Programs not opening/running

77Pat · May 21, 2010

I was directed here after my problem could not be resolved in the general forum.

My main problem is that Malwarebytes will not run. It gives me an error: 703 (0, 48) or mbam error load database (0, 48)

A few other problems are with Last.fm giving me an error saying the program cannot be initialized and Windows Update being set to automatically update, but it does not. All other programs work find and the performance of my computer seems normal.

I was able to successfully run DDS, but GMER would scan to a certain point and then BSOD. I had turned off all active scanning programs while it was running and the scan was able to go longer, but it would still blue screen after my monitor lost connection a few times (I had turned off power save mode, since this caused the BSOD more quickly). It had been running for about 2 hours when the latest BSOD occurred.

The error message reads:

STOP: c000021a {Fatal System Error}

The windows Logon Process system process terminated unexpectedly with a status of

0xc0000005 (0x00000000 0x00000000)

The system has been shut down.

This has happened a couple of times in the past month when my laptop has been very hot. I did a system scan before any of this with Avira and SuperAntiSpyware. SuperAntiSpyware found 5 tracking cookies and Avira had 1 warning that a file would not open.

DDS (Ver_10-03-17.01) - NTFSx86

Run by Administrator at 22:27:19.96 on Thu 05/20/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.276 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Network Associates\Common Framework\UdaterUI.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Network Associates\Common Framework\McTray.exe

C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

C:\Program Files\ThreatFire\TFTray.exe

C:\Program Files\Verizon\McciTrayApp.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Documents and Settings\Administrator\Local Settings\Apps\F.lux\flux.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Secunia\PSI\psi.exe

C:\Program Files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\emaudsv.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\WINDOWS\system32\svchost.exe -k HPService

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Apoint\HidFind.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

c:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Macrium\Reflect\ReflectService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\ThreatFire\TFService.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe

C:\WINDOWS\system32\CCM\CcmExec.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\msiexec.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Program Files\COMODO\COMODO Internet Security\cfpupdat.exe

C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.villanova.edu/homepage/index.htm

uInternet Connection Wizard,ShellNext = hxxp://unit.villanova.edu/support/slp/vuad

uInternet Settings,ProxyOverride = *.local

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [E-MU USB Audio Control Panel] "c:\program files\creative professional\e-mu usb audio\EmuUsbAudioCP.exe"

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [Google Update] "c:\documents and settings\administrator\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [F.lux] "c:\documents and settings\administrator\local settings\apps\f.lux\flux.exe" /noshow

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

mRun: [Apoint] c:\program files\apoint\Apoint.exe

mRun: [McAfeeUpdaterUI] "c:\program files\network associates\common framework\UdaterUI.exe" /StartedFromRunKey

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start

mRun: [broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe

mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h

mRun: [ThreatFire] c:\program files\threatfire\TFTray.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Verizon_McciTrayApp] "c:\program files\verizon\McciTrayApp.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [<NO NAME>]

StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

Trusted Zone: microsoft.com

Trusted Zone: villanova.edu

DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/Verizon%20FiOS%20Installer.cab

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262756265921

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1262756247718

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\v75hnvn5.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig|http://www.villanova.edu/homepage/index.htm

FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\v75hnvn5.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\v75hnvn5.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\RadioWMPCore.dll

FF - plugin: c:\documents and settings\administrator\application data\facebook\npfbplugin_1_0_3.dll

FF - plugin: c:\documents and settings\administrator\application data\move networks\plugins\npqmp071503000010.dll

FF - plugin: c:\documents and settings\administrator\application data\move networks\plugins\npqmp071505000010.dll

FF - plugin: c:\documents and settings\administrator\application data\move networks\plugins\npqmp071505000011.dll

FF - plugin: c:\documents and settings\administrator\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\common files\motive\npMotive.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll

FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-connections-per-server - 8

FF - user.js: content.max.tokenizing.time - 200000

FF - user.js: content.notify.interval - 100000

FF - user.js: nglayout.initialpaint.delay - 300

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.switch.threshold - 650000

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 a320raid;a320raid;c:\windows\system32\drivers\A320RAID.SYS [2006-4-18 251578]

R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [2008-5-20 15328]

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2010-1-14 51984]

R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2010-1-14 59664]

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-1-6 11608]

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2010-1-6 133064]

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2010-1-6 25160]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-6 68168]

R2 Amazon Download Agent;Amazon Download Agent;c:\program files\amazon\amazon games & software downloader\AmazonGSDownloaderService.exe [2009-2-3 317440]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-1-6 108289]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-1-6 185089]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-1-6 56816]

R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2010-1-6 723632]

R2 emaudsv;E-MU Audio Service;c:\windows\system32\emaudsv.exe [2006-11-20 20992]

R2 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2006-5-24 104000]

R2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\macrium\reflect\ReflectService.exe [2009-11-12 220128]

R2 ThreatFire;ThreatFire;c:\program files\threatfire\tfservice.exe service --> c:\program files\threatfire\TFService.exe service [?]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-6-13 24652]

R3 emusba10;E-MU USB-Audio 1.0 Driver;c:\windows\system32\drivers\emusba10.sys [2007-11-26 163352]

R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]

R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2010-1-14 33552]

S0 aac;PERC 320/DC SCSI RAID Miniport Driver;c:\windows\system32\drivers\aac.sys --> c:\windows\system32\drivers\aac.sys [?]

S0 aarich;aarich;c:\windows\system32\drivers\aarich.sys --> c:\windows\system32\drivers\aarich.sys [?]

S0 vmscsi;vmscsi;c:\windows\system32\drivers\vmscsi.sys --> c:\windows\system32\drivers\vmscsi.sys [?]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-3-24 18176]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-3-24 7680]

S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2008-3-24 23680]

=============== Created Last 30 ================

2010-05-21 02:15:23 0 ----a-w- c:\documents and settings\administrator\defogger_reenable

2010-05-21 00:30:08 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-05-21 00:30:03 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-05-21 00:30:03 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-20 17:14:08 0 d-----w- c:\program files\SpywareBlaster

2010-05-20 15:48:50 23113 ----a-w- c:\windows\hpqins15.dat

2010-05-20 15:38:29 77377 ----a-w- c:\windows\hpqins05.dat

2010-05-20 15:18:43 0 d-----w- c:\docume~1\admini~1\applic~1\HpUpdate

2010-05-18 22:29:51 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-05-18 22:29:51 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-05-17 21:05:21 0 d-----w- C:\Swsetup

2010-05-07 10:58:27 0 d-----w- c:\program files\Microsoft Research

2010-05-06 01:36:01 0 d-----w- c:\program files\iPod

2010-05-04 02:45:01 0 d-----w- c:\docume~1\admini~1\applic~1\Printer Info Cache

2010-05-02 16:40:27 0 d-----w- c:\docume~1\admini~1\applic~1\Facebook

==================== Find3M ====================

2010-05-17 21:35:10 68155 ----a-w- c:\windows\system32\nvModes.dat

2010-04-08 17:20:02 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-04-08 17:20:02 107808 ----a-w- c:\windows\system32\dns-sd.exe

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-03-03 12:47:47 132 ---ha-w- c:\docume~1\admini~1\applic~1\lakerda1967.sys

2010-03-03 02:51:10 360580 ----a-w- c:\windows\eSellerateEngine.dll

2010-02-25 06:24:37 916480 ----a-w- c:\windows\system32\wininet.dll

2008-08-20 17:27:07 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat

2008-08-20 17:26:01 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082020080821\index.dat

2008-08-20 17:27:07 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

============= FINISH: 22:30:42.68 ===============

Attach.zip

schrauber · May 23, 2010

Hello, 77Pat

Welcome to the Malwarebytes Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

Please take note of some guidelines for this fix:

Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to <schrauber> before saving it to your desktop.

Link 1

Link 2

--------------------------------------------------------------------

Double click on the renamed Combofix.exe & follow the prompts.

When finished, it will produce a report for you.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.

ComboFix SHOULD NOT be used unless requested by a forum helper

If you need help, see this link:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

77Pat · May 24, 2010

As I was running combofix two errors popped up, after I agreed to the Windows EULA.

The first was:

Extract.cfxxe-Application Error

The application failed to initialize properly (0xc0000005). Click OK to terminate the application.

Then:

Contents of C:\cmdcons are not in order.

Please disable your security programs before trying again.

All of my security programs are disabled.

schrauber · May 24, 2010

What kind of security software do you use?

Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
Click on this link to see a list of programs that should be disabled.
Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
Allow the driver to load if asked.
You may be prompted to scan immediately if it detects rootkit activity.
If you are prompted to scan your system click "No", save the log and post back the results.
If not prompted, click the "Rootkit/Malware" tab.
On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
Select all drives that are connected to your system to be scanned.
Click the Scan button to begin. (Please be patient as it can take some time to complete)
When the scan is finished, click Save to save the scan results to your Desktop.
Save the file as Results.log and copy/paste the contents in your next reply.
Exit the program and re-enable all active protection when done.

77Pat · May 24, 2010

I use Avira, Threatfire, Comodo Firewall, Spywareblaster, and WinPatrol.

Should I try running Combofix again?

schrauber · May 24, 2010

Please uninstall everything, leave only Antivir and Comodo Firewall. Disable both, delete Combofix from the desktop and download a fresh one, try again

77Pat · May 24, 2010

Should I do the scan with IAT/EAT checked, since the sticky at the top says to uncheck that one? I was able to complete the scan with IAT/EAT. The problem was that I had my laptop connected to an external monitor. By using just the laptop the scan was able to work, was a lot faster, and did not find as many .text files for some reason.

I tried running combofix again and received the same error. I wonder if it is because my laptop does not have a separate recovery/fallback partition (Dell Latitude D620).

schrauber · May 25, 2010

I was able to complete the scan with IAT/EAT.

Can you post the logfile please?

77Pat · May 25, 2010

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-05-24 15:24:07

Windows 5.1.2600 Service Pack 3

Running: 3qw3bh1y.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pwloapod.sys

---- System - GMER 1.0.15 ----

SSDT F7E3A0AE ZwCreateKey

SSDT F7E3A0A4 ZwCreateThread

SSDT F7E3A0B3 ZwDeleteKey

SSDT F7E3A0BD ZwDeleteValueKey

SSDT F7E3A0C2 ZwLoadKey

SSDT F7E3A090 ZwOpenProcess

SSDT F7E3A095 ZwOpenThread

SSDT F7E3A0CC ZwReplaceKey

SSDT F7E3A0C7 ZwRestoreKey

SSDT F7E3A0B8 ZwSetValueKey

SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xF4382950]

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF67CA360, 0x212B5D, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1320] ntdll.dll!NtAllocateVirtualMemory 7C90CF6E 5 Bytes JMP 0040F950 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO Internet Security/COMODO)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F75096E0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F75097B0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] [F7509780] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F7509740] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F7509740] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F75097B0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F75096E0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [F7509780] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [F7509780] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F7509740] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F75097B0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F75096E0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F7509740] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [F7509780] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F75096E0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F75097B0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F75096E0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F75097B0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F7509740] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [F7509780] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F7509740] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F75097B0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F75096E0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F7509740] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [F7509780] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F75096E0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F75097B0] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)

AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)

AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)

AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)

---- EOF - GMER 1.0.15 ----

schrauber · May 26, 2010

Hi,

You must first verify that you can logon to the Windows Recovery Console.

To do so, you must have the Recovery Console installed or use the Windows XP installation cd.

How to install and use the Windows XP Recovery Console

Next, please download maxlook, saving the file to your desktop.

Double click maxlook.exe to run it. Note - you must run it only once!

As instructed when the tool runs, restart the computer and logon to the Recovery Console.

Execute the following bolded command at the x:\windows> prompt <--- the red x represents your operating system drive letter, usually C

batch look.bat

You will see many files copied then return to the x:\windows> prompt.

Type Exit then restart your computer and logon in normal mode.

Please run maxlook.exe again now. Note - you must run it only once!

It will produce looklog.txt on the desktop and open it.

Please post the results here.

NEXT:

Once back in Windows, go to Start > Run, and copy/paste the following then press Enter.

maxlook -sig

Post the log in your next reply

Please download OTL from one of the following mirrors:
- This is THE Mirror

[*]Save it to your desktop.

[*]Double click on the icon on your desktop.

[*]Under the Custom Scan box paste this in

netsvcs

%SYSTEMDRIVE%\*.exe

/md5start

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

nvrd32.sys

symmpi.sys

adp3132.sys

mv61xx.sys

/md5stop

%systemroot%\*. /mp /s

CREATERESTOREPOINT

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemdrive%\*.sys /90 /md5

[*]Push the Quick Scan button.

[*]Two reports will open, copy and paste them in a reply here:

OTL.txt <-- Will be opened
Extra.txt <-- Will be minimized

77Pat · May 27, 2010

I do not have a windows xp cd and I tried downloading the windows recovery console from this link http://tips.vlaurie.com/2006/05/recovery-c...out-an-xp-disk/, but I still get an application error.

It happens during extract.exe

This is the same error when trying to download through combofix.

schrauber · May 28, 2010

Hi,

You can also go here and create a Recovery Console CD. Just click the link provided there to download the recovery_console_cd.zip and unzip that to your desktop.

Then inside the recovery_console_cd folder that created locate and click on the IE icon titled Readme. This will open a webpage, which will provide the simple steps you will need to follow, as well as a clickable link to go to the MS download page where you can select the BootDisk file download appropriate for your operating system. For example, for an XP SP2 Home Edition you would be downloading WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe.

77Pat · May 28, 2010

That is what I did, but it still gave me the extract.exe error after clicking recoverycd.bat

schrauber · May 28, 2010

Hi,

Please download MBR.exe and save it to your windows directory (usually C:\windows).
Now click Start > Run and copy/paste the following text in the box that opens. Do not copy the word "code".
```
cmd /c mbr.exe -t >log.txt&start log.txt
```
Press enter.
An mbr.log should open. Please post its contents in your next reply.

77Pat · May 29, 2010

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK

schrauber · May 29, 2010

Ok,

Please follow the above steop to run OTL and post back with the logfiles, let me know how the system is running

77Pat · May 30, 2010

OTL logfile created on: 5/29/2010 9:04:31 PM - Run 1

OTL by OldTimer - Version 3.2.5.1 Folder = C:\Documents and Settings\Administrator\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 444.00 Mb Available Physical Memory | 43.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 49.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 55.88 Gb Total Space | 4.75 Gb Free Space | 8.50% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: D135VS91

Current User Name: Administrator

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/05/29 21:01:54 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe

PRC - [2010/05/06 17:04:56 | 002,017,280 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

PRC - [2010/04/16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

PRC - [2010/03/17 16:55:42 | 001,565,696 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\Verizon\McciTrayApp.exe

PRC - [2010/03/17 16:55:36 | 001,048,576 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\Verizon\McciBrowser.exe

PRC - [2010/01/06 00:43:59 | 000,723,632 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

PRC - [2010/01/06 00:43:56 | 001,800,464 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

PRC - [2009/11/12 14:50:18 | 000,220,128 | ---- | M] () -- C:\Program Files\Macrium\Reflect\ReflectService.exe

PRC - [2009/08/29 02:00:12 | 000,966,656 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Apps\F.lux\flux.exe

PRC - [2009/08/21 04:15:32 | 000,900,816 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psi.exe

PRC - [2009/07/21 14:34:33 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2009/05/13 16:48:22 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2009/03/02 13:08:47 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2009/02/02 02:33:18 | 000,317,440 | ---- | M] (Amazon.com) -- C:\Program Files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe

PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/11/26 15:10:08 | 000,020,992 | ---- | M] (E-MU Systems) -- C:\WINDOWS\system32\emaudsv.exe

PRC - [2007/11/26 15:03:12 | 000,274,432 | ---- | M] (E-MU Systems) -- C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe

PRC - [2007/08/02 20:35:08 | 000,474,368 | ---- | M] (TuneUp Software GmbH) -- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe

PRC - [2007/08/02 20:35:04 | 000,398,592 | ---- | M] (TuneUp Software GmbH) -- C:\Program Files\TuneUp Utilities 2007\RegistryCleaner.exe

PRC - [2007/04/13 02:50:00 | 000,590,712 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\CCM\CcmExec.exe

PRC - [2007/04/13 02:50:00 | 000,251,256 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\CCM\clicomp\RemCtrl\Wuser32.exe

PRC - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe

PRC - [2006/11/17 04:06:00 | 000,136,768 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Network Associates\Common Framework\UdaterUI.exe

PRC - [2006/11/17 04:06:00 | 000,136,768 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe

PRC - [2006/11/17 04:06:00 | 000,104,000 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

PRC - [2006/11/17 04:06:00 | 000,086,016 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Network Associates\Common Framework\Mctray.exe

PRC - [2005/10/07 15:13:38 | 000,176,128 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe

PRC - [2005/07/27 17:41:08 | 000,045,056 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApntEx.exe

PRC - [2004/06/29 00:56:12 | 000,045,056 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\hidfind.exe

========== Modules (SafeList) ==========

MOD - [2010/05/29 21:01:54 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe

MOD - [2010/03/17 16:53:28 | 000,198,656 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\Common Files\Motive\McciContextHook_DSR.dll

MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (ADVService)

SRV - [2010/04/16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2010/01/06 00:43:59 | 000,723,632 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)

SRV - [2009/11/12 14:50:18 | 000,220,128 | ---- | M] () [Auto | Running] -- C:\Program Files\Macrium\Reflect\ReflectService.exe -- (ReflectService)

SRV - [2009/07/21 14:34:33 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009/05/13 16:48:22 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2009/02/02 02:33:18 | 000,317,440 | ---- | M] (Amazon.com) [Auto | Running] -- C:\Program Files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe -- (Amazon Download Agent)

SRV - [2007/11/26 15:10:08 | 000,020,992 | ---- | M] (E-MU Systems) [Auto | Running] -- C:\WINDOWS\system32\emaudsv.exe -- (emaudsv)

SRV - [2007/05/16 10:41:18 | 000,029,704 | ---- | M] (TuneUp Software GmbH) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)

SRV - [2007/04/13 02:50:00 | 000,590,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\CCM\CcmExec.exe -- (CcmExec)

SRV - [2007/04/13 02:50:00 | 000,251,256 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\CCM\clicomp\RemCtrl\Wuser32.exe -- (Wuser32)

SRV - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)

SRV - [2006/11/17 04:06:00 | 000,104,000 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe -- (McAfeeFramework)

SRV - [2005/11/14 01:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2005/10/14 03:53:50 | 000,087,768 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)

========== Driver Services (SafeList) ==========

DRV - [2010/05/06 17:10:20 | 000,068,168 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010/03/17 16:53:38 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)

DRV - [2010/03/17 16:53:22 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)

DRV - [2010/02/17 11:25:50 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2010/01/07 00:37:36 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010/01/06 00:44:00 | 000,133,064 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmdguard.sys -- (cmdGuard)

DRV - [2010/01/06 00:44:00 | 000,087,104 | ---- | M] (COMODO) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\inspect.sys -- (Inspect)

DRV - [2010/01/06 00:44:00 | 000,025,160 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cmdhlp.sys -- (cmdHlp)

DRV - [2009/06/17 08:20:34 | 000,012,648 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\psi_mf.sys -- (PSI)

DRV - [2009/05/11 10:12:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009/03/30 10:33:07 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2009/02/13 12:35:05 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008/10/14 01:07:41 | 000,102,664 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)

DRV - [2008/05/20 09:32:40 | 000,015,328 | ---- | M] (Macrium Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\pssnap.sys -- (pssnap)

DRV - [2008/04/13 14:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)

DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2007/11/26 15:14:54 | 000,163,352 | ---- | M] (E-MU Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emusba10.sys -- (emusba10)

DRV - [2007/11/02 14:36:10 | 000,018,176 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp)

DRV - [2007/10/09 19:17:42 | 001,123,328 | ---- | M] (Broadcom Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)

DRV - [2007/06/18 14:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motport.sys -- (motport)

DRV - [2007/06/18 14:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)

DRV - [2007/04/13 02:50:00 | 000,023,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CCM\PrepDrv.sys -- (prepdrvr)

DRV - [2007/01/22 18:33:00 | 000,007,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl)

DRV - [2006/09/06 08:35:38 | 000,019,072 | ---- | M] (ASIX Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ax88772.sys -- (AX88772)

DRV - [2006/06/14 12:53:00 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID)

DRV - [2006/02/09 02:50:00 | 000,011,744 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\kbstuff5.sys -- (kbstuff)

DRV - [2006/02/09 02:50:00 | 000,008,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\idisw2km.sys -- (idisw2km)

DRV - [2006/01/19 10:14:00 | 003,595,296 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)

DRV - [2005/12/01 02:40:56 | 000,936,960 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSX_DPV.sys -- (HSF_DPV)

DRV - [2005/12/01 02:40:12 | 000,192,512 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSXHWAZL.sys -- (HSXHWAZL)

DRV - [2005/12/01 02:40:08 | 000,669,696 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSX_CNXT.sys -- (winachsf)

DRV - [2005/11/16 16:36:00 | 001,047,816 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)

DRV - [2005/11/14 13:41:10 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | On_Demand | Running] -- C:\Program Files\Dell\NicConfigSvc\Appdrv.sys -- (Appdrv)

DRV - [2005/11/10 11:25:14 | 000,142,720 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)

DRV - [2005/09/28 21:57:18 | 000,113,847 | R--- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2005/05/20 15:01:32 | 000,025,600 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe)

DRV - [2005/05/20 15:01:26 | 000,068,352 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)

DRV - [2005/05/20 15:00:36 | 000,013,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)

DRV - [2005/04/25 09:28:14 | 000,871,040 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\iaStor.sys -- (iaStor)

DRV - [2004/06/28 00:08:56 | 000,042,752 | R--- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)

DRV - [2004/06/15 12:06:20 | 000,251,578 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\a320raid.sys -- (a320raid)

DRV - [2002/08/29 15:29:12 | 000,036,096 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\symmpi.sys -- (Symmpi)

DRV - [2001/08/22 08:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.villanova.edu/homepage/index.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "Swag Bucks Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig|http://www.villanova.edu/homepage/index.htm"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.%(version)s

FF - prefs.js..extensions.enabledItems: noia2_option@kk.noia:3.76

FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:4.3

FF - prefs.js..extensions.enabledItems: {1b8cc170-8c85-11db-b606-0800200c9a66}:3.4.2

FF - prefs.js..extensions.enabledItems: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}:2.5.6.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20100415

FF - prefs.js..extensions.enabledItems: {9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}:3.76

FF - HKLM\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/05/20 11:51:34 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/28 16:50:40 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/18 18:29:51 | 000,000,000 | ---D | M]

[2008/12/25 15:26:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions

[2008/12/25 15:26:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\home2@tomtom.com

[2010/05/29 21:03:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions

[2010/03/14 08:11:46 | 000,000,000 | ---D | M] (ShareThis) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{1b8cc170-8c85-11db-b606-0800200c9a66}

[2009/10/23 16:25:21 | 000,000,000 | ---D | M] (Chainlove Watcher) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{36f56fe4-2739-371f-774b-70121b5d5f2e}

[2009/10/23 16:25:22 | 000,000,000 | ---D | M] (Whiskey Militia Watcher) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{4d0c2910-1e70-11dc-af8a-0008743bf21a}

[2010/05/29 21:03:40 | 000,000,000 | ---D | M] (NoScript) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

[2010/01/27 12:29:40 | 000,000,000 | ---D | M] (Swag Bucks Toolbar) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}

[2010/02/23 16:23:27 | 000,000,000 | ---D | M] (Noia 2.0 (eXtreme)) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}

[2010/04/22 06:16:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2010/05/06 09:13:26 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010/05/14 15:25:33 | 000,000,000 | ---D | M] (SearchPreview) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}

[2009/10/23 16:25:23 | 000,000,000 | ---D | M] (Steep and Cheap Watcher) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\{fa038e8f-d1d1-11db-9705-005056c00008}

[2009/10/23 16:25:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\DesktopWatcher@Bonktown.com

[2010/05/06 09:13:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\nasanightlaunch@example.com

[2010/02/23 16:23:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\noia2_option@kk.noia

[2010/05/14 15:24:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\extensions\smarterwiki@wikiatic.com

[2009/09/01 12:24:10 | 000,000,882 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\searchplugins\conduit.xml

[2010/05/27 07:15:45 | 000,001,051 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\searchplugins\resellerratings.xml

[2010/05/24 03:33:49 | 000,001,540 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\searchplugins\swagbuckscom.xml

[2008/04/21 00:03:34 | 000,001,032 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v75hnvn5.default\searchplugins\wikipedia-eng.xml

[2010/05/28 11:47:57 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/05/18 18:30:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2007/06/21 19:38:54 | 000,079,432 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\CgpCore.dll

[2007/06/21 19:38:56 | 000,071,240 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\confmgr.dll

[2007/06/21 19:39:18 | 000,034,376 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\logging.dll

[2010/03/30 09:17:04 | 000,393,216 | ---- | M] (Invenda Corporation) -- C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll

[2010/05/18 18:29:22 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2007/06/21 19:39:34 | 000,325,200 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npicaN.dll

[2007/04/16 13:07:12 | 000,180,293 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

[2007/06/21 19:40:02 | 000,030,280 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\TcpPServ.dll

O1 HOSTS File: ([2010/01/07 15:50:51 | 000,372,449 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 www.007guard.com

O1 - Hosts: 127.0.0.1 007guard.com

O1 - Hosts: 127.0.0.1 008i.com

O1 - Hosts: 127.0.0.1 www.008k.com

O1 - Hosts: 127.0.0.1 008k.com

O1 - Hosts: 127.0.0.1 www.00hq.com

O1 - Hosts: 127.0.0.1 00hq.com

O1 - Hosts: 127.0.0.1 010402.com

O1 - Hosts: 127.0.0.1 www.032439.com

O1 - Hosts: 127.0.0.1 032439.com

O1 - Hosts: 127.0.0.1 www.100888290cs.com

O1 - Hosts: 127.0.0.1 100888290cs.com

O1 - Hosts: 127.0.0.1 www.100sexlinks.com

O1 - Hosts: 127.0.0.1 100sexlinks.com

O1 - Hosts: 127.0.0.1 www.10sek.com

O1 - Hosts: 127.0.0.1 10sek.com

O1 - Hosts: 127.0.0.1 www.123topsearch.com

O1 - Hosts: 127.0.0.1 123topsearch.com

O1 - Hosts: 127.0.0.1 www.132.com

O1 - Hosts: 127.0.0.1 132.com

O1 - Hosts: 127.0.0.1 www.136136.net

O1 - Hosts: 127.0.0.1 136136.net

O1 - Hosts: 127.0.0.1 www.163ns.com

O1 - Hosts: 127.0.0.1 163ns.com

O1 - Hosts: 12839 more lines...

O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

O4 - HKLM..\Run: [] File not found

O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)

O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)

O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\Network Associates\Common Framework\UdaterUI.exe (McAfee, Inc.)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe (Alcatel-Lucent)

O4 - HKCU..\Run: [E-MU USB Audio Control Panel] C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe (E-MU Systems)

O4 - HKCU..\Run: [F.lux] C:\Documents and Settings\Administrator\Local Settings\Apps\F.lux\flux.exe ()

O4 - HKCU..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe (Secunia)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKCU\..Trusted Domains: microsoft.com ([]* in Trusted sites)

O15 - HKCU\..Trusted Domains: villanova.edu ([]* in Trusted sites)

O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} https://activatemyfios.verizon.net/sdcCommo...20Installer.cab (Support.com Configuration Class)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)

O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock...director/sw.cab (Reg Error: Key error.)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdat...b?1262756265921 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1262756247718 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.250.0.12

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)

O24 - Desktop WallPaper: F:\2010\2010-05-07\P1000999.JPG

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2005/02/28 09:15:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{588746e1-d289-11dd-bad6-00197e54ebc6}\Shell\AutoRun\command - "" = E:\InstallTomTomHOME.exe -- File not found

O33 - MountPoints2\{a3d342b6-02df-11de-baf7-00188bd11d7d}\Shell - "" = AutoRun

O33 - MountPoints2\{a3d342b6-02df-11de-baf7-00188bd11d7d}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{a3d342b6-02df-11de-baf7-00188bd11d7d}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found

O33 - MountPoints2\{bc4c4510-cd7e-11db-91e5-0015c53f5d4d}\Shell\AutoRun\command - "" = E:\autorun.bat -- File not found

O33 - MountPoints2\{ffeaaed1-8b57-11dd-ac1a-0050b6402099}\Shell\AutoRun\command - "" = E:\setupSNK.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/07/24 00:04:05 | 000,000,000 | ---D | M]

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)

NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/05/29 21:01:53 | 000,571,392 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe

[2010/05/26 20:24:31 | 000,000,000 | ---D | C] -- C:\RecoveryCD

[2010/05/26 19:15:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\recovery_console_cd

[2010/05/23 20:06:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010/05/23 20:06:12 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010/05/23 20:06:12 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010/05/23 20:05:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010/05/23 19:54:34 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/05/20 20:30:08 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/05/20 20:30:03 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/05/20 20:30:03 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/05/20 20:23:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\mbam144

[2010/05/20 13:13:47 | 003,103,640 | ---- | C] (Javacool Software LLC ) -- C:\Documents and Settings\Administrator\Desktop\spywareblastersetup43.exe

[2010/05/20 13:07:53 | 005,240,192 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Administrator\Desktop\mbam-rules.exe

[2010/05/20 11:43:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HP Product Assistant

[2010/05/20 11:18:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\HpUpdate

[2010/05/20 08:01:13 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent

[2010/05/17 17:06:14 | 000,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard

[2010/05/17 17:05:21 | 000,000,000 | ---D | C] -- C:\Swsetup

[2010/05/07 06:58:27 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Research

[2010/05/05 21:36:01 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2010/05/03 22:45:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Printer Info Cache

[2010/05/02 12:40:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Facebook

[2010/04/09 19:08:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2010/04/09 18:59:28 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime

[2010/04/09 18:24:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2010/04/09 18:13:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Software Update Utility

[2010/04/02 16:12:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Motive

[2010/04/02 16:05:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive

[2010/03/30 21:53:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Motive

[2010/03/30 09:17:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\E-centives

[2010/03/15 15:06:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\SupportSoft

[2010/03/15 15:04:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SupportSoft

[2010/03/15 15:04:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\FIOS

[2010/03/15 15:03:51 | 000,000,000 | ---D | C] -- C:\Program Files\Verizon

[2010/03/15 14:59:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\TechWizard

[2010/03/10 19:47:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Google

[2010/03/04 19:00:11 | 000,000,000 | ---D | C] -- C:\Program Files\Last.fm

[2010/03/02 22:52:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\docXConverter converted files

[2010/03/02 22:51:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\docXConverter logs

[2010/03/02 22:51:10 | 000,360,580 | ---- | C] (eSellerate Inc.) -- C:\WINDOWS\eSellerateEngine.dll

[2010/03/02 22:51:10 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\eSellerate

[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/05/29 21:01:54 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe

[2010/05/29 20:45:00 | 000,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1508312232-3963068204-619120153-500UA.job

[2010/05/29 03:45:00 | 000,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1508312232-3963068204-619120153-500Core.job

[2010/05/28 22:06:57 | 000,077,312 | ---- | M] () -- C:\WINDOWS\mbr.exe

[2010/05/28 17:15:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job

[2010/05/26 21:02:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010/05/26 17:09:09 | 000,296,972 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\recovery_console_cd.zip

[2010/05/26 07:16:37 | 014,155,776 | ---- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT

[2010/05/25 10:38:22 | 000,068,155 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001

[2010/05/24 15:53:57 | 000,068,155 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat

[2010/05/24 15:45:50 | 000,000,496 | ---- | M] () -- C:\WINDOWS\SMSCFG.ini

[2010/05/24 15:45:24 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/05/24 15:44:56 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\NvwsApps.xml

[2010/05/24 15:44:47 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/05/24 15:44:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/05/24 14:44:09 | 003,696,151 | R--- | M] () -- C:\Documents and Settings\Administrator\Desktop\schrauber.exe

[2010/05/24 14:39:55 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Administrator\ntuser.ini

[2010/05/24 13:31:34 | 000,293,376 | ---- | M] () -- C:\3qw3bh1y.exe

[2010/05/21 09:43:37 | 000,005,683 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Attach.zip

[2010/05/20 22:39:46 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\2wc67000.exe

[2010/05/20 22:25:16 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\dds.scr

[2010/05/20 22:15:23 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Administrator\defogger_reenable

[2010/05/20 22:14:50 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Defogger.exe

[2010/05/20 20:23:01 | 005,090,665 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\mbam144.zip

[2010/05/20 19:48:37 | 000,059,664 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\mbam-clean.exe

[2010/05/20 19:44:19 | 000,276,560 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/05/20 13:17:24 | 000,071,840 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

[2010/05/20 13:15:51 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk

[2010/05/20 13:13:49 | 003,103,640 | ---- | M] (Javacool Software LLC ) -- C:\Documents and Settings\Administrator\Desktop\spywareblastersetup43.exe

[2010/05/20 13:07:59 | 005,240,192 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Administrator\Desktop\mbam-rules.exe

[2010/05/20 11:53:31 | 000,023,113 | ---- | M] () -- C:\WINDOWS\hpqins15.dat

[2010/05/20 11:47:36 | 000,077,377 | ---- | M] () -- C:\WINDOWS\hpqins05.dat

[2010/05/17 15:43:53 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/05/15 00:04:36 | 000,000,664 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Steam.lnk

[2010/05/14 13:17:13 | 000,024,576 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\About Me1.doc

[2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe

[2010/04/22 06:26:00 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010/04/16 17:17:05 | 000,446,318 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/04/16 17:17:05 | 000,072,882 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/04/16 17:17:04 | 000,528,306 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/04/09 18:15:09 | 000,001,640 | -H-- | M] () -- C:\IPH.PH

[2010/03/25 20:03:50 | 000,000,162 | -H-- | M] () -- C:\Documents and Settings\Administrator\My Documents\~$out Me.doc

[2010/03/24 20:09:11 | 000,024,576 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\About Me.doc

[2010/03/24 09:53:16 | 000,001,861 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Lightroom 3 Beta 2.lnk

[2010/03/16 09:17:40 | 000,206,848 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\Copy of March Madness Brackets 2010.xls

[2010/03/03 08:47:47 | 000,010,584 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\docXConverter (3).ini

[2010/03/03 08:47:47 | 000,000,132 | -H-- | M] () -- C:\Documents and Settings\Administrator\Application Data\lakerda1967.sys

[2010/03/02 22:51:10 | 000,360,580 | ---- | M] (eSellerate Inc.) -- C:\WINDOWS\eSellerateEngine.dll

[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/28 22:07:20 | 000,000,195 | ---- | C] () -- C:\Documents and Settings\Administrator\mbr.log

[2010/05/28 22:07:20 | 000,000,195 | ---- | C] () -- C:\Documents and Settings\Administrator\log.txt

[2010/05/26 17:09:08 | 000,296,972 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\recovery_console_cd.zip

[2010/05/24 14:44:08 | 003,696,151 | R--- | C] () -- C:\Documents and Settings\Administrator\Desktop\schrauber.exe

[2010/05/24 13:31:33 | 000,293,376 | ---- | C] () -- C:\3qw3bh1y.exe

[2010/05/23 20:06:12 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010/05/23 20:06:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010/05/23 20:06:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010/05/23 20:06:12 | 000,077,312 | ---- | C] () -- C:\WINDOWS\mbr.exe

[2010/05/23 20:06:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010/05/21 09:43:37 | 000,005,683 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Attach.zip

[2010/05/20 22:39:45 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\2wc67000.exe

[2010/05/20 22:25:16 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\dds.scr

[2010/05/20 22:15:23 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Administrator\defogger_reenable

[2010/05/20 22:14:49 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Defogger.exe

[2010/05/20 20:22:37 | 005,090,665 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\mbam144.zip

[2010/05/20 19:48:37 | 000,059,664 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\mbam-clean.exe

[2010/05/20 11:48:50 | 000,023,113 | ---- | C] () -- C:\WINDOWS\hpqins15.dat

[2010/05/20 11:38:29 | 000,077,377 | ---- | C] () -- C:\WINDOWS\hpqins05.dat

[2010/05/14 13:17:11 | 000,024,576 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\About Me1.doc

[2010/05/05 21:39:43 | 000,002,137 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk

[2010/04/09 18:56:21 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010/03/25 20:03:50 | 000,000,162 | -H-- | C] () -- C:\Documents and Settings\Administrator\My Documents\~$out Me.doc

[2010/03/24 20:09:10 | 000,024,576 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\About Me.doc

[2010/03/24 09:53:16 | 000,001,861 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Lightroom 3 Beta 2.lnk

[2010/03/16 09:17:39 | 000,206,848 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Copy of March Madness Brackets 2010.xls

[2010/03/02 22:51:10 | 000,010,584 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\docXConverter (3).ini

[2010/03/02 22:51:10 | 000,000,132 | -H-- | C] () -- C:\Documents and Settings\Administrator\Application Data\lakerda1967.sys

[2009/11/30 09:12:54 | 000,021,504 | ---- | C] () -- C:\WINDOWS\jestertb.dll

[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll

[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll

[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll

[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll

[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll

[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll

[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll

[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll

[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll

[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll

[2008/04/03 01:14:17 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll

[2008/04/03 01:14:17 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll

[2008/04/03 01:14:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll

[2008/04/03 01:14:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nsprs.dll

[2008/04/03 01:11:14 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll

[2008/04/03 01:11:14 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll

[2007/11/26 15:10:10 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\emcoinst.dll

[2007/09/25 22:04:25 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll

[2007/07/25 16:11:33 | 000,000,004 | ---- | C] () -- C:\WINDOWS\uccspecb.sys

[2007/06/18 10:16:54 | 000,002,319 | R--- | C] () -- C:\WINDOWS\System32\emaud.ini

[2007/06/18 10:16:54 | 000,000,035 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini

[2007/06/12 17:52:58 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS6s.DLL

[2007/03/21 10:07:48 | 000,000,280 | ---- | C] () -- C:\WINDOWS\System32\epoPGPsdk.dll.sig

[2006/05/05 10:34:55 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll

[2006/05/05 10:34:20 | 000,753,664 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll

[2006/04/20 13:39:45 | 000,000,175 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2006/04/18 23:08:56 | 000,004,944 | ---- | C] () -- C:\WINDOWS\System32\drivers\WINIO.SYS

[2006/04/18 22:35:42 | 000,000,496 | ---- | C] () -- C:\WINDOWS\SMSCFG.ini

[2006/04/18 22:05:25 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2006/04/18 20:51:29 | 000,004,652 | ---- | C] () -- C:\WINDOWS\parts.ini

[2006/04/18 20:51:15 | 000,000,445 | ---- | C] () -- C:\WINDOWS\IB.ini

[2006/01/19 10:14:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2006/01/19 10:14:00 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2006/01/19 10:14:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2006/01/19 10:14:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2006/01/19 10:14:00 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll

[2005/02/28 10:01:56 | 000,149,019 | ---- | C] () -- C:\WINDOWS\System32\crtdll.dll

[2001/07/06 16:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

========== LOP Check ==========

[2008/05/07 18:00:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\3M

[2007/06/12 12:30:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\acccore

[2008/08/24 07:55:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Amazon

[2008/10/18 17:28:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Any Video Converter

[2009/01/18 18:35:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Atari

[2009/09/10 18:08:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Braid

[2009/12/10 12:31:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Canon

[2010/05/13 13:39:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Costco Photo Organizer

[2010/05/13 13:39:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Costco Photo Viewer US

[2010/03/30 09:17:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\E-centives

[2010/05/02 12:41:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Facebook

[2008/09/09 14:18:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\FileOpen

[2009/08/17 23:28:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\foobar2000

[2009/01/25 19:03:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\goombah

[2009/03/24 22:48:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\HouseCall 6.6

[2009/01/28 01:03:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\ICAClient

[2009/02/03 11:03:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\iWin

[2007/09/29 11:41:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\MediaLife

[2010/01/06 09:51:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\My Games

[2010/02/10 21:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\MyPublisher

[2010/05/03 22:50:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Printer Info Cache

[2009/03/11 21:53:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Ruckus Network

[2009/01/16 15:26:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SAS

[2009/06/19 10:44:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab

[2010/03/15 15:03:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\TechWizard

[2008/12/25 15:25:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\TomTom

[2009/01/25 19:07:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\TuneUp Software

[2009/01/16 01:18:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Viewpoint

[2008/10/18 17:23:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\WinPatrol

[2008/10/18 17:29:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\wsInspector

[2009/10/13 23:19:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\2DBoy

[2008/10/29 19:03:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\acccore

[2009/11/17 18:40:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM

[2009/02/03 10:38:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Amazon

[2008/09/09 14:18:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FileOpen

[2009/02/08 13:10:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HipSoft

[2010/01/07 09:54:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Karen's Power Tools

[2010/01/07 10:09:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Macrium

[2008/08/29 21:39:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier

[2007/09/29 11:41:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MediaLife

[2010/01/06 00:20:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Network Associates

[2009/07/14 18:13:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SAS

[2008/10/15 14:22:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SecTaskMan

[2010/05/24 13:28:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2008/12/25 15:26:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom

[2009/01/25 19:06:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software

[2009/06/13 10:41:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

[2009/12/26 11:20:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ZoneFiveSoftware

[2010/04/09 19:09:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2009/10/23 11:59:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

[2009/05/18 19:31:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

[2010/05/28 17:15:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\1-Click Maintenance.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

[2010/05/24 13:31:34 | 000,293,376 | ---- | M] () -- C:\3qw3bh1y.exe

< MD5 for: AGP440.SYS >

[2004/08/12 09:29:28 | 018,738,937 | ---- | M] () .cab file -- C:\I386\sp2.cab:AGP440.sys

[2004/08/12 09:29:28 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008/08/20 13:08:04 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2008/08/20 13:08:04 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >

[2004/08/12 09:29:28 | 018,738,937 | ---- | M] () .cab file -- C:\I386\sp2.cab:atapi.sys

[2004/08/12 09:29:28 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008/08/20 13:08:04 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008/08/20 13:08:04 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004/08/12 09:17:27 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\pebuilder3110a\BartPE\i386\system32\drivers\atapi.sys

[2004/08/12 09:17:27 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\pebuilder3110a\BartPE1\I386\SYSTEM32\DRIVERS\ATAPI.SYS

[2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >

[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >

[2005/04/25 09:28:14 | 000,871,040 | ---- | M] (Intel Corporation) MD5=D593517879E65167DF35F6015814AC59 -- C:\WINDOWS\system32\drivers\IASTOR.SYS

[2004/08/12 09:36:15 | 000,467,200 | ---- | M] (Intel Corporation) MD5=F26BFD48B1C314E0F23BF77ACFA75940 -- C:\I386\iastor.sys

[2004/08/12 09:36:15 | 000,467,200 | ---- | M] (Intel Corporation) MD5=F26BFD48B1C314E0F23BF77ACFA75940 -- C:\WINDOWS\Dell\iastor\iastor.sys

< MD5 for: NETLOGON.DLL >

[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

[2004/08/12 09:24:31 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\pebuilder3110a\BartPE\i386\system32\netlogon.dll

[2004/08/12 09:24:31 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\pebuilder3110a\BartPE1\I386\SYSTEM32\NETLOGON.DLL

< MD5 for: SCECLI.DLL >

[2004/08/12 09:27:47 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\pebuilder3110a\BartPE\i386\system32\scecli.dll

[2004/08/12 09:27:47 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\pebuilder3110a\BartPE1\I386\SYSTEM32\SCECLI.DLL

[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SYMMPI.SYS >

[2002/08/29 15:29:12 | 000,036,096 | ---- | M] (LSI Logic) MD5=EA776423FA3762802A19A6A74310730A -- C:\WINDOWS\system32\drivers\SYMMPI.SYS

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

[2009/03/08 05:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll

[2009/03/08 05:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll

[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

[2005/02/28 03:08:36 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2005/02/28 03:08:36 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2005/02/28 03:08:36 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemdrive%\*.sys /90 /md5 >

[2010/05/24 15:44:39 | 805,306,368 | -HS- | M] () Unable to obtain MD5 -- C:\pagefile.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >

OTL Extras logfile created on: 5/29/2010 9:04:31 PM - Run 1

OTL by OldTimer - Version 3.2.5.1 Folder = C:\Documents and Settings\Administrator\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 444.00 Mb Available Physical Memory | 43.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 49.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 55.88 Gb Total Space | 4.75 Gb Free Space | 8.50% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: D135VS91

Current User Name: Administrator

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)

"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" = C:\Program Files\Network Associates\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service -- (McAfee, Inc.)

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)

"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)

"C:\Program Files\Last.fm\LastFM.exe" = C:\Program Files\Last.fm\LastFM.exe:*:Enabled:LastFM -- (Last.fm)

"C:\Program Files\Real\RealPlayer Enterprise\realplay.exe" = C:\Program Files\Real\RealPlayer Enterprise\realplay.exe:*:Enabled:RealPlayer Enterprise -- File not found

"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()

"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)

"C:\Program Files\Trillian\trillian.exe" = C:\Program Files\Trillian\trillian.exe:*:Enabled:Trillian -- (Cerulean Studios)

"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM -- File not found

"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)

"C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe" = C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4 -- (Firaxis Games)

"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()

"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL Inc.)

"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{008739FA-4232-45BE-A58B-00B1C6998BFD}" = Costco Photo Organizer

"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime

"{03A7C57A-B2C8-409b-92E5-524A0DFD0DD3}" = Status

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{087A66B8-1F0F-4a8d-A649-0CFE276AA7C0}" = WebReg

"{186A63A2-4256-43C6-8061-95EF77A5CDB6}" = Sid Meier's Civilization 4

"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter

"{1C99893D-BC98-4456-AA3E-B67AB42301A6}" = E-MU USB Audio

"{1CBE3804-20DF-48DA-B048-895C206E80A5}" = Microsoft SQL Server VSS Writer

"{1E5EEBB6-945D-41c3-AF41-A44C4FE15EE0}" = productcontext

"{1F528948-0E80-4C96-B455-DE4167CB1DF7}" = Internal Network Card Power Management

"{2266312B-3502-41EE-82CD-8DC62276D87B}" = Vz In Home Agent

"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java 6 Update 20

"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime

"{2A329FB6-389D-4396-A974-29656D6864AE}" = MarketResearch

"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint

"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{362BFFCD-8274-11D8-97C8-000129760CBE}" = MediaLife

"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup

"{3B65360C-347C-4D6E-961D-E36F1A103AF9}" = B9100_Help

"{47768394-9B60-4E58-B152-B524A1AF6BE2}" = HP ProPrint

"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4A39A27F-005B-407E-8CF5-F4D8065658E4}" = SMS Advanced Client

"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter

"{4D304678-738E-42a0-931A-2B022F49DEB8}" = TrayApp

"{542C0F0B-FBDF-45d9-AF8A-345C1A9B5AE3}" = 8000A809

"{54A4839E-87F8-4BD1-9682-A349E9943F0A}" = Amazon Unbox Video

"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support

"{56DF5C9E-6392-46D3-B366-297B14E1DAAF}" = Bonjour Core for Windows

"{597E70FF-7C46-4EED-8092-91B7C2E0529D}" = Google SketchUp 7

"{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7

"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{601C6E14-DF1E-4113-A8C8-F9DB90CB0D88}" = SanDisk TransferMate

"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2

"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{671B4BAD-D681-4d29-9498-D8BF3F1A389D}" = BPDSoftware

"{6878D8B8-5795-4472-BAF5-257F950F149F}" = hph_software

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6A3F98BA-338E-49a1-9D79-D786A83E6621}" = HP Officejet Pro 8000 A809 Series

"{6E4EE9B5-F69D-4455-B430-40FA5F0DC988}" = ProductContext

"{78B75C6D-E53C-424C-BF83-4B63BD4A6682}" = Microsoft Device Emulator version 1.0 - ENU

"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec

"{7F94FB03-6617-4442-9817-CDDB36EAE529}" = 8000A809_eDocs

"{81B3BEF9-5D97-4096-86E9-5B48A5BC32D0}" = Motorola Driver Installation 3.4.0

"{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver

"{8653730A-683D-4C42-BB18-6471291D5DEA}" = Canon MP Navigator 1.1

"{86BC184E-CFCD-48D5-829A-666A36C6ACC9}" = 8000A809_Help

"{87A9A9A9-FAB7-4224-9328-0FA2058C0FD5}" = Network

"{8838A511-FC90-4E77-AB04-73EEFBB9AEFB}" = hph_readme

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour

"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver

"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player

"{8B11048A-7CA8-4CB9-97C8-DFE83C32F566}" = AddCustomPaper

"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting

"{900A92BA-19EF-4A34-86CF-7B6C85BDD971}" = VC_MergeModuleToMSI

"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12

"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007

"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007

"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007

"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007

"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007

"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007

"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007

"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007

"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007

"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007

"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007

"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003

"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver

"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime

"{A066194B-DC8F-449A-8E0F-B57BDD3A2072}" = SyncToy 2.1 (x86)

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{AC13BA3A-336B-45a4-B3FE-2D3058A7B533}" = Toolbox

"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2

"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9

"{AEB909AF-6850-4838-B83E-1EB4403B11A9}" = Adobe Photoshop Lightroom 3 Beta 2

"{AFB69549-3AAE-4433-A99B-673B8A513379}" = BPDSoftware_Ini

"{B10A30CF-CCFF-4056-9ABC-F8D42BDF141F}" = myPrintMileage (Officejet Pro 8000 A809)

"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C3DAC196-8487-4E2E-94F3-9CBE361EB712}" = Microsoft Image Composite Editor

"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries

"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update

"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant

"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007

"{C98E8D9D-21DE-4F87-A9B7-142BB89840FC}" = Toolbox

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4

"{D31B401A-41D5-4133-AD09-3C3575200AF2}" = Crazy Machines II +

"{D335AC77-6F59-46D6-9082-F74A9F7E0FC3}" = Canon MP Drivers 7.0

"{D3A80508-CD83-4CA3-8671-914A1BC78B61}" = Microsoft Sync Framework 2.0 Provider Services (x86) ENU

"{D46D081B-F60E-467E-A7C4-117B70D76731}" = HP Update

"{D56B0E27-4A3E-46C9-B5C1-D93D580C099C}" = NVIDIA PhysX v8.10.29

"{D61524CF-93FE-4193-91AD-C6E21FEEAA5A}" = Logitech Harmony Remote Software 7

"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD

"{DE659AC8-EEF0-4115-AA0C-6500D194FB10}" = Garmin Training Center v5

"{DEF22534-3AF3-43ed-86CB-D915165C3957}" = 9100

"{E6FA148F-1E7D-4A42-A9A2-7DFABC2C6A2B}" = SportTracks 2.1

"{E89956F9-5B89-470E-818D-BD46102D0A01}" = Citrix Presentation Server Client

"{EB85CC54-5E9A-4D33-B319-593B82291ABC}" = Macrium Reflect - Free Edition

"{EBBE2FB2-FBED-44F6-B95F-230AB5A65B28}" = Goombah Partner COM Server

"{F34482ED-C751-48ce-81EB-74FD95BE66CC}" = HP Photosmart B9100 series

"{F769B78E-FF0E-4db5-95E2-9F4C8D6352FE}" = DeviceDiscovery

"{FF63121D-91C6-42CC-B341-F1AA729728E7}" = Microsoft Sync Framework 2.0 Core Components (x86) ENU

"7-Zip" = 7-Zip 4.65

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player

"AIM_7" = AIM 7

"Amazon Games & Software Downloader_is1" = Amazon Games & Software Downloader

"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.3

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"Big Kahuna Reef_is1" = Big Kahuna Reef

"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card

"Buildalot_is1" = Buildalot

"CCleaner" = CCleaner

"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem

"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com

"COMODO Internet Security" = COMODO Internet Security

"Defraggler" = Defraggler

"Exact Audio Copy" = Exact Audio Copy 0.99pb3

"foobar2000" = foobar2000 v0.9.6.2

"GPS2PowerTrack Plugin_is1" = GPS2PowerTrack Plugin

"HP Imaging Device Functions" = HP Imaging Device Functions 12.0

"HP Smart Web Printing" = HP Smart Web Printing 4.60

"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0

"HPExtendedCapabilities" = HP Customer Participation Program 12.0

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie8" = Windows Internet Explorer 8

"InfraRecorder" = InfraRecorder

"InstallShield_{54A4839E-87F8-4BD1-9682-A349E9943F0A}" = Amazon Unbox Video

"Jewel Quest 2_is1" = Jewel Quest 2

"LastFM_is1" = Last.fm 1.5.4.24567

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"MetaFrame Presentation Server Web Client for Win32" = MetaFrame Presentation Server Web Client for Win32

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)

"MyPublisher" = MyPublisher

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"NVIDIA Drivers" = NVIDIA Drivers

"OpenAL" = OpenAL

"PE Builder_is1" = PE Builder 3.1.10a

"PROPLUS" = Microsoft Office Professional Plus 2007

"Secunia PSI" = Secunia PSI

"SecureW2 Client" = SecureW2 Client 3.1.2

"SoftwareUpdUtility" = Download Updater (AOL LLC)

"Steam App 12910" = Audiosurf Demo

"Steam App 26800" = Braid

"Steam App 400" = Portal

"SystemRequirementsLab" = System Requirements Lab

"TomTom HOME" = TomTom HOME 2.5.2.60

"Trend Micro HouseCall 6.6" = HouseCall 6.6

"Trillian" = Trillian

"Tweak UI 2.10" = Tweak UI

"Verizon FiOS Activation_is1" = Verizon FiOS Activation

"Verizon Help and Support" = Verizon Help and Support Tool

"ViewpointMediaPlayer" = Viewpoint Media Player

"VLC media player" = VLC media player 1.0.3

"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"WinX DVD Ripper Platinum_is1" = WinX DVD Ripper Platinum 5.1.1

"WMCSetup" = Windows Media Connect

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Facebook Plug-In" = Facebook Plug-In

"Flux" = F.lux

"Google Chrome" = Google Chrome

"Move Media Player" = Move Media Player

"WinDirStat" = WinDirStat 1.1.2

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 5/3/2010 10:55:19 PM | Computer Name = D135VS91 | Source = Application Error | ID = 1000

Description = Faulting application costcoorganizer.exe, version 1.4.0.97, faulting

module fermatau.dll, version 1.3.0.0, fault address 0x0006c22c.

Error - 5/5/2010 10:33:04 PM | Computer Name = D135VS91 | Source = crypt32 | ID = 131080

Description = Failed auto update retrieval of third-party root list sequence number

from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

with error: This operation returned because the timeout period expired.

Error - 5/14/2010 12:19:49 PM | Computer Name = D135VS91 | Source = Application Error | ID = 1000

Description = Faulting application costcoorganizer.exe, version 1.4.0.97, faulting

module fermatau.dll, version 1.3.0.0, fault address 0x0006c206.

Error - 5/14/2010 12:24:39 PM | Computer Name = D135VS91 | Source = Application Error | ID = 1000

Description = Faulting application costcoorganizer.exe, version 1.4.0.97, faulting

module fermatau.dll, version 1.3.0.0, fault address 0x0006c22c.

Error - 5/14/2010 3:52:39 PM | Computer Name = D135VS91 | Source = crypt32 | ID = 131080

Description = Failed auto update retrieval of third-party root list sequence number

from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

with error: This operation returned because the timeout period expired.

Error - 5/14/2010 4:47:58 PM | Computer Name = D135VS91 | Source = Application Error | ID = 1000

Description = Faulting application TFService.exe, version 4.10.1.14, faulting module

msvcr80.dll, version 8.0.50727.4053, fault address 0x00008aa0.

Error - 5/21/2010 12:30:19 AM | Computer Name = D135VS91 | Source = Userenv | ID = 1007

Description = Windows cannot determine the associated site for this computer. (The

RPC server is too busy to complete this operation. ). Group Policy processing aborted.

Error - 5/21/2010 12:32:17 AM | Computer Name = D135VS91 | Source = Userenv | ID = 1007

Description = Windows cannot determine the associated site for this computer. (The

RPC server is too busy to complete this operation. ). Group Policy processing aborted.

Error - 5/24/2010 2:41:15 PM | Computer Name = D135VS91 | Source = crypt32 | ID = 131080

Description = Failed auto update retrieval of third-party root list sequence number

from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

with error: This operation returned because the timeout period expired.

Error - 5/27/2010 11:52:48 AM | Computer Name = D135VS91 | Source = Application Error | ID = 1000

Description = Faulting application hpwucli.exe, version 5.0.8.1, faulting module

hpwucli.exe, version 5.0.8.1, fault address 0x000045f5.

[ System Events ]

Error - 5/24/2010 2:41:31 PM | Computer Name = D135VS91 | Source = Service Control Manager | ID = 7001

Description = The Windows Media Player Network Sharing Service service depends on

the Universal Plug and Play Device Host service which failed to start because of

the following error: %%1058

Error - 5/24/2010 2:41:33 PM | Computer Name = D135VS91 | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

vmscsi

Error - 5/24/2010 2:41:34 PM | Computer Name = D135VS91 | Source = Service Control Manager | ID = 7001

Description = The Windows Media Player Network Sharing Service service depends on

the Universal Plug and Play Device Host service which failed to start because of

the following error: %%1058

Error - 5/24/2010 3:45:13 PM | Computer Name = D135VS91 | Source = DCOM | ID = 10016

Description = The application-specific permission settings do not grant Local Launch

permission for the COM Server application with CLSID {7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18). This security permission can be

modified using the Component Services administrative tool.

Error - 5/24/2010 3:45:18 PM | Computer Name = D135VS91 | Source = Service Control Manager | ID = 7001

Description = The Windows Media Player Network Sharing Service service depends on

the Universal Plug and Play Device Host service which failed to start because of

the following error: %%1058

Error - 5/24/2010 3:45:20 PM | Computer Name = D135VS91 | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

vmscsi

Error - 5/24/2010 3:45:20 PM | Computer Name = D135VS91 | Source = Service Control Manager | ID = 7001

Description = The Windows Media Player Network Sharing Service service depends on

the Universal Plug and Play Device Host service which failed to start because of

the following error: %%1058

Error - 5/24/2010 10:04:54 PM | Computer Name = D135VS91 | Source = Windows Update Agent | ID = 16

Description = Unable to Connect: Windows is unable to connect to the automatic updates

service and therefore cannot download and install updates according to the set

schedule. Windows will continue to try to establish a connection.

Error - 5/26/2010 10:04:55 PM | Computer Name = D135VS91 | Source = Windows Update Agent | ID = 16

Description = Unable to Connect: Windows is unable to connect to the automatic updates

service and therefore cannot download and install updates according to the set

schedule. Windows will continue to try to establish a connection.

Error - 5/28/2010 10:04:56 PM | Computer Name = D135VS91 | Source = Windows Update Agent | ID = 16

Description = Unable to Connect: Windows is unable to connect to the automatic updates

service and therefore cannot download and install updates according to the set

schedule. Windows will continue to try to establish a connection.

< End of report >

My computer is running fine, other than the few programs not being able to load.

schrauber · May 30, 2010

Hi,

We need to repair some of windows' internal registration settings

Please download Dial-A-Fix from one of the following mirrors:
- Primary Mirror
- Secondary Mirror

[*]Extract the zip file to your desktop.

[*]Double click Dial-a-Fix.exe to start the program.

[*]Press the green double checkmark box (Looks like this: )

[*]UNcheck "Empty Temp Folders", as well as "Adjust Time/Date" in the prep section. The prep section should then look like this:

[*]When the window looks like this, press the GO button in the bottom of the window.

[*]Exit/Close Dial-A-Fix

Please visit the links HERE and HERE first to read about this new Microsoft tool!

Then you can download and use: Microsoft Fix it Center Online

Microsoft Fix it Center Client contains troubleshooters that help detect issues on target PCs and solve them on demand or proactively before you even know they exist!

It finds and fixes many common PC and device problems automatically. It also helps prevent new problems by proactively checking for known issues and installing updates. Fix it Center helps to consolidate the many steps of diagnosing and repairing a problem into an automated tool that does the work for you.

Microsoft Fix it Center makes getting support easier than ever, with tools that help solve the issues you have now and prevent new ones.

Easy to Install and Run: Easy-to-use wizards will guide you through the set-up process and help you anytime you need support.
Automated: With automated troubleshooters, Fix it Center helps solve issues with your PC, even if you're not sure what the exact problem is. Fix It Center scans your device to diagnose and repair problems, then gives you the option to "Find and fix" or to "Find and report.
Preventive Care: By helping you find and fix issues before they become real problems, Fix it Center helps keep your PC running smoothly and automatically downloading the latest solutions.

Let me know after you had run all the troubleshooters on your pc if it corrected your problem.

Please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan

Tick the box next to YES, I accept the Terms of Use
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan (This scan can take several hours, so please be patient)
Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

Please post back with a fresh OTL logfile. Also please tell me if there are still problems with any programs. If yes, please let me know which programs.

77Pat · May 31, 2010

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=cd0231cc1731774182175b3475b3a3dc

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-05-31 02:16:30

# local_time=2010-05-30 10:16:30 (-0500, Eastern Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1797 16775125 100 94 475755 46978962 0 0

# compatibility_mode=3073 16777213 80 89 11592884 11593011 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# compatibility_mode=9217 16777214 0 9 11593805 42612589 0 0

# scanned=98969

# found=1

# cleaned=1

# scan_time=8145

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install\6.1.41.2\setup.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

OTL logfile created on: 5/30/2010 11:05:14 PM - Run 2

OTL by OldTimer - Version 3.2.5.1 Folder = C:\Documents and Settings\Administrator\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 413.00 Mb Available Physical Memory | 40.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 47.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 55.88 Gb Total Space | 4.52 Gb Free Space | 8.10% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: D135VS91

Current User Name: Administrator

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/05/29 21:01:54 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe

PRC - [2010/05/06 17:04:56 | 002,017,280 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

PRC - [2010/04/16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

PRC - [2010/04/02 15:45:12 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe