webster10
Hi
The lack of internet access seems to be the only issue.
It certainly is the major issue.
The lack of internet access seems to be the only issue.
It certainly is the major issue.
Spyware / Malware / Virus Removal
Smart Fortress 2012
278 min read
oldman960
Hi webster10,
Let's see if can find what's been changed.
Please download Farbar Service Scanner, transfer it to the effected computer.
Let's see if can find what's been changed.
Please download Farbar Service Scanner, transfer it to the effected computer.
- double click the file to run it
- make sure Internet Service is checked (RpcSs and PlugPlay should be checked by default and greyed out)
- Press "Scan".
- It will create a log (FSS.txt) in the same directory the tool is run.
- Please copy and paste the log to your reply.
webster10
Farbar Service Scanner Version: 17-05-2012
Ran by [removed] (administrator) on 21-05-2012 at 17:29:38
Running from "A:\"
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.
Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error: Google IP is unreachable
Attempt to access Yahoo IP returned error: Yahoo IP is unreachable
File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit
Extra List:
=======
Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3) TMPassthru(9)
0x090000000400000001000000020000000300000005000000060000000700000008000000090000
00
IpSec Tag value is correct.
**** End of log ****
oldman960
Hi webster10,
Click the start button > run
Click the start button > run
- in the run box type services.msc and clcik ok
- locate DHCP Client
- right click on it and click properties
- makes sure the statrup type is automatic
- in the Service Status section click the Start button
webster10
Received dialogue box with message:
Could not start the DHCP Client servie on Lcal Computer.
Error 1083: The executable program that this service is configured to run
in does not implement the service.
oldman960
Hi webster10,
Copy and paste the following into a notepad and transfer it to the sick computer. Do not copy the word CODE , please note the script starts with the :
Open SystemLook and transfer the text from the notepad to SysytemLook.
Click the Look button. Please post the log produced.
Thanks
Copy and paste the following into a notepad and transfer it to the sick computer. Do not copy the word CODE , please note the script starts with the :
:Reg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP /s
Open SystemLook and transfer the text from the notepad to SysytemLook.
Click the Look button. Please post the log produced.
Thanks
webster10
SystemLook 30.07.11 by jpshortstuff
Log created at 18:53 on 23/05/2012 by Administrator
Administrator - Elevation successful
========== Reg ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP]
"Type"= 0x0000000020 (32)
"Start"= 0x0000000002 (2)
"ErrorControl"= 0x0000000001 (1)
"ImagePath"="%SystemRoot%\system32\svchost.exe -k netsvcs"
"DisplayName"="DHCP Client"
"Group"="TDI"
"DependOnService"="Tcpip Afd NetBT"
"DependOnGroup"=" "
"ObjectName"="LocalSystem"
"Description"="Manages network configuration by registering and updating IP addresses and DNS names."
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Configurations]
"Options"=32 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ff ff ff 7f 00 00 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ff ff ff 7f 00 00 00 00 (REG_BINARY)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Linkage]
(No values found)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Linkage\Disabled]
(No values found)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters]
"ServiceDll"="%SystemRoot%\System32\dhcpcsvc.dll"
"{5878ED82-8067-4FB7-8358-F18C917B1CE0}"=2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 c8 17 41 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 c8 17 41 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 c8 17 41 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 c8 17 41 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 c8 17 41 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 c8 17 41 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 c8 17 41 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 c8 17 41 (REG_BINARY)
"{293A756F-F0E8-4250-BFB4-F00ACF54F34F}"=36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 f4 4f 99 4f c0 a8 01 01 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 f4 4f 99 4f 00 01 51 80 06 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 00 f4 4f 99 4f 18 d9 00 05 18 d9 c9 43 18 f7 0f 35 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 f4 4f 99 4f c0 a8 01 01 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 f4 4f 99 4f ff ff ff 00 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 f4 4f 99 4f 05 00 00 00 (REG_BINARY)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options]
(No values found)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\1]
"KeyType"= 0x0000000007 (7)
"RegLocation"="SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpSubnetMaskOpt SYSTEM\CurrentControlSet\Services\?\Parameters\Tcpip\DhcpSubnetMaskOpt"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\15]
"KeyType"= 0x0000000001 (1)
"RegLocation"="SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDomain SYSTEM\CurrentControlSet\Services\TcpIp\Parameters\DhcpDomain"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\220]
"KeyType"= 0x0000000003 (3)
"VendorType"= 0x0000000001 (1)
"RegSendLocation"="SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\SoHRequest"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\3]
"KeyType"= 0x0000000007 (7)
"RegLocation"="SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDefaultGateway SYSTEM\CurrentControlSet\Services\?\Parameters\Tcpip\DhcpDefaultGateway"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\44]
"KeyType"= 0x0000000001 (1)
"RegLocation"="SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_?\DhcpNameServerList SYSTEM\CurrentControlSet\Services\NetBT\Adapters\?\DhcpNameServer"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\46]
"KeyType"= 0x0000000004 (4)
"RegLocation"="SYSTEM\CurrentControlSet\Services\NetBT\Parameters\DhcpNodeType"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\47]
"KeyType"= 0x0000000001 (1)
"RegLocation"="SYSTEM\CurrentControlSet\Services\NetBT\Parameters\DhcpScopeID"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\6]
"KeyType"= 0x0000000001 (1)
"RegLocation"="SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpNameServer SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\DhcpNetbiosOptions]
"KeyType"= 0x0000000004 (4)
"OptionId"= 0x0000000001 (1)
"VendorType"= 0x0000000001 (1)
"RegLocation"="SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_?\DhcpNetbiosOptions"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Security]
"Security"=01 00 14 80 90 00 00 00 9c 00 00 00 14 00 00 00 30 00 00 00 02 00 1c 00 01 00 00 00 02 80 14 00 ff 01 0f 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 8d 01 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 18 00 fd 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 2c 02 00 00 00 00 18 00 ff 01 0f 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 fd 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 (REG_BINARY)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Enum]
"0"="Root\LEGACY_DHCP\0000"
"Count"= 0x0000000001 (1)
"NextInstance"= 0x0000000001 (1)
-= EOF =-
thank you.
oldman960
Hi webster10,,
Try this click start > run
In the run box type the following and hit enter
regsvr32 dhcpcsvc.dll
note the space after 32
Note any messages recieved.
Go back into services.msc and try to start DHCP Client
Click the start button > run
Reboot the computer
Try this click start > run
In the run box type the following and hit enter
regsvr32 dhcpcsvc.dll
note the space after 32
Note any messages recieved.
Go back into services.msc and try to start DHCP Client
Click the start button > run
- in the run box type services.msc and clcik ok
- locate DHCP Client
- right click on it and click properties
- makes sure the statrup type is automatic
- in the Service Status section click the Start button
Reboot the computer
webster10
Hi
I ran regsvr and received message
dhcpcsvc.dll was loaded, but the DllRegisterServer entry point was not found.
This file can not be resitered.
When I ran msc, I again had a dialogue box with error message:
Could not start the DHCP Client service on Local Computer.
Error 1083: The executable program that this service is
configured to run in does not
implement the service.
oldman960
Hi webster10,
Either SystemLook made an error or the forum software corrupted one of the logs you posted. Or there actually is a problem with a registry entry which would explain the problem with the service.
Let's do this and see what happens.
One the working computer:
Open a new Notepad session
This will create a fix.reg file on your desktop [external image: Posted Image]
Transfer the file to the sick computer's desktop.
On the sick computer
To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.
Reboot the computer. Can you now connect to the internet?
Either SystemLook made an error or the forum software corrupted one of the logs you posted. Or there actually is a problem with a registry entry which would explain the problem with the service.
Let's do this and see what happens.
One the working computer:
Open a new Notepad session
- Click the Start button, click run
- in the run box type notepad
- click ok
- In the notepad, Click "Format" and be certain that Word Wrap is not checked.
- Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE
REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost] "netsvcs"=- "netsvcs"=hex(7):41,70,70,4D,67,6D,74,00,41,75,64,69,6F,53,\ 72,76,00,42,49,54,53,00,42,72,6F,77,73,65,72,00,43,72,79,70,74,53,76,\ 63,00,44,68,63,70,00,64,6D,73,65,72,76,65,72,00,45,52,53,76,63,00,45,\ 76,65,6E,74,53,79,73,74,65,6D,00,46,61,73,74,55,73,65,72,53,77,69,74,\ 63,68,69,6E,67,43,6F,6D,70,61,74,69,62,69,6C,69,74,79,00,68,65,6C,70,\ 73,76,63,00,48,69,64,53,65,72,76,00,68,6B,6D,73,76,63,00,49,6E,74,75,\ 69,74,55,70,64,61,74,65,53,65,72,76,69,63,65,00,6C,61,6E,6D,61,6E,73,\ 65,72,76,65,72,00,6C,61,6E,6D,61,6E,77,6F,72,6B,73,74,61,74,69,6F,6E,\ 00,4D,65,73,73,65,6E,67,65,72,00,6E,61,70,61,67,65,6E,74,00,4E,65,74,\ 6D,61,6E,00,4E,6C,61,00,4E,74,6D,73,53,76,63,00,52,61,73,41,75,74,6F,\ 00,52,61,73,4D,61,6E,00,52,65,6D,6F,74,65,41,63,63,65,73,73,00,53,63,\ 68,65,64,75,6C,65,00,73,65,63,6C,6F,67,6F,6E,00,53,45,4E,53,00,53,68,\ 61,72,65,64,41,63,63,65,73,73,00,53,68,65,6C,6C,48,57,44,65,74,65,63,\ 74,69,6F,6E,00,73,72,73,65,72,76,69,63,65,00,54,61,70,69,53,72,76,00,54,\ 68,65,6D,65,73,00,54,72,6B,57,6B,73,00,57,33,32,54,69,6D,65,00,77,69,\ 6E,6D,67,6D,74,00,57,6D,64,6D,50,6D,53,4E,00,57,6D,69,00,77,73,63,73,\ 76,63,00,77,75,61,75,73,65,72,76,00,57,5A,43,53,56,43,00,78,6D,6C,70,\ 72,6F,76,00,7A,38,30,30,6F,62,65,78,00,00,00
- Ensure there is no space above the REGEDIT4.
- ensure the text matches including the space between lines
- in notepad go to FILE > SAVE AS and in the dropdown box, set the top box SAVE IN to DESKTOP
- in the FILE NAME box type (including the " " marks), "fix.reg"
This will create a fix.reg file on your desktop [external image: Posted Image]
Transfer the file to the sick computer's desktop.
On the sick computer
To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.
Reboot the computer. Can you now connect to the internet?
webster10
Hi
I am typing this reply from the formerly sick computer
which now has internet capability again.
THANK YOU.
webster10
It is however running slowly.
IE and Firefox are slow to launch.
And once launched, tend to lock up soon.
oldman960
Hi webster10,
I don't know how that registry entry got mangled like that but that seems to be what that particular problem was.
Let's get some new OTL log and perhaps we can get back to where we were before.
Open OTL if you still have it on the computer otherwise you can get a new copy from HERE
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
I don't know how that registry entry got mangled like that but that seems to be what that particular problem was.
Let's get some new OTL log and perhaps we can get back to where we were before.
Open OTL if you still have it on the computer otherwise you can get a new copy from HERE
- When the window appears, underneath Output at the top change it to Standard Output
- Change the file age to 60 days
- Check the boxes beside LOP Check and Purity Check.
- In the Extra Registry section change it to All
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
webster10
OTL logfile created on: 5/28/2012 7:17:37 PM - Run 8
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
502.80 Mb Total Physical Memory | 309.27 Mb Available Physical Memory | 61.51% Memory free
843.57 Mb Paging File | 598.20 Mb Available in Paging File | 70.91% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 17.85 Gb Free Space | 47.89% Space Free | Partition Type: NTFS
Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
========== Processes (SafeList) ==========
PRC - [2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2011/08/09 17:02:04 | 001,176,064 | —- | M] (W3i, LLC) – C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
PRC - [2011/05/04 09:07:58 | 000,196,320 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
PRC - [2011/05/04 09:07:58 | 000,138,640 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
PRC - [2011/02/10 09:00:24 | 000,116,752 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
PRC - [2011/02/10 08:57:40 | 001,035,512 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe
PRC - [2010/01/15 07:49:20 | 000,255,536 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2008/11/06 11:33:56 | 000,288,088 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2005/06/07 00:46:24 | 000,057,344 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
========== Modules (No Company Name) ==========
MOD - [2011/05/04 09:08:30 | 000,174,432 | —- | M] () – C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll
MOD - [2011/05/04 09:08:05 | 000,442,368 | —- | M] () – C:\Program Files\Trend Micro\AMSP\sqlite3.dll
MOD - [2011/05/04 09:08:01 | 001,081,344 | —- | M] () – C:\Program Files\Trend Micro\AMSP\libprotobuf.dll
MOD - [2011/05/04 09:07:58 | 000,057,344 | —- | M] () – C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll
MOD - [2011/05/04 09:07:58 | 000,049,152 | —- | M] () – C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll
MOD - [2009/04/27 16:49:26 | 000,093,696 | —- | M] () – C:\Program Files\FileZilla FTP Client\fzshellext.dll
MOD - [2006/12/11 15:12:04 | 000,176,235 | —- | M] () – C:\WINDOWS\system32\Primomonnt.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Stopped] – %systemroot%\system32\rollbackclientservice.dll – (z800obex)
SRV - File not found [Auto | Stopped] – %systemroot%\system32\imaservice.dll – (IntuitUpdateService)
SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - File not found [Auto | Running] – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe – (Amsp)
SRV - [2010/01/15 07:49:20 | 000,227,232 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe – (McComponentHostService)
SRV - [2008/11/06 11:33:54 | 000,582,992 | —- | M] (Trend Micro Inc.) [Auto | Stopped] – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe – (RUBotted)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\jgh\catchme.sys – (catchme)
DRV - File not found [File_System | Boot | Stopped] – system32\drivers\21461316.sys – (76851537)
DRV - [2010/05/10 13:41:30 | 000,067,656 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2010/02/17 13:25:48 | 000,012,872 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys – (SASDIFSV)
DRV - [2008/03/02 03:28:00 | 000,206,608 | —- | M] (Trend Micro Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\TMPassthru.sys – (TMPassthruMP)
DRV - [2008/03/02 03:28:00 | 000,206,608 | —- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\TMPassthru.sys – (TMPassthru)
DRV - [2004/10/07 20:16:04 | 000,035,840 | —- | M] (Oak Technology Inc.) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\AFS2K.SYS – (AFS2K)
DRV - [2004/08/03 19:29:50 | 000,019,455 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wvchntxx.sys – (iAimFP4)
DRV - [2004/08/03 19:29:48 | 000,012,063 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wsiintxx.sys – (iAimFP3)
DRV - [2004/08/03 19:29:46 | 000,025,471 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv10nt.sys – (iAimTV5)
DRV - [2004/08/03 19:29:46 | 000,023,615 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wch7xxnt.sys – (iAimTV4)
DRV - [2004/08/03 19:29:46 | 000,022,271 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv06nt.sys – (iAimTV6)
DRV - [2004/08/03 19:29:44 | 000,033,599 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv04nt.sys – (iAimTV3)
DRV - [2004/08/03 19:29:44 | 000,019,551 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv02nt.sys – (iAimTV1)
DRV - [2004/08/03 19:29:42 | 000,029,311 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv01nt.sys – (iAimTV0)
DRV - [2004/08/03 19:29:42 | 000,011,871 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv09nt.sys – (iAimFP7)
DRV - [2004/08/03 19:29:40 | 000,011,807 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv07nt.sys – (iAimFP5)
DRV - [2004/08/03 19:29:40 | 000,011,295 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv08nt.sys – (iAimFP6)
DRV - [2004/08/03 19:29:38 | 000,161,020 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\i81xnt5.sys – (i81x)
DRV - [2004/08/03 19:29:38 | 000,012,415 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv01nt.sys – (iAimFP0)
DRV - [2004/08/03 19:29:38 | 000,012,127 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv02nt.sys – (iAimFP1)
DRV - [2004/08/03 19:29:38 | 000,011,775 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv05nt.sys – (iAimFP2)
DRV - [2004/06/29 04:07:18 | 001,268,204 | —- | M] (Agere Systems) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2002/04/04 01:32:06 | 000,028,416 | R— | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\drivers\symmpi.sys – (Symmpi)
========== Standard Registry (SafeList) ==========
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
502.80 Mb Total Physical Memory | 309.27 Mb Available Physical Memory | 61.51% Memory free
843.57 Mb Paging File | 598.20 Mb Available in Paging File | 70.91% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 17.85 Gb Free Space | 47.89% Space Free | Partition Type: NTFS
Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
========== Processes (SafeList) ==========
PRC - [2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2011/08/09 17:02:04 | 001,176,064 | —- | M] (W3i, LLC) – C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
PRC - [2011/05/04 09:07:58 | 000,196,320 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
PRC - [2011/05/04 09:07:58 | 000,138,640 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
PRC - [2011/02/10 09:00:24 | 000,116,752 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
PRC - [2011/02/10 08:57:40 | 001,035,512 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe
PRC - [2010/01/15 07:49:20 | 000,255,536 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2008/11/06 11:33:56 | 000,288,088 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2005/06/07 00:46:24 | 000,057,344 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
========== Modules (No Company Name) ==========
MOD - [2011/05/04 09:08:30 | 000,174,432 | —- | M] () – C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll
MOD - [2011/05/04 09:08:05 | 000,442,368 | —- | M] () – C:\Program Files\Trend Micro\AMSP\sqlite3.dll
MOD - [2011/05/04 09:08:01 | 001,081,344 | —- | M] () – C:\Program Files\Trend Micro\AMSP\libprotobuf.dll
MOD - [2011/05/04 09:07:58 | 000,057,344 | —- | M] () – C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll
MOD - [2011/05/04 09:07:58 | 000,049,152 | —- | M] () – C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll
MOD - [2009/04/27 16:49:26 | 000,093,696 | —- | M] () – C:\Program Files\FileZilla FTP Client\fzshellext.dll
MOD - [2006/12/11 15:12:04 | 000,176,235 | —- | M] () – C:\WINDOWS\system32\Primomonnt.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Stopped] – %systemroot%\system32\rollbackclientservice.dll – (z800obex)
SRV - File not found [Auto | Stopped] – %systemroot%\system32\imaservice.dll – (IntuitUpdateService)
SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - File not found [Auto | Running] – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe – (Amsp)
SRV - [2010/01/15 07:49:20 | 000,227,232 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe – (McComponentHostService)
SRV - [2008/11/06 11:33:54 | 000,582,992 | —- | M] (Trend Micro Inc.) [Auto | Stopped] – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe – (RUBotted)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\jgh\catchme.sys – (catchme)
DRV - File not found [File_System | Boot | Stopped] – system32\drivers\21461316.sys – (76851537)
DRV - [2010/05/10 13:41:30 | 000,067,656 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2010/02/17 13:25:48 | 000,012,872 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys – (SASDIFSV)
DRV - [2008/03/02 03:28:00 | 000,206,608 | —- | M] (Trend Micro Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\TMPassthru.sys – (TMPassthruMP)
DRV - [2008/03/02 03:28:00 | 000,206,608 | —- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\TMPassthru.sys – (TMPassthru)
DRV - [2004/10/07 20:16:04 | 000,035,840 | —- | M] (Oak Technology Inc.) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\AFS2K.SYS – (AFS2K)
DRV - [2004/08/03 19:29:50 | 000,019,455 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wvchntxx.sys – (iAimFP4)
DRV - [2004/08/03 19:29:48 | 000,012,063 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wsiintxx.sys – (iAimFP3)
DRV - [2004/08/03 19:29:46 | 000,025,471 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv10nt.sys – (iAimTV5)
DRV - [2004/08/03 19:29:46 | 000,023,615 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wch7xxnt.sys – (iAimTV4)
DRV - [2004/08/03 19:29:46 | 000,022,271 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv06nt.sys – (iAimTV6)
DRV - [2004/08/03 19:29:44 | 000,033,599 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv04nt.sys – (iAimTV3)
DRV - [2004/08/03 19:29:44 | 000,019,551 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv02nt.sys – (iAimTV1)
DRV - [2004/08/03 19:29:42 | 000,029,311 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\watv01nt.sys – (iAimTV0)
DRV - [2004/08/03 19:29:42 | 000,011,871 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv09nt.sys – (iAimFP7)
DRV - [2004/08/03 19:29:40 | 000,011,807 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv07nt.sys – (iAimFP5)
DRV - [2004/08/03 19:29:40 | 000,011,295 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv08nt.sys – (iAimFP6)
DRV - [2004/08/03 19:29:38 | 000,161,020 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\i81xnt5.sys – (i81x)
DRV - [2004/08/03 19:29:38 | 000,012,415 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv01nt.sys – (iAimFP0)
DRV - [2004/08/03 19:29:38 | 000,012,127 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv02nt.sys – (iAimFP1)
DRV - [2004/08/03 19:29:38 | 000,011,775 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wadv05nt.sys – (iAimFP2)
DRV - [2004/06/29 04:07:18 | 001,268,204 | —- | M] (Agere Systems) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2002/04/04 01:32:06 | 000,028,416 | R— | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\drivers\symmpi.sys – (Symmpi)
========== Standard Registry (SafeList) ==========
webster10
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{E4013329-B79F-4680-AD25-5D4D64F28342}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP1…s={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0C55421B-685A-4156-A691-073C1D6AEBD2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{0C55421B-685A-4156-A691-073C1D6AEBD2}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{579457C0-C7D6-481B-8DBF-3CA259316F8C}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\..\SearchScopes\{D5EF9B3F-A073-433A-BDDE-BE64509C0AB3}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E58FD494-9104-4DA0-AD13-7C6A590592BD}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.6.20110307083656
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..network.proxy.type: 1
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/21 16:16:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/12 21:39:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/21 16:20:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/11/25 12:38:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ABC82C52-8331-11E1-826D-B8AC6F996F26}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{E4013329-B79F-4680-AD25-5D4D64F28342}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP1…s={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0C55421B-685A-4156-A691-073C1D6AEBD2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{0C55421B-685A-4156-A691-073C1D6AEBD2}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{579457C0-C7D6-481B-8DBF-3CA259316F8C}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\..\SearchScopes\{D5EF9B3F-A073-433A-BDDE-BE64509C0AB3}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E58FD494-9104-4DA0-AD13-7C6A590592BD}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.6.20110307083656
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..network.proxy.type: 1
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/21 16:16:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/12 21:39:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/21 16:20:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/11/25 12:38:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ABC82C52-8331-11E1-826D-B8AC6F996F26}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI