Spyware / Malware / Virus Removal

possible virus 2nd pc

4 min read

Looking for the outcome? Ask AI

brokenhead Topic Starter

Post #1November 15, 2010, 1:00 AM UTC last edited November 15, 2010, 4:13 AM UTC

Hi, this log is from a 2nd computer, that had some strange system tray notice. Thanks

OTL logfile created on: 11/14/2010 7:42:51 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\MXC\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 567.00 Mb Available Physical Memory | 55.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 93.16 Gb Total Space | 3.01 Gb Free Space | 3.23% Space Free | Partition Type: NTFS
Drive D: | 1.86 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: MAU | User Name: MXC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\MXC\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Hotspot Shield\bin\openvpntray.exe ()
PRC - C:\Program Files\Hotspot Shield\bin\openvpnas.exe ()
PRC - C:\Program Files\Hotspot Shield\bin\hsswd.exe ()
PRC - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe (Juniper Networks)
PRC - C:\Documents and Settings\MXC\Application Data\Juniper Networks\Setup Client\JuniperSetupClient.exe (Juniper Networks)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - C:\Program Files\RapidSolution\Tunebite\Tunebite.exe (RapidSolution Software AG)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe (SRS Labs, Inc.)
PRC - C:\WINDOWS\system32\LGDMEBTN.exe (LG Electronics Inc.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
PRC - C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe (Dell)
PRC - C:\WINDOWS\system32\dlbxcoms.exe (Dell)
PRC - C:\WINDOWS\system32\brsvc01a.exe (brother Industries Ltd)
PRC - C:\WINDOWS\system32\brss01a.exe (brother Industries Ltd)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\MXC\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (HssTrayService) – C:\Program Files\Hotspot Shield\bin\HssTrayService.exe ()
SRV - (HotspotShieldService) – C:\Program Files\Hotspot Shield\bin\openvpnas.exe ()
SRV - (HssWd) – C:\Program Files\Hotspot Shield\bin\hsswd.exe ()
SRV - (HssSrv) – C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (dsNcService) – C:\Program Files\Juniper Networks\Common Files\dsNcService.exe (Juniper Networks)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (S24EventMonitor) – C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (SRS_PostInstaller) – C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe (SRS Labs, Inc.)
SRV - (IAANTMon) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
SRV - (dlbx_device) – C:\WINDOWS\System32\dlbxcoms.exe (Dell)
SRV - (Brother XP spl Service) – C:\WINDOWS\system32\brsvc01a.exe (brother Industries Ltd)

========== Driver Services (SafeList) ==========

DRV - (lgodd_filter) – C:\WINDOWS\System32\drivers\lgodd_filter.sys File not found
DRV - (taphss) – C:\WINDOWS\system32\drivers\taphss.sys (AnchorFree Inc)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (dsNcAdpt) – C:\WINDOWS\system32\drivers\dsNcAdpt.sys (Juniper Networks)
DRV - (NETw5x32) Intel® – C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (tbhsd) – C:\WINDOWS\system32\drivers\tbhsd.sys (RapidSolution Software AG)
DRV - (tapvpn) – C:\WINDOWS\system32\drivers\tapvpn.sys (The OpenVPN Project)
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (AnyDVD) – C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (ElbyCDIO) – C:\WINDOWS\system32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (NETw3x32) Intel® – C:\WINDOWS\system32\drivers\NETw3x32.sys (Intel® Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AGR1310_51) – C:\WINDOWS\system32\drivers\AGR1310_51.sys (Agere Systems)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (wowfilter) – C:\WINDOWS\system32\drivers\WOWFilter.sys ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500) – C:\WINDOWS\system32\drivers\ATSwpDrv.sys (AuthenTec, Inc.)
DRV - (lgsnd_filter) – C:\WINDOWS\system32\drivers\lgsnd_filter.sys ()
DRV - (w39n51) Intel® – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (IFXTPM) – C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (iaStor) – C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (LGDMEBTN) – C:\WINDOWS\system32\drivers\LGDMEBTN.sys (LG Electronics Inc.)
DRV - (Ndisipo) – C:\WINDOWS\system32\drivers\Ndisipo.sys (Windows ® 2000 DDK provider)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (BrSerIf) – C:\WINDOWS\system32\drivers\BrSerIf.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\WINDOWS\system32\drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrScnUsb) – C:\WINDOWS\system32\drivers\BrScnUsb.sys (Brother Industries Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ca.msn.com/?lang=en-ca
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.bing.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\..\URLSearchHook: CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/16 18:26:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/12 18:49:22 | 000,000,000 | —D | M]

[2008/07/17 01:47:26 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\Mozilla\Extensions
[2010/11/14 09:13:27 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\Mozilla\Firefox\Profiles\2j0wv06z.default\extensions
[2010/10/16 19:07:47 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/10/11 13:16:03 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 04:00:04 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/11/14 19:39:47 | 000,000,736 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1312.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll (AnchorFree Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1312.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe File not found
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [batterymiser] C:\Program Files\LG Software\Battery Miser\batterymiser.exe File not found
O4 - HKLM..\Run: [DLBXCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBXtime.DLL ()
O4 - HKLM..\Run: [dlbxmon.exe] C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe (Dell)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe File not found
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe File not found
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe File not found
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe File not found
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
O4 - HKLM..\Run: [KeybdUtility] C:\Program Files\LG Software\On Screen Display\HotKey.exe File not found
O4 - HKLM..\Run: [LG Direct Media Button Service] C:\WINDOWS\System32\LGDMEBTN.exe (LG Electronics Inc.)
O4 - HKLM..\Run: [LG Intelligent Update] C:\Program Files\lg_swupdate\autoupdate.exe File not found
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe File not found
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe File not found
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe File not found
O4 - HKCU..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [SRSTrayApp] C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRSTrayApp.exe File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [Tunebite] C:\Program Files\RapidSolution\Tunebite\Tunebite.exe (RapidSolution Software AG)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: MasterCook: Select Image - C:\Program Files\MasterCook 9\Web\MCIEContext.hta ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab (StagingUI Object)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} http://zone.msn.com/bingame/trix/default/T…nx.1.0.0.87.cab (CPlayFirstTriJinxControl Object)
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab (MSN Games – Buddy Invite)
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab (ZonePAChat Object)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} http://upload.facebook.com/controls/Facebo…toUploader3.cab (Facebook Photo Uploader 4 Control)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} http://zone.msn.com/bingame/amun/default/mjolauncher.cab (MJLauncherCtrl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab55579.cab (ZPA_HRTZ Object)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe (Virtools WebPlayer Class)
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} http://upload.facebook.com/controls/Facebo…Uploader4_5.cab (Facebook Photo Uploader 4)
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} http://zone.msn.com/binframework/v10/StProxy.cab55579.cab (MSN Games – Game Communicator)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/popcaploader_v10.cab (PopCapLoader Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://riskmetrics.webex.com/client/T26L/webex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://connect2.riskmetrics.com/dana-cache…SetupClient.cab (JuniperSetupClientControl Class)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/01/19 11:38:32 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.dvsd - C:\WINDOWS\System32\mcdvd_32.dll (MainConcept)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620634377289728)

========== Files/Folders - Created Within 30 Days ==========

[2010/11/14 19:41:46 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\MXC\Desktop\OTL.exe
[2010/11/02 19:13:02 | 000,032,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msonpmon.dll
[2010/11/02 19:10:25 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2010/11/02 19:09:26 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2010/11/02 19:09:25 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2010/11/02 19:08:21 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2010/11/02 19:06:47 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/11/02 19:02:16 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio 8
[2010/11/02 19:01:16 | 000,000,000 | —D | C] – C:\Documents and Settings\MXC\Local Settings\Application Data\Microsoft Help
[2010/11/02 19:01:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2010/10/29 21:31:58 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2010/10/20 21:02:33 | 000,000,000 | —D | C] – C:\Documents and Settings\MXC\My Documents\competitives 2010
[2010/10/16 19:08:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2010/10/16 19:08:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/10/16 19:08:09 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2010/10/16 17:37:58 | 008,534,336 | —- | C] (Mozilla) – C:\Documents and Settings\MXC\Desktop\Firefox Setup 3.6.10.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/14 19:41:49 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\MXC\Desktop\OTL.exe
[2010/11/14 19:37:16 | 000,001,162 | -H– | M] () – C:\Documents and Settings\MXC\My Documents\Default.rdp
[2010/11/14 19:17:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/14 14:52:58 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/11/14 11:52:10 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/14 00:17:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/12 19:03:33 | 000,444,596 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/11/12 19:03:33 | 000,072,306 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/11/12 18:59:08 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/11/12 18:59:05 | 1072,156,672 | -HS- | M] () – C:\hiberfil.sys
[2010/11/02 23:19:13 | 000,006,375 | —- | M] () – C:\Documents and Settings\MXC\Application Data\PrimoPDFSet.xml
[2010/11/02 19:21:15 | 001,556,592 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/01 21:38:59 | 000,079,093 | —- | M] () – C:\Documents and Settings\MXC\My Documents\Cuba Vacation December 11 - 19, 2010.pdf
[2010/11/01 21:21:33 | 006,843,342 | —- | M] () – C:\Documents and Settings\MXC\My Documents\msl_1010_pumpkin_carving_templates_02.psd
[2010/10/31 08:31:55 | 000,184,756 | —- | M] () – C:\Documents and Settings\MXC\My Documents\msl_1010_pumpkin_carving_templates_02.pdf
[2010/10/29 21:31:36 | 000,001,619 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2010/10/29 21:31:36 | 000,001,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2010/10/29 10:52:09 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/24 17:54:16 | 000,004,036 | —- | M] () – C:\Documents and Settings\MXC\My Documents\Vehicle Sticker Renewal 2011 Receipt.pdf
[2010/10/24 08:56:34 | 000,371,712 | —- | M] () – C:\Documents and Settings\MXC\Desktop\Bill Payment Tracking (MXC).xls
[2010/10/16 17:38:47 | 008,534,336 | —- | M] (Mozilla) – C:\Documents and Settings\MXC\Desktop\Firefox Setup 3.6.10.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/01 21:38:54 | 000,079,093 | —- | C] () – C:\Documents and Settings\MXC\My Documents\Cuba Vacation December 11 - 19, 2010.pdf
[2010/11/01 21:21:27 | 006,843,342 | —- | C] () – C:\Documents and Settings\MXC\My Documents\msl_1010_pumpkin_carving_templates_02.psd
[2010/10/31 08:31:55 | 000,184,756 | —- | C] () – C:\Documents and Settings\MXC\My Documents\msl_1010_pumpkin_carving_templates_02.pdf
[2010/10/24 17:54:14 | 000,004,036 | —- | C] () – C:\Documents and Settings\MXC\My Documents\Vehicle Sticker Renewal 2011 Receipt.pdf
[2010/10/16 19:08:09 | 000,001,619 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2010/10/16 19:08:09 | 000,001,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2009/09/21 10:16:45 | 002,463,976 | —- | C] () – C:\WINDOWS\System32\NPSWF32.dll
[2009/09/20 19:36:10 | 000,148,992 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/05/18 12:30:46 | 000,000,624 | —- | C] () – C:\WINDOWS\dellstat.ini
[2009/05/18 12:26:50 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\dlbxins.dll
[2009/05/18 12:26:50 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\dlbxinsr.dll
[2009/05/18 12:26:48 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\dlbxvs.dll
[2009/05/18 12:26:44 | 000,397,312 | —- | C] () – C:\WINDOWS\System32\dlbxutil.dll
[2009/05/18 12:26:44 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\dlbxcu.dll
[2009/05/18 12:26:44 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\dlbxcur.dll
[2009/05/18 12:26:42 | 000,176,128 | —- | C] () – C:\WINDOWS\System32\dlbxinsb.dll
[2009/05/18 12:26:41 | 000,135,168 | —- | C] () – C:\WINDOWS\System32\dlbxjswr.dll
[2009/05/18 12:26:41 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\dlbxcub.dll
[2008/05/28 23:24:05 | 000,006,592 | —- | C] () – C:\WINDOWS\gwpreset.ini
[2008/05/28 23:24:05 | 000,001,088 | —- | C] () – C:\WINDOWS\goldwave.ini
[2008/04/08 15:26:20 | 000,004,381 | —- | C] () – C:\Documents and Settings\MXC\Application Data\Cabos.plist
[2008/03/25 15:00:29 | 000,000,224 | —- | C] () – C:\Documents and Settings\MXC\Application Data\APUSet.xml
[2008/03/25 15:00:28 | 000,006,375 | —- | C] () – C:\Documents and Settings\MXC\Application Data\PrimoPDFSet.xml
[2008/03/25 14:03:12 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2008/02/15 14:08:26 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\f7129022-a000-4847-db07-470265a73c4f
[2008/01/13 09:44:22 | 000,010,247 | —- | C] () – C:\WINDOWS\lg_up.ini
[2007/11/11 21:15:18 | 000,001,617 | —- | C] () – C:\WINDOWS\ARCHPR.INI
[2007/10/13 18:40:55 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/09/12 19:33:33 | 000,717,296 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2007/09/03 22:06:00 | 000,000,600 | —- | C] () – C:\Documents and Settings\MXC\Local Settings\Application Data\PUTTY.RND
[2007/08/23 17:30:00 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2007/07/20 10:35:43 | 000,000,001 | —- | C] () – C:\Documents and Settings\MXC\Application Data\FrontEndCD.ini
[2007/07/20 08:30:36 | 000,126,464 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2007/05/06 18:05:01 | 000,038,473 | —- | C] () – C:\Documents and Settings\MXC\Application Data\Comma Separated Values (Windows).ADR
[2007/04/27 15:40:25 | 000,000,040 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2007/04/22 22:03:48 | 000,001,359 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/02/21 21:48:37 | 000,000,410 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2007/02/21 21:48:37 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\brss01a.ini
[2007/02/21 21:48:37 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2007/02/17 09:26:41 | 000,036,352 | —- | C] () – C:\Documents and Settings\MXC\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/02/07 15:43:38 | 000,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2007/02/07 13:06:12 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/02/07 11:34:03 | 000,000,130 | —- | C] () – C:\Documents and Settings\MXC\Local Settings\Application Data\fusioncache.dat
[2006/11/06 17:49:36 | 000,000,310 | —- | C] () – C:\WINDOWS\primopdf.ini
[2006/02/15 08:49:57 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/02/12 13:56:31 | 000,007,552 | —- | C] () – C:\WINDOWS\System32\drivers\lgsnd_filter.sys
[2006/02/11 00:15:22 | 000,000,992 | —- | C] () – C:\WINDOWS\lgcenter.ini
[2006/02/10 23:53:35 | 000,000,010 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/02/06 20:47:22 | 000,020,608 | —- | C] () – C:\WINDOWS\System32\drivers\WOWFilter.sys
[2006/02/06 20:47:20 | 000,036,352 | —- | C] () – C:\WINDOWS\System32\drivers\WOWXT_kern_i386.sys
[2006/02/06 20:47:18 | 000,031,232 | —- | C] () – C:\WINDOWS\System32\drivers\TSXT_kern_i386.sys
[2006/01/23 16:50:59 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/01/23 16:50:59 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/01/23 16:50:59 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/01/23 16:50:59 | 000,573,440 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/01/23 16:50:59 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/01/23 16:50:59 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/01/20 03:28:18 | 000,016,966 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/01/19 20:34:29 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI

========== LOP Check ==========

[2008/12/20 09:21:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\America's Army Deploy Client
[2007/12/09 12:38:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\eBay
[2008/07/29 20:43:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Graboid Inc
[2006/02/11 01:34:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Infineon
[2008/09/23 21:23:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Juniper Networks
[2008/04/13 21:27:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Laplink
[2008/07/30 13:05:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Launcher
[2007/04/29 20:51:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2007/02/27 21:57:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2007/04/20 21:39:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2008/06/03 21:49:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RapidSolution
[2009/12/17 20:23:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Rosetta Stone
[2008/04/13 21:34:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/04/25 15:29:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/20 16:05:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/30 16:24:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2008/04/14 08:41:15 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\Cabos
[2008/04/11 12:28:45 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\DAEMON Tools
[2007/07/22 18:42:52 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\GlobalSCAPE
[2006/02/11 01:34:38 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\Infineon
[2010/05/11 21:17:03 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\Juniper Networks
[2008/04/13 21:35:21 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\Laplink
[2008/04/08 15:11:32 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\Launchy
[2008/03/31 11:20:55 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\LimeWire
[2007/02/27 21:57:02 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\PlayFirst
[2008/06/03 22:05:40 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\RTPlayer
[2007/04/27 22:49:41 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\SlySoft
[2006/02/11 00:31:48 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\SRSCPL
[2010/11/12 18:51:38 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\Tunebite
[2010/11/02 18:53:49 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\uTorrent
[2008/09/10 06:05:15 | 000,000,000 | —D | M] – C:\Documents and Settings\MXC\Application Data\webex
[2007/02/20 20:52:33 | 000,000,110 | —- | M] () – C:\WINDOWS\Tasks\Critical Battery Alarm Program.job
[2007/02/20 20:52:33 | 000,000,110 | —- | M] () – C:\WINDOWS\Tasks\Low Battery Alarm Program.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/01/19 11:38:32 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2008/06/19 07:58:31 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2006/01/19 11:38:32 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/11/14 12:06:43 | 000,319,011 | —- | M] () – C:\dlbxscan.log
[2007/03/01 09:32:45 | 371,392,511 | —- | M] () – C:\DogWhispererSeason1Eps1-10.ISO
[2007/03/01 09:32:45 | 000,004,339 | —- | M] () – C:\DogWhispererSeason1Eps1-10.MDS
[2010/11/12 18:59:05 | 1072,156,672 | -HS- | M] () – C:\hiberfil.sys
[2007/12/09 12:23:10 | 000,000,418 | —- | M] () – C:\InstallHelper.log
[2006/01/19 11:38:32 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/03/03 19:30:54 | 000,009,768 | —- | M] () – C:\JavaRa.log
[2010/11/12 18:51:39 | 000,001,820 | —- | M] () – C:\Log.txt
[2006/01/19 11:38:32 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2006/02/12 13:48:47 | 000,250,048 | RHS- | M] () – C:\ntldr
[2007/03/01 11:09:04 | 3595,567,104 | —- | M] () – C:\NVE_DVD.ISO
[2007/03/01 11:09:04 | 000,004,320 | —- | M] () – C:\NVE_DVD.MDS
[2010/11/12 18:59:02 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2007/02/07 15:39:50 | 000,017,404 | —- | M] () – C:\PkgClnup.log
[2007/02/27 22:18:41 | 000,052,490 | —- | M] () – C:\playground.log
[2008/02/18 19:17:38 | 000,002,328 | —- | M] () – C:\rapport.txt
[2008/04/16 07:57:18 | 000,000,000 | —- | M] () – C:\RTBTrace.txt
[2007/09/13 08:00:56 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2007/09/15 18:30:42 | 000,000,268 | -H– | M] () – C:\sqmdata01.sqm
[2007/09/17 08:30:57 | 000,000,268 | -H– | M] () – C:\sqmdata02.sqm
[2008/02/15 09:03:04 | 000,000,268 | -H– | M] () – C:\sqmdata03.sqm
[2008/02/15 09:53:19 | 000,000,268 | -H– | M] () – C:\sqmdata04.sqm
[2008/02/18 13:58:15 | 000,000,268 | -H– | M] () – C:\sqmdata05.sqm
[2008/02/18 14:16:49 | 000,000,268 | -H– | M] () – C:\sqmdata06.sqm
[2008/02/18 16:45:51 | 000,000,268 | -H– | M] () – C:\sqmdata07.sqm
[2009/02/21 23:36:32 | 000,000,268 | -H– | M] () – C:\sqmdata08.sqm
[2009/03/18 06:16:02 | 000,000,232 | -H– | M] () – C:\sqmdata09.sqm
[2009/03/18 06:17:36 | 000,000,232 | -H– | M] () – C:\sqmdata10.sqm
[2009/04/23 21:57:34 | 000,000,268 | -H– | M] () – C:\sqmdata11.sqm
[2007/09/13 08:00:56 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2007/09/15 18:30:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2007/09/17 08:30:57 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2008/02/15 09:03:04 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2008/02/15 09:53:19 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2008/02/18 13:58:15 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2008/02/18 14:16:48 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2008/02/18 16:45:50 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2009/02/21 23:36:32 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2009/03/18 06:16:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2009/03/18 06:17:36 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2009/04/23 21:57:34 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2008/04/23 09:22:03 | 049,122,714 | —- | M] () – C:\xampplite.rar

< %systemroot%\Fonts\*.com >
[2006/06/29 13:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/01/19 11:38:10 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2004/02/09 00:00:00 | 000,026,285 | —- | M] (Brother Industries ,Ltd ) – C:\WINDOWS\system32\spool\prtprocs\w32x86\brmfpp1.dll
[2004/12/16 09:15:10 | 000,073,728 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\dlbxPP5C.DLL
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/04/04 21:01:40 | 000,272,896 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpcpp5r1.DLL
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 18:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/01/19 20:33:19 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/01/19 20:33:19 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/01/19 20:33:19 | 000,913,408 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >
[2008/02/04 21:20:18 | 000,000,000 | —D | M] – C:\Program Files\Adobe\Reader 8.0\Reader\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\ATI Technologies\ATI.ACE\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\Common Files\Adobe\Updater5\bak
[2008/02/04 21:20:18 | 000,000,000 | —D | M] – C:\Program Files\Common Files\Nero\Lib\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\CyberLink\PowerDVD\bak
[2008/02/04 21:20:16 | 000,000,000 | —D | M] – C:\Program Files\DAEMON Tools\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\Intel\Intel Matrix Storage Manager\bak
[2008/02/04 21:20:18 | 000,000,000 | —D | M] – C:\Program Files\Java\jre1.6.0_02\bin\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\LG Software\Battery Miser\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\LG Software\IP Operator\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\LG Software\On Screen Display\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\lg_swupdate\bak
[2008/02/04 21:20:16 | 000,000,000 | —D | M] – C:\Program Files\MSN Messenger\bak
[2008/02/04 21:20:18 | 000,000,000 | —D | M] – C:\Program Files\Nero\Nero8\Nero BackItUp\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\QuickTime\bak
[2008/02/04 21:20:16 | 000,000,000 | —D | M] – C:\Program Files\SRS Labs\WOWXT and TSXT Driver\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\bak
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\Program Files\Synaptics\SynTP\bak
[2008/02/04 21:20:18 | 000,000,000 | —D | M] – C:\Program Files\Winamp\bak

< %systemroot%\system32\bak. /s >
[2008/02/04 21:20:17 | 000,000,000 | —D | M] – C:\WINDOWS\system32\bak

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2006/01/19 11:38:33 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/02/07 11:30:20 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\MXC\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2006/01/19 11:43:08 | 000,000,079 | —- | M] () – C:\Documents and Settings\MXC\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2008/02/15 08:38:25 | 000,426,961 | —- | M] () – C:\Documents and Settings\MXC\Desktop\611help5500.exe
[2010/10/16 17:38:47 | 008,534,336 | —- | M] (Mozilla) – C:\Documents and Settings\MXC\Desktop\Firefox Setup 3.6.10.exe
[2010/11/14 19:41:49 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\MXC\Desktop\OTL.exe
[2009/02/22 10:12:36 | 000,494,080 | —- | M] (OldTimer Tools) – C:\Documents and Settings\MXC\Desktop\OTListIt2.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2009-01-01 18:07:52

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8CC56B59

< End of report >

OTL Extras logfile created on: 11/14/2010 7:42:51 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\MXC\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 567.00 Mb Available Physical Memory | 55.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 93.16 Gb Total Space | 3.01 Gb Free Space | 3.23% Space Free | Partition Type: NTFS
Drive D: | 1.86 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: MAU | User Name: MXC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found
"C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe" = C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe:*:Enabled:Rosetta Stone Ltd Services – (Rosetta Stone Ltd. )
"C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe" = C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe:*:Enabled:Rosetta Stone Version 3 Application – (Rosetta Stone Ltd. )

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\utorrent.exe" = C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found
"C:\Program Files\Atari\Neverwinter Nights 2\nwn2main.exe" = C:\Program Files\Atari\Neverwinter Nights 2\nwn2main.exe:*:Enabled:Neverwinter Nights 2 Main – File not found
"C:\Program Files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe" = C:\Program Files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:*:Enabled:Neverwinter Nights 2 AMD – File not found
"C:\Program Files\Atari\Neverwinter Nights 2\nwupdate.exe" = C:\Program Files\Atari\Neverwinter Nights 2\nwupdate.exe:*:Enabled:Neverwinter Nights 2 Updater – File not found
"C:\Program Files\Atari\Neverwinter Nights 2\nwn2server.exe" = C:\Program Files\Atari\Neverwinter Nights 2\nwn2server.exe:*:Enabled:Neverwinter Nights 2 Server – File not found
"C:\xampplite\apache\bin\apache.exe" = C:\xampplite\apache\bin\apache.exe:*:Enabled:Apache HTTP Server – (Apache Software Foundation)
"C:\xampplite\mysql\bin\mysqld.exe" = C:\xampplite\mysql\bin\mysqld.exe:*:Enabled:mysqld – ()
"C:\Program Files\LeechFTP\Leechftp.exe" = C:\Program Files\LeechFTP\Leechftp.exe:*:Enabled:LeechFTP – (jan debis)
"C:\Documents and Settings\MXC\Application Data\Juniper Networks\Juniper Terminal Services Client\dsTermServ.exe" = C:\Documents and Settings\MXC\Application Data\Juniper Networks\Juniper Terminal Services Client\dsTermServ.exe:*:Enabled:Juniper Terminal Services Client – (Juniper Networks)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Explorer – (Microsoft Corporation)
"C:\Program Files\Intel\WiFi\bin\S24EvMon.exe" = C:\Program Files\Intel\WiFi\bin\S24EvMon.exe:*:Enabled:S24EvMon – (Intel® Corporation)
"C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe" = C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe:*:Enabled:Rosetta Stone Ltd Services – (Rosetta Stone Ltd. )
"C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe" = C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe:*:Enabled:Rosetta Stone Version 3 Application – (Rosetta Stone Ltd. )
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{0650BB10-BCF4-400A-85EE-04097E3046C6}" = Adobe Setup
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{148E08FF-D7C4-46ED-8D4D-601C67FE0AFD}" = Rosetta Stone Version 3
"{15EC1872-FEAC-4FF6-B2ED-B686BBE183D1}" = IP Operator
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1B3D74CC-6C96-46CD-8D1F-780AC85A9DB5}" = Tunebite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 21
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}" = PixiePack Codec Pack
"{6230D052-547E-48B7-828E-422EB1C83684}" = Wallpaper Installation
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76BC2442-0002-47FA-9617-43BAD82BEF4C}" = Bonjour
"{774C8C61-83BA-4D36-A982-2C680943B888}" = ATI Catalyst Control Center
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7C10F5C7-F00F-4BD3-A110-C7D240D2DD25}" = Adobe Dreamweaver CS3
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{81717D01-32F6-449C-85E1-41AFD678E545}" = LG Intelligent Update
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C036829-1301-42F3-9042-B01452FDE0B2}" = WOW XT and TSXT Filter Driver
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" =
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager
"{90AABED0-25A8-41FC-B738-224889E31033}" = Nero 8 Demo
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes
"{99B366B0-76B6-4DBA-95A3-A730015A7D01}" = MasterCook Deluxe 9
"{9B16B8E8-170F-43AF-8EE7-5D04660BF3C7}" = Agere Ethernet Adapter
"{9C661DEF-3F08-468D-B5CE-B37E4771B5D2}" = MSN Toolbar
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9DE3F260-B88E-42CE-90E7-73C78C37D95E}" = 32 Bit HP BiDi Channel Components Installer
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB18B0BA-A08F-48B8-8D0E-AA9DDDCA22EA}" = CuteFTP 6 Professional
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC73C2D7-D10C-40F5-AD67-3E957EE9B6BC}" = On Screen Display
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B47709FF-F32A-405A-BF0D-F59A98710D69}" = LG Direct Media Button Service
"{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = TIPCI
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1BB4446-AE9C-4256-9A7F-4D46604D2462}" = Adobe Setup
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D2777D85-7E63-402F-A5E7-2AF436C1C9D4}" = Intel® PROSet/Wireless WiFi Software
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E55C8F84-160B-41FA-9D41-6210801C0C24}" = Battery Miser
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E713E222-AF67-47DF-9D59-37A051083630}" = Ez User's Guide
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"Active@ ISO Burner v 1.1" = Active@ ISO Burner v 1.1
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_2ac78060bc5856b0c1cf873bb919b58" = Adobe Photoshop CS3
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Adobe_7328fdfcb73660ec8b11d5a3d5c6232" = Adobe Dreamweaver CS3
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"All ATI Software" = ATI - Software Uninstall Utility
"AnyDVD" = AnyDVD
"Applian FLV Player2.0.24" = Applian FLV Player
"ATI Display Driver" = ATI Display Driver
"avast!" = avast! Antivirus
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"D16AA00FE65B9D2C6E0A57F54400303BF3259CC3" = Windows Driver Package - Intel (w29n51) net (06/26/2006 9.0.4.17)
"Dell Photo AIO Printer 962" = Dell Photo AIO Printer 962
"DemoApp" = FE Convert Drop
"DVD Decrypter" = DVD Decrypter (Remove Only)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"F178FB7BCA7F0236039E3554BF5BCAC1A7E6B864" = Windows Driver Package - Intel (NETw3x32) net (07/02/2006 10.5.1.57)
"Free DVD Video Burner_is1" = Free DVD Video Burner version 2.1
"Free DVD Video Converter_is1" = Free DVD Video Converter version 1.1
"Free Video to DVD Converter_is1" = Free Video to DVD Converter version 1.2
"GoldWave v4.26" = GoldWave v4.26
"Google Updater" = Google Updater
"Graboid Video" = Graboid Video 1.2
"Hijackthis_is1" = Hijackthis 1.99.1
"HotspotShield" = Hotspot Shield 1.37
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"InstallShield_{99B366B0-76B6-4DBA-95A3-A730015A7D01}" = MasterCook Deluxe 9
"InstallShield_{AB18B0BA-A08F-48B8-8D0E-AA9DDDCA22EA}" = CuteFTP 6 Professional
"InstallShield_{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"Juniper Network Connect 6.5.0" = Juniper Networks Network Connect 6.5.0
"LeechFTP" = LeechFTP
"Magic ISO Maker v5.4 (build 0251)" = Magic ISO Maker v5.4 (build 0251)
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla ActiveX Control v1.7.12" = Mozilla ActiveX Control v1.7.12
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PrimoPDF4.0.1" = PrimoPDF
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"uTorrent" = µTorrent
"Virtools3DLifePlayer" = Virtools 3D Life Player
"VLC media player" = VideoLAN VLC media player 0.8.6d
"WIC" = Windows Imaging Component
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Juniper_Setup_Client" = Juniper Networks Setup Client
"Juniper_Term_Services" = Juniper Terminal Services Client

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 1/26/2010 6:28:05 PM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - initialization error: Standard Shield provider: cannot start
because 'Norton Antivirus / Symantec Antivirus' is active!, 00000000.

Error - 2/9/2010 10:52:05 AM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - initialization error: Instant Messaging provider: cannot start
because 'Norton Antivirus / Symantec Antivirus' is active!, 00000000.

Error - 2/9/2010 10:52:05 AM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - initialization error: P2P provider: cannot start because 'Norton
Antivirus / Symantec Antivirus' is active!, 00000000.

Error - 2/9/2010 10:52:05 AM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - initialization error: Standard Shield provider: cannot start
because 'Norton Antivirus / Symantec Antivirus' is active!, 00000000.

Error - 5/16/2010 4:47:55 AM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - scanning error: OpenEventsAndMapping: OpenEvent failed!, 00000002.

Error - 5/16/2010 4:47:56 AM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - scanning error: ClientRqDispatchThread: OpenEventsAndMapping
failed - client probably died, 00003B2D.

Error - 10/14/2010 6:34:07 PM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - scanning error: OpenEventsAndMapping: OpenEvent failed!, 00000002.

Error - 10/14/2010 6:34:07 PM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - scanning error: ClientRqDispatchThread: OpenEventsAndMapping
failed - client probably died, 00000F3A.

Error - 11/9/2010 8:50:40 AM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - scanning error: OpenEventsAndMapping: OpenEvent failed!, 00000002.

Error - 11/9/2010 8:50:40 AM | Computer Name = MAU | Source = avast! | ID = 33554522
Description = AAVM - scanning error: ClientRqDispatchThread: OpenEventsAndMapping
failed - client probably died, 00008050.

[ Application Events ]
Error - 11/14/2010 9:48:14 AM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 28410469

Error - 11/14/2010 1:06:46 PM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/14/2010 1:06:46 PM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1954

Error - 11/14/2010 1:06:46 PM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1954

Error - 11/14/2010 1:06:48 PM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/14/2010 1:06:48 PM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4485

Error - 11/14/2010 1:06:48 PM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4485

Error - 11/14/2010 1:06:50 PM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/14/2010 1:06:50 PM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6454

Error - 11/14/2010 1:06:50 PM | Computer Name = MAU | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6454

[ System Events ]
Error - 11/9/2010 3:15:16 PM | Computer Name = MAU | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 11/9/2010 3:50:29 PM | Computer Name = MAU | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 11/9/2010 3:50:38 PM | Computer Name = MAU | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 11/9/2010 3:50:38 PM | Computer Name = MAU | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 11/9/2010 3:50:59 PM | Computer Name = MAU | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 11/10/2010 11:18:15 PM | Computer Name = MAU | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.

Error - 11/11/2010 8:46:33 AM | Computer Name = MAU | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.102 for the Network Card with network
address 0018DE6798A3 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 11/12/2010 8:00:16 PM | Computer Name = MAU | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 11/12/2010 8:00:18 PM | Computer Name = MAU | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 11/12/2010 8:00:18 PM | Computer Name = MAU | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

< End of report >

Tomk

Post #2November 17, 2010, 5:11 PM UTC

Hi ,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

µTorrent
You have µTorrent, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm

I would recommend that you uninstall µTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_...ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

brokenhead

Post #3November 21, 2010, 9:34 PM UTC

Thanks Tom, here is the requested log: ComboFix 10-11-21.01 - MXC 11/21/2010 15:06:16.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2558.2091 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Downloaded Program Files\popcaploader.dll c:\windows\Downloaded Program Files\popcaploader.inf c:\windows\system32\dumphive.exe c:\windows\system32\IEDFix.exe c:\windows\system32\Process.exe c:\windows\system32\SrchSTS.exe c:\windows\system32\tmp.reg c:\windows\system32\VACFix.exe c:\windows\system32\VCCLSID.exe c:\windows\system32\WS2Fix.exe . ((((((((((((((((((((((((( Files Created from 2010-10-21 to 2010-11-21 ))))))))))))))))))))))))))))))) . 2010-11-18 15:25 . 2010-11-21 19:59 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9 2010-11-17 18:12 . 2010-11-17 18:12 ——– d—–w- c:\documents and settings\MXC\Application Data\HD Tune Pro 2010-11-15 04:03 . 2010-11-17 17:37 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-11-03 00:13 . 2006-10-26 23:56 33104 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll 2010-11-03 00:13 . 2006-10-26 23:56 32592 —-a-w- c:\windows\system32\msonpmon.dll 2010-11-03 00:10 . 2010-11-03 00:10 ——– d—–w- c:\program files\Microsoft Works 2010-11-03 00:08 . 2010-11-03 00:08 ——– d—–w- c:\program files\Microsoft.NET 2010-11-03 00:02 . 2010-11-03 00:16 ——– d—–w- c:\program files\Microsoft Visual Studio 8 2010-11-03 00:01 . 2010-11-03 00:01 ——– d—–w- c:\documents and settings\MXC\Local Settings\Application Data\Microsoft Help 2010-11-03 00:01 . 2010-11-09 00:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-10-30 02:31 . 2010-10-30 02:31 ——– d—–w- c:\documents and settings\LocalService\Application Data\McAfee . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-05-11 07:06 . 2007-10-11 00:51 39792 c:\program files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe 2006-01-02 22:41 . 2006-01-02 22:41 45056 c:\program files\ATI Technologies\ATI.ACE\bak\cli.exe 2007-03-01 04:06 . 2007-03-01 04:06 2321600 c:\program files\Common Files\Adobe\Updater5\bak\AdobeUpdater.exe 2006-09-27 18:32 . 2009-09-28 18:53 2356088 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe 2007-03-01 19:57 . 2007-03-01 19:57 153136 c:\program files\Common Files\Nero\Lib\bak\NeroCheck.exe 2007-09-20 19:35 . 2007-09-20 19:35 202024 c:\program files\Common Files\Nero\Lib\bak\NMBgMonitor.exe 2007-02-07 16:26 . 2004-11-03 01:24 32768 c:\program files\CyberLink\PowerDVD\bak\PDVDServ.exe 2007-08-29 15:09 . 2007-08-29 15:09 171464 c:\program files\DAEMON Tools\bak\daemon.exe 2006-02-11 05:42 . 2005-10-12 03:30 139264 c:\program files\Intel\Intel Matrix Storage Manager\bak\iaanotif.exe 2007-08-30 17:16 . 2007-07-12 08:00 132496 c:\program files\Java\jre1.6.0_02\bin\bak\jusched.exe 2006-02-12 18:56 . 2006-09-29 23:29 327680 c:\program files\LG Software\Battery Miser\bak\batterymiser.exe 2006-01-23 22:46 . 2006-02-15 02:09 2658304 c:\program files\LG Software\On Screen Display\bak\HotKey.exe 2006-02-15 13:17 . 2007-02-07 17:54 122880 c:\program files\lg_swupdate\bak\autoupdate.exe 2007-09-20 13:51 . 2007-09-20 13:51 1836328 c:\program files\Nero\Nero8\Nero BackItUp\bak\NBKeyScan.exe 2007-02-16 14:54 . 2007-02-16 14:54 282624 c:\program files\QuickTime\bak\qttask.exe 2010-03-18 01:53 . 2010-03-18 01:53 421888 c:\program files\QuickTime\QTTask.exe 2006-02-07 01:46 . 2006-02-07 01:46 176128 c:\program files\SRS Labs\WOWXT and TSXT Driver\bak\SRSTrayApp.exe 2002-07-30 16:35 . 2002-07-30 16:35 77824 c:\program files\Symantec_Client_Security\Symantec AntiVirus\bak\vptray.exe 2006-02-11 06:32 . 2006-06-02 19:09 786521 c:\program files\Synaptics\SynTP\bak\SynTPEnh.exe 2008-02-18 22:01 . 2005-09-17 00:12 737369 c:\program files\Synaptics\SynTP\SynTPEnh.exe 2007-05-14 22:22 . 2007-05-14 22:22 35328 c:\program files\Winamp\bak\winampa.exe 2006-01-25 14:36 . 2006-02-07 07:36 77824 c:\windows\system32\bak\hkcmd.exe 2006-01-25 14:36 . 2006-02-07 07:40 118784 c:\windows\system32\bak\igfxpers.exe 2006-01-25 14:36 . 2006-02-07 07:39 94208 c:\windows\system32\bak\igfxtray.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Tunebite"="c:\program files\RapidSolution\Tunebite\Tunebite.exe" [2008-04-24 6366512] "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-07 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-17 737369] "RTHDCPL"="RTHDCPL.EXE" [2006-01-11 15961088] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952] "IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-10-02 1368064] "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2008-10-02 1191936] "dlbxmon.exe"="c:\program files\Dell Photo AIO Printer 962\dlbxmon.exe" [2005-01-18 425984] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\utorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\xampplite\\apache\\bin\\apache.exe"= "c:\\xampplite\\mysql\\bin\\mysqld.exe"= "c:\\Program Files\\LeechFTP\\Leechftp.exe"= "c:\\Documents and Settings\\MXC\\Application Data\\Juniper Networks\\Juniper Terminal Services Client\\dsTermServ.exe"= "c:\\Program Files\\Intel\\WiFi\\bin\\S24EvMon.exe"= "c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe"= "c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9/12/2007 7:33 PM 717296] R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [1/8/2010 6:42 PM 285744] R2 SRS_PostInstaller;SRS PostInstaller Service;c:\program files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe [2/6/2006 8:46 PM 31744] R3 AGR1310_51;Agere Systems ET-13xx PCI-E Ethernet Adapter XP Driver;c:\windows\system32\drivers\AGR1310_51.sys [1/23/2006 4:57 PM 75648] R3 LGDMEBTN;LG Direct Media Button Device Driver;c:\windows\system32\drivers\LGDMEBTN.sys [2/11/2006 12:44 AM 15616] R3 wowfilter;WOW XT Filter Driver;c:\windows\system32\drivers\WOWFilter.sys [2/6/2006 8:47 PM 20608] S3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2/11/2006 1:34 AM 36352] S3 lgodd_filter;lgodd_filter;c:\windows\system32\drivers\lgodd_filter.sys –> c:\windows\system32\drivers\lgodd_filter.sys [?] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}] 2008-02-25 15:55 7680 —-a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe . Contents of the 'Scheduled Tasks' folder . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.ca/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: MasterCook: Select Image - c:\program files\MasterCook 9\Web\MCIEContext.hta FF - ProfilePath - c:\documents and settings\MXC\Application Data\Mozilla\Firefox\Profiles\2j0wv06z.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo! Search FF - prefs.js: browser.startup.homepage - google.com FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll —- FIREFOX POLICIES —- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . - - - - ORPHANS REMOVED - - - - URLSearchHooks-CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) Notify-avgrsstarter - avgrsstx.dll ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'winlogon.exe'(1716) c:\windows\system32\Ati2evxx.dll c:\windows\system32\cscdll.dll c:\windows\system32\netprovcredman.dll . Completion time: 2010-11-21 15:12:22 ComboFix-quarantined-files.txt 2010-11-21 20:12 Pre-Run: 401,344,696,320 bytes free Post-Run: 401,725,296,640 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - D9DF97640DB11C407A14A4E42FB76DD2

Tomk

Post #4November 21, 2010, 10:50 PM UTC

brokenhead,

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

How are things running now?

Tomk

Post #5November 27, 2010, 2:02 AM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

possible virus 2nd pc

✨ Ask AI

Ask AI