,688 | —- | C] () – C:\WINDOWS\System32\TBTMonUI.dll
[2003/03/26 01:30:00 | 000,024,819 | —- | C] () – C:\WINDOWS\System32\ntdsctrs.ini
[2003/03/26 01:30:00 | 000,020,386 | —- | C] () – C:\WINDOWS\System32\ntfrsrep.ini
[2003/03/26 01:30:00 | 000,011,817 | —- | C] () – C:\WINDOWS\System32\iasperf.ini
[2003/03/26 01:30:00 | 000,011,030 | —- | C] () – C:\WINDOWS\System32\ipsecprf.ini
[2003/03/26 01:30:00 | 000,005,597 | —- | C] () – C:\WINDOWS\System32\ntfrscon.ini
[1999/11/30 00:00:46 | 000,082,944 | —- | C] () – C:\WINDOWS\System32\cmasn0n.dll
[1999/11/29 23:16:12 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\cmoss0n.dll
[1998/04/24 02:30:00 | 000,000,218 | —- | C] () – C:\WINDOWS\FRONTPG.INI

========== LOP Check ==========

[2010/07/19 13:25:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Aventail
[2008/04/14 01:49:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
[2008/02/15 19:51:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IBM
[2008/02/15 18:28:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Network Associates
[2009/12/15 23:55:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PassMark
[2008/10/26 05:15:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/03/06 22:48:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2009/10/30 19:16:26 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\SysDir
[2009/10/30 18:27:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SysDll
[2010/07/25 23:14:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/03/11 13:35:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2010/07/30 15:24:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Youdao
[2009/09/24 17:40:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/09/24 17:28:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/08/12 23:25:07 | 000,000,000 | —D | M] – C:\Documents and Settings\prasannaa\Application Data\Jumping Bytes
[2010/08/11 11:10:31 | 000,000,000 | —D | M] – C:\Documents and Settings\prasannaa\Application Data\PLSQL Developer
[2010/07/16 00:02:30 | 000,000,000 | —D | M] – C:\Documents and Settings\prasannaa\Application Data\Subversion
[2010/08/23 02:19:00 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/08/02 09:01:37 | 000,032,522 | —- | M] () – C:\WINDOWS\Tasks\SchedLgU.Txt

========== Purity Check ==========



========== Custom Scans ==========


< %systemroot%\system32\drivers\*.sys /90 >
[2010/06/25 00:28:46 | 000,377,344 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\srv.sys

< %SYSTEMDRIVE%\*.exe >
[2007/02/18 00:31:38 | 000,094,720 | —- | M] (Microsoft Corporation) – C:\msizap.exe

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 04:31:44 | 000,348,160 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2008/02/06 20:34:22 | 000,019,712 | —- | M] (Utimaco Safeware AG) Unable to obtain MD5 – C:\WINDOWS\system32\drivers\AES128.sys
[2008/02/06 20:34:20 | 000,019,712 | —- | M] (Utimaco Safeware AG) Unable to obtain MD5 – C:\WINDOWS\system32\drivers\AES256.sys
[2008/02/06 20:34:30 | 000,016,640 | —- | M] (Utimaco Safeware AG) Unable to obtain MD5 – C:\WINDOWS\system32\drivers\TRIDES.sys

< %systemroot%\System32\config\*.sav >
[2007/03/11 05:59:42 | 000,090,112 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2007/03/11 05:59:42 | 000,741,376 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2007/03/11 05:59:42 | 000,503,808 | —- | M] () – C:\WINDOWS\system32\config\system.sav

========== Files - Unicode (All) ==========
[2010/07/30 15:23:33 | 000,000,736 | —- | M] ()(C:\Documents and Settings\All Users\Desktop\????.lnk) – C:\Documents and Settings\All Users\Desktop\有道词典.lnk
[2010/07/30 15:23:33 | 000,000,736 | —- | C] ()(C:\Documents and Settings\All Users\Desktop\????.lnk) – C:\Documents and Settings\All Users\Desktop\有道词典.lnk

========== Alternate Data Streams ==========

@Alternate Data Stream - 2880 bytes -> C:\WINDOWS\iflexwallpaper.bmp:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 2656 bytes -> C:\WINDOWS\System32\iflexlogo.bmp:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6724CB45
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
< End of report >

FROM Extras.txt,


OTL Extras logfile created on: 9/3/2010 10:37:43 AM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\prasannaa\Desktop
Windows Server 2003 Enterprise Edition Service Pack 2 (Version = 5.2.3790) - Type = NTServer
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free
14.00 Gb Paging File | 12.00 Gb Available in Paging File | 91.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.53 Gb Total Space | 4.45 Gb Free Space | 22.76% Space Free | Partition Type: NTFS
Drive D: | 73.62 Gb Total Space | 50.82 Gb Free Space | 69.03% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: IFLEXLAPDLBP1S
Current User Name: PrasannaA
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.js [@ = JSFile] – C:\WINDOWS\System32\CScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] – C:\WINDOWS\System32\CScript.exe (Microsoft Corporation)
.vbe [@ = VBEFile] – C:\WINDOWS\System32\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] – C:\WINDOWS\System32\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] – C:\WINDOWS\System32\CScript.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "D:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "D:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
jsfile [open] – %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] – %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
vbefile [open] – %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] – %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] – %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – D:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EAM Standard\IMonitorSrv.exe" = C:\Program Files\EAM Standard\IMonitorSrv.exe:*:Enabled:IMonitor EAM Service – File not found
"C:\Program Files\EAM Standard\IMonitorMng.exe" = C:\Program Files\EAM Standard\IMonitorMng.exe:*:Enabled:IMonitor EAM – File not found
"C:\Program Files\EAM Standard\RDesk.exe" = C:\Program Files\EAM Standard\RDesk.exe:*:Enabled:Remote Desktop Viewer – File not found
"C:\WINDOWS\system32\drivers\imonagent\service.exe" = C:\WINDOWS\system32\drivers\imonagent\service.exe:*:Enabled:Windows service provider – File not found
"C:\WINDOWS\system32\drivers\IMONAG~1\service.exe" = C:\WINDOWS\system32\drivers\IMONAG~1\service.exe:*:Enabled:Windows service provider – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00FC3F65-86EB-475E-881F-A5B1CF731320}" = McAfee SiteAdvisor Enterprise Plus
"{0A649E72-DB35-4C54-968E-CECAECA7E293}" = OZ776 SCR CardBus V1.1.3.6
"{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}" = McAfee VirusScan Enterprise
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{2AEBE10C-D819-4EBF-BC60-03BF2327D340}" = Microsoft XML Parser and SDK
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{32DC7F09-9F80-49A3-B7A1-DA408535F11C}" = Quest Central for DB2 v4.8
"{3DAB528E-AA54-4FDC-AD9D-824DBB54CFF0}" = VS7.1 CR Help Install
"{47A2A6D7-C198-4E57-A383-3D56315C53AD}" = ATI Catalyst Control Center
"{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}" = Cisco Systems VPN Client 5.0.04.0300
"{55146BAC-8A94-48AA-B107-BC5E7030A95E}" = SafeGuard® Easy Client 4.40.3
"{5C1FBBAF-14C8-4A23-A4A7-BCF19A979890}" = McAfee Agent
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{72806716-7088-41B2-8FA6-717A2A164DAB}" = ThinkVantage Active Protection System
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74BE4293-19ED-4FB6-9C0A-AB3F22896718}" = Netwatcher
"{77F5D72A-483E-49F2-BACD-98D94C10B674}" = PureSync
"{7E369B27-13E2-41A5-9879-358EE1C8B5AD}" = Broadcom Gigabit Integrated Controller
"{85DB9644-98DF-4A4B-B14F-1886BBDAE853}" = ceVS7Help
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{90120000-0054-0409-0000-0000000FF1CE}" = Microsoft Office Visio MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0000-0000-0000000FF1CE}" = Microsoft Office OneNote 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{903B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Project Professional 2003
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{97F81AF1-0E47-DC99-FF1F-C8B3B9A1E18E}" = Visual C++ 8.0 ATL (x86) WinSXS MSM
"{98CB24AD-52FB-DB5F-FF1F-C8B3B9A1E18E}" = Visual C++ 8.0 CRT (x86) WinSXS MSM
"{9C7FD031-24E1-4496-AE98-F1ACE869E81F}" = prerequisite
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A634A2AF-2495-4F36-B88F-0B24B84A183C}" = Oracle Beehive Extensions for Outlook
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABEB838C-A1A7-4C5D-B7E1-8B4314600820}" = MSN Messenger 7.0
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{AC76BA86-7AD7-5464-3428-7E8A450000A7}" = Spelling Dictionaries For Adobe Reader Package
"{BBD6BA59-4593-43CC-BBC8-8E53D354AEA4}" = Atmel TPM Driver Installer [removed]
"{BD1F16BE-7B1B-4C8B-9C37-C99724513225}" = TortoiseSVN 1.4.1.7992 (32 bit)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{E5BA0430-919F-46DD-B656-0796F8A5ADFF}" = Microsoft Office Communicator 2007
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{EA664480-3844-11D5-8C25-444553540000}" = TrackPoint Accessibility Features
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"Array SSL VPN8,3,1,231" = Array Networks SSL VPN Client 8,3,1,231 (Array Networks)
"ATI Display Driver" = ATI Display Driver
"Cisco VPN Client 5.0.04.0300" = Cisco VPN Client 5.0.04.0300
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV;_2BFA&SUBSYS;_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"GENEUIDE" = USB Storage Driver
"GTK 2.0" = GTK+ Runtime 2.12.1 rev b (remove only)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{0A649E72-DB35-4C54-968E-CECAECA7E293}" = OZ776 SCR CardBus V1.1.3.6
"McAfee Anti-Spyware Enterprise Module" = McAfee AntiSpyware Enterprise Module
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.2)" = Mozilla Firefox (3.6.2)
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"ONENOTE" = Microsoft Office OneNote 2007
"Oracle Beehive for Outlook" = Oracle Beehive for Outlook
"Oracle WebLogic" = Oracle WebLogic
"PL/SQL Developer [80687275]" = PL/SQL Developer
"Power Management Driver" = ThinkPad Power Management Driver
"PrimoPDF" = PrimoPDF – brought to you by Nitro PDF Software
"ProInst" = Intel® PROSet/Wireless Software
"PROPLUS" = Microsoft Office Professional Plus 2007
"PROSet" = Intel® PRO Network Connections Drivers
"PureSync" = PureSync 2.6.10
"SynTPDeinstKey" = ThinkPad UltraNav Driver
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"VISPRO" = Microsoft Office Visio Professional 2007
"WebPost" = Microsoft Web Publishing Wizard 1.53
"WIC" = Windows Imaging Component
"Windows Server 2003 Service Pack" = Windows Server 2003 Service Pack 2
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"有道词典" = 有道词典

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/2/2010 7:34:48 AM | Computer Name = IFLEXLAPDLBP1S | Source = UserInit | ID = 1000
Description = Could not execute the following script ScreenSaver.bat. The system
cannot find the file specified. .

Error - 9/2/2010 7:35:13 AM | Computer Name = IFLEXLAPDLBP1S | Source = Userenv | ID = 1053
Description = Windows cannot determine the user or computer name. (The specified
domain either does not exist or could not be contacted. ). Group Policy processing
aborted.

Error - 9/2/2010 9:17:51 AM | Computer Name = IFLEXLAPDLBP1S | Source = Userenv | ID = 1053
Description = Windows cannot determine the user or computer name. (The specified
domain either does not exist or could not be contacted. ). Group Policy processing
aborted.

Error - 9/2/2010 9:28:18 AM | Computer Name = IFLEXLAPDLBP1S | Source = Userenv | ID = 1053
Description = Windows cannot determine the user or computer name. (The specified
domain either does not exist or could not be contacted. ). Group Policy processing
aborted.

Error - 9/2/2010 9:34:57 AM | Computer Name = IFLEXLAPDLBP1S | Source = Application Error | ID = 1000
Description = Faulting application chrome.exe, version 0.0.0.0, faulting module
msvcrt.dll, version 7.0.3790.3959, fault address 0x00038bab.

Error - 9/2/2010 11:03:53 AM | Computer Name = IFLEXLAPDLBP1S | Source = Userenv | ID = 1053
Description = Windows cannot determine the user or computer name. (The specified
domain either does not exist or could not be contacted. ). Group Policy processing
aborted.

Error - 9/2/2010 11:26:19 AM | Computer Name = IFLEXLAPDLBP1S | Source = Userenv | ID = 1053
Description = Windows cannot determine the user or computer name. (The specified
domain either does not exist or could not be contacted. ). Group Policy processing
aborted.

Error - 9/2/2010 8:46:24 PM | Computer Name = IFLEXLAPDLBP1S | Source = Userenv | ID = 1053
Description = Windows cannot determine the user or computer name. (The specified
domain either does not exist or could not be contacted. ). Group Policy processing
aborted.

Error - 9/2/2010 8:46:24 PM | Computer Name = IFLEXLAPDLBP1S | Source = Userenv | ID = 1053
Description = Windows cannot determine the user or computer name. (The specified
domain either does not exist or could not be contacted. ). Group Policy processing
aborted.

Error - 9/2/2010 10:24:26 PM | Computer Name = IFLEXLAPDLBP1S | Source = Userenv | ID = 1053
Description = Windows cannot determine the user or computer name. (The specified
domain either does not exist or could not be contacted. ). Group Policy processing
aborted.

[ OSession Events ]
Error - 8/5/2010 4:47:05 AM | Computer Name = IFLEXLAPDLBP1S | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1036
seconds with 420 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 9/2/2010 7:36:10 AM | Computer Name = IFLEXLAPDLBP1S | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service WksCfgSrv with
arguments "-Service" in order to run the server: {741B05B6-16B9-4F99-9EA2-7617FB419BCC}

Error - 9/2/2010 7:36:22 AM | Computer Name = IFLEXLAPDLBP1S | Source = Service Control Manager | ID = 7000
Description = The DNS Client service failed to start due to the following error:
%%1079

Error - 9/2/2010 7:36:22 AM | Computer Name = IFLEXLAPDLBP1S | Source = Service Control Manager | ID = 7001
Description = The GSL Service service depends on the PC/SC Proxy Service service
which failed to start because of the following error: %%1058

Error - 9/2/2010 7:36:22 AM | Computer Name = IFLEXLAPDLBP1S | Source = Service Control Manager | ID = 7023
Description = The Servers service terminated with the following error: %%193

Error - 9/2/2010 7:38:35 AM | Computer Name = IFLEXLAPDLBP1S | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
TPHKDRV

Error - 9/2/2010 8:25:35 AM | Computer Name = IFLEXLAPDLBP1S | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 9/2/2010 9:31:15 AM | Computer Name = IFLEXLAPDLBP1S | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 30 minutes. NtpClient has no source of accurate
time.

Error - 9/2/2010 12:17:10 PM | Computer Name = IFLEXLAPDLBP1S | Source = NETLOGON | ID = 5719
Description = This computer was not able to set up a secure session with a domain
controller
in domain I-FLEX due to the following: %%1311 This may lead to authentication problems.
Make sure that this computer is connected to the network. If the problem persists,
please
contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller
for the specified domain, it sets up the secure session to the primary domain controller
emulator in the specified domain. Otherwise, this computer sets up the secure session
to any domain controller in the specified domain.

Error - 9/2/2010 8:46:32 PM | Computer Name = IFLEXLAPDLBP1S | Source = NETLOGON | ID = 5719
Description = This computer was not able to set up a secure session with a domain
controller
in domain I-FLEX due to the following: %%1311 This may lead to authentication problems.
Make sure that this computer is connected to the network. If the problem persists,
please
contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller
for the specified domain, it sets up the secure session to the primary domain controller
emulator in the specified domain. Otherwise, this computer sets up the secure session
to any domain controller in the specified domain.

Error - 9/2/2010 9:52:45 PM | Computer Name = IFLEXLAPDLBP1S | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.


< End of report >

Prazz:

In that case I'm willing to help you out as long as you are comfortable with the risks I pointed out in my last post.

🖼Click to load external image (Posted Image) Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :OTL
  SRV - (zvvmza) – C:\WINDOWS\System32\uyyfoc.dll File not found
  SRV - (vzpzui) – C:\WINDOWS\System32\hgqicf.dll File not found
  SRV - (TrkWkSer) – C:\WINDOWS\System32\edqesh.dll File not found
  SRV - (GrayPigeonSere) – C:\WINDOWS\G_So.exe File not found
  SRV - (appzqx) – C:\WINDOWS\System32\clgktl.dll File not found
  :Commands
  [ClearAllRestorePoints]
  [CreateRestorePoint]
  [EmptyFlash]
  [EmptyTemp]
  [Purity]

• Then click the Run Fix button at the top
• Let the program run unhindered, it will reboot when it is done and produce a log

🖼Click to load external image (Posted Image) Go to My Computer-> Tools-> Folder Options-> View tab:

• Under the Hidden files and folders heading:
• Select - Show hidden files and folders.
• Uncheck- Hide protected operating system files (recommended) option.
• Also, make sure there is no checkmark beside Hide file extensions for known file types.
• Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
virscan.org
Virus Total

Click on Browse, and upload the following file for analysis:
C:\Documents and Settings\prasannaa\Desktop\FeiQ.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

🖼Click to load external image (Posted Image) Download TDSSKiller.zip and extract TDSSKiller.exe to your desktop

• Execute TDSSKiller.exe by doubleclicking on it.
• Press Start Scan
  
• If Malicious objects are found then ensure Cure is selected
• Then click Continue > Reboot now
  
• Once complete, a log will be produced at root. It will be named for example, TDSSKiller.2.4.0.0_24.07.2010_13.10.52_log.txt
• Attach that log, please.

Please include the following in your next post:

• OTL Fix log
• File Analysis results
• TDSSKiller log

Hi, Apologies for the delay in replying. Attached are the logs. TDSSKiller did not find any errors hence I did not get any logs for it. Thanks