Spyware / Malware / Virus Removal

XP runs slloooww

20 min read

Looking for the outcome? Ask AI

Jack&Jill

Post #16January 22, 2011, 2:05 AM UTC

Hello TheGreat.308 :),

The way firewalls like ZoneAlarm work is by informing about program execution and network activities and may also ask for permission. Sometimes, these activities may not be malicious.

The IP addresses are from a range of local or internal addresses and they coincide with the time your computer should be connecting to the internet after a startup. So there is nothing to worry about.

As for the problem with Internet Explorer, I suggest you to try alternative browsers to see if the same issue occurs. I also think the addition of RAM will help.

——————–

Rerun OTL

Double click on OTL.exe to run it.
Make sure all the Use SafeList options is checked (ticked). There are six of them.
Check Scan All Users.
At the lower right corner, check LOP Check and Purity Check.
Click on Run Scan at the top left hand corner. This might take a while.
When done, two Notepad files will open. Please post the contents of these 2 Notepad files in your next reply. One log per reply please.
Note: These files are saved as OTL.txt and Extras.txt on the desktop.

——————–

Please post back:
1. OTL log

TheGreat.308

Post #17January 22, 2011, 4:23 AM UTC

Hello Jack & Jill,

I feel that we are making great progress - the zone alarm messages haven't shown up since I used the OTL fix. I am glad to hear it is nothing to fret over.I noticed some limewire stuff was still on my pc it is gone now. Thoroughly read the adding RAM and even I can add more- Thanks for giving me a push w/ that article!

OTL log posted below Have a great weekend.

OTL logfile created on: 1/21/2011 10:15:42 PM - Run 1
OTL by OldTimer - Version 3.2.20.3 Folder = C:\Documents and Settings\user1\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

255.00 Mb Total Physical Memory | 59.00 Mb Available Physical Memory | 23.00% Memory free
989.00 Mb Paging File | 632.00 Mb Available in Paging File | 64.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 18.64 Gb Total Space | 8.20 Gb Free Space | 43.99% Space Free | Partition Type: NTFS
Drive E: | 618.77 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: COMPAQ-033HB3B9 | User Name: user1 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/20 12:57:52 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\user1\Desktop\OTL.exe
PRC - [2011/01/13 02:47:34 | 003,396,624 | —- | M] (AVAST Software) – C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/01/13 02:47:33 | 000,040,384 | —- | M] (AVAST Software) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/09/02 08:22:30 | 002,435,592 | —- | M] (Check Point Software Technologies LTD) – C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2010/09/02 08:21:04 | 001,043,968 | —- | M] (Check Point Software Technologies LTD) – C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/12/18 14:20:00 | 000,401,408 | —- | M] (Creative Technology Ltd.) – C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
PRC - [2007/04/02 14:15:40 | 000,061,440 | —- | M] (Creative Technology Ltd) – C:\Program Files\Creative\Shared Files\CTDevSrv.exe
PRC - [2004/09/29 11:14:36 | 000,069,632 | —- | M] (HP) – C:\WINDOWS\system32\HPZipm12.exe
PRC - [2002/09/20 15:50:10 | 000,045,056 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

========== Modules (SafeList) ==========

MOD - [2011/01/20 12:57:52 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\user1\Desktop\OTL.exe
MOD - [2011/01/13 02:47:35 | 000,189,728 | —- | M] (AVAST Software) – C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2010/08/23 10:12:02 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/01/13 02:47:33 | 000,040,384 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Antivirus)
SRV - [2010/09/02 08:22:30 | 002,435,592 | —- | M] (Check Point Software Technologies LTD) [Auto | Running] – C:\WINDOWS\System32\ZoneLabs\vsmon.exe – (vsmon)
SRV - [2010/03/29 07:51:54 | 000,068,000 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2007/04/02 14:15:40 | 000,061,440 | —- | M] (Creative Technology Ltd) [Auto | Running] – C:\Program Files\Creative\Shared Files\CTDevSrv.exe – (CTDevice_Srv)
SRV - [2004/09/29 11:14:36 | 000,069,632 | —- | M] (HP) [Auto | Running] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)
SRV - [2002/09/20 15:50:10 | 000,045,056 | —- | M] (Analog Devices, Inc.) [Auto | Running] – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe – (SoundMAX Agent Service (default))

========== Driver Services (SafeList) ==========

DRV - [2011/01/13 02:41:16 | 000,294,608 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aswSP.sys – (aswSP)
DRV - [2011/01/13 02:40:16 | 000,047,440 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aswTdi.sys – (aswTdi)
DRV - [2011/01/13 02:40:04 | 000,100,176 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\WINDOWS\System32\drivers\aswmon2.sys – (aswMon2)
DRV - [2011/01/13 02:37:30 | 000,023,632 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aswRdr.sys – (aswRdr)
DRV - [2011/01/13 02:37:11 | 000,029,392 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aavmker4.sys – (Aavmker4)
DRV - [2011/01/13 02:37:09 | 000,017,744 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\WINDOWS\System32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2010/05/13 09:02:32 | 000,532,224 | —- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] – C:\WINDOWS\system32\vsdatant.sys – (vsdatant)
DRV - [2008/04/13 12:45:12 | 000,060,032 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbaudio.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2007/03/02 13:53:18 | 001,972,224 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2005/08/17 21:44:50 | 000,049,867 | R— | M] (Mobile Action Technology Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mardp2k.sys – (MaRdPnp)
DRV - [2005/08/17 21:44:44 | 000,011,473 | R— | M] (Mobile Action Technology Inc.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\MaVc2K.sys – (MaVctrl)
DRV - [2005/08/10 08:06:28 | 000,019,968 | —- | M] (Protection Technology) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\sfsync02.sys – (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2005/08/10 06:44:04 | 000,050,688 | —- | M] (Protection Technology) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\sfdrv01.sys – (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005/05/27 03:31:28 | 000,022,016 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LVUSBSta.sys – (LVUSBSta)
DRV - [2005/05/16 07:20:39 | 000,006,656 | —- | M] (Protection Technology) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\sfhlp02.sys – (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004/09/16 03:11:02 | 000,025,300 | R— | M] (Mobile Action Technology Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\MA8512M.sys – (MA8512M)
DRV - [2004/09/16 03:11:00 | 000,049,106 | R— | M] (Mobile Action Technology Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\MA8512U.sys – (MA8512U)
DRV - [2001/08/17 11:12:26 | 000,164,586 | —- | M] (Madge Networks Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mdgndis5.sys – (MadgeTRN)
DRV - [2001/08/17 11:11:18 | 000,020,160 | —- | M] (ADMtek Incorporated) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ADM8511.SYS – (ADM8511)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-839522115-2146812355-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[2009/08/13 14:52:32 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\user1\Application Data\Mozilla\Extensions
[2009/08/13 14:52:32 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\user1\Application Data\Mozilla\Extensions\[removed]

O1 HOSTS File: ([2008/07/13 17:31:43 | 000,250,896 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.1001-search.info
O1 - Hosts: 127.0.0.1 1001-search.info
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 8770 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CD Autorun] File not found
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKU\S-1-5-21-839522115-2146812355-725345543-1003..\Run: [CTZDetec.exe] C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe (Creative Technology Ltd.)
O4 - HKU\S-1-5-21-839522115-2146812355-725345543-1003..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 2
O7 - HKU\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKU\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKU\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKU\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O7 - HKU\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scan8/oscan8.cab (Reg Error: Key error.)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} http://www.creative.com/softwareupdate/su/…101/CTSUEng.cab (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/softwareupdate/su/…15106/CTPID.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.15.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\user1\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\user1\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/07/25 12:11:17 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2005/01/26 14:19:21 | 000,000,147 | R— | M] () - E:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/20 13:53:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2011/01/20 13:53:09 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2011/01/20 12:57:39 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\user1\Desktop\OTL.exe
[2011/01/20 12:31:35 | 000,000,000 | —D | C] – C:\_OTL
[2011/01/19 13:38:44 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/01/18 13:57:02 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/01/18 13:57:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/01/18 13:56:53 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/01/18 13:56:53 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/01/18 13:55:49 | 007,734,208 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\user1\Desktop\mbam-setup-1.50.1.1100.exe
[2011/01/12 13:19:10 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\user1\Desktop\HiJackThis.exe
[2011/01/12 09:49:30 | 000,000,000 | -HSD | C] – C:\RECYCLER

========== Files - Modified Within 30 Days ==========

[2011/01/21 22:19:58 | 000,004,212 | -H– | M] () – C:\WINDOWS\System32\zllictbl.dat
[2011/01/21 22:00:57 | 000,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/21 21:59:47 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/20 13:53:13 | 000,000,592 | —- | M] () – C:\Documents and Settings\user1\Desktop\ERUNT.lnk
[2011/01/20 13:29:27 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/01/20 12:57:52 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\user1\Desktop\OTL.exe
[2011/01/20 12:32:59 | 000,117,360 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/01/18 13:57:03 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/18 13:55:49 | 007,734,208 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\user1\Desktop\mbam-setup-1.50.1.1100.exe
[2011/01/14 16:11:51 | 000,133,632 | —- | M] () – C:\Documents and Settings\user1\Desktop\RKUnhookerLE.EXE
[2011/01/13 02:47:32 | 000,188,216 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2011/01/13 02:41:16 | 000,294,608 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2011/01/13 02:40:16 | 000,047,440 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/01/13 02:40:04 | 000,100,176 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/01/13 02:39:50 | 000,094,544 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2011/01/13 02:37:30 | 000,023,632 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/01/13 02:37:11 | 000,029,392 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/01/13 02:37:09 | 000,017,744 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/01/12 13:19:13 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\user1\Desktop\HiJackThis.exe
[2010/12/31 14:06:36 | 000,038,848 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr

========== Files Created - No Company Name ==========

[2011/01/20 13:53:13 | 000,000,592 | —- | C] () – C:\Documents and Settings\user1\Desktop\ERUNT.lnk
[2011/01/18 13:57:03 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/14 16:11:51 | 000,133,632 | —- | C] () – C:\Documents and Settings\user1\Desktop\RKUnhookerLE.EXE
[2010/10/10 19:51:26 | 000,000,036 | —- | C] () – C:\Documents and Settings\user1\Local Settings\Application Data\housecall.guid.cache
[2010/05/22 13:41:29 | 000,000,869 | —- | C] () – C:\WINDOWS\CODUO.ini
[2010/05/22 13:12:26 | 000,000,766 | —- | C] () – C:\WINDOWS\COD.INI
[2009/08/26 18:47:27 | 000,011,776 | —- | C] () – C:\WINDOWS\System32\ZPORT4AS.dll
[2009/07/25 12:21:50 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2008/11/09 16:13:00 | 000,796,048 | —- | C] () – C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2008/07/07 14:39:27 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2008/06/29 20:28:13 | 000,000,121 | —- | C] () – C:\WINDOWS\bdagent.INI
[2008/06/21 18:58:53 | 000,354,816 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2008/05/07 11:37:58 | 000,000,135 | —- | C] () – C:\WINDOWS\ChssBase.ini
[2008/04/21 15:30:14 | 000,002,950 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/04/17 12:23:29 | 000,000,134 | —- | C] () – C:\Documents and Settings\user1\Application Data\Setup.txt
[2008/02/07 18:27:18 | 000,000,112 | —- | C] () – C:\WINDOWS\ActiveSkin.INI
[2008/01/12 22:06:18 | 000,000,092 | —- | C] () – C:\WINDOWS\dellstat.ini
[2008/01/12 22:06:16 | 000,000,365 | —- | C] () – C:\WINDOWS\lexstat.ini
[2008/01/12 22:05:50 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxczvs.dll
[2008/01/12 22:05:15 | 000,000,270 | —- | C] () – C:\WINDOWS\System32\lxczcoin.ini
[2008/01/09 15:01:48 | 000,000,453 | —- | C] () – C:\WINDOWS\bdoscandellang.ini
[2007/06/19 07:59:36 | 000,070,400 | —- | C] () – C:\WINDOWS\System32\PhysXLoader.dll
[2007/04/20 06:57:30 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2007/04/20 06:57:28 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2007/04/20 06:57:28 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2007/04/20 06:57:28 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2007/04/20 06:57:28 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2007/04/20 06:57:28 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2007/04/20 06:57:28 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2007/04/20 06:57:28 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2007/04/20 06:57:28 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2006/10/13 09:46:56 | 000,016,384 | —- | C] () – C:\WINDOWS\System32\hndlt.ini
[2006/09/12 13:21:38 | 000,054,272 | —- | C] () – C:\Documents and Settings\user1\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/08/28 09:25:39 | 000,009,255 | R— | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2006/08/08 10:58:28 | 000,008,040 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2006/07/25 15:56:46 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2006/07/25 06:49:47 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI

========== LOP Check ==========

[2010/10/26 22:14:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2007/12/12 14:06:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2008/06/18 10:17:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Friends Games
[2010/08/25 15:38:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\magicJack
[2008/12/13 09:40:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MailFrontier
[2010/10/26 19:18:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2009/11/01 15:18:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2008/06/20 18:10:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NeoEdge Networks
[2008/05/02 23:41:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Oberon Media
[2008/06/21 16:55:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2008/06/19 15:01:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus
[2008/06/17 12:06:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TERMINAL Studio
[2008/06/17 15:54:26 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\7Wonders
[2010/02/07 14:26:45 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Big Fish
[2009/05/20 16:53:24 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Big Fish Games
[2010/10/26 21:12:23 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\CheckPoint
[2008/05/07 12:11:34 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\ChessBase
[2008/07/24 18:56:37 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Disney Mix It Plug-in
[2009/10/12 14:52:13 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Eyeblaster
[2009/09/25 15:08:48 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Gearbox Software
[2009/07/19 20:54:47 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Groove Games
[2008/03/20 19:11:13 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Leadertech
[2007/12/08 18:07:21 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Paltalk
[2008/06/21 16:59:01 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\PlayFirst
[2010/11/22 09:30:27 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Registry Mechanic
[2008/01/12 21:50:10 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Simple Star
[2008/01/12 22:04:42 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\Snapfish
[2011/01/18 13:33:45 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\TweakNow PowerPack 2010
[2010/11/22 10:17:10 | 000,000,000 | —D | M] – C:\Documents and Settings\user1\Application Data\TweakNow PowerPack Professional

========== Purity Check ==========

< End of report >

TheGreat.308

Post #18January 22, 2011, 4:25 AM UTC

Jack & Jill,

Post 2 of OTL

OTL Extras logfile created on: 1/21/2011 10:15:42 PM - Run 1
OTL by OldTimer - Version 3.2.20.3 Folder = C:\Documents and Settings\user1\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

255.00 Mb Total Physical Memory | 59.00 Mb Available Physical Memory | 23.00% Memory free
989.00 Mb Paging File | 632.00 Mb Available in Paging File | 64.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 18.64 Gb Total Space | 8.20 Gb Free Space | 43.99% Space Free | Partition Type: NTFS
Drive E: | 618.77 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: COMPAQ-033HB3B9 | User Name: user1 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Disabled:Microsoft Management Console – (Microsoft Corporation)
"C:\Program Files\EA GAMES\Battlefield 1942\BF1942.exe" = C:\Program Files\EA GAMES\Battlefield 1942\BF1942.exe:*:Enabled:BF1942
"F:\GAMES\Battlefield Vietnam\bfvietnam.exe" = F:\GAMES\Battlefield Vietnam\bfvietnam.exe:*:Enabled:bfvietnam
"F:\Turbo tax\TurboTax Deluxe 2006\32bit\ttax.exe" = F:\Turbo tax\TurboTax Deluxe 2006\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax
"F:\Turbo tax\TurboTax Deluxe 2006\32bit\updatemgr.exe" = F:\Turbo tax\TurboTax Deluxe 2006\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager
"F:\MofH Pacific Assault\mohpa.exe" = F:\MofH Pacific Assault\mohpa.exe:*:Enabled:Medal of Honor Pacific Assault™
"C:\Program Files\EA GAMES\Medal of Honor Pacific Assault™\mohpa.exe" = C:\Program Files\EA GAMES\Medal of Honor Pacific Assault™\mohpa.exe:*:Enabled:Medal of Honor Pacific Assault™
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe" = C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon – (Check Point Software Technologies LTD)
"C:5\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe" = C:5\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:*:Enabled:Medal of Honor Airborne
"C:5\Medal of Honor Pacific Assault\mohpa.exe" = C:5\Medal of Honor Pacific Assault\mohpa.exe:*:Enabled:Medal of Honor Pacific Assault™

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0DEA94ED-915A-4834-A87E-388D012C8E02}" = Medal of Honor Allied Assault
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{14AA72DA-DB40-4A34-93A6-401A81D7AF9E}" = Unreal Anthology
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20676B6E-3A89-9D8B-DF0B-66B52C007864}" = CCC Help French
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 22
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F6535CB-8385-14E8-0BC6-136CB9750A85}" = ccc-core-preinstall
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{42B10D50-68F9-0C65-D7AE-3602A9852041}" = Catalyst Control Center Graphics Light
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BEC42A2-B060-C560-B177-5A955F527160}" = CCC Help Spanish
"{5659C1C6-FBBC-2019-854C-8D5D68AFB877}" = Catalyst Control Center Graphics Full New
"{56CFA833-F44F-4199-8C58-7F8B38F2BC7B}" = Medal of Honor Pacific Assault™
"{5BDEC021-A430-5531-76C1-10FE3ED2E405}" = CCC Help English
"{65F1CF63-31E0-450B-96F3-4A88BE7361A6}" = AGEIA PhysX v7.07.09
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942
"{6FA88A80-45C3-4B3E-999E-FE9FB9B3C0DA}" = CCC Help German
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75BED4BB-2580-7D68-840C-A6A25AAED4B1}" = Catalyst Control Center Core Implementation
"{7914BE1E-F186-4790-B8F4-9F63C52A41C1}" = Medal of Honor Allied Assault™ Spearhead
"{7E0CDB79-91DA-BDFB-B88C-E869942784CE}" = Catalyst Control Center Localization Spanish
"{7ED80209-18CB-61CD-7CD2-C9197BD6AA0B}" = Catalyst Control Center Localization German
"{823A68CC-3049-4A6B-8F63-7DC85E4BB1C9}" = Medal of Honor Allied Assault™ Breakthrough
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9862B19F-4CAD-4EED-920F-2F378D84393F}" = ATI Parental Control & Encoder
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A041C7FC-1E1B-4DD9-4CCC-306AB36DA087}" = Catalyst Control Center Graphics Full Existing
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive
"{A918DE8A-98C8-0800-0000-0000000C0001}" = Sanyo PM8200 USB - Handset Manager V8
"{A918DE8A-98C8-0800-0001-000000000000}" = Multimedia Samples
"{ABB7151E-754A-351A-4F7A-5292591937E6}" = CCC Help Chinese Standard
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.5
"{B54D3E98-8757-FCFF-398F-199B618D36B6}" = Catalyst Control Center Localization French
"{B73B4A99-4173-4747-BBEC-0F05E966F9D2}" = Battlefield 1942: Secret Weapons of WWII
"{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom 570x Driver Installer
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}" = AVIVO Codecs
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D057AA08-8CBF-42E3-9EAB-23B8FED1C279}" = Battlefield 1942: The Road To Rome
"{D1696920-9794-4BBC-8A30-7A88763DE5A2}" = ABBYY FineReader 5.0 Sprint
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E35B3C63-E958-4E31-A178-95D22024109A}" = Battlefield Vietnam™
"{E35E55BC-BC35-4303-2C46-D3E63C5EDC2F}" = ccc-utility
"{EA767019-E9AD-4B96-FF31-C1A816612D1F}" = ccc-core-static
"{EB10E764-79C1-BCE7-6526-D3A4B7220BF8}" = Skins
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{F9089224-6CBA-B814-0A58-77EEBA7A9579}" = Catalyst Control Center Localization Chinese Standard
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"avast5" = avast! Free Antivirus
"Battlecraft 19422.1" = Battlecraft 1942
"BFG-Mystery in London" = Mystery in London
"Call of Duty Game of the Year Edition" = Call of Duty Game of the Year Edition
"Creative Media Lite" = Creative Media Lite
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"ie8" = Windows Internet Explorer 8
"InstallShield_{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive
"InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom 570x Driver Installer
"Lexmark 1200 Series" = Lexmark 1200 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MDT" = Battlefield Mod Development Toolkit 2.0 Beta
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PROSet" = Intel® PRO Network Connections Drivers
"Vietcong" = Vietcong
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"YInstHelper" = Yahoo! Install Manager
"ZENStoneUG" = Creative ZEN Stone User's Guide
"ZoneAlarm" = ZoneAlarm

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-839522115-2146812355-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"notify" = License Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/30/2010 7:33:53 PM | Computer Name = COMPAQ-033HB3B9 | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 12/30/2010 7:33:53 PM | Computer Name = COMPAQ-033HB3B9 | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 1/7/2011 11:19:58 PM | Computer Name = COMPAQ-033HB3B9 | Source = Application Hang | ID = 1002
Description = Hanging application WORDVIEW.EXE, version 11.0.8169.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/10/2011 6:51:41 PM | Computer Name = COMPAQ-033HB3B9 | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5145, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/10/2011 6:51:41 PM | Computer Name = COMPAQ-033HB3B9 | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5145, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/10/2011 6:51:41 PM | Computer Name = COMPAQ-033HB3B9 | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5145, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/19/2011 11:34:25 PM | Computer Name = COMPAQ-033HB3B9 | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5145, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/21/2011 6:47:37 PM | Computer Name = COMPAQ-033HB3B9 | Source = | ID = 0
Description =

Error - 1/21/2011 6:47:37 PM | Computer Name = COMPAQ-033HB3B9 | Source = | ID = 0
Description =

Error - 1/21/2011 6:47:37 PM | Computer Name = COMPAQ-033HB3B9 | Source = | ID = 0
Description =

[ System Events ]
Error - 1/20/2011 3:00:58 PM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7034
Description = The Creative Service for CDROM Access service terminated unexpectedly.
It has done this 1 time(s).

Error - 1/20/2011 3:00:59 PM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7034
Description = The CT Device Query service service terminated unexpectedly. It has
done this 1 time(s).

Error - 1/20/2011 3:00:59 PM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 1/20/2011 3:00:59 PM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7034
Description = The Pml Driver HPZ12 service terminated unexpectedly. It has done
this 1 time(s).

Error - 1/20/2011 3:01:00 PM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7034
Description = The SoundMAX Agent Service service terminated unexpectedly. It has
done this 1 time(s).

Error - 1/20/2011 3:17:15 PM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 1/20/2011 6:26:43 PM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 1/21/2011 4:02:42 PM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 1/21/2011 6:47:59 PM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.

Error - 1/22/2011 12:00:53 AM | Computer Name = COMPAQ-033HB3B9 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

< End of report >

Jack&Jill

Post #19January 22, 2011, 8:17 AM UTC

Hello TheGreat.308 :), Good to hear things are working better. Your logs looked clean. How is the computer behaving now? Any more problems?

TheGreat.308

Post #20January 22, 2011, 2:58 PM UTC

Jack & Jill, Glad to hear that the logs are clean. PC seems to be ok. Are the firewall and antivirus I have running compatible? They aren't slowing each other down? Not saying that this is happening but I have heard that some programs work against each other. Everything seems to be ok. Thank you.

Jack&Jill

Post #21January 22, 2011, 3:43 PM UTC

Hello TheGreat.308 :),

Are the firewall and antivirus I have running compatible? They aren't slowing each other down? Not saying that this is happening but I have heard that some programs work against each other.

Your combination is OK. I use Avast myself, but complemented by Online Armor. There will be some other recommendations for you later.

——————–

Your Adobe Reader is outdated. Older versions have security vulnerabilities that can be exploited.

Please update your Adobe Reader to the latest.
It is important that you uninstall any previous versions by using Add/Remove Programs in your Control Panel before installing a newer version. Please uninstall:

Adobe Reader 8.2.5

Go to the Adobe download page. Click here.
If your OS is not the same as stated, click on Different language or operating system? link.
- Under the Select an operating system title, click on Select an OS… box and choose the OS that you have.
- Change the language if you want by clicking on English below the Select a language title.
- Press Continue.
- Uncheck (untick) Free McAfee Security Scan (optional).
- Click the Download now button after selecting the latest version.
- Allow if prompted and save the file to a convenient location.
- Run the downloaded file to continue with the installation.
If your OS is the same, uncheck (untick) Free McAfee Security Scan (optional).
Click Download to proceed. Allow if prompted and save the file to a convenient location.
Run the downloaded file to continue with the installation.

——————–

You should always keep your Java updated to the latest version too.

To set for automatic updates of Java, Go to Start > Control Panel.
Double click on the Java icon to open the Java Control Panel.
Click on the Update tab.
Make sure the option Check for Updates Automatically is ticked.
You can also update Java manually via the Update Now button, then continue accordingly.
Click on OK when you are done.

——————–

Congratulations, you are All Clear to go. Glad to hear everything is good and running :). If you have any more problems, please let me know.

Now we need to clear out the programs we have been using to clean up your computer. They are not suitable for general malware removal and could cause damage if used inappropriately.

Run OTL by double clicking on OTL.exe. Click on CleanUp, proceed to reboot if prompted.
Delete the DDS and Rootkit Unhooker files on your desktop.
Delete any logs on the desktop.

Some tips to help you stay clean and safe:

1. Keep your Windows up to date. Enable Automatic Updates for Windows XP to always update the latest security patches from Microsoft, or you can download from the Microsoft website. Otherwise, your computer will be vulnerable to new exploits or malwares.

2. Purge System Restore, for this one time only. A recovery feature will only be useful if it is clean from malwares. See Windows XP System Restore Guide for some detail explanations.

3. Update your Antivirus program regularly, it is a must for constant protection against viruses. If you do not have one, Microsoft Security Essentials, Avast and Avira are some great and free antivirus programs that you can try. For paid versions, Avast, ESET NOD32 and Kaspersky are some good options. Please keep only one AV installed.

4. Install Malwarebytes' Anti-Malware if you haven't and use it occasionally. It is a new and powerful anti-malware tool, totally free but for real-time protection you will have to pay a small one-time fee.

5. Install WinPatrol, a great protection program that helps you monitor for unwanted files or applications.

6. Use a hosts file to block the access of bad sites from your computer. Get yourself a MVPS Hosts for this purpose.

7. Install Web of Trust (WOT). WOT keeps you from dangerous websites with warnings and blockings.

8. Protect your computer from removable or USB drive infections with Panda USB Vaccine, an effective method to prevent malware from spreading.

9. Keep all your softwares updated. Visit Secunia Software Inspector to find out if any updates required.

10. If you have been a victim of malware before, Stand Up and Be Counted —> Malware Complaints <— where you can make difference!

11. Also look up:
Computer Security - a short guide to staying safer online
PC Safety and Security - What Do I Need? By Glaswegian
How to prevent malware: By miekiemoes
So how did I get infected in the first place? By Tony Klein
Microsoft Online Safety

Stay safe.

TheGreat.308

Post #22January 24, 2011, 4:24 AM UTC

Jack & Jill, Thanks for your time and effort in helping me out. I learned a lot and appreciate your time and patience. Thank you, The Great.308

Jack&Jill

Post #23January 24, 2011, 11:45 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

XP runs slloooww

✨ Ask AI

Ask AI