What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

need help with logfile

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Thanks in advance for your help

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:54:22 AM, on 2/16/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\WINDOWS\vVX6000.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Neat Business Cards\exec\NeatReceiptsDBController.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\ProToolbarUpdate.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Documents and Settings\Thad\My Documents\Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro Toolbar BHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [VX6000] C:\WINDOWS\vVX6000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Monitor] "C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [TrendSecure Remote File Lock] C:\Program Files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe /lock
O4 - HKCU\..\Run: [DriverScanner] "C:\Program Files\Uniblue\DriverScanner\launcher.exe" delay 20000
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: NeatReceipts Database Controller - Digital Business Processes - C:\Program Files\Neat Business Cards\exec\NeatReceiptsDBController.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

–
End of file - 9809 bytes
Post #2
Hello and Posted Image

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:
  • Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
  • Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
  • Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!



Run Hijack This
*Double click on the icon on your desktop to launch Hijack This
*Click on the Scan button
*When the scan has finished, please put a check in the box next to the following item:

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


*Make sure all other windows, including your browser are closed, and then click on the Fix Checked button

Please make sure you reboot your computer after completing this step.



HijackThis has largely been replaced by other tools. Since being acquired by TrendMicro, HijackThis has not been regularly updated. Many infections are now able to hide partly, or completely from a HijackThis scan. DDS includes all the scan locations of HijackThis and more.



Download and Run DDS by sUBs

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.




Scan With RootKitUnHooker

  • Please choose one link and download Rootkit Unhooker and save it to your desktop.

    Link 1
    Link 2
    Link 3
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers and Stealth
  • Uncheck the rest. then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished and then click File > Save Report.[/b
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"
Post #5
No, the DDS.txt log should not be gibberish. Can you go ahead and post what it gave you so I can see how it looks? Please copy and paste it from your notepad. Don't worry about the Attach file for now.

Let's try an OTL scan and see if that runs properly:

OTL Custom Scan

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click on Minimal Output at the top
  • Download the following file scan.txt to your Desktop. Right-Click here and choose save to download it.
  • Double click inside the Custom Scan box at the bottom
  • A window will appear saying "Click Ok to load a custom scan from a file or Cancel to cancel"
  • Click the Ok button and navigate to the file scan.txt which we just saved to your desktop
  • Select scan.txt and click Open. Writing will now appear under the Custom Scan box
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic
Post #6
Hi Doris, here is a small fragment of the DDS.txt. the whol thing looks like this. I will post the RKU and OTL logs next. MZ   ÿÿ ¸ @ € º ´ Í!¸LÍ!This program cannot be run in DOS mode. $ PE L +I à  2 n ¦    @     p  ïÖ       ÔW  P ´ .code @  n  PEC2FO à.rsrc P  p à ¸ücS Pdÿ5 d‰% 3À‰PECompact2 VÒËK¬Ç Ñžç†ì¸oTNòË?ÍÆ244½ ¿i)míÞK‚᪆­Ï+:@óîC NÏâ>Ût°ì-dŽ·DS[.‰^ݏ|ó@‘ِtŸ°œP\R-TèqLA™u\ªãh‘žcýŽ¨Dä4fÆi€’™]6ô€nôlúÁ èoä@èAFGÜoµØÞ*ä=³ÖÜ”…à|H¨˜ÕúÏ—«~'VR¯¯¦ î`÷±ïømÛŸÇõIÍÓͬèK1¹UxË>âARÔC)^ØMÝ.!5Ø „šé?î‰Sî& €vŒjulB礪`Á2vŽâ²åÅÖb' ñJ:%Æž5,£à ñ°§h•èØý¾2ôöžø±­ÿ3‘gÛ/C³\Ä.’‚˜š¯ÖÍþ2ÜÜw«iL—­%g³ðž‡Êji]f—ËÞË“@¸U?ú­¿³Í@.HÓ0ß½$UwÕëðGBÂÝœÒÔ£’b]jÚž¥ëõºe ´å•)l •àLz»?j,¤BºÑ›Îówþ`›íâ´ÛUE[Ôƒ¼P×Ïÿ®§‰¼è§FW'• ±Ӛ𜤊­ÿ¦h©ÒÕ2QNסåY2×¢:Ôڏ„"5ý_ˆ:”Ûäœf¾Ëy”Õf½ƈɘ2ˆVöí"î ÿG§¬áà²xª× €ysˆ{[»ã ²›"}êg”+Zµq°p=sA¡á— à0†»žˆþ ù‹’NÄ°Á"…ˆ¶•ÑfC¼0Æ:àâmñôª4‰ˆgÒ3Î %²Û¹àø’ά͢‘ûÖ <ùÁçWŒ¼Øç°èqÍWý¶0¤ñìYÕÞû]éó,A±úƒ¸lB¸¶w$ ͺ¹]¨øag‹Hƒ(Á‚a£ˆIyõµÖŸÄ>Äç(D»µ§ PÂ5Z{qßR9*.…ró“)79§ôØ1;rÜÖTîë5ÚX{½ €;–õÖ· µ‘1 ಴XÌ 0fÆTqÒ{³ „³³×Œ¡ê00|-_»þ ÜÛ¾%¯Åh’µÀ©;s¡ºö?»8PV·z¨¨^Poä²í?&Á%fKù€©xó_IðôÍÂPzêÓPãžâHäi@l0¥Y!¬ç›)Á¼ýßµê”èlöÛåÂ=Ñ*M3|ð ±kÜY®Ÿ6m&鼦 ÑçqÏOÍ–éÔhC˜å’ܾÛÏ æ1=K1Ç T ä±5B˜I¬k‹†ë>ŽyÞIÂ~åÉv +:` Ô 6Ñœ0-npv©±³æp”ÉT¤^ÑáÙ æ}ï•}¤Ç‡qèã¿Scs! FcÝZ4q‰k€h/g↎³5Úäi/ýÖ•>‡í!¹J$¥^õÄ`Sãš÷$Ì(]’Ñ4ã*éÔ\VÜÜɶq9•ÈDº…àÁK3“Œà‰üŒv:32ÞÜ¢ÃûXª¥EÕ²B7ÂŽŸÑbk±.ÜK{ ɱ›æ»v8]e‹ Mp92S -4´‹!/ÌMïÎ[È#ÈC~šò*`"ï±_Ǥ*QÞ­9hm!ÛI¼獚b ;)!Æ¿fÏWJÙriKñ̦#¡Œ¶–B¥Ò”ŠÏšàʱv•äªÆÑ߬qN…“U_5¸&΢Zç“×½£èŽ S»ñ .tP—7îi^ —È›…úŽvþSQÔ!È`[›@ç7zå3´5æñ³¹dD@tüq¬TŽoŸehK³$€òÒ×Çw†!·c²D“zXC©ÃUUY3PøÌÁ”¸¹+Oè"%ïx&1ÔIxM‹âoh*}¡od6®#ê$"~°¹ÒäIX‹šëÚ·lõ®ï©‚ΔֿŽÝÊUF„Io`C&K²49.Ãï!¯Ä+(Öʯ%í0'¹g‹ „"ÅByÈ;OAwdž<.ªYÅœlJûúǐý=¢vž´0/5Ýö¶mÆñj©twÃÃuä.Ø5gê"­þðÊÉ[/›Ë~ðú±|6ÒØ}·…•¢øN›nÇèf±ÏÊ9Ò<ÇÞê?SïÑ‚ÆÓ &.0B½…YžŸ D{NhêÙ½FŸrqiÛ0slò¥¥¼4ü!;ðxÄ xug3eZrœjÐNç#hÓÏû¿ß=ºs`U®=ªcñ a]Ä´u±{¨ \³œ Ö‰æJaò½)ócpj°J»j£àW)ÁÊØên„‹Û§VBû–\k0¤ˆ¥Å:ÌT˜6ÕiŒÍ—­µ­ |‡›“H æ[ŠÕÑTŒòšuë‚5ºÊo¶P¾Eº#å^·´· Ù)¶MUÊ\çíêæà N²¦/Kt!y©Ÿ»®c-ÈÑ ßÖ’äĪ,¨¥e¨Hæ/áCñ½!yØI<µõ£&‰PKó¾ ﮶­gMe›fó®F·Î㦠­ X¿èBc ©ÐO 0Bm¤B€ãh9Ütè…—óí¼u«'¢Êåj£Ê]nÄ—þzŸ#È ­ž2á{+X2ƒˆ1zµóÿ ~ãSà=Âùù|a×uÊOš'ÄÑžØÙ#p“Ågóm÷¥œ‚à5;±ù_vÖÿfôVèðuþ6s–h _¦‰~d2ÞÃý‹À—;]Ã|R°Õ'_U m@G?]Ì)[£‘Bè+;óÂ$x§è44=Q(b §ÂÛ—¿‰®[@UÑ‘åy¤Zî¥ÝÁ$$ûŸqBžÂñb΂zñÙ¸sÂÇkrôúºYŽåÂñ-ïò d£ÆÈÊ5UXI§Á(º©Ã*‡ygk®JB64ZŒG¸7íb'Øú“¹ŒX¦SIÒ¾]²¸AI@ÏòHúƒ¢¹m¬‚HCºXR@³‚dM,M—¦Š„ š7|º¤Ï÷J ‘•|ìµãH™ÊPM‡éoO=²;É2žÕÁßowƒé/øÌÁzi”]ïŽ&콉Ød¿TÄîÒáO/E-߇B?)‹~Ød# .ʉAn¯ ÷kð f)Ò{Œl! ԏ¨¾ÅÃœD%6 ÅÁéfü»\¥ÓTæ^SÐ5ÏwQx£†€ùrnC8@°¿¨mð· Þ¶0ñ š}*ÙÛ¢ 8µÏêó[Ä}™,8Hj†^+& qX ¯³îdDKGÕc0FsvØ7ßXà÷ÿ¬@Ð- \< €XMt ¿ªf¨¨$ãßpëi}O´ÓŒ^_2÷‘ÄÜjnÄШœ×X¢hµõxÉì‘y=2õ¹Ÿuß‹Ó¿‰Ïð¯«îÄiæ·z–—Nõ՝¤Oµv®q?Š„4ë²"¨ Ð#瀤X•Š¬ó¹ ã^â»â¡íÐH95^7XÇÝBÓB[Ä¿jÕ¥ò(?Ú<2 ËðÃzûå.8 øÉO^%??ƒì-0’ ©F¹«0Üà²ÙËñ^F߇¶°ç°Mf–´Î¬›dï,ò2À'—žÉ^ΰR¥È;QVì²V-ɝ?7¬Â8ïÒZéh\cnœòKl°þ€[’Wý©”±{~8W¨ÌUÍzˆËt‰Cp'o*s”!ùgS©Ñóó²,~ Ó⏏{Û9HSI _¿©UÚíaýœpÏÑMàŸ;£j²D%¡úIuìŒj-æ8å/P_ÀÒvïTäÁ[P=*2Èù²V‹í#CÂ%á®9˜2<\¹¤*è8Œmô˜jð%Û*y”Tª% ]vÓ{ä@Y¹äPx"+cËzPå6àÖ»Ô#œÖ°X.í¬ÀaàÊŒøþ eR0R³0_¡L,çÚm”óKBÁxƒ3ëÑ0`2³PëÜ}u¯Àd'åÁš"-,ÊØ4ô_7ÑÂͶì}}ÃI†Ãë|M Îè1šcdrC³^2ý±òCPM4RìÿàhˆÓºƒmKao{”­¢ˆñ“oÍZÅ+$^Ò2QÊ«lN¡j×$õÁ a ìðw+±bEà¸ÔàõSfJ ¯õæqæ%„‘ß·Ü¥ õ¨P ´B vEËh?ñjºü²9ÒÿçBL¨Q¬ò½Ó~ ÀU©´ZsW¿ýÀ‘îš—a’ 5ˆú®DªzˆÇoù$„‘_Œ˜6¤ùo»|_|—ñ2fû•«ØÉò†{Ù·•‰QœëL­bÄû°Päþ÷ŸöwâôãjJ$µ5Ÿ›P> ûÒ¸Ç*Î!‚Õ ä_™™"As»ÚNÿс¬TWµ*èA¦¢ª‡'µï):P°l…d`Ñ_L3EG¸)QWþõV,nýÞÕ:ÕM Ö—ŠrÊ¢sÿÞ.T^* ÷[Kôt¼e!X¨Ýé·!ꙃ'ŒÂK­Õ2ñfBÄÁ•¸®@sã3äf‰vÅþMH讹0‰¢ ÜýÅØgSk ˆ¤æl RÂú"2µô©¬ÐŒô*Xb–)€ K‡}Iá@,[5§§Ÿ>r$±U´‹è2€Äèó ¹~$^¾jX°CýƒúÄw4Tøa%Úþ§ƒUr·±«ól\²ž™<ÝDò z”#.mDË|gX ز£<Žù†1L=ÖâS[†ÖIÆH?ŠNÅ­½½ŒôN?î\lT?cøpDða^¶GtL4®C!®ð:1ÛÔô8_qÑèߝ&eØõxyC‘Θöò6äDŒ•ˆ ©F–wà›ð P?Óí4,He€R@1yÔß‘1v…ÌKQ•h½Hsw7ÍáÏÚ¸*ÂkTÍë±êaÈ Úäå}#ßn?~è^](tÐXJW‚ÑÇÊžÚ“ÖÊó®\´Yw¿MC•²lL¹mÝåçýšÏÒIºf…Aø¥zL  º4ÝÜ~b}’Se8[ sL‡ ïº!3ÎÚ˜ç·CySvòÛžj«Ï¿‡úRÓUÉ^Ä?Ôݬ¬> Ð;aèJbe쉝{šBŸ9ØIdÊjð÷Å‹mOLl”jÒð_„–štÖÚ‹6?ÌVºª˜˜Xt±JËÝ'­Ï²ô>2f³á›v1–7¡É(èuA…§\ø{¼ÖÒÑ–ôKú{› `„ù<Ÿjfdt­ø× ˆØË!Â:ý½ ¬KmÂHt'±c :^Ái¢÷µg‘fdæ ÝfŸ»ÆH>'˜h—Ta»+%f˜'êP©\úóø™Ä¯¹¤±Ö z"èNûŽMíÔ¥:@•è·=BU‚zû—‘AˆáæN÷VôžŽc†•c£È,±W‹õ‚£Sä%$ ˆÝ=õHS(¯ãâLÖýoâ)¯»kN¿oÞ¸Ÿ )µQª+ôèTÔô‡vå ÿ*ñÑÓ…¼p¿/°¢£7 gpü }«û5äá·¹ýBG+’èÑÇÐ=ðQ”SªÇúé)ª9û0[¡žÞ*Ö šplç¯rŒ¼ ¡JÈŸ"ã„¿ÇËFkŸfqë ñ §ˆx´Öx!/+®B-¬7!Qrë5 ²QÈp"HîÌà•à€µJ œÿ„ÐD:2Æ £m[fƒá¯Ý™éä^+'B`$ŸojøeÁh´x4c'P`µ"¥Y!Uð7Ձm“·ŸRD ãò» cõ«”MñŸ¥TuL¨6]Jív€b–^ÿ:‰öw`‹2  ñší! êé¾a:Ük=‰—K‡ú£v&Â"ôqŸ;lZ¯“ʘP|˜1€œ\¦)A-}Æ g‰'ö'º4t°>‹Šž‹¹•ž\Ýo‘q˜Y*ªNˆ±{ صTNRoãû¸À,òg & 3…{’UÍÜíªmÈÓ :s°¶‹JŠˆxK˜£ Ëœ¡‡Í>rìosf™]†>¶u1ËüÏx–ݯÄÎÉ—JÀÄAê„Ôgs4þÑÀ4ˆ×C ›šbh—EuÂÇy®ßŒ'çTYµü„«zîê絺¬ (vaç!) ûeò3á®d7сλÛû¬4Û¿ÐçÐS¸±™€É‹÷ Ø+ ê¬$•ô´Å'A)#ä5¤ºÈØb©zmyÅ3ÕJ ¹Ä°6D˜Ýö—£Ö1w&ùoþÉFÑïÈ?ðÌéåޝ¼ˆCSÝÈÃ×͍̊’i•˜SBæ7„ù„¼v&›üä'mÖê[Zíõn8øþ¯öX±hÂw_9òkäP8˜\±á¥z½¢@ÏŒ:êå ¢;qÏ2ÕÂéåLßîo”*¯ä¥y*P«vhÞ›7³+wëèKå{yPѯ,¿Ö¿5@P:ÍÅ+ê0‘¼x ‡ôª³ìUyï¿/1|ye\…klÜx<¤î†Ëb­ü qö¼øAÑG$îá1'ÓlïRIp_™Ö T¦kïsdkw™½ W:n4ÍñwÈ¥Þא¢™<^p#ÑÀ>-º–æ'JÊL8Py½ÎNŽOÜšmÄ#VÁ²^ø'Y”¥ÖóûÖç@¨ñºœ+Òní²¿•@?ã°ÓÕâ®Ý°¤•ÓR6§Û …àC3ýkÅî3zý* ô0þá*Cºx½j‡¦Cc¶Ñ¡úe±{K ú6`cÁ’ëÄ#e[.!#Õï!!eeÇ[=2„g¨&5b‡³,HžŒ-:Eu=fß~c¡vtçm¼×!­RA¯ªh´1íÿ¼®Úq˜'È䆆|9€—êŠïYw‘Q×9¾‡ÈeHf ëG r”a”DrsÂE@ÅFý†“ K’5wïE†¥z¾Í»Îb¼ ‰6 Îþ1–unÐ2ŽÇ¸¼±]úoت”#âÜ`öÛˆËp œkßï¸?àvÄÜtÅÕ3jQ±L¸¯/º.’æ!ÆäçtvÂÉŠ‘)àÿÔoöÁLä›]v4u _¬4¯_>býîU×÷ –»c-%ô#=eãþËÇû:?ÜÁ'/ÍGYÎv¼æXñêgÔZ^’ h÷|6šÇ`†R@ŒQ¥Èn…ZUS'†Þ+òÎ"9ló_À/¦Pˆ>\yåàôˆ¼XO{Α3i ‘‹ÍÁ?SJœò€E¬^rºÖÏFú—h–Mš<ÆТm1h‡V‡kR ï%¦KrµB¾¡¶/Y˜-k 4E±À4þ•ôõí{ª™û<øÂq7»ÂvXÚ²ò6Ò½SÔ|3‚ÍFêf’B0º`;‰“ö IV=u}®oäÍ`€ëòjlž}]7w|ƒým¼Ë„‡§|–V’ÒX?¦?³6ßÑì’«N¶í5Îú–«3k:§çŽ°®±Ãöü&Ij•P òe©x{¿v¤†Qƒd%é·j¥æýÙ°ÆG Ú9\[¦ ¾Z*™JÚ¹àö 0×! ÔU®-?Š!u’³‚öíѼJƒô+¡ØÒyH~Q¤m…Z4K°MO0ÉÑ?¸oŠ=kË$ê\ZìØlDW–/°ÈoWßWç_dî‹ìõF¹ß¹'\SОŠ2¬æø&h”®õ6ûádî.,bâ²Ûf‘>OË{1”hµ›c»phÊWOð¬°Tuxä·6‡JöÌÚ`pùŠ ÕŽ¬…é2‹U³vÐu;N1¨N¤œèæùéÄg]éßô€ë<Îœï²Ö{BúéQ4ìzF`9ñYg`Z&5/’ÀÜ[L±H%F‘ÿV¶v1 DU¦ŒqOI·•mþ|ïx Rý5Ÿo²%*àÞ1öójdasUÄïç)9DFƍÿ”t<6òe<ÒˆÏpƒÞ{}zzþU§0Å/ƒ¢˜Î¾â ºVîö¸ 3ØØ3°xB£lO;UÉUÐKì(-±c«pDÿiÈžóÈR!¦FçA ›ñ[r]ôËù…V8D†Þ'['¬+e]¡(ü6… «$gX×|‘~Ù”LÓޏcÆQþ ±q gТô)LÇÆÒèªâ®­‹‚¾¼ñ$;Í ï?ʧ™"õø˜Ó ÿ>\·àâ•Z3!ÙƒeX) A‡! Àû(¬DÒŠ-é¶Åb¥@äj[c©ð_)'YR+/¼¯þû«%;P(ž°&Í×óá-Î!«“ü݉¡ªD¿k’TP¹?/gyüAÎ -¶Yû¢µ³OýG=3óN¢ GWȉ”2bwò wî?‰¡W܉ÞÕÎØä· ]âürnô£¨]ÞúCŸÔäå.æXIšxCÏû×~6M»>aea ÏïûcJŠªÓ2f=;}‰=üQô°m­eºֈ䪿·å=,b,g4²C„~$}Ïr›ÛWÅ€¥ççñ–œÑX’afî#¬­¨ké„fhÓ‹`¼ݯ9Ò59†«"”{W¿D™h ´èêYQzø^/àƒ} n¿.pçÖD›åùì™ãúrR]´¯o€fÆ‘f…8±:Wœ™€"¯a“œûå0J®:ékˆ_™þÃX ;íÑÅ·ðôÚ–©~n£ª[§·ÉERÂ^êh¸PìkË»ãÀ½šyêÊ–¤ì#Ñš¡üďqqbnÑòUÁl¼Õkü ç ‘JÕ¼¶Ž8 Î@éè!.w„åxS}P¨Èÿú•3›q¾)FŽô¢¢8¤¤uß„:zK…#. µ@¸àB«ë ) ùwŽnà“N¨Ë‡¤tï°‰ªA„·ÿÌDCrl„§Þ#1ûY?Ø‘9D¼BQa%£_UC‘F°%À:“ï#M†3¸`ñ/Õ÷‡¿‰-` -Wu ¾eXgÅ ÚȵzÏ ¤õŠÔ Æ#:tе®=u”­Kw+àãÄÅ0¨V9¡GîÜܦÒ—ÈÛ}jBÖü#Î ò í¡¢J5¨þŠÎhW>Á•!…†ü}$Úõ½ ¦šE³ä"üývc¸žV†x¦x.zFØ) 2[?Xey{Œ æÒ²ÉËIMÞNêÒêqÜ3qQ+A¬÷êösÅ–S|›f­&'tÅ.’r.逿Ä9éI+A.ä pm¥I ê6]2 þóXCŸ°•Øz;Á”áD~EË° Î-ÇE ƒT¬˜¼ ¦s¨Âí”vú¤Ñ ÿä[ÃÓ€­ÉöiG³ ArP3â‘ù½ÅA–7 Áñ |, =î] Ö‰¥ãn3TRZ·§c7/&)tʼní…CrØtl3`‡àtR{w®ÁÆpë\°á h¿™.ú®"n†ºN $ÒØ`‰üÜ£\ã$Qr†gùO¡ ý«¾÷hÒµC›nˆX̏5Eѯfüñ@ÓSí Å Q]29ÿ'_OaƒÃU”.ß:@‘,p×׉ñJ­34$3ºˆ˜Ø_ œâš%øxr†„ªbtfê¤qá™ïÇ€tÚ9™ÃÓÌ Ÿ:ÿt…²›Ð¦ã%=¢‘8Ÿ¥ý¨ºdZªTWG7„ÁhÉ/;#rÎG³„ ‹tP+æý´/G,éÆ|žQèzÕÓ__ §ýAG”—’ù43âff2lèD­øòYàÀ /šV›ÖÜINh‹ÉüÁS !h½W¡¼ÊÝ"¬— UšÖú8%¹8¡›·j|À2U–d×·cd¬øõV嬇:÷Z½ô\ïù“¸R5ofiÃå¥þn–z´×0ƒŽ!ðÈ"g«¶# Qùì ½n.½´ÅS1Ìbå'}nÂ׆´ŠbIjþ1´ÙwBÿ^3ñ8>‡8à~yÌ«¡Õ¨q}éŽþeÊÎA½[å®WZ6ðî*dJ*þ`GÚ§–°áJÝ­+"½d ôŸ2¼m=uk}³ ù׳éW$¸³£ÍRNaàß4¡Ú¢ 2=ùË híÜp4©Â{„Y.žÜ5n 0NïåôáΘ;®Þéȏ²Ûæ_*öó«ÏÙï3QéˆùÔø57â"Ç o‘øž‚Ì_þœ;~jë ‰súÞ{ 1Á—sñ7 Dù£Ìk… 6:¦XÃþm¨9LAH­¹Yri8€¯Á÷C‚³Nå5yÀ7lr&—‹0NÉ^"…–=Lh²…-\$AâÇvT7(õÇð&0Íz(–<òUÙ—Å…g¡Á¤_‹ÜMЦå#'` [¬P©ìFæ0@:×ß 3JgÌ^÷gä÷Ûµˆß8Å"ºsž“`žr:r ~•™F¡¶Aòq_}DõI#Ì…5[‘©[Esç+çg¼k¼Xu¨ä ¤Êû¬åW=˜lÈúH¦Ÿ~9¨P'Èy"ö=šìŠokÎýŸã«»}[¥‹-Šìõ„†½„MÒ<>:µA”´¢¤Gá…¢ ˆTö¾‰6‚Ô£¬>ꕵïk`iC>'q 6+ÿî{㉺3—¬-QõH˜¢1Yhwñ}¡ 9‘2eýNÛªŽœîs;w"‹]€~Ìa‚ Ëí5ÐmiÁlŸ¶óþqìqŽÛmîp´ 78F¸â‡Œ1qáñv‡/,i„“}=vÉ‹zt›†QƒÐ*ØU þØn ’$I¢ 0òÆ:4ÞT7ró_­3öÛ“}¾cï­ìBæÆçC…¥Î·‘„ДÐ×ܼTùšÀ…{Ü»4»¡Öž²>ÆXýó•dƒðÙænI,(Ùg²Ÿ3¼ Ò˜ p€PØB¬g&AªªZ£Qßà+."éµµTõôâ q_û(Üß·Ç,ð.c l~4àvWjƒvŽØ P ƒ1† -h4}”{ª5VéäØÐ…Í4Á˜U0½„£ Zåf mâ“™)ûoӏ2©ß £N¡kvžúùÑ“ †-€5¤²O]<é·t å{Ó—Iˆb§!ô|‹\4JG~(Aøá}fò‰èM_· ,¢ªÇýíP%¥<86v-po’>xë­A.ž0Ƀüë÷KË×=4ñ°§YƒÉÐ^mZwv@ãXt^UÅbîd,í±e{%U ýŽê?~­[ÇVËÎÍà‘±t†òÔàxÓ@*™Ÿ–kËΠuåN@¯¦kÚ‚o7ÉÏXŔù…UöRæþVÆÔV6Ä=Æ'³â8BU)ù°e¦NÕèÉb9ÚkF²›5a”(ú¹c‹ÄÙç³*‚hô¿jÿTné{ñ!3 ñÊè¤(‡è¤}),ÐV9=¥Vù °: MÎ(ŽqÈI'øž ÒÏ’ÏP…ÌÓz-þËbïj”, bßRÛ~„Ù‰ïvù)Ô$.âó€Ÿ߀ÚÃui"|éûC Ae"Y+Ïz‚XÑsl]«J )¥õHD„ €©?QwÙ7Œ"˜¾¶&Ý7qw#lB³Få¶@¢¥v}ä`¢V€ÛÃâC"á# £ï¾m‘S3¥s—ˆ$f\‡»Ž!ðdPÇþªõ*žY„±Š) ›ψ!J« ¹ý‡-C3ä1£icÁ˜Tg m«0&)/š¸#6Ê=‘mÈ‘N«¯õjËþ´K=9/k˜gM±7‘Ü=  ªÞê"ö¦†q+© Áßòª2q'<ù(éhˆÝ¢l÷GKqôþW¡ âS1šz}*?§íæHº¤=iÜ|8 gé´|[hz %L·Ùïåol‡‡äKy× <ÚåNF!.šêÙ>{§„\3¥g2ç)Hy|XU6ˆ ßgÏ¿w˦D@€ õb¯¹€$.åOž,n¸ÿ=Û¶Ó Mxï£ÓlÒªˆ(:í#âÅF{YáÝ׊åu[.IŒ,U:ª-é±J£¿É̓Ú±pc5/Ʊœº áÀ4VÛ~·•5#]²U(R L ž¯‹o­r&Fñ¾\¦·©¢{‹õPDÓò:8¸Ü'ÿ†…5îU³KÂéB¥ôÜ£'úJÒLÑŠ»ýíÐ;îÞ©^í-´SÈû8€›._4PÅUØÓ—…m¾·ÿ8ä(±©£$2+?B´•ë*3.LúÞðéßá…ü6ÀõGö¶Ä"TK¯—'-m âì¥ÅàÚ½~ïD[û3…¯$*^QY:bËÀ%Ëz ö ´Þt’ó'½ê¥§ÈCMWZïŽf‚Ó!±"XÈS3ìÓ…‹DµÖ4¹µ'È{«|rnU÷»7UÛOÒOÿNi<S5~kn4<-y,c®e“⊜N©ÅWLÏ{¦t#ȁô7Z…P*š‡ÓÓaw xË¢L³r¸“¡'´ÖþÂœ‰hÒø ÇÕ˳Ú-nT€ ·úèòà‚ù8ö»†H6xç­xøbˆåÐÎ3Õï_SY<­åRl`‹¹ü¶û&üÌO;ð½É:¨"/º/1>½Ñ7Ø3·‘ÛöÓ@AîóävD·Q\j!üÖ¸õeóÝø.;6à>‚«óf=­Õ=n/Ê Õ=µGÁõ6Y2è»e½ßrA]*Ú t! ‘Ñ0ØnÕc¿b‚4£4:¶Ar`Ëë¯ÅûS?ËFÿÜ«a¤ä,’P^rRÂ…ú@tã_•ûu¹‹ážóSÛÇ&é3ô"‡â2¬h4ß“‚Æâ´‰*f¥×ðk³rzÅd!O\Z>‡y—>d.[P}ËF¬È,áî@T²ÏË:F"Rs‹>Ty6€’ðzš‰L»½!µ'·]7¡‡Â ä):™šCdÕ¢¸›ÔÈ{HÂÂâÁi4n©:"€Œtï¤k"úÉm÷x%0AUª¬0sÍWü—Ï‘(Ö“Õ ¾åÔ$òäuWá®*+lê‚Â%£Ç¸\`Á°Fsfcº+R—7vrCv¾†e‡ ª\Hòtç™jZÿÈQßA¹œ+~á*Ÿß¾ÅZè¬úK1órê—žá'¤¸¡§,­+´M8ÄþßH¾|BºŒ¹KÌ¥s;NžbòºZs.aöÝ[}kcŒk¼óz#•ûçÜXG™@ xºjÉu°ªe¬r/ªìñF¤°“!d¬ÀÕv1Ñ_p ôkTýÜôô½Mƒ¥JxÀ›œžÃŸ«\®[´¬—XP„*&¹‚þU³Â²FŸNžvŒ äO9ÿ¡'©e…>rëÀp« %~¦CL5©a ©qU7­—ÖtÂRR˜+5Kë aM4JF8šþ^„«kÀ!æÝŸN$ã‹;Š)=ÅŽªW\鵺•ÙÏç!+wZ[óéççÕHÈx¾€Á}Ò×}ÍëÃ×O/»q>懗/ÚgºŽ5’¶¢µ´èñ”Ë]còŽ±¼©a™>FÇàC£Û¸_‘¦ö·šLìXØ«D®Ǐ`ö^º/”2^çÍ=UhÐßÚDCp¬ªŒT°ä$ïÑsÈMΊ  tP>òfC®ÜQHVç`áÀ¦‰À‹ptýЊr…d´ÉFJøïTÐÀçÇT\HÞ«|5~À[¨ßK„®;ס^8v%ât÷Š«Ž§¼òGêÉ1óÀi±®â9WÚ7ûKÀ^øVW^`¶@èôX÷u0ø±¸*jO>‡'ˆ·¹LI?ª lì£älRÏ YÕŠ¤‘>1b¥ø7î&ÂgŽšI×.–ŸVŒ¥4Èd,bËX9šu^z T1-qáè«„ú)”MrxI Ãä3Ö«™öª=¶As®¡™Í"†®b;*lÁ:†3.ÿ]ˆÚyÄK0!Ì`嫳¥D?²~«NñÎ{ù×cþàÓj«´ÃG»xgÑtšzQQ2€B.§™¸œ?z–ãäÀkWVt›uÞo4pë3pÿ=ÔÇ­%9E˜ƒ{ ’J µ -ÿr>;Ÿ\f˜hKÍ3Ô’¢ýÓ®˜ô—ｍû–A¥ébꐢÈ]OI,[sü"Ñ­ûÚ/‹8½Š*§—Q©²Gô‘0½-Z‚îŒñhhó|ëë{8•E«-™=H˜H¡æ¦ ¼[Íd;±9I/vçÍUÚ<&¹ ¬W‹j[ÇÏ!áʽìùõ •j U½võ‘«ëÀM5½´|ƒžCwÙuö6‡Ô4 §‘O¢ÚWeó bJ‚3îïÝ-õ‘{#UâTT` Vvl>Ÿ³`¿‘>²€9ñÖäîzJr4V’ÏëÛr‡H‘Æ/UizÄ0|mÁXVËo«ëÝÆa¶ÿ¸°Å5"ÇÞw9”ÎoJ áR5þ7+.Å`á¡Õ?ä9OÊò:r /hKÙÔ}m@Æþ<6O€¶âU{õ5«½vw©„¬‘³PƒÕýßÈYˆâЬys׎,æM†½lb0lh줸‚Û dÑcàoÖžVì‹ãü*Q¶¥yo¨Næê}S™4i¹Ä€)[ˆ€à±OÃ:FWï7ùæš{6 Ú§ m®3ùíj˜Fð\¶Ó¦4BCÑ¡9æQ*6Ù>Dà×Øä¼ ð•{ÕÆ.©x4én+MȘm•ÝÞ]™®HÈ@dÄDéO` ½üûhë÷S^3¿I‰2‚‡»ßƒzî8à¤TmÖ'±ËýÊN¢¦51Ð V~ÊÅæ¡Æé`¥ Ó·¿>µrëѝç`} _ÈEè+Q°ÖÑ›îɼ©É£pŽCúZg(ÜôÅÉ úQ± MKŠ 2†§À ]ƒ96=¿Èƒ Ö»µˆ»'öÙpŽÎ—ª1ìÖhӕƧdí@ïÚí(ÉWû½´-J+±£É„.Ó™·Íçðâk(G€vKÇÆ…xQ€à{"ŸÈ¶:+ FGtÖÛ æ‚ä©V!É0%XÛk5Õý‘HŠÝ4P§´êYŒŽðk«ž‡‰ÿ€NKïÇՁÒXÃÊ¿U‰µÃ¯þòoü“â¢W ›áufƒc^: 29ò×(u9&#­lNòZÓx2šÞэþ˜…¿¦ˆrÕÂQsF»¥0æó4•œÎCá¾D7× K&]ÌRªxÇÁñéO€*ҝò´GìPxtX3)86ÖÊšóÞ › f]$Õ -¦l†qó$°¶|E4b¢ñèŽ""€$%Ê2Æ~S-™ý"²°ßœÔªòÿÙ÷Ó ß·ÝLh¾ws'|]P[T°„ÀÁâTßB±VÌ¿¡€Z‘\ª€úÖ°öM£D³_"„ä.ŸY‹të¡ñp½Ähçù|êJiŠ&¢Agü“ÐÍž°Kªÿ}2Üh0Q·:îVQ± ~=½yUÿKÞžB‹ÛH›l{Ål|SÒd®n9ÃܪҿÖ8b>!ú2¾ Â`HR €0T"GŒ¼8ÚâÖàÌl•ì÷Ïg›Ü/Ü÷<´U 5¬³tņ#®¯ýãwçõµ=n±/h&”T¤>Zy!úþ÷vœq‡*©aá®W\¤‚A3äå Ú@]È‘(:€£4¼¬ÁÅÆL4v=kÚˆkÕ«bËZ%å¸É­XòÇn,©1ìÂï½—›»œÓ_·fÇ°%ýß'[SR@QKè/˜8Ëg(è8›Òí•M¤,Ö•t¯ŽWÆðtl, SÉ>ØÆ»!•­|8÷°_â$} ‡ ùE>ç†{ìû&¤9ü–63ßµñØïuþœœÕâñud)?ÜOÕ™‹®¡¹µIšÔœâÉhÆ1÷‚;V­÷—Ê*×ÈÝûÐÿãS0ÒsÝ"—UœÖ‚0Mü@Þ|.µ}ìK‘ ¿È Ë£ddÏ#¹Y¥;P#·›6ƒ(æF$ŒeìäÅÂ~4D¹ðÕH˜£!¾¶Êb¬+ö—TÁÛÓ§m…dðß9Ä[†•Ïƒ# p——6“Ú—1ã"¥j&mrz—gpâlòN`ZªÑ〓âÍ¥¬r .±ÊÐ&Ø¿*Œ©³vÃÊE{LÄ,Ü„§nø€HÆÆ«Ûù×ĺ¹ñ$ÐÁhz5ŒuÑ­ƒe;ÛüÕÇ'.üj.Ga ¯ŒúË hýY>¢~>¾Ù‹‰öik!i¾FÝ=E%WÉȶhþr·‰äŽ·#œµÓ³ÿXþ2[¶Ûþó7qÄÞ%vŸ¢ÝtòsqӏÀ„< ?ŽPcq@dBTÆ—ûêb iwõÇøMUb_Û˜Ö þ„OјœÛå9ÑP·ß‹fÆEyÿ‘ÀÍàõ1ûù¼—’k´™bN)²—XýJÍ”gò±ÆJ̏Ÿy @9ü§ ð.2¶åŸ?’-»2šÃÞ|<¿÷¤L«÷¶¡¨ |ÞÜdDµÒØ Ùgôö½HxÉ[wÎ<³¬ì«v‹ Ù „u•Œf€œT~ vUwªs`32RšIË"ŽÃü`‡czm¡/Ž{1ðÅKjßÑÆv"?¥*Rò‘ê>À­ÉÚ}×$á”CjÚÊèd7©DâÿX YÖd’ž¿SÚ; ˜…Õ_|×–ûló³^a݆úiˆêEÚ†}YÛ²„>cÀ䶃Ÿ%ž+ïŒ_ü­Ü8Bç®G¿Õ1ú2MGÁ¾ÔYmlTô sÿ­•ª…eœCÕ'$2þFŽ'^‚`ËΏ-+RÔéY­mQÉÆNàvh³e‡C Ÿ§WÛUJàÓ}%£”Ô /60”§\ÏàAú›ùS¬hA,¹ÀrÓз¦ùæßÔ­Œ Ó·Ø=Ÿª y„sñºx…-FÐUPó¿ªêQœÔ ɝÊGí|£¤¿ª—ë-G®òSþJÖ´ü"ÊuŽîÒd- ¬!ƒLÕå/ú%QQig¥ýÙ®I[½°{”‹^g‚ö¸ÑQ~c7 ~Ã!î…RñeªÜq¬ûJÊAiÙ/ÙÄ£0,Õ¨KL3b%þjžÕ‘ð^Ø­± ý¯¿âß½,gIKñ„:ö‹©1#Ë(¹-ÂuÎ".yRõë(Õ”œôñ¡MlŒ¯>_Ž†Œ#/¾A‚x¡Ø2 ºbSŸK´r4¾N/í4ôåÀÒRmÜØA:Ë«Àü¶%Á’ èô‡HŒâëx ‰î·wë &üD8Óþ~œÅ@Н&˜VU‰^ýÚ:ùø¾¬N$HÅ–~DÚÙ²ªûöAš‚‰°qÔEaMúw¼,À8H#àp¡²HñÚ\Rü±Üì÷ûÚ Q·þ@«ˆÂÌ(o[›¢M ‰¸ÐÚ)½íÁ•rÛ‡t’4äçc’Ɛ , 1w Ov3ð;pE2nS‡ß8çdð‰.¶'Fħ`Á{Gê¥îi)CŒF:ÿéQªéÞáªO2DP( ¹ÆEÁªØM Ú®c7#¡Üx¢(µÏâêD ­ƒão›N-¥œÃ@SWYSÑ”  ÒË»úúŽR™K¶t›8º¤>…^,’í¤ h’ýIϱ®wùM„B§ÖÙÁ¹N¦õļ^Ò ”9“CíU7³ËB‚‡Õې°wE) ?Žy£NêØ, vÑ\ŠÞ-æm^Ë"k-Âë«ál(êÎ¥’dÕ]4¸§žzWF`Ã)w滂ïÐùI¦d2{š™Ë}ÝjëOí+ßᶠ`úvÊ\_…vfPÞ_c‹0áw7Ív/ë¿-ŽXb¥k¸Gæ]Çg?Nw´w«+Ó ˜ xeÞ¼%îâw3?ßSèÊñÛZ¡ÿI-eý¯¸ˆ®š YMÓn‹¶'§¹Èƒ6‘IÜ®N€ Éy8ªT!Œ7ÆZŽóÌ^Åd¢Lè'òùî8üQÙÇ)Š‰h‚„ÕÞЯÃØÕ7ºpÿ–»Äñ©£Œ½ï«»¤¤  :Èj… Nx¢ÇˆÓ”€O+ºß_¨r%Ò3åÅwúïuy›K¾ì ?=aS[ÃŒ–½„÷a™ækk·f¡Þõ>i2¦¾/*·ÚÌ’éšøŸà–hË£ÈÅ&?1Zyv®¶õÚN4QCëºdØ„æï<ˆWyŸ0q —¿Û½uå›ÒÝÞ®³B$Ÿû¦Ñ¹ÌJMênj'/Z ûóÖîu»)jX,×®z ØN¢m—¦”öÞe «‘µ7þIÍwƒìÛiO‡›¦¨ۏWÉUÈŸÑ8±Ä®Á3~EšÍ[UÿÑ þ¼Œ€€ÑŒÊ_ÂýBÁUÐI¡ä3ßhŠ0;Î"DªgÉÅž.x/&µò×ÃÂôLŸ÷à 7—ý”Ð%>!QÆš4Íh;Ñ«ã‡Ê©ÜÀ‚–|¸”"®žÅƒ˜7”æë¹ûÕ_Õ¯Ý3‚Iò§;ê[: Ó¡ÿÖ:­èSÞmû—cü1À֐46î­¿Plµƒ¶ãâÏó>‘õ+6ò‘qeù_‡ËW¿éœG7vLVhbìr C¯î>ÿbòw¢øe ÅÕ òÛýÙW¢Ð¤6øIjmpçR.ðºÉ‹ÙȸSØfàÓ ‚vJòPûl®e> SÞËð¡PBÍ“tڌԞ—¨GÅñ7¨ˆ¼ØÇþê>e„XI‘ùu[šXû-Tù=Šܮݟ$õÑ%Ò¨zý ½Ll 4BLퟯSŽ %`ê»ÁêlÇ\ zIÔý).Ã*™œcò¤Ôwö]ì]fE¸1g,%gh$¨¬„›ÿ}@ï’]ÍÎäh˜úÛI;TÞbÏWn˜N·!“#NñÓDþ[óVÐhÓèœ?q[` A,,½á¾00ø¬g‹îöcÕ3¹œ$·8͸ó7Kö€Öˆô•8$)†›âCdï9èënÄE– lzÚÊl­‡n"óÀ[”00o©ƒÇÌ@%Wc†+á~‹ê#5$ë§ ÎS>Ž‰Žƒ$(ãªþîOI‰¨“š(Qõ)¬k&táH£?hºLŠ^Öˆ$Œiý‡’ñ°„Þ+)Î8hûx>–þ¢(xÆ3ÍhX£Šƒåù#Iµü*ëUG xç?¾ºÓy Hø{tM“¢q€$ȵtE ÄŽgW0xý‚žDòºÍïÁþ$ØãöCóßËi rñ«šò ñŒ£èõ³@l!vµ[%—ÅZÞá|ÔÓ¦òÝÀc§<ôâ’£&t­…'(HìdûEfXàjA¥gÒßÈ7«®D{ˆNykn*)§ò„ýïÅneèôÞq€Ý2òm£Û[«¢Éƒ Ý°÷ø*Åäjt¨)™ûg!vÅw· £î:ñŐ FŒˆÀsØ=IÔ{ç!*ËPáÿõds‰\UÔ}‘Ɛ† ’w6ã‰@¬Úýê#ùmJ,n–æ¸ÞüT+sfH‡ ¸éÅ>ÁNv)?ãzí*«Vê–†ÿš»’˜f9.û©ñ”—õoüøŠ9hâ$Mú`VÀAñÝä¶ÿ‚F8 ñQç4f¹ ô]Ã-:XãÓ-hˆïÒaˆâɃa ŠÚ‘<–åô$—ä ÁQ ha-í*ó´o=—êÿÜ¥ ¯jI]—O¼Fú“Ô @4+7˜ÃéðŽE¬ #á¢l<sZ?åÀÀk8aÖ 3Ï£Œ¿¼Ÿý&ÜÕ¾½µ³¦Q…@·B–cÔÚ˜“.™€¦¾b\‚ó&Ê¢qÿD"GhÕÛ9lôUIj‚»ãxŠðȳ8G{%w&Wvopùï«Ë<™š}ä,-€°Rõ¦y0:ÈJU“p0ÈÜݏCãËb µW—Wbýì‰Òw1a¨6ÁO¬ad¯GÚÿgˆ·l&eg¸Dœ˜‹¡•È ¡ýÝù’˜ùi•Çùú{gÌè<]¾L͉¸•Ä9Бž¿¹'âì™fr|àó{ Æ2ÏÍ’CéE‹ÐdYÞ(ó0Ô’"Æeÿ“ä]Fç1/¡©ÝFt­1îÀž4ÉH>]±÷·{Nl–ÀV‹h^Ðnï^Q::! ¬qº¢æ!„‚ûÄDfÓOßôūǐì¥B ZÕsÒĵÔulj¾tõÜ0÷GÃ&¦ «’îÙì”Í ªfQŸmf C·ánC:‡ÐæIžS(®ÞGÌMÁí«F™­+ö§rAËVY‰ÚßÐTñÊî’"ÂÜ;@Jv/„‚MjÈËåz‹óqo C¬ç§ï:ôwˆI¦Y6{ ºÈNZp›Ïèz¹u€4fŽU*˜üñ46 P[6Y§û[SítÑ,8›V™QðښΤyaEYzï^ ^Áô%¥»eM+¢%•"?må8àJA%£ r e Œ³w:ý> Ä Íᬺ-ùP|⤟¯ ÛèÈsN_U3˜àûÄljàTéع ?Éá¡n<[—ð÷’λ#¤Pýø¿1Œ\{á`þjJ涍‘e1£lC…ömÆc!‹ªŠïá–À×GˆßIBËCï«Ôs½é%m(,P<â½åЈˆ:^I¿ŽßsØÛ—Rsè`eîhðåØ—¿^|ÿæ4o)h‚r.M Il;O dZËòé·å €^>Ž<¯×@·Eñ7‘æÙUÎßò¥ØÙ# hAî|.ÔµJPÊLü”bºmLÕ‹p}äÇ«C%4 ðÞaÊômaÙÌDgg¡4v$†Ðô†ñ ÷L²ßóÀïÛ×4€gÄ–Ár^ßZËÒEö?u ~d›¹LsdýUƒ²ÞmÐ×,ªbjr_ÈJi/b ŒâˆoŽ]®›8`ÝËÒ£è„äMÖ ½“bÀ¯BÔ ¡ë#.…øûÐs#×_“€Úf/ v‡¥.Ï{ûIw„È8ž:Ïðê(©òR÷øIf ï^ ¬’U¥#xBF«ù‰œ—‹.cÜ*Ùšu]ÝJ™£ÁíFTÿ¢tan¨±šÐ†9{Æg4¬#Õ3x`R¨Cm&L/₹Z½«¬eDU¶´Š­Ë‹‹ 4÷ÈPúài²Ý´'’1hX¯ÓBˆ ï¶Qˆ [;µËdã“©\ò.]lŽIHî‡u;Ý Ýšc7‚_ÕÁ.Y&Îõݳ1\¸ëÔòIaœ¹RDÚ¯vŸSšÕjp4ñÜ6’Öž»Å«wÆRþ€œïŸ~3|`F(¦yÜã:¬¹ê»eÖnñW°:êJ÷ú;m&WŸBŒTèW£¸"»;#©Ïp Ù¤U]ˆHÛ?2'O AYZ²ˆÈv¾£Zû92Xj#D™·ç”ütU Á3ÑxåŽüSF¦7:çƶ}Ð]œºÝ¾Ò}‹}cð}k=¢…Ãf´ôÞŒÝmåm|°†èÉìP é  ‡¾Ò{!©§½À½*+˜€…û e:]^"œ)þÍê”ùEF¬‘~}µœuàÛ8 }{FÖîük€ÍhŽ bIà¶8~NWSZ³é9´lTZÒÖ‹ õž0qÄ£Uül„¾â½.†ÚYãëq¥mÞ4ËNt?˜rÁ¡ô  [9j[u3ût‰e²)gˆÚ¶ùxjXG‚¶MàΑ)ÿÖàlDE€^†ðÞ¢5UÝ*ꯧìñº-¸Ûßz#‡§gjaÍÆ£Còº­§ ëOÎQ[gô$E@c •½çŒh\k†ÈÛðÄ Èhuâs–ºGiF·)øLÎÖ#ýAzŸX, €ÙW‰×¥^w±6"ß)i~öÁßõwfA†îoÿ2mr ¡¾>Hi¡‰¶2ÓÚhÕ „¹|Ù6A¤ >éD|Cø' ï`/®F×$Ë.p{AÛ ŒO­\J:r×£Õƒ7éµ¢›¸ôô:ß-sŸ@6 øˆÞ·©†Ïö¯Í‹Ë`PC$ *~Â-¦- ÔÝ 5Fý:mŠÿ|w~ÔpL©þÁ=E[ƒŒ\ÃuÝðf+¨àÈau?Ÿ½@§EÕèR!~³sùZ‹8ÍõÿÛDŠMýSEKSc[ì?‡Í¶êÓ;L¤›ý#Ë©ž»ÕHhšøo;BèBO‘>uà|?ÓîšÔéw¯¯}¾›PNëWUõg!¸¬ÌÄ»ÄéÅå%1Í”’ ç^ŠX ÿªÏMêFð ïÇŽwW½”èK¨—ãtCs2|•ƒª™Ï'›™Í­6%!‹‡ãÔñã1ÚºHh¨ºþkÈþÌû”òñz[G©«…ä¾Ñ«D&ú».».ø™Ô;зß(Æ!*͹3ê †â}¹àÛ¾”Ø—´Ú¬p‘Áxଠ€yìÑŠ¹5Á½ K^Þ57?ønoåý>~YzâêÖÖV¸Ø·"(.9÷ã+ˆÕZ¶õÄtünŒß»… ËO¾š‘ÕñÄûÒ§h¸ãV—Àð0pݪ};z0®s?ÝOUjº *ã—¦Óø®Sƒ#l!ŸŒƒ¿ñª¢rÛ°òošE:~”i}¡Ÿ £ØFAëøˆß›¢!wEöZ¦OBy‚Ï‘”ê ÒPv¹—¯G\7eÞãp’«„t¹Aï‡-|p"k%¾3ÉNpàOPg5ªŸnPŸLA@Ü/»m3ÞÃC2cº]<š•ATª9€¸¡³æsNȌÝßHLòËWa¦“= >¦ò¬8ãÏÔBP¨ðΚ~Ì€Árˆ~iä0Z’èÍÅ]û7ƒyRVÂB¹öw*=LhÓo-&*Tz3î.Ô@r]¼T§PQ¢H Äœqkd¢G…wÇG÷ ¹±º‘$ œo‡Õ,C@•Ñì?ÜÐqˆ¼€¡R¿B†ÁïõþA8–x1ñÜkÿ ý %/c’6ºïU£ZOºo»›Àh˜d˜ç5¹…!‰Ï /›Øï ¿ Wg噂.£ý³1¹/ÖCpÕú0×æ1æy´ÒüŒµšùì¼»øh­O[ªT¤®Pµ)¶ä8{;iÜf¿¤¼kT)ß¹cš’ÜÓ•ƒêx`ö ׫[€ÝƒÚ®&ÏfÔz<Ρ¥‡C„ÅvQù)(ìeeƒÇ„]!žõz¯/!x4giÁ~G3ÍwÌX•7ôi=6᎗|¸›9àØ^|ó"±tŠ¾âiFi‡ýµçÞ3_–þð‰%Ùõ?*©hÁ§pRj€É‡ƒI-¦×ÕN¨KD»‘Ü ’ɪíXYj–ËùI{.˜
Post #7
Hi Doris,

here is the RKU, and the two OTL.txt's

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>Drivers
==============================================
0xBF012000 C:\WINDOWS\System32\nv4_disp.dll 3911680 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 77.74 )
0xB8EA6000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 3198976 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 77.74 )
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2154496 bytes
0x804D7000 RAW 2154496 bytes
0x804D7000 WMIxWDM 2154496 bytes
0xBF800000 Win32k 1855488 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xB8985000 C:\WINDOWS\system32\DRIVERS\TM_CFW.sys 1802240 bytes (Trend Micro Inc., Trend Micro NDIS 5.0 Intermedia Driver (i386-fre))
0xB8C2C000 C:\WINDOWS\system32\DRIVERS\athw.sys 1347584 bytes (Atheros Communications, Inc., Driver for Atheros AR5008 Wireless Network Adapter)
0xA5DB2000 C:\WINDOWS\system32\DRIVERS\vsapint.sys 1327104 bytes (Trend Micro Inc., VsapiNT )
0xAFC8A000 C:\WINDOWS\system32\drivers\ha20x2k.sys 1175552 bytes (Creative Technology Ltd, Creative 20X HAL (WDM))
0xA6E97000 C:\WINDOWS\System32\Drivers\dump_iastor.sys 872448 bytes
0xB9E36000 iastor.sys 872448 bytes (Intel Corporation, Intel Matrix Storage Manager driver)
0xAFB96000 C:\WINDOWS\system32\drivers\ctac32k.sys 638976 bytes (Creative Technology Ltd, Creative AC3 SW Decoder Device Driver (WDM))
0xB9D4A000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xA3E0E000 C:\WINDOWS\system32\Drivers\CVPNDRVA.sys 544768 bytes (Cisco Systems, Inc., Cisco Systems VPN Client IPSec Driver)
0xB8DF0000 C:\WINDOWS\system32\drivers\ctaud2k.sys 516096 bytes (Creative Technology Ltd, Creative WDM Audio Device Driver)
0xA704F000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xB8B6B000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xA7219000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA3C26000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xA5D66000 C:\WINDOWS\system32\DRIVERS\tmxpflt.sys 311296 bytes (Trend Micro Inc., Post Filter For XP)
0xBF3CD000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA2BFE000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xB8D75000 C:\WINDOWS\system32\drivers\ctoss2k.sys 212992 bytes (Creative Technology Ltd., Creative OS Services Driver (WDM))
0xB8BC9000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xAFC5B000 C:\WINDOWS\system32\drivers\emupia2k.sys 192512 bytes (Creative Technology Ltd, E-mu Plug-in Architecture Driver (WDM))
0xB9F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xB8B3D000 C:\WINDOWS\system32\DRIVERS\MarvinBus.sys 188416 bytes (Pinnacle Systems GmbH, Pinnacle Marvin Discrete Bus Enumerator)
0xB9D1D000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xA1539000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xA70BF000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xAFC32000 C:\WINDOWS\system32\drivers\ctsfm2k.sys 167936 bytes (Creative Technology Ltd, SoundFont® Manager (WDM))
0xA71E7000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xB9F23000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xA71C1000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xA1E06000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xB8DCC000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB8E6E000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB8DA9000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xA28C0000 C:\WINDOWS\System32\Drivers\RDPWD.SYS 143360 bytes (Microsoft Corporation, RDP Terminal Stack Driver (US/Canada Only, Not for Export))
0xA719F000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x806E5000 ACPI_HAL 134400 bytes
0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xB9E16000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xB9F49000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xB8C10000 C:\WINDOWS\system32\DRIVERS\dne2000.sys 114688 bytes (Deterministic Networks, Inc., Deterministic Network Enhancer)
0xB9D03000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xB9F0B000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xA5D38000 C:\WINDOWS\System32\DLA\DLAUDFAM.SYS 98304 bytes (Sonic Solutions, Drive Letter Access Component)
0xB9DD7000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB8BF9000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA5D50000 C:\WINDOWS\System32\DLA\DLAIFS_M.SYS 90112 bytes (Sonic Solutions, Drive Letter Access Component)
0xA5D22000 C:\WINDOWS\System32\DLA\DLAUDF_M.SYS 90112 bytes (Sonic Solutions, Drive Letter Access Component)
0xB9DEE000 DRVMCDB.SYS 90112 bytes (Sonic Solutions, Device Driver)
0xA70EA000 C:\WINDOWS\system32\DRIVERS\tmtdi.sys 86016 bytes (Trend Micro Inc., Trend Micro TDI Driver (i386-fre))
0xA40D3000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xB8E92000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xA7272000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xB9E04000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xB9F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xA7522000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xB98ED000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xBA108000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0xB98FD000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xB98DD000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xA7582000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xBA1A8000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xBA118000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0xBA0E8000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xA7512000 C:\WINDOWS\system32\DRIVERS\HPZid412.sys 53248 bytes (HP, IEEE-1284.4-1999 Driver (Windows 2000))
0xB987D000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xBA2F8000 C:\WINDOWS\system32\DRIVERS\tmpreflt.sys 53248 bytes (Trend Micro Inc., Pre-Filter For XP)
0xBA0C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xB9233000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xA816F000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xB98CD000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xBA0B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xB9243000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xBA308000 C:\WINDOWS\System32\Drivers\DRVNDDM.SYS 40960 bytes (Sonic Solutions, Device Driver Manager)
0xBA0A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xBA188000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xB9223000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xBA0D8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xA815F000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xB990D000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xA81AF000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xA819F000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA3428000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xBA0F8000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xA817F000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xBA418000 C:\WINDOWS\system32\drivers\ctprxy2k.sys 32768 bytes (Creative Technology Ltd, Creative Proxy Device Driver (WDM))
0xA877C000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xA78C4000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xBA410000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xBA488000 C:\WINDOWS\System32\DLA\DLABOIOM.SYS 28672 bytes (Sonic Solutions, Drive Letter Access Component)
0xBA420000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xA8794000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xBA328000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xA6FFE000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
0xA6FEE000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xA879C000 C:\WINDOWS\System32\Drivers\DLARTL_N.SYS 24576 bytes (Sonic Solutions, Shared Driver Component)
0xBA428000 C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0xA6FF6000 C:\WINDOWS\system32\DRIVERS\HPZius12.sys 24576 bytes (HP, 1284.4<->Usb Datalink Driver (Windows 2000))
0xBA448000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xBA450000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xBA478000 C:\WINDOWS\system32\drivers\symlcbrd.sys 24576 bytes (Symantec Corporation, Symantec Core Component)
0xACB7E000 C:\WINDOWS\System32\Drivers\TDTCP.SYS 24576 bytes (Microsoft Corporation, TCP Transport Driver)
0xBA408000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xA878C000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xA87AC000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xA8784000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xBA330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xA787C000 C:\WINDOWS\system32\DRIVERS\point32.sys 20480 bytes (Microsoft Corporation, Point32.sys)
0xBA438000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xBA440000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xBA430000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xA6FC6000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xA74D0000 C:\WINDOWS\system32\DRIVERS\AegisP.sys 16384 bytes (Meetinghouse Data Communications, IEEE 802.1X Protocol Driver)
0xB7ABD000 C:\WINDOWS\System32\DLA\DLAOPIOM.SYS 16384 bytes (Sonic Solutions, Drive Letter Access Component)
0xA72C5000 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 16384 bytes (HP, IEEE-1284.4-1999 Print Class Driver)
0xA7787000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xBA598000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xA74CC000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xA7793000 C:\WINDOWS\system32\drivers\pclepci.sys 16384 bytes (Pinnacle Systems GmbH, PCLEPCI)
0xA72C9000 C:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver)
0xBA4B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xA703F000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xA778F000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xA8ADD000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xA3C92000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)
0xA7773000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xBA584000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xA86E5000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xA9323000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xBA604000 C:\WINDOWS\System32\Drivers\DLACDBHM.SYS 8192 bytes (Sonic Solutions, Shared Driver Component)
0xBA5E0000 C:\WINDOWS\System32\DLA\DLAPoolM.SYS 8192 bytes (Sonic Solutions, Drive Letter Access Component)
0xBA5AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xA9325000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xBA5A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xA9321000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xA931F000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xBA60C000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xBA646000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xBA5AA000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xBA769000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xA7218000 C:\WINDOWS\System32\DLA\DLADResN.SYS 4096 bytes (Sonic Solutions, Drive Letter Access Component)
0xACA64000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xA80C9000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xBA670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
WARNING: Virus alike driver modification [Hdaudio.sys]
WARNING: Virus alike driver modification [acpiec.sys]
WARNING: Virus alike driver modification [cpqdap01.sys]
WARNING: Virus alike driver modification [nikedrv.sys]
WARNING: Virus alike driver modification [rio8drv.sys]
WARNING: Virus alike driver modification [riodrv.sys]
WARNING: Virus alike driver modification [ws2ifsl.sys]
WARNING: Virus alike driver modification [CTGAME.SYS]
WARNING: Virus alike driver modification [fsvga.sys]
WARNING: Virus alike driver modification [smclib.sys]
WARNING: Virus alike driver modification [haP16v2k.sys]
WARNING: Virus alike driver modification [haP17v2k.sys]
WARNING: Virus alike driver modification [iqvw32.sys]
WARNING: Virus alike driver modification [tsbvcap.sys]
WARNING: Virus alike driver modification [cinemst2.sys]
WARNING: Virus alike driver modification [atmepvc.sys]
WARNING: Virus alike driver modification [rawwan.sys]
WARNING: Virus alike driver modification [atmuni.sys]
0x03340000 Hidden Image–>com.digitalbp.ipc.dll [ EPROCESS 0x86F648B0 ] PID: 2256, 36864 bytes
WARNING: Virus alike driver modification [StMp3Rec.sys]
WARNING: Virus alike driver modification [wmilib.sys]
WARNING: Virus alike driver modification [tosdvd.sys]
WARNING: Virus alike driver modification [nwlnkspx.sys]
WARNING: Virus alike driver modification [vdmindvd.sys]
WARNING: Virus alike driver modification [rootmdm.sys]
WARNING: Virus alike driver modification [nwlnknb.sys]
WARNING: Virus alike driver modification [parvdm.sys]
WARNING: Virus alike driver modification [ha10kx2k.sys]
WARNING: Virus alike driver modification [mcd.sys]
WARNING: Virus alike driver modification [asctrm.sys]


!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

OTL logfile created on: 2/18/2011 4:22:04 PM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Thad\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 461.78 Gb Total Space | 288.81 Gb Free Space | 62.54% Space Free | Partition Type: NTFS

Computer Name: ONEGIRLAGENCY | User Name: Thad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Thad\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
PRC - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
PRC - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\ProToolbarUpdate.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe (Trend Micro Inc.)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\Program Files\Neat Business Cards\exec\NeatReceiptsDBController.exe (Digital Business Processes)
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft LifeCam\MSCamS32.exe (Microsoft Corporation)
PRC - C:\WINDOWS\vVX6000.exe (Microsoft Corporation
)
PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\system32\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\system32\acs.exe ()
PRC - C:\WINDOWS\system32\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Thad\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\CTAGENT.DLL (Creative Technology Ltd)
MOD - C:\WINDOWS\system32\AcSignIcon.dll (Autodesk)
MOD - C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll (Autodesk)


========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (SfCtlCom) – C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe (Trend Micro Inc.)
SRV - (LeapFrog Connect Device Service) – C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
SRV - (TmProxy) – C:\Program Files\Trend Micro\Internet Security\TmProxy.exe (Trend Micro Inc.)
SRV - (TmPfw) – C:\Program Files\Trend Micro\Internet Security\TmPfw.exe (Trend Micro Inc.)
SRV - (TMBMServer) – C:\Program Files\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (NeatReceipts Database Controller) – C:\Program Files\Neat Business Cards\exec\NeatReceiptsDBController.exe (Digital Business Processes)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (WLSetupSvc) – C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (MSCamSvc) – C:\Program Files\Microsoft LifeCam\MSCamS32.exe (Microsoft Corporation)
SRV - (Autodesk Licensing Service) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk, Inc.)
SRV - (ACS) – C:\WINDOWS\system32\acs.exe ()
SRV - (CVPND) – C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (IAANTMon) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)


========== Driver Services (SafeList) ==========

DRV - (tmxpflt) – C:\WINDOWS\system32\drivers\tmxpflt.sys (Trend Micro Inc.)
DRV - (tmpreflt) – C:\WINDOWS\system32\drivers\tmpreflt.sys (Trend Micro Inc.)
DRV - (vsapint) – C:\WINDOWS\system32\drivers\vsapint.sys (Trend Micro Inc.)
DRV - (tmactmon) – C:\WINDOWS\system32\drivers\tmactmon.sys (Trend Micro Inc.)
DRV - (tmevtmgr) – C:\WINDOWS\system32\drivers\tmevtmgr.sys (Trend Micro Inc.)
DRV - (tmcomm) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (tmcfw) – C:\WINDOWS\system32\drivers\TM_CFW.sys (Trend Micro Inc.)
DRV - (tmtdi) – C:\WINDOWS\system32\drivers\tmtdi.sys (Trend Micro Inc.)
DRV - (FlyUsb) – C:\WINDOWS\system32\drivers\FlyUsb.sys (LeapFrog)
DRV - (BVRPMPR5) – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (AR5416) – C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (61883) – C:\WINDOWS\system32\drivers\61883.sys (Microsoft Corporation)
DRV - (Avc) – C:\WINDOWS\system32\drivers\avc.sys (Microsoft Corporation)
DRV - (MSDV) – C:\WINDOWS\system32\drivers\msdv.sys (Microsoft Corporation)
DRV - (MSTAPE) – C:\WINDOWS\system32\drivers\mstape.sys (Microsoft Corporation)
DRV - (AVCSTRM) – C:\WINDOWS\system32\drivers\avcstrm.sys (Microsoft Corporation)
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (VX6000) – C:\WINDOWS\system32\drivers\VX6000Xp.sys (Microsoft Corporation
)
DRV - (ha20x2k) – C:\WINDOWS\system32\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (AR5211) – C:\WINDOWS\system32\drivers\WPN311.sys (Atheros Communications, Inc.)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (DRVMCDB) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (e1express) Intel® – C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (CVPNDRVA) – C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DRVNDDM) – C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (PinnacleMarvinUsb) – C:\WINDOWS\system32\drivers\MarvinUsb.sys (Pinnacle Systems)
DRV - (iastor) – C:\WINDOWS\system32\drivers\iastor.sys (Intel Corporation)
DRV - (MarvinBus) – C:\WINDOWS\system32\drivers\MarvinBus.sys (Pinnacle Systems GmbH)
DRV - (CVirtA) – C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (PCLEPCI) – C:\WINDOWS\system32\drivers\Pclepci.sys (Pinnacle Systems GmbH)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Zone Labs LLC)
DRV - (DNE) – C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (HSFHWBS2) – C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl;…&channel;=us
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.com/ig/dell?hl=en&cl;…&channel;=us

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?wl=true
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23


FF - HKLM\software\mozilla\Firefox\extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\FirefoxExtension [2010/02/12 17:53:25 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/01/14 12:40:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/24 15:14:58 | 000,000,000 | —D | M]

[2008/08/26 15:41:34 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Thad\Application Data\Mozilla\Extensions
[2011/02/17 17:05:27 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Thad\Application Data\Mozilla\Firefox\Profiles\y8axrbry.default\extensions
[2009/08/09 20:28:09 | 000,000,000 | —D | M] (ANTHEM) – C:\Documents and Settings\Thad\Application Data\Mozilla\Firefox\Profiles\y8axrbry.default\extensions\{07b2a769-ed19-4483-87ce-c643914c9626}
[2007/10/20 07:43:04 | 000,000,000 | —D | M] ("Mostly Crystal") – C:\Documents and Settings\Thad\Application Data\Mozilla\Firefox\Profiles\y8axrbry.default\extensions\{0cdfdd5e-eea6-45ff-b035-81243cf02efb}
[2009/11/28 14:25:01 | 000,000,000 | —D | M] (Gradient xMas) – C:\Documents and Settings\Thad\Application Data\Mozilla\Firefox\Profiles\y8axrbry.default\extensions\{5ec18880-c9dd-11dd-ad8b-0800200c9a66}
[2007/10/20 07:43:04 | 000,000,000 | —D | M] ("Phoenity") – C:\Documents and Settings\Thad\Application Data\Mozilla\Firefox\Profiles\y8axrbry.default\extensions\{88060a48-addf-4060-87db-c9aec3e5615a}
[2009/11/28 08:28:22 | 000,000,000 | —D | M] (PitchDark) – C:\Documents and Settings\Thad\Application Data\Mozilla\Firefox\Profiles\y8axrbry.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66}
[2009/11/28 08:23:57 | 000,000,000 | —D | M] (BloodFire 3) – C:\Documents and Settings\Thad\Application Data\Mozilla\Firefox\Profiles\y8axrbry.default\extensions\[removed]
[2011/02/17 17:05:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/12/27 13:24:04 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2009/03/06 17:11:35 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009/08/13 13:30:41 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2009/11/19 14:16:28 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/11/12 18:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/01/09 12:03:02 | 000,658,056 | —- | M] (Move Networks) – C:\Program Files\Mozilla Firefox\plugins\npmnqmp07010901.dll
[2009/11/19 14:16:29 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
[2008/09/08 17:00:16 | 000,106,128 | —- | M] ( ) – C:\Program Files\Mozilla Firefox\plugins\npstrlnk.dll

O1 HOSTS File: ([2010/02/12 19:56:30 | 000,610,653 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 a9rhiwa.cn #[Google.Warning]
O1 - Hosts: 127.0.0.1 www.a9rhiwa.cn
O1 - Hosts: 127.0.0.1 acezip.net #[SiteAdvisor.acezip.net]
O1 - Hosts: 127.0.0.1 www.acezip.net #[Win32/Adware.180Solutions]
O1 - Hosts: 127.0.0.1 phpadsnew.abac.com
O1 - Hosts: 127.0.0.1 a.abnad.net
O1 - Hosts: 127.0.0.1 b.abnad.net
O1 - Hosts: 127.0.0.1 c.abnad.net #[eTrust.Tracking.Cookie]
O1 - Hosts: 127.0.0.1 d.abnad.net
O1 - Hosts: 127.0.0.1 e.abnad.net
O1 - Hosts: 127.0.0.1 t.abnad.net
O1 - Hosts: 127.0.0.1 z.abnad.net
O1 - Hosts: 127.0.0.1 banners.absolpublisher.com
O1 - Hosts: 127.0.0.1 tracking.absolstats.com
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 gtb5.acecounter.com
O1 - Hosts: 127.0.0.1 gtb19.acecounter.com
O1 - Hosts: 16251 more lines…
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll (Trend Micro Inc.)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (Trend Micro Toolbar) - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll (Trend Micro Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Monitor] C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [UfSeAgnt.exe] C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [VX6000] C:\WINDOWS\vVX6000.exe (Microsoft Corporation
)
O4 - HKCU..\Run: [DriverScanner] File not found
O4 - HKCU..\Run: [TrendSecure Remote File Lock] C:\Program Files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe (Trend Micro Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EditLevel = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCommonGroups = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Thad\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Thad\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/04/20 16:54:00 | 000,000,095 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MJPG - C:\WINDOWS\System32\pvmjpg30.dll (Pegasus Imaging Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe - (BVRP Software)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax DllCmd 4.0.lnk - C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe - (j2 Global Communications, Inc.)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax Tray Menu 4.0.lnk - C:\Program Files\eFax Messenger 4.0\J2GTray.exe - (j2 Global Communications, Inc.)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^j2 4.2.lnk - C:\Program Files\j2 Messenger 4.2\J2GTray.exe - (j2 Global Communications, Inc.)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WPN311 Smart Wizard.lnk - C:\Program Files\NETGEAR\WPN311\wlancfg5.exe - ()
MsConfig - StartUpReg: AudioDrvEmulator - hkey= - key= - C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
MsConfig - StartUpReg: CTDVDDET - hkey= - key= - C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE (Creative Technology Ltd)
MsConfig - StartUpReg: ctfmon.exe - hkey= - key= - File not found
MsConfig - StartUpReg: CTHelper - hkey= - key= - C:\WINDOWS\CTHELPER.EXE (Creative Technology Ltd)
MsConfig - StartUpReg: CTxfiHlp - hkey= - key= - File not found
MsConfig - StartUpReg: DLA - hkey= - key= - File not found
MsConfig - StartUpReg: DMXLauncher - hkey= - key= - C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
MsConfig - StartUpReg: ECenter - hkey= - key= - c:\dell\E-Center\gtb.exe ()
MsConfig - StartUpReg: EPSON Stylus C86 Series - hkey= - key= - File not found
MsConfig - StartUpReg: EPSON Stylus C86 Series (Copy 1) - hkey= - key= - File not found
MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
MsConfig - StartUpReg: IAAnotif - hkey= - key= - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
MsConfig - StartUpReg: IntelliPoint - hkey= - key= - C:\Program Files\Microsoft IntelliPoint\point32.exe (Microsoft Corporation)
MsConfig - StartUpReg: ISUSScheduler - hkey= - key= - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
MsConfig - StartUpReg: j2 4.2 - hkey= - key= - C:\Program Files\j2 Messenger 4.2\J2GDllCmd.exe (j2 Global Communications, Inc.)
MsConfig - StartUpReg: LifeCam - hkey= - key= - C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
MsConfig - StartUpReg: PinnacleDriverCheck - hkey= - key= - File not found
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - File not found
MsConfig - StartUpReg: Symantec PIF AlertEng - hkey= - key= - File not found
MsConfig - StartUpReg: UpdReg - hkey= - key= - C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
MsConfig - StartUpReg: USB2Check - hkey= - key= - File not found
MsConfig - StartUpReg: USBToolTip - hkey= - key= - C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
MsConfig - StartUpReg: VolPanel - hkey= - key= - C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe (Creative Technology Ltd)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0

SafeBootMin: aawservice - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: aawservice - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {1A726475-391F-E205-A0F5-1923DC365311} - Vector Graphics Rendering (VML)
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {4469FF37-6A48-40FB-660C-A0B06A9E5C68} - Internet Explorer
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4b218e3e-bc98-4770-93d3-2731b9329278} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E8FC3EF8-A095-5CC2-55CB-0CD9EDA9438D} - DirectAnimation
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

========== Files/Folders - Created Within 30 Days ==========

[2011/02/18 16:06:10 | 000,602,624 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Thad\Desktop\OTL.exe
[2011/02/16 08:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Thad\My Documents\scope
[2011/02/16 08:47:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Thad\My Documents\dac
[2011/02/15 16:13:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Thad\My Documents\fieldherp
[2011/02/14 11:47:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Thad\My Documents\pete
[2011/02/11 15:04:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2006/04/06 08:00:16 | 000,033,792 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[26 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/02/18 16:06:10 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Thad\Desktop\OTL.exe
[2011/02/18 15:58:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/18 14:37:40 | 000,534,974 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/02/18 14:37:40 | 000,105,038 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/02/18 14:35:28 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/02/18 14:33:25 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/18 14:32:15 | 000,029,204 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2011/02/18 14:31:59 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/02/18 14:31:58 | 2145,546,240 | -HS- | M] () – C:\hiberfil.sys
[2011/02/18 13:24:00 | 000,064,756 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000005-00000000-00000004-00001102-00000005-10031102}.rfx
[2011/02/18 13:24:00 | 000,055,092 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000005-00000000-00000004-00001102-00000005-10031102}.rfx
[2011/02/18 13:24:00 | 000,055,092 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000005-00000000-00000004-00001102-00000005-10031102}.rfx
[2011/02/18 13:24:00 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2011/02/18 13:24:00 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2011/02/18 13:20:39 | 000,133,632 | —- | M] () – C:\Documents and Settings\Thad\Desktop\RKUnhookerLE.EXE
[2011/02/18 13:19:58 | 000,624,128 | —- | M] () – C:\Documents and Settings\Thad\Desktop\dds.scr
[2011/02/16 18:04:24 | 000,013,120 | —- | M] () – C:\Documents and Settings\Thad\Desktop\00040876-00003.png
[2011/02/14 11:21:39 | 000,250,288 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/02/14 09:07:07 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/02/11 15:04:39 | 000,001,542 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/02/11 14:28:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/02/11 01:39:09 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[26 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/02/18 13:20:39 | 000,133,632 | —- | C] () – C:\Documents and Settings\Thad\Desktop\RKUnhookerLE.EXE
[2011/02/18 13:19:51 | 000,624,128 | —- | C] () – C:\Documents and Settings\Thad\Desktop\dds.scr
[2011/02/16 18:04:24 | 000,013,120 | —- | C] () – C:\Documents and Settings\Thad\Desktop\00040876-00003.png
[2011/02/11 15:04:39 | 000,001,542 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/11/11 11:54:42 | 000,000,155 | —- | C] () – C:\WINDOWS\TmProxy.ini
[2010/04/21 08:55:17 | 000,181,176 | —- | C] () – C:\WINDOWS\System32\vpnapi.dll
[2010/04/21 08:55:15 | 000,189,440 | —- | C] () – C:\WINDOWS\System32\CSGina.dll
[2010/03/09 18:03:10 | 000,836,900 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate
[2009/12/30 18:15:32 | 000,015,360 | —- | C] () – C:\WINDOWS\System32\GetInst32.dll
[2009/12/26 18:01:18 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2009/12/26 18:01:18 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\DVResampleru.dll
[2009/12/24 21:03:22 | 002,440,206 | —- | C] () – C:\Documents and Settings\Thad\Local Settings\Application Data\[j0009]-[p01].bmp
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/06/13 10:37:02 | 000,021,791 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2009/06/13 10:37:02 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2009/06/13 10:36:49 | 000,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2009/06/13 10:36:49 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2009/06/13 10:36:49 | 000,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2009/03/14 17:22:18 | 000,595,134 | —- | C] () – C:\Documents and Settings\Thad\Local Settings\Application Data\[j0014]-[p01].bmp
[2009/02/02 18:00:04 | 000,001,823 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/09/07 15:49:46 | 000,015,497 | —- | C] () – C:\WINDOWS\VX6KStd.ini
[2006/12/19 06:15:20 | 000,065,154 | —- | C] () – C:\WINDOWS\System32\instwdm.ini
[2006/10/02 18:59:04 | 000,000,112 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/07/07 16:37:02 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\A5FD5DA9EC.sys
[2006/05/14 18:32:47 | 000,001,359 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/05/14 08:57:48 | 000,003,350 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2006/04/30 19:37:35 | 000,004,096 | —- | C] () – C:\Documents and Settings\Thad\Application Data\dvd.bmk
[2006/04/22 13:57:33 | 000,000,127 | —- | C] () – C:\Documents and Settings\Thad\Local Settings\Application Data\fusioncache.dat
[2006/04/20 17:59:29 | 000,000,017 | —- | C] () – C:\WINDOWS\MovingPicture.ini
[2006/04/20 17:02:16 | 000,194,248 | —- | C] () – C:\WINDOWS\System32\LTRFD13n.DLL
[2006/04/20 16:53:59 | 000,196,096 | —- | C] () – C:\WINDOWS\System32\macd32.dll
[2006/04/20 16:53:59 | 000,138,752 | —- | C] () – C:\WINDOWS\System32\mase32.dll
[2006/04/20 16:53:59 | 000,136,192 | —- | C] () – C:\WINDOWS\System32\mamc32.dll
[2006/04/20 16:53:59 | 000,057,856 | —- | C] () – C:\WINDOWS\System32\masd32.dll
[2006/04/20 16:53:59 | 000,027,648 | —- | C] () – C:\WINDOWS\System32\ma32.dll
[2006/04/18 18:29:38 | 000,031,744 | —- | C] () – C:\Documents and Settings\Thad\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/04/11 18:45:49 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/04/06 08:31:15 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/04/06 08:27:24 | 000,000,218 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/04/06 08:21:21 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/04/06 08:00:16 | 000,050,432 | —- | C] () – C:\WINDOWS\System32\claptn.ini
[2006/04/06 08:00:16 | 000,038,400 | —- | C] () – C:\WINDOWS\System32\CTBurst.dll
[2006/04/06 08:00:16 | 000,000,194 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2006/04/06 08:00:16 | 000,000,053 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2006/04/06 07:59:08 | 000,000,387 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/11/10 05:56:34 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/12/20 17:24:03 | 001,663,068 | —- | C] () – C:\WINDOWS\System32\libmmd.dll
[2004/08/11 14:24:19 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/11 14:11:31 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/11 14:07:24 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/01/07 12:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2006/12/18 18:31:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Autodesk
[2006/04/14 20:50:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.0 Setup
[2008/07/19 14:52:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\j2 Messenger 4.2 Setup
[2010/01/05 12:17:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Leapfrog
[2006/09/08 10:33:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2006/04/15 06:49:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Napster
[2006/04/20 17:49:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pinnacle
[2006/09/24 09:34:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pinnacle Studio
[2010/08/09 15:25:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RegCure
[2010/05/07 20:15:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2007/02/17 18:02:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
[2009/06/16 06:01:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2010/03/31 10:42:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2006/04/06 08:23:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/04/11 15:29:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/04 19:45:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/21 16:50:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/03/31 10:25:12 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2006/12/18 18:35:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Thad\Application Data\Autodesk
[2010/05/09 12:58:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Thad\Application Data\FrontDesign
[2006/04/15 18:43:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Thad\Application Data\Leadertech
[2010/10/22 19:15:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Thad\Application Data\Uniblue

========== Purity Check ==========



< End of report >


OTL Extras logfile created on: 2/18/2011 4:22:04 PM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Thad\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 461.78 Gb Total Space | 288.81 Gb Free Space | 62.54% Space Free | Partition Type: NTFS

Computer Name: ONEGIRLAGENCY | User Name: Thad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"427:UDP" = 427:UDP:*:Enabled:SLP_Port(427)
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"427:UDP" = 427:UDP:*:Enabled:SLP_Port(427)
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"15123:TCP" = 15123:TCP:*:Enabled:RDC

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"D:\setup\HPZnui01.exe" = D:\setup\HPZnui01.exe:*:Enabled:hpznui01.exe
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\LeapFrog\LeapFrog Connect\LeapFrogConnect.exe" = C:\Program Files\LeapFrog\LeapFrog Connect\LeapFrogConnect.exe:*:Enabled:LeapFrog Connect – (LeapFrog Enterprises, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Pinnacle\Studio 10\programs\RM.exe" = C:\Program Files\Pinnacle\Studio 10\programs\RM.exe:*:Enabled:Render Manager – (Pinnacle Systems)
"C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe" = C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe:*:Enabled:Studio – (Pinnacle Systems)
"C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe" = C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile – ( )
"C:\Program Files\Pinnacle\Studio 10\programs\umi.exe" = C:\Program Files\Pinnacle\Studio 10\programs\umi.exe:*:Enabled:umi – (Pinnacle Systems)
"C:\Program Files\Microsoft LifeCam\LifeCam.exe" = C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe – (Microsoft Corporation)
"C:\Program Files\Microsoft LifeCam\LifeExp.exe" = C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe – (Microsoft Corporation)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\PFPortChecker\PFPortChecker.exe" = C:\Program Files\PFPortChecker\PFPortChecker.exe:*:Enabled:PFPortchecker by portforward.com helps check if your ports are properly forwarded. – (portforward.com)
"C:\Program Files\LeapFrog\LeapFrog Connect\LeapFrogConnect.exe" = C:\Program Files\LeapFrog\LeapFrog Connect\LeapFrogConnect.exe:*:Enabled:LeapFrog Connect – (LeapFrog Enterprises, Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{04214FC6-598A-4819-A1BC-7AC88242C437}" = eFax Messenger 4.0
"{062BFFA1-0CCC-400B-B840-F162328D8C00}" = winLAME prerelease4
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data
"{08C5815C-2C6E-44f8-8748-0E61BC9AFB68}" = Symantec KB-DocID:2003093015493306
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA
"{16FD907B-FA72-4F3C-B959-E076C8238F80}" = Napster Label Creator
"{18F11181-EA1A-42AE-AF89-4867C7F7A6FA}" = Sound Blaster X-Fi
"{1A15507A-8551-4626-915D-3D5FA095CC1B}" = Corel Paint Shop Pro X
"{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Roxio MyDVD LE
"{226279A7-64EA-4F0F-897C-AC71596FF525}" = Neat OCR15
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ Beta 4.0
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 23
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (NR2007)
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{32622F02-640A-4335-86FF-557325DC39D4}" = PS_AIO_04_C6300_Software_Min
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{43CAC9A1-1993-4F65-9096-7C9AFC2BBF54}" = Dell CinePlayer
"{4667B940-BB01-428B-986E-A0CC46497BF7}" = ELIcon
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement
"{4CEA6811-DFAD-4892-828D-49941FE3B779}" = Intel® PROSet for Wired Connections
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{5301C483-40FB-4F94-B56E-D7D5A114D2F6}" = Garmin City Navigator North America NT v8
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{548EEA8E-8299-497F-8057-811D2D7097DC}" = Dell Support 3.1
"{5624C000-B109-11D4-9DB4-00E0290FCAC5}" = VPN Client
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{571700F0-DB9D-4B3A-B03D-35A14BB5939F}" = Windows Live Messenger
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5783F2D7-0309-0409-0002-0060B0CE6BBA}" = AutoCAD LT 2005 - English
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
"{63AFACBC-4795-4A1B-8037-5085DC03FC54}" = Microsoft LifeCam
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{64635543-70E7-436D-8D6D-4A721595029E}" = Microsoft IntelliPoint 5.2
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6A012D9C-2E2E-405A-B87C-E909F5297C3F}" = Studio 10 Bonus DVD
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6C08AC4A-81DB-4df9-A1EB-E2027BD4789A}" = j2 Messenger 4.2
"{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}" = Digital Content Portal
"{6E179C77-7335-458D-9537-4F4EAC0181ED}" = Photo Click
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{708F9BEF-2B8C-421D-813E-8CA9EA29B1B8}" = Napster 3.5 MP3 Encoder
"{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}" = Trend Micro Internet Security Pro
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7BD42C12-74D1-4804-B24D-D21E25D4E3CF}" = PS_AIO_04_C6300_ProductContext
"{7C5B62D2-F779-482F-A4DC-A0636B06BCD7}" = LeapFrog Connect
"{7CC978FD-AE31-419D-A7AB-2A137689AE1F}" = OLYMPUS Digital Camera Updater
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
"{8A83AE5F-F59B-4E1F-BF2A-49185A42ED1B}" = LeapFrog My Pals Plugin
"{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Napster Burn Engine
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager
"{91130409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Basic Edition 2003
"{995C90B7-042C-44AF-9219-D9AEA9EAAEED}" = Neat Business Cards Scanner Drivers
"{99832252-D489-4276-B961-6D505CF0AFAA}" = PS_AIO_04_C6300_Software
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9D2B0322-44AE-460E-9283-4D2D7A9205AE}" = Trend Micro Internet Security Pro
"{9EDC4EA1-558A-4297-9BCB-F36E572E6B1D}" = C6300_Help
"{A13A7648-03C5-4B6A-B7C1-18CB04588E52}" = LeapFrog Tag Junior Plugin
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A683A2C0-821C-486F-858C-FA634DB5E864}" = EducateU
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio
"{AB938897-211A-4999-9749-236D2E8E464A}" = NETGEAR WPN311 Wireless Adapter
"{AC0EE5B0-A8FB-4D0A-AF03-2EDC518F841B}" = Dell Media Experience
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B357C4B4-9024-4B64-9B3F-A6729031C3DD}" = SketchUp 5
"{BBBCAE4B-B416-4182-A6F2-438180894A81}" = Napster
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C41F4616-44B6-4E8D-BFC7-4267862A2CE1}" = CinepPlayer 30 Update
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C8732DC3-1736-44b2-B741-2D636DE58605}" = HP Photosmart C6300 All-In-One Driver Software 11.0 Rel .4
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D16B4BE6-8B10-422f-8034-96D1CA9483B5}" = GPBaseService
"{D4250558-4DE6-4342-8865-D397FD66076B}" = C6300
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DF6A589A-7A1A-430C-9FF2-A0BDB42669DC}" = Search Assist
"{E0783143-EAE2-4047-A8D6-E155523C594C}" = Garmin WebUpdater
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF781A5C-58F5-4BFD-87F9-E4F14D382F25}" = Pinnacle Instant DVD Recorder
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F5797F1E-0463-437D-950B-40C7DBA148AB}" = NeatReceipts Database Controller
"{F95F178B-56AD-4fab-87F8-FA81E66C7D68}" = Network
"{FF1482CF-D19B-44DD-B887-9698CB51DFD5}" = Studio 10.8 Patch
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"781745E87AFF80C0C1388CFF79D19ECAB2E9BB47" = Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0)
"8F14F2ECEDE68D26EA515B48DC25B39103C4FE8D" = Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)
"ACT!" = ACT!
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Autodesk DWF Viewer" = Autodesk DWF Viewer
"CNXT_MODEM_PCI_VEN_14F1&DEV;_2F20&SUBSYS;_200F14F1" = Conexant D850 56K V.9x DFVc Modem
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"Dell Game Console" = Dell Game Console
"E77704EF5E71F4F18CADFBFA68595AFE036D5D97" = Windows Driver Package - OLYMPUS IMAGING CORP. Camera Communication Driver Package (09/09/2009 1.0.0.0)
"EPSON Printer and Utilities" = EPSON Printer Software
"Front Panel Designer 3.41" = Front Panel Designer 3.41
"Google Chrome" = Google Chrome
"HijackThis" = HijackThis 2.0.2
"Hollywood FX for Studio" = Pinnacle Hollywood FX for Studio
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"InstallShield_{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{AB938897-211A-4999-9749-236D2E8E464A}" = NETGEAR WPN311 Wireless Adapter
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Move Player_is1" = Move Networks Player for Firefox
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MyPalsPlugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog My Pals Plugin)
"Neat Business Cards" = Neat Business Cards v2.1.0
"NVIDIA Drivers" = NVIDIA Drivers
"PFPortChecker" = PFPortChecker 1.0.28
"proDAD-Heroglyph-2.0" = proDAD Heroglyph 2.0
"PROSet" = Intel® PRO Network Connections Drivers
"RealPlayer 6.0" = RealPlayer
"ST6UNST #1" = Magnetics Inductor Design Using Powder Cores
"StreetPlugin" = Learn2 Player (Uninstall Only)
"TagJuniorPlugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Junior Plugin)
"ToneGen" = NCH Tone Generator Uninstall
"UPCShell" = LeapFrog Connect
"ViewpointMediaPlayer" = Viewpoint Media Player
"WildTangent CDA" = WildTangent Web Driver
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Front Panel Designer" = Front Panel Designer

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/31/2011 10:08:21 AM | Computer Name = ONEGIRLAGENCY | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.3989, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 1/31/2011 10:10:01 AM | Computer Name = ONEGIRLAGENCY | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.3989, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 1/31/2011 5:57:48 PM | Computer Name = ONEGIRLAGENCY | Source = Application Hang | ID = 1002
Description = Hanging application EXCEL.EXE, version 11.0.8328.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 1/31/2011 5:57:59 PM | Computer Name = ONEGIRLAGENCY | Source = Application Hang | ID = 1001
Description = Fault bucket 2058947556.

Error - 2/2/2011 11:40:45 PM | Computer Name = ONEGIRLAGENCY | Source = Application Hang | ID = 1002
Description = Hanging application OUTLOOK.EXE, version 11.0.8326.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 2/2/2011 11:40:55 PM | Computer Name = ONEGIRLAGENCY | Source = Application Hang | ID = 1001
Description = Fault bucket -2136891283.

Error - 2/11/2011 7:12:13 PM | Computer Name = ONEGIRLAGENCY | Source = Bonjour Service | ID = 100
Description = 264: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 2/11/2011 7:12:13 PM | Computer Name = ONEGIRLAGENCY | Source = Bonjour Service | ID = 100
Description = 244: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 2/11/2011 7:12:13 PM | Computer Name = ONEGIRLAGENCY | Source = Bonjour Service | ID = 100
Description = 252: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 2/11/2011 7:12:13 PM | Computer Name = ONEGIRLAGENCY | Source = Bonjour Service | ID = 100
Description = 404: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

[ System Events ]
Error - 2/15/2011 2:39:27 PM | Computer Name = ONEGIRLAGENCY | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 2/15/2011 2:39:27 PM | Computer Name = ONEGIRLAGENCY | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 2/15/2011 2:41:15 PM | Computer Name = ONEGIRLAGENCY | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.

Error - 2/16/2011 12:04:16 PM | Computer Name = ONEGIRLAGENCY | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.

Error - 2/17/2011 11:54:40 AM | Computer Name = ONEGIRLAGENCY | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 2/17/2011 11:54:40 AM | Computer Name = ONEGIRLAGENCY | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 2/17/2011 11:56:25 AM | Computer Name = ONEGIRLAGENCY | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.

Error - 2/18/2011 6:52:42 AM | Computer Name = ONEGIRLAGENCY | Source = TermService | ID = 1006
Description = The terminal server received large number of incomplete connections.
The system may be under attack.

Error - 2/18/2011 5:29:25 PM | Computer Name = ONEGIRLAGENCY | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.

Error - 2/18/2011 6:35:25 PM | Computer Name = ONEGIRLAGENCY | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.


< End of report >
Post #8
Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]
  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Post #9
hey Doris,

here is the combofix log

ComboFix 11-02-19.02 - Thad 02/20/2011 8:46.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1495 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\WhatTheTech\ComboFix.exe
AV: Trend Micro Internet Security Pro *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: Trend Micro Personal Firewall *Disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\service
c:\windows\system32\service\02032010_TIS17_SfFniAU.log
c:\windows\system32\service\05052010_TIS17_SfFniAU.log
c:\windows\system32\service\07052010_TIS17_SfFniAU.log
c:\windows\system32\service\07122010_TIS17_SfFniAU.log
c:\windows\system32\service\17072010_TIS17_SfFniAU.log
c:\windows\system32\service\18022011_TIS17_SfFniAU.log
c:\windows\system32\service\28042010_TIS17_SfFniAU.log
c:\windows\system32\service\29062010_TIS17_SfFniAU.log
c:\windows\system32\service\30062010_TIS17_SfFniAU.log
c:\windows\system32\service\30092010_TIS17_SfFniAU.log
c:\windows\system32\service\31032010_TIS17_SfFniAU.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_USNJSVC
——-\Service_usnjsvc


((((((((((((((((((((((((( Files Created from 2011-01-20 to 2011-02-20 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-10 21:17 . 2010-08-26 20:17 1324 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\d3d9caps.tmp
2011-01-21 14:44 . 2004-08-11 22:00 439296 —-a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2004-08-11 22:00 290048 —-a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:10 . 2004-08-11 22:00 1854976 —-a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2004-08-11 22:00 301568 —-a-w- c:\windows\system32\kerberos.dll
2010-12-20 22:15 . 2004-08-11 22:00 667136 —-a-w- c:\windows\system32\wininet.dll
2010-12-20 22:15 . 2004-08-11 22:00 61952 —-a-w- c:\windows\system32\tdc.ocx
2010-12-20 22:15 . 2004-08-11 22:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2010-12-20 17:26 . 2004-08-11 22:00 730112 —-a-w- c:\windows\system32\lsasrv.dll
2010-12-20 15:30 . 2004-08-11 22:00 369664 —-a-w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2004-08-11 22:00 718336 —-a-w- c:\windows\system32\ntdll.dll
2010-12-09 14:30 . 2004-08-11 22:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2010-12-09 13:42 . 2004-08-11 22:00 2148864 ——w- c:\windows\system32\ntoskrnl.exe
2010-12-09 13:07 . 2004-08-04 03:59 2027008 ——w- c:\windows\system32\ntkrnlpa.exe
2010-11-30 01:38 . 2010-11-30 01:38 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-30 01:38 . 2010-11-30 01:38 69632 —-a-w- c:\windows\system32\QuickTime.qts
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrendSecure Remote File Lock"="c:\program files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe" [2009-07-25 329040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2010-01-26 1020248]
"VX6000"="c:\windows\vVX6000.exe" [2007-04-10 996712]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 249856]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-07-09 7110656]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-09 47904]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-09-28 185688]
"CTHelper"="CTHELPER.EXE" [2006-12-12 19456]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 18944]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 339968]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Cisco Systems VPN Client.lnk - c:\program files\Cisco Systems\VPN Client\vpngui.exe [2010-4-21 1385400]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax DllCmd 4.0.lnk]
backup=c:\windows\pss\eFax DllCmd 4.0.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax Tray Menu 4.0.lnk]
backup=c:\windows\pss\eFax Tray Menu 4.0.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^j2 4.2.lnk]
backup=c:\windows\pss\j2 4.2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WPN311 Smart Wizard.lnk]
backup=c:\windows\pss\NETGEAR WPN311 Smart Wizard.lnkCommon Startup
backupExtension=Common Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDrvEmulator]
2005-11-04 23:07 49152 ——w- c:\program files\Creative\Shared Files\Module Loader\DLLML.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
2003-06-18 06:00 45056 ——w- c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
2006-12-12 17:46 19456 —-a-w- c:\windows\system32\CtHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
2006-03-02 09:00 18944 —-a-w- c:\windows\system32\Ctxfihlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 10:20 122940 —-a-w- c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-11-01 08:12 94208 —-a-w- c:\program files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2006-02-23 00:00 49152 —-a-w- c:\dell\E-Center\GTB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C86 Series]
2003-11-25 10:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2R1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C86 Series (Copy 1)]
2003-11-25 10:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2R1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-03-26 05:27 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2005-06-17 12:56 139264 —-a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
2004-06-03 08:50 204800 —-a-w- c:\program files\Microsoft IntelliPoint\point32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-06-10 15:44 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\j2 4.2]
2006-07-14 20:03 107008 —-a-w- c:\program files\j2 Messenger 4.2\J2GDllCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2007-05-17 21:45 279912 —-a-w- c:\program files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
2004-03-11 08:26 406016 —-a-w- c:\windows\system32\PSDrvCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 06:00 90112 ——w- c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB2Check]
2004-09-21 20:22 73728 —-a-w- c:\windows\system32\PCLECoInst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]
2007-02-20 10:07 199752 —-a-w- c:\program files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VolPanel]
2005-10-14 16:01 122880 ——w- c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\PFPortChecker\\PFPortChecker.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\LeapFrog\\LeapFrog Connect\\LeapFrogConnect.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"427:UDP"= 427:UDP:SLP_Port(427)
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"15123:TCP"= 15123:TCP:RDC

R2 NeatReceipts Database Controller;NeatReceipts Database Controller;c:\program files\Neat Business Cards\exec\NeatReceiptsDBController.exe [5/28/2008 12:56 PM 230744]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2/11/2010 10:59 PM 36432]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2/11/2010 10:59 PM 339984]
S?2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4/8/2010 8:42 PM 136176]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/5/2010 12:49 PM 18560]
S3 MSSQL$NR2007;SQL Server (NR2007);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [5/27/2009 2:27 AM 29262680]
S3 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2/12/2010 5:52 PM 51792]
S3 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [2/12/2010 5:53 PM 497008]
S3 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2/12/2010 5:53 PM 689416]
S3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\drivers\VX6000Xp.sys [9/7/2008 3:49 PM 2385896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2011-02-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50]

2011-02-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 04:42]

2011-02-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 04:42]
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://www.dell.com
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Thad\Application Data\Mozilla\Firefox\Profiles\y8axrbry.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - user.js: yahoo.homepage.dontask - true
.
.
——- File Associations ——-
.
.scr=AutoCADLTScriptFile
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DriverScanner - c:\program files\Uniblue\DriverScanner\launcher.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-Symantec PIF AlertEng - c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-20 09:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1204)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
c:\windows\system32\acs.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTsvcCDA.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Intel\Intel Matrix Storage Manager\iaantmon.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\LeapFrog\LeapFrog Connect\CommandService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Trend Micro\Internet Security\SfCtlCom.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Trend Micro\TrendSecure\TISProToolbar\ProToolbarUpdate.exe
c:\windows\system32\imapi.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Trend Micro\BM\TMBMSRV.exe
.
**************************************************************************
.
Completion time: 2011-02-20 09:04:22 - machine was rebooted
ComboFix-quarantined-files.txt 2011-02-20 17:04

Pre-Run: 309,997,670,400 bytes free
Post-Run: 309,917,339,648 bytes free

- - End Of File - - C3EC3880462E32E9E6073496E46014B1
Post #10
Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Click the green ESET Online Scanner button.
Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
Click on the Start button next to it.
You may receive an alert on the address bar that "This site might require the following ActiveX control…Click here to install…". Click on that alert and then click Insall ActiveX component.
A new window will appear asking "Do you want to install this software?"".
Answer Yes to download and install the ActiveX controls that allows the scan to run.
Click Start.
Check Remove found threats and Scan potentially unwanted applications.
Click Scan to begin.
If offered the option to get information or buy software. Just close the window.
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.



Please let me know how the computer is running now.
Post #11
hi Doris, here is the mbam and the eset log… computer seems to be running good. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5822 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 2/20/2011 12:31:06 PM mbam-log-2011-02-20 (12-31-06).txt Scan type: Quick scan Objects scanned: 192139 Time elapsed: 12 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ESETSmartInstaller@High as downloader log: all ok can not get scanner. e_gle=1001 DLL:pipe not connected. attempts=120 can not get scanner. e_gle=1001 DLL:pipe not connected. attempts=120 ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6419 # api_version=3.0.2 # EOSSerial=febd093547301c4ba0b93d65850f0971 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-02-21 12:16:20 # local_time=2011-02-20 04:16:20 (-0800, Pacific Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=516 16774502 100 100 0 32833722 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=143560 # found=0 # cleaned=0 # scan_time=4025
Post #12
I'm glad to hear things are running better.


[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 24 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 24 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u24 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u24-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


Update Adobe Reader
There have been updates to Adobe Reader to address security vulnerabilities. You should download the latest version from the Adobe website.


The following will implement some cleanup procedures as well as reset System Restore points:
  • Click Start > Run
  • Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]


Now to remove most of the tools that we have used in fixing your machine:
  • Run OTL.exe
  • This time, click on the CleanUp button.

If you notice any remaining tools or files you can delete them by right clicking and choosing delete.



Are you still having issues with the DVD player? Since there won't be any logs to post after these instructions, please just let me know when you have completed them.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI