bigmuff Posted November 4, 2009 ID:153525 Share Posted November 4, 2009 HijackThis found the 2 host changes easily. Not sure if there's other stuff in there that needs deleting.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:18:26 AM, on 11/4/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\Spyware Doctor\pctsTray.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exeC:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\system32\HPZipm12.exeC:\Program Files\Spyware Doctor\pctsAuxs.exeC:\Program Files\Spyware Doctor\pctsSvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\System32\alg.exeC:\Program Files\Windows Live\Contacts\wlcomm.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Spyware Doctor\pctsGui.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\Program Files\Internet Explorer\iexplore.exec:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Malwarebytes' Anti-Malware\mbam.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\WINDOWS\system32\wbem\wmiprvse.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO1 - Hosts: ::1 localhostO1 - Hosts: 91.212.127.226 osguard-pro.comO1 - Hosts: 91.212.127.226 www.osguard-pro.comO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dllO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscriptO4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRunO4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1253870474218O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1253910908828O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cabO16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cabO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exeO23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe--End of file - 7657 bytesMalwarebytes' Anti-Malware 1.41Database version: 3097Windows 5.1.2600 Service Pack 3 (Safe Mode)11/4/2009 8:54:27 AMmbam-log-2009-11-04 (08-54-27).txtScan type: Full Scan (C:\|)Objects scanned: 159589Time elapsed: 48 minute(s), 23 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
SpySentinel Posted November 4, 2009 ID:153529 Share Posted November 4, 2009 Hi Bigmuff,Step #1Download the HostsXpert 4.3 - Hosts File Manager.Unzip HostsXpert 4.3 - Hosts File Manager to a convenient folder such as C:\HostsXpert 4.3 - Hosts File ManagerRun HostsXpert 4.3 - Hosts File Manager from its new homeClick on "File Handling".Click on "Restore MS Hosts File".Click OK on the Confirmation box.Click on "Make Read Only?"Click the X to exit the program.Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.Step #2Run ESET Online ScanHold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScanClick the button.For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on to download the ESET Smart Installer. Save it to your desktop.Double click on the icon on your desktop.Check Click the button.Accept any security warnings from your browser.Check Push the Start button.ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.When the scan completes, push Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.Push the button.Push You can refer to this animation by neomage if needed.Step #3Download OTL to your desktop.Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.When the window appears, underneath Output at the top change it to Minimal Output.Check the boxes beside LOP Check and Purity Check.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. Link to post Share on other sites More sharing options...
bigmuff Posted November 4, 2009 Author ID:153606 Share Posted November 4, 2009 OK, I ran the Hostsxpert program, which restored Microsoft's defaults and locked the entries so they can't be overwritten (at least I assume that's what it did).2nd, I ran the ESET online scan. It also scanned my huge external drive, which took forever. It found no threats, and therefore didn't give me a log to post.3rd, I attempted to install OTL, but IE explorer displayed a nastygram indicating the website is unsafe and contains links to viruses, etc. So I dind't run it. Can you confirm this program/website is safe to use? Link to post Share on other sites More sharing options...
SpySentinel Posted November 4, 2009 ID:153607 Share Posted November 4, 2009 Hi bigmuff,Yes the OTL site is safe to use. Link to post Share on other sites More sharing options...
bigmuff Posted November 4, 2009 Author ID:153619 Share Posted November 4, 2009 Here are the 2 OTL reports.OTL Extras logfile created on: 11/4/2009 1:11:04 PM - Run 1OTL by OldTimer - Version 3.1.3.3 Folder = C:\Documents and Settings\Mike\DesktopWindows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy2.00 Gb Total Physical Memory | 1.34 Gb Available Physical Memory | 67.15% Memory free3.85 Gb Paging File | 3.09 Gb Available in Paging File | 80.30% Paging File freePaging file location(s): C:\pagefile.sys 2046 4092 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 127.99 Gb Total Space | 34.45 Gb Free Space | 26.91% Space Free | Partition Type: NTFSD: Drive not present or media not loadedDrive E: | 481.33 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFSDrive F: | 465.76 Gb Total Space | 354.83 Gb Free Space | 76.18% Space Free | Partition Type: NTFSDrive G: | 170.10 Gb Total Space | 170.03 Gb Free Space | 99.96% Space Free | Partition Type: NTFSH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: STOMPBOXCurrent User Name: MikeLogged in as Administrator.Current Boot Mode: NormalScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Minimal========== Extra Registry (SafeList) ==================== File Associations ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)========== Shell Spawning ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %* File not foundcmdfile [open] -- "%1" %* File not foundcomfile [open] -- "%1" %* File not foundexefile [open] -- "%1" %* File not foundhtmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)htmlfile [print] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)piffile [open] -- "%1" %* File not foundregfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1" File not foundscrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /S File not foundtxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not foundDirectory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)========== Security Center Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"AntiVirusDisableNotify" = 0"FirewallDisableNotify" = 0"UpdatesDisableNotify" = 0"AntiVirusOverride" = 0"FirewallOverride" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]========== Authorized Applications List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)"C:\Program Files\Messenger\msmsgs.exe" = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger -- (Microsoft Corporation)"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)"C:\Program Files\Soulseek\slsk.exe" = C:\Program Files\Soulseek\slsk.exe:*:Enabled:SoulSeek -- ()"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe -- ()"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard)"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- ()"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( )"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour -- (Apple Inc.)"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)========== HKEY_LOCAL_MACHINE Uninstall List ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center"{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1"{06E73C0B-7DE7-4F41-860B-587033B75BD9}" = iPod Updater 2004-11-15"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour"{0893078B-8A9A-84D6-D393-119B9B0B033A}" = CCC Help French"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations"{0E2A60F7-2907-5718-FF16-7D8FAF70051E}" = CCC Help Chinese Standard"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter"{14FAE013-AE19-4FC9-B5BF-E56ADC01ECE6}" = CCC Help Turkish"{17BB2784-6EE4-D7FF-FE63-58A3AD2B3708}" = CCC Help Russian"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate"{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT"{233588CF-96D5-46AF-EF74-7EC382662791}" = Catalyst Control Center Graphics Full Existing"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java 6 Update 17"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp"{3260ECBC-9DDF-E7A3-0863-449473BC7BD5}" = CCC Help Chinese Traditional"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant"{39C6C229-CFFD-639E-229A-E463FCD87478}" = CCC Help German"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform"{3E386744-10FA-44b2-98C9-DF7A270DECB3}" = HP PSC & OfficeJet 5.3.A"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant"{4CD67A02-DF59-43f7-8E8F-86DCF40543EF}" = 2570_Help"{4F11FC80-CE8C-1BD4-5C39-EBE5744E5135}" = CCC Help Portuguese"{4FAB2BA7-E16C-95D2-F326-60A68409373F}" = Catalyst Control Center HydraVision Full"{50E7BB78-02B4-469a-9D8B-B2F42835F90E}" = ProductContextNPI"{529AA9A8-5020-6CFB-A809-BC5943C87077}" = CCC Help Thai"{53604297-26FD-516D-6FF7-1063BA64A0A4}" = Catalyst Control Center Graphics Light"{55BD3B0B-F054-9341-514F-295A5F7EA450}" = CCC Help Spanish"{567C23E1-7580-4185-B8C2-30805677297C}" = NewCopy_CDA"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg"{5A4FA9C8-ED56-08C3-153B-FC5C19256290}" = CCC Help Dutch"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update"{6BB6627C-694F-4FDC-A3E5-C7F4BED4C724}" = DocProc"{6C390D51-E5F0-4FCD-24C4-731ACAF34571}" = CCC Help Japanese"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{7AA8FA9A-1656-7DBD-633B-FE7A62BBED0C}" = CCC Help Czech"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials"{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player"{8C22131B-8634-CECF-F0D1-A2ECC160B450}" = CCC Help Norwegian"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system"{90FBE4D0-2ACA-A8A8-2CC4-CFFBAE528504}" = CCC Help Finnish"{923A7F5A-1E8C-4FBE-8DF6-85940A60A79F}" = Readme"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{9D74375E-3012-E7D2-9229-B220C91F326A}" = Catalyst Control Center Core Implementation"{9EE8BDCA-7505-4895-D91E-8108DD16292E}" = CCC Help English"{A195B13E-A5E3-4BAF-A995-7F70F445CD06}" = ScannerCopy"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger"{A8AF8BD3-61B5-7945-4D1B-217421F604FC}" = CCC Help Hungarian"{A8D91906-4032-4443-8C49-69F90E38F39D}" = 2570"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder"{AA46E1C5-A709-6D9B-D99D-92E4C6E042A9}" = CCC Help Korean"{AA62A33C-9E5E-3913-7D88-7E58A8CB1493}" = CCC Help Greek"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0"{B276997E-4367-4b1b-A39C-4CAE7464337A}" = AiO_Scan_CDA"{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support"{B60E7826-F117-4d26-8165-D2DC5A494AB0}" = Fax_CDA"{B64E3AFC-59EF-4f18-BF11-E751462450D3}" = AiOSoftwareNPI"{B653F643-A1B4-9936-2DB6-FEA9A3110D8D}" = ccc-core-preinstall"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player"{B71C4637-0247-78CE-6A3D-D61645CB8921}" = ccc-utility"{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm"{BB6D4A78-4BDB-4FBD-81CB-00DC2FC2BF41}" = Seagate Manager Installer"{BC2E7C0B-1AC6-5F6C-F31D-E1E72D8E0B5C}" = CCC Help Danish"{BF8C7DA7-2DE6-ED67-6C82-6BE82F8BA8D3}" = Catalyst Control Center Graphics Full New"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2"{C409F338-BB20-6C4A-F40D-20CA07AF714C}" = CCC Help Polish"{C506A18C-1469-4678-B094-F4EC9DAE6DB7}" = Scan"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1"{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes"{D4B7B2DC-E688-A9D6-6EC0-56AE540E074C}" = Catalyst Control Center Localization All"{D9CD701B-3F04-FC69-D974-F3A7F5E9BA30}" = CCC Help Swedish"{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}" = Catalyst Control Center - Branding"{E213321B-1E88-B38D-DAB2-D8CB9355984A}" = Skins"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter"{EE55FD52-0D47-4c5a-96EC-48F70FF30520}" = 2570Trb"{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}" = Doom 3"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard"{F4148D8F-ED3A-3097-509C-04D5560220F9}" = ccc-core-static"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call"{F7E68997-E626-952B-A7BF-F72066CD5D77}" = Catalyst Control Center Graphics Previews Common"{FA36C82B-464D-51F2-A6A1-0BC9140BE067}" = CCC Help Italian"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio"{FE64AE29-0883-4C70-8388-DC026019C900}" = HP Image Zone Express"Adobe AIR" = Adobe AIR"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX"All ATI Software" = ATI - Software Uninstall Utility"ATI Display Driver" = ATI Display Driver"Browser Defender_is1" = Browser Defender 2.0.6.10"CCleaner" = CCleaner (remove only)"Champions Online" = Champions Online"COH" = City of Villains/City of Heroes (remove only)"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters"ESET Online Scanner" = ESET Online Scanner v3"HijackThis" = HijackThis 2.0.2"HP Imaging Device Functions" = HP Imaging Device Functions 5.3"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3"ie8" = Windows Internet Explorer 8"InstallShield_{06E73C0B-7DE7-4F41-860B-587033B75BD9}" = iPod Updater 2004-11-15"InstallShield_{BB6D4A78-4BDB-4FBD-81CB-00DC2FC2BF41}" = Seagate Manager Installer"InstallShield_{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}" = Doom 3"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP"Soulseek" = SoulSeek Client 156c"Spyware Doctor" = Spyware Doctor 7.0"Steam App 380" = Half-Life 2: Episode One"Steam App 420" = Half-Life 2: Episode Two"Windows Media Format Runtime" = Windows Media Format 11 runtime"Windows Media Player" = Windows Media Player 11"Windows XP Service Pack" = Windows XP Service Pack 3"WinLiveSuite_Wave3" = Windows Live Essentials"WMFDist11" = Windows Media Format 11 runtime"wmp11" = Windows Media Player 11"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0========== Last 10 Event Log Errors ==========[ Application Events ]Error - 10/22/2009 7:56:18 PM | Computer Name = STOMPBOX | Source = Application Error | ID = 1001Description = Fault bucket 1228796429.Error - 10/22/2009 7:57:16 PM | Computer Name = STOMPBOX | Source = Application Hang | ID = 1002Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 10/22/2009 7:57:21 PM | Computer Name = STOMPBOX | Source = Application Hang | ID = 1001Description = Fault bucket 1180947459.Error - 10/31/2009 2:05:12 AM | Computer Name = STOMPBOX | Source = MsiInstaller | ID = 11921Description = Product: iTunes -- Error 1921. Service 'iPod Service' (iPodService) could not be stopped. Verify that you have sufficient privileges to stop system services.Error - 10/31/2009 2:09:21 AM | Computer Name = STOMPBOX | Source = MsiInstaller | ID = 11921Description = Product: iTunes -- Error 1921. Service 'iPod Service' (iPodService) could not be stopped. Verify that you have sufficient privileges to stop system services.Error - 10/31/2009 2:43:51 AM | Computer Name = STOMPBOX | Source = MsiInstaller | ID = 11905Description = Product: iTunes -- Error 1905.Module C:\Program Files\iTunes\iTunesMiniPlayer.dll failed to unregister. HRESULT -2147220472. Contact your support personnel.Error - 10/31/2009 2:48:04 AM | Computer Name = STOMPBOX | Source = MsiInstaller | ID = 11921Description = Product: iTunes -- Error 1921. Service 'iPod Service' (iPodService) could not be stopped. Verify that you have sufficient privileges to stop system services.Error - 10/31/2009 2:53:52 AM | Computer Name = STOMPBOX | Source = MsiInstaller | ID = 11921Description = Product: iTunes -- Error 1921.Service iPod Service (iPodService) could not be stopped. Verify that you have sufficient privileges to stop system services.Error - 10/31/2009 2:54:35 AM | Computer Name = STOMPBOX | Source = MsiInstaller | ID = 11905Description = Product: iTunes -- Error 1905.Module C:\Program Files\iTunes\iTunesMiniPlayer.dll failed to unregister. HRESULT -2147220472. Contact your support personnel.Error - 11/1/2009 7:05:06 PM | Computer Name = STOMPBOX | Source = Application Hang | ID = 1002Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.[ System Events ]Error - 10/7/2009 1:22:16 PM | Computer Name = STOMPBOX | Source = Cdrom | ID = 262151Description = The device, \Device\CdRom0, has a bad block.< End of report >OTL logfile created on: 11/4/2009 1:11:04 PM - Run 1OTL by OldTimer - Version 3.1.3.3 Folder = C:\Documents and Settings\Mike\DesktopWindows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy2.00 Gb Total Physical Memory | 1.34 Gb Available Physical Memory | 67.15% Memory free3.85 Gb Paging File | 3.09 Gb Available in Paging File | 80.30% Paging File freePaging file location(s): C:\pagefile.sys 2046 4092 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 127.99 Gb Total Space | 34.45 Gb Free Space | 26.91% Space Free | Partition Type: NTFSD: Drive not present or media not loadedDrive E: | 481.33 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFSDrive F: | 465.76 Gb Total Space | 354.83 Gb Free Space | 76.18% Space Free | Partition Type: NTFSDrive G: | 170.10 Gb Total Space | 170.03 Gb Free Space | 99.96% Space Free | Partition Type: NTFSH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: STOMPBOXCurrent User Name: MikeLogged in as Administrator.Current Boot Mode: NormalScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Minimal========== Processes (SafeList) ==========PRC - C:\Documents and Settings\Mike\Desktop\OTL.exe (OldTimer Tools)PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)PRC - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)PRC - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)PRC - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)PRC - C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)PRC - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)PRC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe (Seagate Technology LLC)PRC - C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe (Seagate LLC)PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.)PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)PRC - C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)========== Modules (SafeList) ==========MOD - C:\Documents and Settings\Mike\Desktop\OTL.exe (OldTimer Tools)MOD - C:\Program Files\Spyware Doctor\PCTGMhk.dll (PC Tools)MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (Microsoft Corporation)MOD - C:\WINDOWS\system32\wbem\framedyn.dll (Microsoft Corporation)========== Win32 Services (SafeList) ==========SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)SRV - (iPod Service) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)SRV - (Browser Defender Update Service) -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)SRV - (sdCoreService) -- C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)SRV - (sdAuxService) -- C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)SRV - (ATI Smart) -- C:\WINDOWS\system32\ati2sgag.exe ()SRV - (Ati HotKey Poller) -- C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)SRV - (FreeAgentGoNext Service) -- C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe (Seagate Technology LLC)SRV - (Bonjour Service) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)SRV - (FontCache3.0.0.0) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)SRV - (idsvc) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)SRV - (NetTcpPortSharing) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)SRV - (clr_optimization_v2.0.50727_32) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)SRV - (aspnet_state) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)SRV - (helpsvc) -- C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc.dll (Microsoft Corporation)SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\HPZipm12.exe (HP)SRV - (WMPNetworkSvc) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)========== Driver Services (SafeList) ==========DRV - (TfSysMon) -- C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)DRV - (TfNetMon) -- C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)DRV - (TfFsMon) -- C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)DRV - (PxHelp20) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)DRV - (pctgntdi) -- C:\WINDOWS\system32\drivers\pctgntdi.sys (PC Tools)DRV - (PCTCore) -- C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)DRV - (pctplsg) -- C:\WINDOWS\system32\drivers\pctplsg.sys (PC Tools)DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)DRV - (GEARAspiWDM) -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)DRV - (ALCXWDM) -- C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)DRV - (Secdrv) -- C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)DRV - (HPZius12) -- C:\WINDOWS\system32\drivers\HPZius12.sys (HP)DRV - (HPZipr12) -- C:\WINDOWS\system32\drivers\HPZipr12.sys (HP)DRV - (HPZid412) -- C:\WINDOWS\system32\drivers\HPZid412.sys (HP)DRV - (rtl8139) -- C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)DRV - (Ptilink) -- C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearchIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-usIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 4B EF DA EC 59 CA 01 [binary data]IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.localFF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/25 12:38:15 | 00,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/11/03 23:46:59 | 00,000,000 | ---D | M]O1 HOSTS File: (698 bytes) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)O4 - HKLM..\Run: [] File not foundO4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [iSTray] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [MaxMenuMgr] C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe (Seagate LLC)O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)O4 - HKLM..\Run: [soundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)O4 - HKLM..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)O4 - HKCU..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab (QuickTime Object)O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1253870474218 (WUWebControl Class)O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1253910908828 (MUWebControl Class)O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (OnlineScanner Control)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.69.150 68.87.85.102O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)O18 - Protocol\Handler\ipp - No CLSID value foundO18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)O18 - Protocol\Handler\msdaipp - No CLSID value foundO18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)O24 - Desktop Components:0 (My Current Home Page) - About:HomeO31 - SafeBoot: AlternateShell - cmd.exeO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2009/09/25 01:15:24 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O32 - AutoRun File - [2004/04/27 15:10:00 | 00,000,143 | R--- | M] () - E:\autorun.inf -- [ CDFS ]O32 - AutoRun File - [2009/09/25 21:29:59 | 00,000,067 | ---- | M] () - F:\Autorun.inf -- [ NTFS ]O33 - MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\Shell - "" = AutoRunO33 - MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\Shell\AutoRun - "" = Auto&PlayO33 - MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\Shell\AutoRun\command - "" = E:\Setup\rsrc\AUTORUN.EXE -- [2000/01/17 08:28:36 | 00,028,672 | R--- | M] (Dipl.-Ing. Stefan Krueger <skrueger@installsite.org>)O33 - MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\Shell\dinstall\command - "" = E:\DirectX\dxsetup.exe -- [2003/08/18 16:15:00 | 00,467,456 | R--- | M] (Microsoft Corporation)O33 - MountPoints2\E\Shell - "" = AutoRunO33 - MountPoints2\E\Shell\AutoRun - "" = Auto&PlayO33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup.exe -- [2004/07/16 09:04:26 | 00,229,376 | R--- | M] ()O34 - HKLM BootExecute: (autocheck) - File not foundO34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)O34 - HKLM BootExecute: (*) - File not foundO35 - comfile [open] -- "%1" %* File not foundO35 - exefile [open] -- "%1" %* File not found========== Files/Folders - Created Within 30 Days ==========[2009/11/04 13:07:05 | 00,528,384 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Mike\Desktop\OTL.exe[2009/11/04 10:48:00 | 00,000,000 | ---D | C] -- C:\Program Files\ESET[2009/11/04 10:44:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Desktop\hostsxpert[2009/11/04 10:43:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Desktop\New Folder[2009/11/04 10:17:50 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro[2009/11/04 00:30:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Application Data\GetRightToGo[2009/11/03 23:47:15 | 00,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll[2009/11/03 23:47:15 | 00,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe[2009/11/03 23:47:15 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe[2009/11/03 23:47:15 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe[2009/11/03 23:47:15 | 00,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl[2009/11/03 23:46:55 | 00,000,000 | ---D | C] -- C:\Program Files\Java[2009/11/03 23:46:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Application Data\Sun[2009/11/03 21:40:19 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Mike\Recent[2009/11/01 13:15:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Desktop\vacuum[2009/10/31 11:12:27 | 01,628,920 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxsfs.dll[2009/10/31 11:12:27 | 00,551,672 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\px.dll[2009/10/31 11:12:27 | 00,518,904 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxdrv.dll[2009/10/31 11:12:27 | 00,379,640 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxwave.dll[2009/10/31 11:12:27 | 00,187,128 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxmas.dll[2009/10/31 11:12:27 | 00,129,784 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxafs.dll[2009/10/31 11:12:27 | 00,120,056 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxcpyi64.exe[2009/10/31 11:12:27 | 00,118,520 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxinsi64.exe[2009/10/31 11:12:27 | 00,088,824 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\vxblock.dll[2009/10/31 11:12:27 | 00,072,440 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxhpinst.exe[2009/10/31 11:12:27 | 00,066,296 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxcpya64.exe[2009/10/31 11:12:27 | 00,064,760 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxinsa64.exe[2009/10/31 11:12:27 | 00,043,528 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\drivers\PxHelp20.sys[2009/10/31 11:12:27 | 00,009,464 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\drivers\cdralw2k.sys[2009/10/31 11:12:27 | 00,009,336 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys[2009/10/31 11:12:08 | 00,000,000 | ---D | C] -- C:\Program Files\DivX[2009/10/31 11:12:08 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\DivX Shared[2009/10/30 23:03:27 | 00,107,368 | ---- | C] (GEAR Software Inc.) -- C:\WINDOWS\System32\GEARAspi.dll[2009/10/30 23:03:27 | 00,026,600 | ---- | C] (GEAR Software Inc.) -- C:\WINDOWS\System32\drivers\GEARAspiWDM.sys[2009/10/30 23:02:43 | 00,000,000 | ---D | C] -- C:\Program Files\iTunes[2009/10/30 23:02:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}[2009/10/30 21:59:22 | 00,000,000 | ---D | C] -- C:\Program Files\Bonjour[2009/10/30 21:58:53 | 00,000,000 | ---D | C] -- C:\Program Files\QuickTime[2009/10/30 21:58:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Local Settings\Application Data\Apple[2009/10/30 21:58:39 | 00,000,000 | ---D | C] -- C:\Program Files\Apple Software Update[2009/10/30 21:58:32 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE[2009/10/30 21:58:00 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple[2009/10/30 21:58:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple[2009/10/30 21:47:05 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss[2009/10/30 21:37:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Local Settings\Application Data\Apple Computer[2009/10/30 21:37:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Application Data\Apple Computer[2009/10/30 21:37:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\QuickTime[2009/10/30 21:37:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer[2009/10/30 21:36:33 | 00,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations[2009/10/30 21:36:09 | 00,000,000 | ---D | C] -- C:\Program Files\iPod[2009/10/26 15:22:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ATI[2009/10/25 21:17:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Desktop\flatty[2009/10/25 10:29:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Desktop\ski stuff[2009/10/24 16:53:07 | 00,000,000 | ---D | C] -- C:\Program Files\Cryptic Studios[2009/10/22 16:17:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Local Settings\Application Data\Threat Expert[2009/10/22 15:12:21 | 00,059,664 | --S- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\TfSysMon.sys[2009/10/22 15:12:21 | 00,051,984 | --S- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\TfFsMon.sys[2009/10/22 15:12:21 | 00,033,552 | --S- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\TfNetMon.sys[2009/10/22 15:11:59 | 00,149,456 | ---- | C] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll[2009/10/22 15:11:58 | 01,636,304 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll[2009/10/22 15:11:58 | 00,165,840 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll[2009/10/22 15:09:44 | 00,229,304 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys[2009/10/22 15:09:39 | 00,207,280 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys[2009/10/22 15:09:39 | 00,087,784 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys[2009/10/22 15:09:32 | 00,070,408 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys[2009/10/22 15:09:26 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools[2009/10/22 15:09:25 | 00,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor[2009/10/22 15:09:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Application Data\PC Tools[2009/10/22 15:09:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools[2009/10/20 14:41:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Local Settings\Application Data\Identities[2009/10/18 23:55:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\madll[2009/10/16 23:14:39 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\Mike\IECompatCache[2009/10/15 21:37:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Desktop\digitech[2009/10/14 12:27:25 | 00,000,000 | ---D | C] -- C:\Program Files\Doom 3[2009/10/13 12:47:16 | 00,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll[2009/10/13 12:47:16 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll[2009/10/07 22:11:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HP Product Assistant[2009/10/07 22:07:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Application Data\HpUpdate[2009/10/07 22:07:30 | 00,000,000 | ---D | C] -- C:\WINDOWS\Hewlett-Packard[2009/10/07 11:59:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Mike\Application Data\DivX[2009/10/07 09:45:23 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK[2009/10/06 23:45:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA[2009/10/06 21:15:32 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2009/11/04 13:06:21 | 00,528,384 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Mike\Desktop\OTL.exe[2009/11/04 10:17:50 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Mike\Desktop\HijackThis.lnk[2009/11/04 09:50:02 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job[2009/11/04 08:59:25 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2009/11/04 08:58:45 | 00,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job[2009/11/04 08:58:43 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT[2009/11/04 08:58:07 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2009/11/04 08:57:20 | 02,097,152 | -H-- | M] () -- C:\Documents and Settings\Mike\NTUSER.DAT[2009/11/04 08:57:20 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Mike\ntuser.ini[2009/11/04 08:57:17 | 03,184,656 | -H-- | M] () -- C:\Documents and Settings\Mike\Local Settings\Application Data\IconCache.db[2009/11/03 23:46:59 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe[2009/11/03 23:46:59 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe[2009/11/03 23:46:59 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe[2009/11/03 23:46:59 | 00,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl[2009/11/03 23:46:58 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll[2009/11/01 22:36:08 | 00,508,956 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI[2009/11/01 22:36:08 | 00,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat[2009/11/01 22:36:08 | 00,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat[2009/11/01 09:05:20 | 00,029,184 | ---- | M] () -- C:\Documents and Settings\Mike\My Documents\enchiladas.doc[2009/10/30 22:30:12 | 00,013,334 | ---- | M] () -- C:\Documents and Settings\Mike\Desktop\cc_20091030_232912.reg[2009/10/30 21:50:31 | 00,000,588 | ---- | M] () -- C:\WINDOWS\win.ini[2009/10/30 21:50:31 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini[2009/10/30 21:50:31 | 00,000,211 | -HS- | M] () -- C:\boot.ini[2009/10/27 00:58:10 | 00,032,768 | ---- | M] () -- C:\Documents and Settings\Mike\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2009/10/26 15:11:40 | 00,000,010 | ---- | M] () -- C:\WINDOWS\WININIT.INI[2009/10/19 21:20:58 | 00,003,532 | ---- | M] () -- C:\drmHeader.bin[2009/10/19 20:31:01 | 00,000,883 | ---- | M] () -- C:\WINDOWS\RegSDImport.xml[2009/10/14 12:53:04 | 00,000,331 | ---- | M] () -- C:\WINDOWS\doom3.ini[2009/10/12 14:52:57 | 00,368,306 | ---- | M] () -- C:\Documents and Settings\Mike\My Documents\BoostRVB-OM.pdf[2009/10/08 12:14:10 | 00,059,664 | --S- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\TfSysMon.sys[2009/10/08 12:14:10 | 00,033,552 | --S- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\TfNetMon.sys[2009/10/08 12:14:08 | 00,051,984 | --S- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\TfFsMon.sys[2009/10/08 10:31:46 | 00,149,456 | ---- | M] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll[2009/10/08 10:31:44 | 01,636,304 | ---- | M] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll[2009/10/08 10:31:44 | 00,165,840 | ---- | M] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll[2009/10/08 10:31:14 | 00,767,952 | ---- | M] () -- C:\WINDOWS\BDTSupport.dll[2009/10/07 22:10:25 | 00,000,214 | ---- | M] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini[2009/10/07 22:09:40 | 00,000,221 | ---- | M] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini[2009/10/07 09:46:28 | 00,001,812 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SeaTools for Windows.lnk[2009/10/06 16:56:20 | 00,000,662 | ---- | M] () -- C:\Documents and Settings\Mike\My Documents\cc_20091006_175604.reg[2009/10/06 16:55:50 | 00,032,202 | ---- | M] () -- C:\Documents and Settings\Mike\My Documents\cc_20091006_175537.reg[2009/10/06 16:40:49 | 00,126,112 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT[2009/10/06 15:31:30 | 00,087,784 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]========== Files Created - No Company Name ==========[2009/11/04 10:17:50 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Mike\Desktop\HijackThis.lnk[2009/11/01 09:05:20 | 00,029,184 | ---- | C] () -- C:\Documents and Settings\Mike\My Documents\enchiladas.doc[2009/10/30 22:29:18 | 00,013,334 | ---- | C] () -- C:\Documents and Settings\Mike\Desktop\cc_20091030_232912.reg[2009/10/30 21:58:41 | 00,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job[2009/10/26 15:18:50 | 00,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe[2009/10/26 14:08:39 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI[2009/10/22 15:11:59 | 00,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll[2009/10/22 15:11:59 | 00,000,883 | ---- | C] () -- C:\WINDOWS\RegSDImport.xml[2009/10/22 15:11:59 | 00,000,880 | ---- | C] () -- C:\WINDOWS\RegISSImport.xml[2009/10/22 15:11:59 | 00,000,131 | ---- | C] () -- C:\WINDOWS\IDB.zip[2009/10/22 15:11:58 | 01,152,470 | ---- | C] () -- C:\WINDOWS\UDB.zip[2009/10/22 15:09:44 | 00,007,387 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctgntdi.cat[2009/10/22 15:09:39 | 00,007,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\PCTAppEvent.cat[2009/10/22 15:09:39 | 00,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctcore.cat[2009/10/22 15:09:32 | 00,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctplsg.cat[2009/10/18 23:38:45 | 00,003,532 | ---- | C] () -- C:\drmHeader.bin[2009/10/14 12:53:04 | 00,000,331 | ---- | C] () -- C:\WINDOWS\doom3.ini[2009/10/12 14:52:57 | 00,368,306 | ---- | C] () -- C:\Documents and Settings\Mike\My Documents\BoostRVB-OM.pdf[2009/10/07 22:10:25 | 00,002,064 | ---- | C] () -- C:\Documents and Settings\Mike\Application Data\HPSU_48BitScanUpdate.log[2009/10/07 22:10:25 | 00,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini[2009/10/07 22:09:40 | 00,042,962 | ---- | C] () -- C:\Documents and Settings\Mike\Application Data\Update_HP_RedboxHprblog_HPSU.log[2009/10/07 22:09:40 | 00,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini[2009/10/07 09:46:28 | 00,001,812 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SeaTools for Windows.lnk[2009/10/06 23:45:14 | 00,000,236 | ---- | C] () -- C:\WINDOWS\tasks\OGALogon.job[2009/10/06 16:56:05 | 00,000,662 | ---- | C] () -- C:\Documents and Settings\Mike\My Documents\cc_20091006_175604.reg[2009/10/06 16:55:39 | 00,032,202 | ---- | C] () -- C:\Documents and Settings\Mike\My Documents\cc_20091006_175537.reg[2009/10/01 20:18:37 | 00,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll[2009/10/01 20:14:59 | 00,000,740 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log[2009/09/29 09:27:04 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI[2009/09/26 09:45:23 | 00,032,768 | ---- | C] () -- C:\Documents and Settings\Mike\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2009/09/25 11:37:12 | 00,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll[2009/09/25 08:48:11 | 00,019,224 | ---- | C] () -- C:\Documents and Settings\Mike\Local Settings\Application Data\GDIPFONTCACHEV1.DAT[2009/09/25 01:23:42 | 03,184,656 | -H-- | C] () -- C:\Documents and Settings\Mike\Local Settings\Application Data\IconCache.db[2009/09/25 01:20:01 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Mike\Application Data\desktop.ini[2009/09/24 18:03:36 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini[2009/08/03 14:07:42 | 00,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll[2006/06/29 13:58:52 | 00,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont[2006/06/29 13:53:56 | 00,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont[2006/04/18 14:39:28 | 00,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont[2006/04/18 14:39:28 | 00,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont[2001/08/23 04:00:00 | 00,000,588 | ---- | C] () -- C:\WINDOWS\win.ini[2001/08/23 04:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini[2001/07/06 14:30:00 | 00,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini========== LOP Check ==========[2009/10/26 15:22:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATI[2009/09/25 11:27:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters[2009/09/25 21:29:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Seagate[2009/11/04 10:47:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP[2009/10/30 23:03:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}[2009/09/25 10:37:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Mike\Application Data\ATI[2009/11/04 00:30:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Mike\Application Data\GetRightToGo[2009/09/25 21:26:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Mike\Application Data\Leadertech[2001/08/23 04:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini[2009/11/04 08:58:45 | 00,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job[2009/11/04 08:58:43 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT========== Purity Check ==================== Alternate Data Streams ==========@Alternate Data Stream - 180 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8< End of report > Link to post Share on other sites More sharing options...
SpySentinel Posted November 4, 2009 ID:153621 Share Posted November 4, 2009 How is your computer running?Run OTL.exeUnder the Custom Scans/Fixes box at the bottom, paste in the following:OTLO4 - HKLM..\Run: [] File not foundO33 - MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\Shell - "" = AutoRunO33 - MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\Shell\AutoRun - "" = Auto&PlayO33 - MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\Shell\AutoRun\command - "" = E:\Setup\rsrc\AUTORUN.EXE -- [2000/01/17 08:28:36 | 00,028,672 | R--- | M] (Dipl.-Ing. Stefan Krueger <skrueger@installsite.org>)O33 - MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\Shell\dinstall\command - "" = E:\DirectX\dxsetup.exe -- [2003/08/18 16:15:00 | 00,467,456 | R--- | M] (Microsoft Corporation)O33 - MountPoints2\E\Shell - "" = AutoRunO33 - MountPoints2\E\Shell\AutoRun - "" = Auto&PlayO33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup.exe -- [2004/07/16 09:04:26 | 00,229,376 | R--- | M] ():Commands[purity][emptytemp][start explorer][Reboot]Then click the Run Fix button at the topLet the program run unhindered, reboot when it is doneDownload TFC by OldTimer to your desktop Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).It will close all programs when run, so make sure you have saved all your work before you begin.Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion. Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean. Link to post Share on other sites More sharing options...
bigmuff Posted November 4, 2009 Author ID:153634 Share Posted November 4, 2009 OK, did all that. My computer seems to run fine, most of the time. This is a month or so old fresh install of windows - I reinstalled because I got a vundo varient I simply gave up on fixing. Sometimes IE hangs, and I can't tell if it's something malicious hogging resources, or if it's Spyware Doctor hogging resources. A few weeks ago I got some kind of rogue AV thing, but I was able to remove it. As of this exact moment, the PC is running nice and smooth, and fast, though I don't know how much of that has to do with Spyware Dr being shut down. Here's the log from that 2nd OTL run:All processes killed========== OTL ==========Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b8a69c3-a977-11de-b38c-806d6172696f}\ not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\ not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b8a69c3-a977-11de-b38c-806d6172696f}\ not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\ not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b8a69c3-a977-11de-b38c-806d6172696f}\ not found.File move failed. E:\Setup\rsrc\AUTORUN.EXE scheduled to be moved on reboot.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b8a69c3-a977-11de-b38c-806d6172696f}\ not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b8a69c3-a977-11de-b38c-806d6172696f}\ not found.File move failed. E:\DirectX\dxsetup.exe scheduled to be moved on reboot.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.File move failed. E:\setup.exe scheduled to be moved on reboot.========== COMMANDS ==========[EMPTYTEMP]User: All UsersUser: Default User->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 33170 bytesUser: LocalService->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 33684 bytesUser: Mike->Temp folder emptied: 23280455 bytes->Temporary Internet Files folder emptied: 79362270 bytes->Java cache emptied: 13689500 bytesUser: NetworkService->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 500508 bytes%systemdrive% .tmp files removed: 0 bytes%systemroot% .tmp files removed: 1138618 bytes%systemroot%\System32 .tmp files removed: 2577 bytesWindows Temp folder emptied: 98809 bytesRecycleBin emptied: 3092 bytesTotal Files Cleaned = 112.67 mbOTL by OldTimer - Version 3.1.3.3 log created on 11042009_132912Files\Folders moved on Reboot...File move failed. E:\Setup\rsrc\AUTORUN.EXE scheduled to be moved on reboot.File move failed. E:\DirectX\dxsetup.exe scheduled to be moved on reboot.File move failed. E:\setup.exe scheduled to be moved on reboot.Registry entries deleted on Reboot... Link to post Share on other sites More sharing options...
SpySentinel Posted November 4, 2009 ID:153635 Share Posted November 4, 2009 I would like to take a deeper look to make sure nothing is hiding:Download random's system information tool (RSIT) by random/random from here and save it to your desktop.Double click on RSIT.exe to run RSIT.Click Continue at the disclaimer screen.Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized) Link to post Share on other sites More sharing options...
bigmuff Posted November 4, 2009 Author ID:153641 Share Posted November 4, 2009 Done. Here are the 2 logs: Thanks for doing all this, by the way.info.txt logfile of random's system information tool 1.06 2009-11-04 13:58:15======Uninstall list======-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.infAcrobat.com-->msiexec /qb /x {6D8D64BE-F500-55B6-705D-DFD08AFE0624}Acrobat.com-->MsiExec.exe /I{6D8D64BE-F500-55B6-705D-DFD08AFE0624}Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstallAdobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exeAdobe Reader 9.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A92000000001}Apple Application Support-->MsiExec.exe /I{B607C354-CD79-4D22-86D1-92DC94153F42}Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exeATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0 ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -cleanBonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}Browser Defender 2.0.6.10-->"C:\Program Files\Spyware Doctor\BDT\unins000.exe"Catalyst Control Center - Branding-->MsiExec.exe /I{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"Champions Online-->C:\Program Files\Cryptic Studios\Uninstall Champions Online.exeCity of Villains/City of Heroes (remove only)-->"C:\Program Files\City of Heroes\uninstall.exe"Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODECDivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTERDivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYERDivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERSDivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGINDoom 3-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{EEFB15EB-FE8B-47DF-A496-1C4D1420294A} ESET Online Scanner v3-->C:\Program Files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exeHalf-Life 2: Episode One-->"C:\Program Files\Steam\steam.exe" steam://uninstall/380Half-Life 2: Episode Two-->"C:\Program Files\Steam\steam.exe" steam://uninstall/420HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstallHotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"Hotfix for Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"Hotfix for Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"HP Image Zone Express-->MsiExec.exe /X{FE64AE29-0883-4C70-8388-DC026019C900}HP Imaging Device Functions 5.3-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.datHP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}HP PSC & OfficeJet 5.3.A-->"C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.datHP Solution Center & Imaging Support Tools 5.3-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.datHP Update-->MsiExec.exe /X{818ABC3C-635C-4651-8183-D0E9640B7DD1}iPod Updater 2004-11-15-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{06E73C0B-7DE7-4F41-860B-587033B75BD9} /l1033 iTunes-->MsiExec.exe /I{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}Java 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216017FF}Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exeMicrosoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"Microsoft Office 2000 Premium-->MsiExec.exe /I{00000409-78E1-11D2-B60F-006097C998E7}Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}OGA Notifier 2.0.0048.0-->MsiExec.exe /I{B2544A03-10D0-4E5E-BA69-0362FFC20D18}QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x9 -removeonlySeagate Manager Installer-->"C:\Program Files\InstallShield Installation Information\{BB6D4A78-4BDB-4FBD-81CB-00DC2FC2BF41}\setup.exe" -runfromtemp -l0x0409 -removeonlySeagate Manager Installer-->MsiExec.exe /X{BB6D4A78-4BDB-4FBD-81CB-00DC2FC2BF41}SeaTools for Windows-->MsiExec.exe /I{98613C99-1399-416C-A07C-1EE1C585D872}Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}Security Update for Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"Security Update for Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"Security Update for Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.infSecurity Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"Security Update for Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"Security Update for Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"Security Update for Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"Security Update for Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}SoulSeek Client 156c-->"C:\Program Files\Soulseek\uninstall.exe"Spyware Doctor 7.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOGSteam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""Update for Windows Internet Explorer 8 (KB973874)-->"C:\WINDOWS\ie8updates\KB973874-IE8\spuninst\spuninst.exe"Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"Update for Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"Update for Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"Update for Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE}Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exeWindows Live Essentials-->MsiExec.exe /I{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}Windows Live Messenger-->MsiExec.exe /X{A85FD55B-891B-4314-97A5-EA96C0BD80B5}Windows Live Sign-in Assistant-->MsiExec.exe /I{45338B07-A236-4270-9A77-EBB4115517B5}Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAllWindows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /UninstallWindows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"======Hosts File======127.0.0.1 localhost======Security center information======AV: Spyware Doctor with AntiVirus (disabled)======System event log======Computer Name: STOMPBOXEvent Code: 51Message: An error was detected on device \Device\Harddisk1\D during a paging operation.Record Number: 2240Source Name: DiskTime Written: 20091007085210.000000-420Event Type: warningUser: Computer Name: STOMPBOXEvent Code: 51Message: An error was detected on device \Device\Harddisk1\D during a paging operation.Record Number: 2236Source Name: DiskTime Written: 20091007065210.000000-420Event Type: warningUser: Computer Name: STOMPBOXEvent Code: 51Message: An error was detected on device \Device\Harddisk1\D during a paging operation.Record Number: 2235Source Name: DiskTime Written: 20091007045210.000000-420Event Type: warningUser: Computer Name: STOMPBOXEvent Code: 51Message: An error was detected on device \Device\Harddisk0\D during a paging operation.Record Number: 2234Source Name: DiskTime Written: 20091007035355.000000-420Event Type: warningUser: Computer Name: STOMPBOXEvent Code: 51Message: An error was detected on device \Device\Harddisk0\D during a paging operation.Record Number: 2233Source Name: DiskTime Written: 20091007035350.000000-420Event Type: warningUser: =====Application event log=====Computer Name: STOMPBOXEvent Code: 5603Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.Record Number: 35Source Name: WinMgmtTime Written: 20090925094819.000000-420Event Type: warningUser: NT AUTHORITY\SYSTEMComputer Name: STOMPBOXEvent Code: 63Message: A provider, WMIProv, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.Record Number: 24Source Name: WinMgmtTime Written: 20090925094426.000000-420Event Type: warningUser: STOMPBOX\MikeComputer Name: STOMPBOXEvent Code: 63Message: A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.Record Number: 23Source Name: WinMgmtTime Written: 20090925094426.000000-420Event Type: warningUser: STOMPBOX\MikeComputer Name: STOMPBOXEvent Code: 4354Message: The COM+ Event System failed to fire the ConnectionMade method on subscription {A50AEA41-54A2-440C-8329-9971C54430EA}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The subscriber returned HRESULT 80004001.Record Number: 22Source Name: EventSystemTime Written: 20090925022517.000000-420Event Type: warningUser: Computer Name: STOMPBOXEvent Code: 4354Message: The COM+ Event System failed to fire the StartShell method on subscription {A5978620-5B3F-F1D1-8ED2-00FA0035B753}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The subscriber returned HRESULT 80004001.Record Number: 18Source Name: EventSystemTime Written: 20090925022023.000000-420Event Type: warningUser: ======Environment variables======"ComSpec"=%SystemRoot%\system32\cmd.exe"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\DivX Shared\"windir"=%SystemRoot%"OS"=Windows_NT"PROCESSOR_ARCHITECTURE"=x86"PROCESSOR_LEVEL"=15"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel"PROCESSOR_REVISION"=0401"NUMBER_OF_PROCESSORS"=2"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH"TEMP"=%SystemRoot%\TEMP"TMP"=%SystemRoot%\TEMP"FP_NO_HOST_CHECK"=NO"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip-----------------EOF-----------------Logfile of random's system information tool 1.06 (written by random/random)Run by Mike at 2009-11-04 13:58:09Microsoft Windows XP Professional Service Pack 3System drive C: has 35 GB (27%) free of 131 GBTotal RAM: 2047 MB (77% free)Logfile of Trend Micro HijackThis v2.0.2Scan saved at 1:58:12 PM, on 11/4/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exeC:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\system32\HPZipm12.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Windows Live\Contacts\wlcomm.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Mike\Desktop\RSIT.exeC:\Program Files\Trend Micro\HijackThis\Mike.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dllO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscriptO4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRunO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1253870474218O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1253910908828O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cabO16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cabO16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cabO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exeO23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe--End of file - 6962 bytes======Scheduled tasks folder======C:\WINDOWS\tasks\AppleSoftwareUpdate.jobC:\WINDOWS\tasks\OGALogon.job======Registry dump======[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}]PC Tools Browser Guard BHO - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll [2009-10-08 395216][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-03 41760][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-11-03 73728][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]{472734EA-242A-422B-ADF8-83D1E48CC825} - PC Tools Browser Guard - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll [2009-10-08 395216][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]"MaxMenuMgr"=C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe [2009-03-27 181544]"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-07-21 61440]"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600]"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-09-05 417792]"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-03 149280][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2008-12-08 54576][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]C:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]C:\Program Files\Steam\Steam.exe [2009-10-26 1217808][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2005-05-11 282624][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]C:\PROGRA~1\MICROS~3\Office\OSA9.EXE [1999-02-17 65588][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]C:\WINDOWS\system32\Ati2evxx.dll [2009-07-21 155648][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]"dontdisplaylastusername"=0"legalnoticecaption"="legalnoticetext"="shutdownwithoutlogon"=1"undockwithoutlogon"=1[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]"NoDriveTypeAutoRun"=145[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]"HonorAutoRunSetting"=[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019""%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000""C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger""C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call""C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger""C:\Program Files\Soulseek\slsk.exe"="C:\Program Files\Soulseek\slsk.exe:*:Enabled:SoulSeek""C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe""C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe""C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe""C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe""C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe""C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe""C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe""C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe""C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe""C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe""C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe""C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe""C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe""C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour""C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019""%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000""C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call""C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"======List of files/folders created in the last 3 months======2009-11-04 13:58:09 ----D---- C:\rsit2009-11-04 13:29:12 ----D---- C:\_OTL2009-11-04 10:48:00 ----D---- C:\Program Files\ESET2009-11-04 10:17:50 ----D---- C:\Program Files\Trend Micro2009-11-04 00:47:54 ----A---- C:\WINDOWS\ntbtlog.txt2009-11-04 00:30:16 ----D---- C:\Documents and Settings\Mike\Application Data\GetRightToGo2009-11-03 23:47:15 ----A---- C:\WINDOWS\system32\javaws.exe2009-11-03 23:47:15 ----A---- C:\WINDOWS\system32\javaw.exe2009-11-03 23:47:15 ----A---- C:\WINDOWS\system32\java.exe2009-11-03 23:47:15 ----A---- C:\WINDOWS\system32\deploytk.dll2009-11-03 23:46:55 ----D---- C:\Program Files\Java2009-11-03 23:46:29 ----D---- C:\Documents and Settings\Mike\Application Data\Sun2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\vxblock.dll2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxwave.dll2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxsfs.dll2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxmas.dll2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxinsi64.exe2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxinsa64.exe2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxhpinst.exe2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxdrv.dll2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxcpyi64.exe2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxcpya64.exe2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\pxafs.dll2009-10-31 11:12:27 ----N---- C:\WINDOWS\system32\px.dll2009-10-31 11:12:08 ----D---- C:\Program Files\DivX2009-10-31 11:12:08 ----D---- C:\Program Files\Common Files\DivX Shared2009-10-30 23:03:27 ----A---- C:\WINDOWS\system32\GEARAspi.dll2009-10-30 23:02:43 ----D---- C:\Program Files\iTunes2009-10-30 23:02:43 ----D---- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}2009-10-30 21:59:22 ----D---- C:\Program Files\Bonjour2009-10-30 21:58:53 ----D---- C:\Program Files\QuickTime2009-10-30 21:58:39 ----D---- C:\Program Files\Apple Software Update2009-10-30 21:58:32 ----DC---- C:\WINDOWS\system32\DRVSTORE2009-10-30 21:58:00 ----D---- C:\Program Files\Common Files\Apple2009-10-30 21:58:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple2009-10-30 21:47:05 ----D---- C:\WINDOWS\pss2009-10-30 21:37:45 ----A---- C:\WINDOWS\system32\reglog.txt2009-10-30 21:37:44 ----D---- C:\Documents and Settings\Mike\Application Data\Apple Computer2009-10-30 21:37:33 ----D---- C:\Documents and Settings\All Users\Application Data\QuickTime2009-10-30 21:37:27 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer2009-10-30 21:36:33 ----D---- C:\WINDOWS\Downloaded Installations2009-10-30 21:36:09 ----D---- C:\Program Files\iPod2009-10-26 15:22:06 ----D---- C:\Documents and Settings\All Users\Application Data\ATI2009-10-26 15:18:50 ----N---- C:\WINDOWS\system32\ati2sgag.exe2009-10-26 14:08:39 ----A---- C:\WINDOWS\WININIT.INI2009-10-24 16:53:07 ----D---- C:\Program Files\Cryptic Studios2009-10-22 15:11:59 ----A---- C:\WINDOWS\SGDetectionTool.dll2009-10-22 15:11:59 ----A---- C:\WINDOWS\BDTSupport.dll2009-10-22 15:11:58 ----A---- C:\WINDOWS\PCTBDRes.dll2009-10-22 15:11:58 ----A---- C:\WINDOWS\PCTBDCore.dll2009-10-22 15:09:26 ----D---- C:\Program Files\Common Files\PC Tools2009-10-22 15:09:25 ----D---- C:\Program Files\Spyware Doctor2009-10-22 15:09:25 ----D---- C:\Documents and Settings\Mike\Application Data\PC Tools2009-10-22 15:09:25 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools2009-10-18 23:55:59 ----D---- C:\WINDOWS\system32\madll2009-10-15 02:02:32 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$2009-10-15 02:01:06 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$2009-10-15 02:01:01 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$2009-10-15 02:00:58 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$2009-10-15 02:00:53 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$2009-10-15 02:00:48 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$2009-10-15 02:00:36 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$2009-10-15 02:00:29 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$2009-10-15 02:00:23 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$2009-10-14 12:53:04 ----A---- C:\WINDOWS\doom3.ini2009-10-14 12:27:25 ----D---- C:\Program Files\Doom 32009-10-13 12:47:16 ----A---- C:\WINDOWS\system32\ptpusd.dll2009-10-13 12:47:16 ----A---- C:\WINDOWS\system32\ptpusb.dll2009-10-07 22:11:29 ----D---- C:\Documents and Settings\All Users\Application Data\HP Product Assistant2009-10-07 22:10:25 ----A---- C:\WINDOWS\HP_48BitScanUpdatePatch.ini2009-10-07 22:09:40 ----A---- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini2009-10-07 22:07:31 ----D---- C:\Documents and Settings\Mike\Application Data\HpUpdate2009-10-07 22:07:30 ----D---- C:\WINDOWS\Hewlett-Packard2009-10-07 11:59:45 ----D---- C:\Documents and Settings\Mike\Application Data\DivX2009-10-07 09:45:23 ----D---- C:\Program Files\Common Files\Wise Installation Wizard2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\zh-TW2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\zh-HK2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\tr-TR2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\sv-SE2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\pt-BR2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\nl-NL2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\nb-NO2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\ko-KR2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\it-IT2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\he-IL2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\fr-FR2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\fi-FI2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\es-ES2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\el-GR2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\de-DE2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\da-DK2009-10-06 23:45:13 ----D---- C:\WINDOWS\system32\ar-SA2009-10-06 21:15:32 ----D---- C:\WINDOWS\system32\NtmsData2009-10-06 17:27:42 ----A---- C:\WINDOWS\SchedLgU.Txt2009-10-03 02:00:19 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.22009-10-01 20:22:06 ----D---- C:\Documents and Settings\All Users\Application Data\HP2009-10-01 20:21:50 ----D---- C:\Program Files\Common Files\HP2009-10-01 20:19:37 ----D---- C:\Program Files\Common Files\Hewlett-Packard2009-10-01 20:18:37 ----RA---- C:\WINDOWS\system32\hpzids01.dll2009-10-01 20:18:36 ----A---- C:\WINDOWS\system32\hpz3l3xu.dll2009-10-01 20:17:43 ----A---- C:\WINDOWS\system32\HPZisn12.dll2009-10-01 20:17:43 ----A---- C:\WINDOWS\system32\HPZipt12.dll2009-10-01 20:17:43 ----A---- C:\WINDOWS\system32\HPZipr12.dll2009-10-01 20:17:43 ----A---- C:\WINDOWS\system32\HPZipm12.exe2009-10-01 20:17:43 ----A---- C:\WINDOWS\system32\HPZinw12.exe2009-10-01 20:17:43 ----A---- C:\WINDOWS\system32\HPZidr12.dll2009-10-01 20:17:39 ----A---- C:\WINDOWS\IsUninst.exe2009-10-01 20:16:25 ----D---- C:\Program Files\HP2009-10-01 20:15:43 ----HD---- C:\Config.Msi2009-10-01 20:14:23 ----D---- C:\Documents and Settings\Mike\Application Data\HP2009-10-01 17:31:11 ----D---- C:\Program Files\MSECache2009-10-01 15:33:41 ----D---- C:\WINDOWS\system32\SoftwareDistribution2009-10-01 10:15:26 ----D---- C:\Program Files\Microsoft Silverlight2009-09-29 09:27:04 ----A---- C:\WINDOWS\ODBC.INI2009-09-29 09:26:34 ----D---- C:\Program Files\Common Files\Designer2009-09-29 09:26:32 ----D---- C:\WINDOWS\ShellNew2009-09-29 09:26:17 ----D---- C:\Program Files\Microsoft Office2009-09-28 09:52:24 ----D---- C:\Program Files\Soulseek2009-09-27 16:45:22 ----D---- C:\Program Files\Steam2009-09-26 12:44:05 ----D---- C:\Program Files\Common Files\Adobe2009-09-26 12:43:24 ----D---- C:\Program Files\Adobe2009-09-26 12:43:17 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe2009-09-26 12:43:15 ----D---- C:\Program Files\Common Files\Adobe AIR2009-09-26 12:42:44 ----D---- C:\Documents and Settings\All Users\Application Data\NOS2009-09-26 08:29:11 ----D---- C:\Program Files\CCleaner2009-09-25 23:32:47 ----D---- C:\Documents and Settings\Mike\Application Data\Google2009-09-25 23:27:50 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP2009-09-25 21:29:44 ----D---- C:\Program Files\Seagate2009-09-25 21:29:44 ----D---- C:\Documents and Settings\All Users\Application Data\Seagate2009-09-25 21:28:19 ----SHD---- C:\WINDOWS\ftpcache2009-09-25 21:26:03 ----D---- C:\Documents and Settings\Mike\Application Data\Leadertech2009-09-25 19:09:41 ----A---- C:\WINDOWS\system32\mucltui.dll.mui2009-09-25 19:09:41 ----A---- C:\WINDOWS\system32\mucltui.dll2009-09-25 14:44:48 ----D---- C:\Program Files\City of Heroes2009-09-25 12:38:06 ----HDC---- C:\WINDOWS\$NtUninstallKB961503$2009-09-25 12:37:49 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$2009-09-25 12:37:38 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$2009-09-25 12:37:33 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$2009-09-25 12:37:22 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$2009-09-25 12:37:11 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$2009-09-25 12:31:13 ----D---- C:\Program Files\Microsoft2009-09-25 12:30:57 ----D---- C:\Program Files\Windows Live SkyDrive2009-09-25 12:30:34 ----D---- C:\Program Files\Windows Live2009-09-25 12:27:50 ----D---- C:\Program Files\Common Files\Windows Live2009-09-25 12:25:48 ----SHD---- C:\RECYCLER2009-09-25 12:02:53 ----N---- C:\WINDOWS\system32\spmsg.dll2009-09-25 12:02:50 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$2009-09-25 12:02:40 ----D---- C:\Program Files\Windows Media Connect 22009-09-25 12:02:33 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$2009-09-25 12:02:05 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$2009-09-25 12:01:51 ----D---- C:\WINDOWS\system32\LogFiles2009-09-25 12:01:45 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$2009-09-25 11:50:33 ----D---- C:\Documents and Settings\Mike\Application Data\Malwarebytes2009-09-25 11:50:29 ----D---- C:\Program Files\Malwarebytes' Anti-Malware2009-09-25 11:50:29 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes2009-09-25 11:45:59 ----D---- C:\WINDOWS\RegisteredPackages2009-09-25 11:37:41 ----A---- C:\WINDOWS\system32\ChCfg.exe2009-09-25 11:37:18 ----A---- C:\WINDOWS\system32\ksuser.dll2009-09-25 11:37:13 ----D---- C:\Program Files\Realtek AC972009-09-25 11:37:13 ----A---- C:\WINDOWS\system32\RTLCPL.exe2009-09-25 11:37:12 ----A---- C:\WINDOWS\system32\RtlCPAPI.dll2009-09-25 11:37:12 ----A---- C:\WINDOWS\soundman.exe2009-09-25 11:37:12 ----A---- C:\WINDOWS\alcupd.exe2009-09-25 11:37:12 ----A---- C:\WINDOWS\Alcrmv.exe2009-09-25 11:27:36 ----D---- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters2009-09-25 10:39:54 ----D---- C:\Documents and Settings\Mike\Application Data\Macromedia2009-09-25 10:37:53 ----D---- C:\Documents and Settings\Mike\Application Data\ATI2009-09-25 10:32:17 ----D---- C:\WINDOWS\system32\XPSViewer2009-09-25 10:32:14 ----D---- C:\Program Files\MSBuild2009-09-25 10:32:10 ----D---- C:\Program Files\Reference Assemblies2009-09-25 10:31:55 ----N---- C:\WINDOWS\system32\xpssvcs.dll2009-09-25 10:31:55 ----N---- C:\WINDOWS\system32\xpsshhdr.dll2009-09-25 10:31:55 ----N---- C:\WINDOWS\system32\prntvpt.dll2009-09-25 10:31:54 ----D---- C:\9531cc9ca40a0cbb260f619e929d2009-09-25 10:23:56 ----RSD---- C:\WINDOWS\assembly2009-09-25 10:23:37 ----D---- C:\WINDOWS\Microsoft.NET2009-09-25 10:18:53 ----HD---- C:\Program Files\InstallShield Installation Information2009-09-25 10:18:53 ----D---- C:\Program Files\ATI Technologies2009-09-25 10:18:24 ----D---- C:\Program Files\Common Files\InstallShield2009-09-25 10:18:04 ----D---- C:\ATI2009-09-25 10:14:35 ----D---- C:\Documents and Settings\Mike\Application Data\Adobe2009-09-25 09:52:21 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$2009-09-25 09:52:17 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$2009-09-25 09:52:13 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$2009-09-25 09:51:52 ----D---- C:\WINDOWS\ie8updates2009-09-25 09:51:37 ----D---- C:\WINDOWS\WBEM2009-09-25 09:50:51 ----HDC---- C:\WINDOWS\ie82009-09-25 09:25:41 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$2009-09-25 09:25:36 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$2009-09-25 09:25:33 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$2009-09-25 09:25:29 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$2009-09-25 09:25:24 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$2009-09-25 09:25:20 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$2009-09-25 09:25:16 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$2009-09-25 09:25:11 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$2009-09-25 09:25:07 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$2009-09-25 09:25:02 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$2009-09-25 09:24:58 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$2009-09-25 09:24:53 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$2009-09-25 09:24:45 ----HDC---- C:\WINDOWS\$NtUninstallKB972260$2009-09-25 09:24:41 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$2009-09-25 09:24:37 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$2009-09-25 09:24:32 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$2009-09-25 09:24:28 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$2009-09-25 09:24:24 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$2009-09-25 09:24:19 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$2009-09-25 09:24:15 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$2009-09-25 09:24:10 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$2009-09-25 09:24:01 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$2009-09-25 09:23:56 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$2009-09-25 09:23:49 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$2009-09-25 09:23:45 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$2009-09-25 09:23:41 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$2009-09-25 09:23:37 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$2009-09-25 09:23:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$2009-09-25 09:23:29 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$2009-09-25 09:23:25 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$2009-09-25 09:23:21 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$2009-09-25 09:23:17 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$2009-09-25 09:23:13 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$2009-09-25 09:23:08 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$2009-09-25 09:23:04 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$2009-09-25 09:23:00 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$2009-09-25 09:22:56 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$2009-09-25 09:22:52 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$2009-09-25 09:22:48 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$2009-09-25 09:22:44 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$2009-09-25 09:22:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$2009-09-25 09:22:34 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$2009-09-25 09:22:30 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$2009-09-25 09:22:25 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$2009-09-25 09:17:43 ----D---- C:\WINDOWS\Prefetch2009-09-25 09:13:31 ----D---- C:\WINDOWS\system32\en-us2009-09-25 09:13:30 ----D---- C:\WINDOWS\system32\scripting2009-09-25 09:13:30 ----D---- C:\WINDOWS\l2schemas2009-09-25 09:13:29 ----D---- C:\WINDOWS\system32\en2009-09-25 09:10:39 ----D---- C:\WINDOWS\network diagnostic2009-09-25 09:06:04 ----N---- C:\WINDOWS\system32\xpsp3res.dll2009-09-25 09:06:04 ----A---- C:\WINDOWS\system32\xmllite.dll2009-09-25 09:06:03 ----N---- C:\WINDOWS\system32\wmphoto.dll2009-09-25 09:06:02 ----N---- C:\WINDOWS\system32\wlanapi.dll2009-09-25 09:06:02 ----N---- C:\WINDOWS\system32\windowscodecsext.dll2009-09-25 09:06:02 ----N---- C:\WINDOWS\system32\windowscodecs.dll2009-09-25 09:06:02 ----N---- C:\WINDOWS\system32\verclsid.exe2009-09-25 09:06:01 ----N---- C:\WINDOWS\system32\tzchange.exe2009-09-25 09:06:01 ----N---- C:\WINDOWS\system32\tspkg.dll2009-09-25 09:06:01 ----N---- C:\WINDOWS\system32\tsgqec.dll2009-09-25 09:05:59 ----N---- C:\WINDOWS\system32\setupn.exe2009-09-25 09:05:58 ----N---- C:\WINDOWS\system32\rhttpaa.dll2009-09-25 09:05:58 ----N---- C:\WINDOWS\system32\rasqec.dll2009-09-25 09:05:58 ----N---- C:\WINDOWS\system32\qutil.dll2009-09-25 09:05:58 ----N---- C:\WINDOWS\system32\qcliprov.dll2009-09-25 09:05:58 ----N---- C:\WINDOWS\system32\qagentrt.dll2009-09-25 09:05:58 ----N---- C:\WINDOWS\system32\qagent.dll2009-09-25 09:05:58 ----N---- C:\WINDOWS\system32\photometadatahandler.dll2009-09-25 09:05:58 ----N---- C:\WINDOWS\system32\onex.dll2009-09-25 09:05:56 ----N---- C:\WINDOWS\system32\napstat.exe2009-09-25 09:05:56 ----N---- C:\WINDOWS\system32\napmontr.dll2009-09-25 09:05:56 ----N---- C:\WINDOWS\system32\napipsec.dll2009-09-25 09:05:56 ----N---- C:\WINDOWS\system32\msxml6r.dll2009-09-25 09:05:56 ----N---- C:\WINDOWS\system32\msshavmsg.dll2009-09-25 09:05:56 ----N---- C:\WINDOWS\system32\mssha.dll2009-09-25 09:05:56 ----A---- C:\WINDOWS\system32\msxml6.dll2009-09-25 09:05:54 ----N---- C:\WINDOWS\system32\mmcperf.exe2009-09-25 09:05:54 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll2009-09-25 09:05:54 ----N---- C:\WINDOWS\system32\mmcex.dll2009-09-25 09:05:53 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll2009-09-25 09:05:52 ----N---- C:\WINDOWS\system32\l2gpstore.dll2009-09-25 09:05:52 ----N---- C:\WINDOWS\system32\kmsvc.dll2009-09-25 09:05:52 ----N---- C:\WINDOWS\system32\kbdpash.dll2009-09-25 09:05:52 ----N---- C:\WINDOWS\system32\kbdnepr.dll2009-09-25 09:05:52 ----N---- C:\WINDOWS\system32\kbdiultn.dll2009-09-25 09:05:52 ----N---- C:\WINDOWS\system32\kbdbhc.dll2009-09-25 09:05:50 ----N---- C:\WINDOWS\system32\smtpapi.dll2009-09-25 09:05:50 ----N---- C:\WINDOWS\system32\rwnh.dll2009-09-25 09:05:48 ----N---- C:\WINDOWS\system32\eapsvc.dll2009-09-25 09:05:48 ----N---- C:\WINDOWS\system32\eapqec.dll2009-09-25 09:05:48 ----N---- C:\WINDOWS\system32\eappprxy.dll2009-09-25 09:05:48 ----N---- C:\WINDOWS\system32\eapphost.dll2009-09-25 09:05:48 ----N---- C:\WINDOWS\system32\eappgnui.dll2009-09-25 09:05:48 ----N---- C:\WINDOWS\system32\eappcfg.dll2009-09-25 09:05:48 ----N---- C:\WINDOWS\system32\eapp3hst.dll2009-09-25 09:05:48 ----N---- C:\WINDOWS\system32\eapolqec.dll2009-09-25 09:05:47 ----N---- C:\WINDOWS\system32\dot3ui.dll2009-09-25 09:05:47 ----N---- C:\WINDOWS\system32\dot3svc.dll2009-09-25 09:05:47 ----N---- C:\WINDOWS\system32\dot3msm.dll2009-09-25 09:05:47 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll2009-09-25 09:05:47 ----N---- C:\WINDOWS\system32\dot3dlg.dll2009-09-25 09:05:47 ----N---- C:\WINDOWS\system32\dot3cfg.dll2009-09-25 09:05:47 ----N---- C:\WINDOWS\system32\dot3api.dll2009-09-25 09:05:47 ----N---- C:\WINDOWS\system32\dimsroam.dll2009-09-25 09:05:47 ----N---- C:\WINDOWS\system32\dimsntfy.dll2009-09-25 09:05:46 ----N---- C:\WINDOWS\system32\dhcpqec.dll2009-09-25 09:05:46 ----N---- C:\WINDOWS\system32\credssp.dll2009-09-25 09:05:44 ----N---- C:\WINDOWS\system32\bitsprx4.dll2009-09-25 09:05:44 ----N---- C:\WINDOWS\system32\azroles.dll2009-09-25 09:05:44 ----N---- C:\WINDOWS\system32\aaclient.dll2009-09-25 08:56:53 ----N---- C:\WINDOWS\system32\xpsp4res.dll2009-09-25 08:54:11 ----D---- C:\WINDOWS\system32\PreInstall2009-09-25 08:54:09 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$2009-09-25 08:54:09 ----HD---- C:\WINDOWS\$hf_mig$2009-09-25 08:53:59 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$2009-09-25 08:49:23 ----A---- C:\WINDOWS\system32\MRT.exe2009-09-25 08:47:45 ----SD---- C:\WINDOWS\system32\Microsoft2009-09-25 08:44:03 ----D---- C:\WINDOWS\provisioning2009-09-25 08:44:03 ----D---- C:\WINDOWS\peernet2009-09-25 08:43:06 ----D---- C:\WINDOWS\ServicePackFiles2009-09-25 08:41:28 ----A---- C:\WINDOWS\system32\dpl100.dll2009-09-25 08:41:26 ----A---- C:\WINDOWS\system32\divx_xx16.dll2009-09-25 08:41:26 ----A---- C:\WINDOWS\system32\divx_xx11.dll2009-09-25 08:41:26 ----A---- C:\WINDOWS\system32\divx_xx0c.dll2009-09-25 08:41:26 ----A---- C:\WINDOWS\system32\divx_xx0a.dll2009-09-25 08:41:26 ----A---- C:\WINDOWS\system32\divx_xx07.dll2009-09-25 08:41:26 ----A---- C:\WINDOWS\system32\DivX.dll2009-09-25 08:41:11 ----D---- C:\WINDOWS\system32\ReinstallBackups2009-09-25 08:40:55 ----A---- C:\WINDOWS\system32\spupdsvc.exe2009-09-25 08:39:38 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$2009-09-25 08:39:36 ----D---- C:\WINDOWS\EHome2009-09-25 01:31:11 ----N---- C:\WINDOWS\system32\spnpinst.exe2009-09-25 01:25:17 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage2009-09-25 01:23:12 ----D---- C:\WINDOWS\system32\bits2009-09-25 01:23:06 ----HDC---- C:\WINDOWS\$NtUninstallKB842773$2009-09-25 01:22:54 ----N---- C:\WINDOWS\system32\bitsprx3.dll2009-09-25 01:22:54 ----N---- C:\WINDOWS\system32\bitsprx2.dll2009-09-25 01:22:54 ----A---- C:\WINDOWS\system32\xpob2res.dll2009-09-25 01:22:54 ----A---- C:\WINDOWS\system32\winhttp.dll2009-09-25 01:22:54 ----A---- C:\WINDOWS\system32\qmgrprxy.dll2009-09-25 01:21:52 ----A---- C:\WINDOWS\system32\wups2.dll2009-09-25 01:21:52 ----A---- C:\WINDOWS\system32\wups.dll2009-09-25 01:21:52 ----A---- C:\WINDOWS\system32\wucltui.dll.mui2009-09-25 01:21:52 ----A---- C:\WINDOWS\system32\wucltui.dll2009-09-25 01:21:52 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui2009-09-25 01:21:52 ----A---- C:\WINDOWS\system32\wuapi.dll.mui2009-09-25 01:21:52 ----A---- C:\WINDOWS\system32\wuapi.dll2009-09-25 01:21:21 ----D---- C:\WINDOWS\SoftwareDistribution2009-09-25 01:20:10 ----SHD---- C:\WINDOWS\Installer2009-09-25 01:20:09 ----D---- C:\Documents and Settings\Mike\Application Data\Identities2009-09-25 01:20:05 ----HD---- C:\Program Files\Uninstall Information2009-09-25 01:20:01 ----SD---- C:\Documents and Settings\Mike\Application Data\Microsoft2009-09-25 01:20:01 ----ASH---- C:\Documents and Settings\Mike\Application Data\desktop.ini2009-09-25 01:18:07 ----SHD---- C:\System Volume Information2009-09-25 01:15:42 ----D---- C:\WINDOWS\system32\xircom2009-09-25 01:15:42 ----D---- C:\Program Files\xerox2009-09-25 01:15:42 ----D---- C:\Program Files\microsoft frontpage2009-09-25 01:15:24 ----A---- C:\WINDOWS\control.ini2009-09-25 01:15:24 ----A---- C:\AUTOEXEC.BAT2009-09-25 01:15:15 ----A---- C:\WINDOWS\system32\mapi32.dll2009-09-25 01:14:39 ----SD---- C:\WINDOWS\Downloaded Program Files2009-09-25 01:14:39 ----RD---- C:\WINDOWS\Offline Web Pages2009-09-25 01:14:39 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest2009-09-25 01:14:35 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest2009-09-25 01:14:22 ----D---- C:\WINDOWS\srchasst2009-09-25 01:14:17 ----D---- C:\WINDOWS\system32\DirectX2009-09-25 01:14:16 ----D---- C:\WINDOWS\system32\Macromed2009-09-25 01:14:07 ----A---- C:\WINDOWS\system32\qmgr.dll2009-09-25 01:14:06 ----D---- C:\Program Files\Movie Maker2009-09-25 01:13:53 ----A---- C:\WINDOWS\system32\safrslv.dll2009-09-25 01:13:53 ----A---- C:\WINDOWS\system32\safrdm.dll2009-09-25 01:13:53 ----A---- C:\WINDOWS\system32\safrcdlg.dll2009-09-25 01:13:53 ----A---- C:\WINDOWS\system32\racpldlg.dll2009-09-25 01:13:52 ----A---- C:\WINDOWS\system32\atrace.dll2009-09-25 01:13:48 ----A---- C:\WINDOWS\system32\desktop.ini2009-09-25 01:13:48 ----A---- C:\WINDOWS\desktop.ini2009-09-25 01:13:42 ----D---- C:\WINDOWS\system32\Restore2009-09-25 01:13:42 ----D---- C:\Program Files\Windows Media Player2009-09-25 01:13:42 ----A---- C:\WINDOWS\system32\srsvc.dll2009-09-25 01:13:42 ----A---- C:\WINDOWS\system32\srrstr.dll2009-09-25 01:13:42 ----A---- C:\WINDOWS\system32\srclient.dll2009-09-25 01:13:41 ----A---- C:\WINDOWS\system32\nmmkcert.dll2009-09-25 01:13:41 ----A---- C:\WINDOWS\system32\nmevtmsg.dll2009-09-25 01:13:41 ----A---- C:\WINDOWS\system32\msconf.dll2009-09-25 01:13:41 ----A---- C:\WINDOWS\system32\mnmsrvc.exe2009-09-25 01:13:41 ----A---- C:\WINDOWS\system32\mnmdd.dll2009-09-25 01:13:41 ----A---- C:\WINDOWS\system32\isrdbg32.dll2009-09-25 01:13:41 ----A---- C:\WINDOWS\system32\ils.dll2009-09-25 01:13:38 ----D---- C:\Program Files\NetMeeting2009-09-25 01:13:37 ----D---- C:\WINDOWS\PCHEALTH2009-09-25 01:13:37 ----D---- C:\Program Files\Common Files\Services2009-09-25 01:13:37 ----A---- C:\WINDOWS\system32\msoert2.dll2009-09-25 01:13:37 ----A---- C:\WINDOWS\system32\msoeacct.dll2009-09-25 01:13:37 ----A---- C:\WINDOWS\system32\acctres.dll2009-09-25 01:13:36 ----A---- C:\WINDOWS\system32\inetres.dll2009-09-25 01:13:35 ----A---- C:\WINDOWS\system32\inetcomm.dll2009-09-25 01:13:32 ----SD---- C:\WINDOWS\Tasks2009-09-25 01:13:32 ----D---- C:\Program Files\Outlook Express2009-09-25 01:13:32 ----A---- C:\WINDOWS\system32\schedsvc.dll2009-09-25 01:13:32 ----A---- C:\WINDOWS\system32\mstinit.exe2009-09-25 01:13:32 ----A---- C:\WINDOWS\system32\mstask.dll2009-09-25 01:13:32 ----A---- C:\WINDOWS\system32\icwphbk.dll2009-09-25 01:13:31 ----A---- C:\WINDOWS\system32\isign32.dll2009-09-25 01:13:31 ----A---- C:\WINDOWS\system32\inetcfg.dll2009-09-25 01:13:31 ----A---- C:\WINDOWS\system32\icwdial.dll2009-09-25 01:13:31 ----A---- C:\WINDOWS\system32\icfgnt5.dll2009-09-25 01:13:29 ----D---- C:\Program Files\Common Files\MSSoap2009-09-25 01:13:26 ----D---- C:\Program Files\Common Files\System2009-09-25 01:13:23 ----D---- C:\Program Files\Internet Explorer2009-09-25 01:12:55 ----A---- C:\WINDOWS\vbaddin.ini2009-09-25 01:12:55 ----A---- C:\WINDOWS\vb.ini2009-09-25 01:12:52 ----D---- C:\WINDOWS\Registration2009-09-25 01:12:46 ----HD---- C:\Program Files\WindowsUpdate2009-09-25 01:12:46 ----D---- C:\Program Files\Online Services2009-09-25 01:12:41 ----D---- C:\Program Files\Messenger2009-09-25 01:12:36 ----D---- C:\Program Files\MSN2009-09-25 01:12:33 ----D---- C:\Program Files\MSN Gaming Zone2009-09-25 01:12:33 ----A---- C:\WINDOWS\system32\write.exe2009-09-25 01:12:26 ----A---- C:\WINDOWS\system32\sndvol32.exe2009-09-25 01:12:26 ----A---- C:\WINDOWS\system32\sndrec32.exe2009-09-25 01:12:26 ----A---- C:\WINDOWS\system32\mplay32.exe2009-09-25 01:12:26 ----A---- C:\WINDOWS\system32\accwiz.exe2009-09-25 01:12:25 ----D---- C:\Program Files\Windows NT2009-09-25 01:12:25 ----A---- C:\WINDOWS\system32\winchat.exe2009-09-25 01:12:25 ----A---- C:\WINDOWS\system32\hypertrm.dll2009-09-25 01:12:25 ----A---- C:\WINDOWS\system32\hticons.dll2009-09-25 01:12:25 ----A---- C:\WINDOWS\system32\avwav.dll2009-09-25 01:12:25 ----A---- C:\WINDOWS\system32\avtapi.dll2009-09-25 01:12:25 ----A---- C:\WINDOWS\system32\avmeter.dll2009-09-25 01:12:24 ----A---- C:\WINDOWS\system32\mspaint.exe2009-09-25 01:12:20 ----A---- C:\WINDOWS\system32\clipbrd.exe2009-09-25 01:12:19 ----A---- C:\WINDOWS\system32\spider.exe2009-09-25 01:12:19 ----A---- C:\WINDOWS\system32\sol.exe2009-09-25 01:12:19 ----A---- C:\WINDOWS\system32\getuname.dll2009-09-25 01:12:19 ----A---- C:\WINDOWS\system32\charmap.exe2009-09-25 01:12:19 ----A---- C:\WINDOWS\system32\calc.exe2009-09-25 01:12:18 ----A---- C:\WINDOWS\system32\wuauserv.dll2009-09-25 01:12:18 ----A---- C:\WINDOWS\system32\wuaueng.dll2009-09-25 01:12:18 ----A---- C:\WINDOWS\system32\wuauclt.exe2009-09-25 01:12:18 ----A---- C:\WINDOWS\system32\winmine.exe2009-09-25 01:12:18 ----A---- C:\WINDOWS\system32\mshearts.exe2009-09-25 01:12:18 ----A---- C:\WINDOWS\system32\freecell.exe2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\usrlogon.cmd2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\tskill.exe2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\tscupgrd.exe2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\tscfgwmi.dll2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\sessmgr.exe2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\reset.exe2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\remotepg.dll2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\rdshost.exe2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\rdsaddin.exe2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\rdchost.dll2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\mstscax.dll2009-09-25 01:12:17 ----A---- C:\WINDOWS\system32\mstsc.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\tsshutdn.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\tslabels.ini2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\tsdiscon.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\tscon.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\termsrv.dll2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\shadow.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\rwinsta.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\regini.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\rdpwsx.dll2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\rdpsnd.dll2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\rdpclip.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\rdpcfgex.dll2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\qwinsta.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\qprocess.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\qappsrv.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\msg.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\logoff.exe2009-09-25 01:12:16 ----A---- C:\WINDOWS\system32\icaapi.dll2009-09-25 01:12:15 ----D---- C:\WINDOWS\system32\MsDtc2009-09-25 01:12:15 ----A---- C:\WINDOWS\system32\xolehlp.dll2009-09-25 01:12:15 ----A---- C:\WINDOWS\system32\mtxoci.dll2009-09-25 01:12:15 ----A---- C:\WINDOWS\system32\msdtcuiu.dll2009-09-25 01:12:15 ----A---- C:\WINDOWS\system32\msdtctm.dll2009-09-25 01:12:15 ----A---- C:\WINDOWS\system32\msdtcprx.dll2009-09-25 01:12:15 ----A---- C:\WINDOWS\system32\msdtcprf.ini2009-09-25 01:12:15 ----A---- C:\WINDOWS\system32\cfgbkend.dll2009-09-25 01:12:15 ----A---- C:\WINDOWS\system32\cdmodem.dll2009-09-25 01:12:14 ----A---- C:\WINDOWS\system32\msdtclog.dll2009-09-25 01:12:14 ----A---- C:\WINDOWS\system32\msdtc.exe2009-09-25 01:12:14 ----A---- C:\WINDOWS\system32\dcomcnfg.exe2009-09-25 01:12:13 ----D---- C:\WINDOWS\system32\Com2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\stclient.dll2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\mtxlegih.dll2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\mtxex.dll2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\mtxdm.dll2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\comrepl.dll2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\comaddin.dll2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\colbact.dll2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\clbcatex.dll2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\catsrvut.dll2009-09-25 01:12:13 ----A---- C:\WINDOWS\system32\catsrvps.dll2009-09-25 01:12:12 ----A---- C:\WINDOWS\system32\comuid.dll2009-09-25 01:12:12 ----A---- C:\WINDOWS\system32\comsvcs.dll2009-09-25 01:12:12 ----A---- C:\WINDOWS\system32\comsnap.dll2009-09-25 01:12:12 ----A---- C:\WINDOWS\system32\clbcatq.dll2009-09-25 01:12:12 ----A---- C:\WINDOWS\system32\catsrv.dll2009-09-25 01:12:04 ----A---- C:\WINDOWS\system32\wmimgmt.msc2009-09-25 01:12:04 ----A---- C:\WINDOWS\system32\servdeps.dll2009-09-25 01:12:04 ----A---- C:\WINDOWS\system32\mmfutil.dll2009-09-25 01:12:04 ----A---- C:\WINDOWS\system32\licwmi.dll2009-09-25 01:12:04 ----A---- C:\WINDOWS\system32\cmprops.dll2009-09-24 18:10:03 ----A---- C:\WINDOWS\system32\h323log.txt2009-09-24 18:04:52 ----A---- C:\WINDOWS\system32\usbui.dll2009-09-24 18:03:58 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI2009-09-24 18:03:57 ----D---- C:\Program Files\Common Files\ODBC2009-09-24 18:03:57 ----A---- C:\WINDOWS\ODBCINST.INI2009-09-24 18:03:55 ----RD---- C:\Program Files2009-09-24 18:03:55 ----D---- C:\Program Files\Common Files\SpeechEngines2009-09-24 18:03:55 ----D---- C:\Program Files\Common Files\Microsoft Shared2009-09-24 18:03:55 ----D---- C:\Program Files\Common Files2009-09-24 18:03:53 ----RA---- C:\WINDOWS\system32\kbdtuq.dll2009-09-24 18:03:53 ----RA---- C:\WINDOWS\system32\kbdtuf.dll2009-09-24 18:03:53 ----RA---- C:\WINDOWS\system32\kbdazel.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdycc.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbduzb.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdur.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdtat.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdru1.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdru.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdmon.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdkyr.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdkaz.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdbu.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdblr.dll2009-09-24 18:03:51 ----RA---- C:\WINDOWS\system32\kbdaze.dll2009-09-24 18:03:50 ----RA---- C:\WINDOWS\system32\kbdhept.dll2009-09-24 18:03:50 ----RA---- C:\WINDOWS\system32\kbdhela3.dll2009-09-24 18:03:50 ----RA---- C:\WINDOWS\system32\kbdhela2.dll2009-09-24 18:03:50 ----RA---- C:\WINDOWS\system32\kbdhe319.dll2009-09-24 18:03:50 ----RA---- C:\WINDOWS\system32\kbdhe220.dll2009-09-24 18:03:50 ----RA---- C:\WINDOWS\system32\kbdhe.dll2009-09-24 18:03:50 ----RA---- C:\WINDOWS\system32\kbdgkl.dll2009-09-24 18:03:48 ----RA---- C:\WINDOWS\system32\kbdlv1.dll2009-09-24 18:03:48 ----RA---- C:\WINDOWS\system32\kbdlv.dll2009-09-24 18:03:48 ----RA---- C:\WINDOWS\system32\kbdlt1.dll2009-09-24 18:03:48 ----RA---- C:\WINDOWS\system32\kbdlt.dll2009-09-24 18:03:48 ----RA---- C:\WINDOWS\system32\kbdest.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdycl.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdsl1.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdsl.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdro.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdpl1.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdpl.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdhu1.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdhu.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdcz2.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdcz1.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdcz.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\kbdcr.dll2009-09-24 18:03:47 ----RA---- C:\WINDOWS\system32\KBDAL.DLL2009-09-24 18:03:45 ----A---- C:\WINDOWS\system32\irclass.dll2009-09-24 18:03:45 ----A---- C:\WINDOWS\system32\dgsetup.dll2009-09-24 18:03:45 ----A---- C:\WINDOWS\system32\dgrpsetu.dll2009-09-24 18:03:44 ----A---- C:\WINDOWS\system32\spxcoins.dll2009-09-24 18:03:44 ----A---- C:\WINDOWS\system32\EqnClass.Dll2009-09-24 18:03:44 ----A---- C:\WINDOWS\system32\batt.dll2009-09-24 18:03:42 ----A---- C:\WINDOWS\TASKMAN.EXE2009-09-24 18:03:42 ----A---- C:\WINDOWS\system32\storprop.dll2009-09-24 18:03:42 ----A---- C:\WINDOWS\notepad.exe2009-09-24 18:03:36 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini2009-09-24 18:03:26 ----D---- C:\WINDOWS\system32\CatRoot22009-09-24 18:03:26 ----D---- C:\WINDOWS\system32\CatRoot2009-09-24 18:03:20 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft2009-09-24 18:03:09 ----D---- C:\Documents and Settings2009-09-24 18:02:12 ----ASH---- C:\boot.ini2009-09-24 17:59:26 ----RSHDC---- C:\WINDOWS\system32\dllcache2009-09-24 17:59:26 ----RSD---- C:\WINDOWS\Fonts2009-09-24 17:59:26 ----RD---- C:\WINDOWS\Web2009-09-24 17:59:26 ----HD---- C:\WINDOWS\inf2009-09-24 17:59:26 ----D---- C:\WINDOWS\WinSxS2009-09-24 17:59:26 ----D---- C:\WINDOWS\twain_322009-09-24 17:59:26 ----D---- C:\WINDOWS\Temp2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\wins2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\wbem2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\usmt2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\spool2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\ShellExt2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\Setup2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\ras2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\oobe2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\npp2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\mui2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\inetsrv2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\IME2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\icsxml2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\ias2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\export2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\drivers2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\dhcp2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\config2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\3com_dmi2009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\30762009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\20522009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\10542009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\10422009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\10412009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\10372009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\10332009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\10312009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\10282009-09-24 17:59:26 ----D---- C:\WINDOWS\system32\10252009-09-24 17:59:26 ----D---- C:\WINDOWS\system322009-09-24 17:59:26 ----D---- C:\WINDOWS\system2009-09-24 17:59:26 ----D---- C:\WINDOWS\security2009-09-24 17:59:26 ----D---- C:\WINDOWS\Resources2009-09-24 17:59:26 ----D---- C:\WINDOWS\repair2009-09-24 17:59:26 ----D---- C:\WINDOWS\mui2009-09-24 17:59:26 ----D---- C:\WINDOWS\msapps2009-09-24 17:59:26 ----D---- C:\WINDOWS\msagent2009-09-24 17:59:26 ----D---- C:\WINDOWS\Media2009-09-24 17:59:26 ----D---- C:\WINDOWS\java2009-09-24 17:59:26 ----D---- C:\WINDOWS\ime2009-09-24 17:59:26 ----D---- C:\WINDOWS\Help2009-09-24 17:59:26 ----D---- C:\WINDOWS\Driver Cache2009-09-24 17:59:26 ----D---- C:\WINDOWS\Debug2009-09-24 17:59:26 ----D---- C:\WINDOWS\Cursors2009-09-24 17:59:26 ----D---- C:\WINDOWS\Connection Wizard2009-09-24 17:59:26 ----D---- C:\WINDOWS\Config2009-09-24 17:59:26 ----D---- C:\WINDOWS\AppPatch2009-09-24 17:59:26 ----D---- C:\WINDOWS\addins2009-09-24 17:59:26 ----D---- C:\WINDOWS======List of files/folders modified in the last 3 months======2009-10-30 21:50:31 ----A---- C:\WINDOWS\win.ini2009-10-30 21:50:31 ----A---- C:\WINDOWS\system.ini2009-09-25 08:41:56 ----RASH---- C:\NTDETECT.COM2009-09-11 06:18:39 ----A---- C:\WINDOWS\system32\msv1_0.dll2009-09-04 13:03:36 ----A---- C:\WINDOWS\system32\msasn1.dll2009-08-29 00:08:21 ----A---- C:\WINDOWS\system32\wininet.dll2009-08-29 00:08:21 ----A---- C:\WINDOWS\system32\urlmon.dll2009-08-29 00:08:20 ----N---- C:\WINDOWS\system32\occache.dll2009-08-29 00:08:20 ----A---- C:\WINDOWS\system32\mshtml.dll2009-08-29 00:08:18 ----N---- C:\WINDOWS\system32\jsproxy.dll2009-08-29 00:08:18 ----A---- C:\WINDOWS\system32\msfeedsbs.dll2009-08-29 00:08:18 ----A---- C:\WINDOWS\system32\msfeeds.dll2009-08-29 00:08:18 ----A---- C:\WINDOWS\system32\iertutil.dll2009-08-29 00:08:17 ----A---- C:\WINDOWS\system32\iepeers.dll2009-08-29 00:08:16 ----A---- C:\WINDOWS\system32\ieframe.dll2009-08-29 00:08:13 ----N---- C:\WINDOWS\system32\iedkcs32.dll2009-08-28 02:35:52 ----N---- C:\WINDOWS\system32\ie4uinit.exe2009-08-26 00:00:21 ----A---- C:\WINDOWS\system32\strmdll.dll2009-08-06 18:24:18 ----A---- C:\WINDOWS\system32\wuweb.dll2009-08-06 18:24:04 ----A---- C:\WINDOWS\system32\cdm.dll2009-08-06 18:23:46 ----A---- C:\WINDOWS\system32\muweb.dll2009-08-05 01:01:48 ----A---- C:\WINDOWS\system32\mswebdvd.dll======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-13 36352]R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-09-24 4122368]R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-07-21 3565056]R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-07 51120]R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-07 16496]R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-07 21744]R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-03 20992]R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]S3 TfNetMon;TfNetMon; \??\C:\WINDOWS\system32\drivers\TfNetMon.sys []S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]S4 pctgntdi;pctgntdi; \??\C:\WINDOWS\system32\drivers\pctgntdi.sys []S4 pctplsg;pctplsg; \??\C:\WINDOWS\system32\drivers\pctplsg.sys []S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-07-21 602112]R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]R2 Browser Defender Update Service;Browser Defender Update Service; C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe [2009-10-08 112592]R2 FreeAgentGoNext Service;Seagate Service; C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe [2009-03-27 165160]R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-11-03 153376]R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-08 73728]R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-07-21 593920]S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2009-09-23 358600]S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2009-09-23 1141200]S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]-----------------EOF----------------- Link to post Share on other sites More sharing options...
bigmuff Posted November 5, 2009 Author ID:154019 Share Posted November 5, 2009 Bump.There's a lot of code here that I have no idea what it means. I've been slightly concerned about the paging operation errors. Link to post Share on other sites More sharing options...
SpySentinel Posted November 8, 2009 ID:155195 Share Posted November 8, 2009 Please update Malwarebytes and run one more quick scan and post the log here. Link to post Share on other sites More sharing options...
bigmuff Posted November 9, 2009 Author ID:155468 Share Posted November 9, 2009 Clean per Malwarebytes:Malwarebytes' Anti-Malware 1.41Database version: 3131Windows 5.1.2600 Service Pack 311/8/2009 10:57:42 PMmbam-log-2009-11-08 (22-57-42).txtScan type: Quick ScanObjects scanned: 99649Time elapsed: 4 minute(s), 29 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
SpySentinel Posted November 9, 2009 ID:155614 Share Posted November 9, 2009 Your log looks clean, Great Job Now for some cleanup..Please download OTC and save it to Desktop.Please make sure you are connecting to the InternetDouble-click OTC.exeClick the CleanUp! button.Select Yes when the "Begin cleanup Process?" prompt appears.If you are prompted to Reboot during the cleanup, select YesSet a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. The easiest and safest way to do this is:Go to Start > Programs > Accessories > System Tools and click "System Restore".Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.Then go to Start > Run and type: CleanmgrClick "OK".Click the "More Options" Tab.Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.Make your Internet Explorer more secure - This can be done by following these simple instructions:From within Internet Explorer click on the Tools menu and then click on Options.Click once on the Security tabClick once on the Internet icon so it becomes highlighted.Click once on the Custom Level button.Change the Download signed ActiveX controls to PromptChange the Download unsigned ActiveX controls to DisableChange the Initialize and script ActiveX controls not marked as safe to DisableChange the Installation of desktop items to PromptChange the Launching programs and files in an IFRAME to PromptChange the Navigate sub-frames across different domains to PromptWhen all these settings have been made, click on the OK button.If it prompts you as to whether or not you want to save the settings, press the Yes button.Next press the Apply button and then the OK to exit the Internet Properties page.Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.No Firewall Onboard You don't seem to have a firewall program installed. Using a firewall will allow you to allow/deny access for applications that want to go online. Select one of these, or another of your choice: Online Armor Sunbelt Personal FirewallOutPost Firewall[*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.[*]Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.[*]Install SpywareGuard - SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.[*]Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.Follow this list and your potential for being infected again will reduce dramatically. here are some additional utilities that will enhance your safetyMcAfee Site Advisor <= McAfee Site Advisor protects your browser against malicious sites and warns you when you go to one.MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computerMalwarebytes' Anti-Malware - which you already have.SUPER AntiSpyware - A Free AntiSpyware scanner that has great detection ratings. Link to post Share on other sites More sharing options...
bigmuff Posted November 10, 2009 Author ID:156114 Share Posted November 10, 2009 Thanks for all your help! Hope this does the trick. Link to post Share on other sites More sharing options...
SpySentinel Posted November 11, 2009 ID:156307 Share Posted November 11, 2009 You're welcome Link to post Share on other sites More sharing options...
Recommended Posts