Roque.Antivir and othre problems

ghnew1 · September 5, 2010

Cought some virus. Sometimes I have to reboot since it gets hung. Symantec did not find anything. Malwarebytes found Roque.Antivir and supposetly got rid of that. But there are strange things going on, like I need to reboot because sometimes it does not do anything anymore.

Also I use remote desktop connection and it can't find mstsc.exe anymore. So I can't use it.

Something is seriously wrong with my PC. Can you help?

Elise · September 5, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

Please download OTL from one of the following mirrors:
- This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the Quick Scan button.
[*]Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

Please download Rootkit Unhooker and save it to your Desktop

Double-click on RKUnhookerLE to run it
Click the Report tab, then click Scan
Check Drivers, Stealth and uncheck the rest
Click OK
Wait until it's finished and then go to File > Save Report
Save the report to your Desktop

Copy the entire contents of the report and paste it in a reply here.

Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

A detailed description of your problems
A new OTL log (don't forget extra.txt)
RKU log

Thanks and again sorry for the delay.

ghnew1 · September 5, 2010

Thanks for the response

Here are the log files: 2 OTL followed by RKU

OTL logfile created on: 9/5/2010 10:36:40 AM - Run 1

OTL by OldTimer - Version 3.2.11.0 Folder = C:\download\virus\virus

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free

5.00 Gb Paging File | 4.00 Gb Available in Paging File | 88.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files

Drive C: | 232.82 Gb Total Space | 162.22 Gb Free Space | 69.67% Space Free | Partition Type: NTFS

Drive D: | 1.41 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

Drive G: | 37.24 Gb Total Space | 1.34 Gb Free Space | 3.59% Space Free | Partition Type: NTFS

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: GXH-HOME

Current User Name: gxh

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/09/05 10:36:21 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\download\virus\virus\OTL.exe

PRC - [2010/06/16 17:20:50 | 000,624,056 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

PRC - [2010/03/28 15:24:20 | 000,364,544 | ---- | M] (Western Digital Technologies, Inc.) -- C:\WINNT\system32\WDBtnMgr.exe

PRC - [2009/09/29 09:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

PRC - [2009/06/22 15:21:40 | 001,044,480 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe

PRC - [2009/04/11 15:04:57 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

PRC - [2009/03/25 10:04:20 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

PRC - [2009/03/12 04:00:26 | 000,233,472 | ---- | M] (AVAYA Communication) -- C:\Program Files\Avaya\Avaya one-X Communicator\QosServM.exe

PRC - [2008/11/13 14:06:30 | 000,541,976 | ---- | M] (PIXELA CORPORATION) -- C:\Program Files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe

PRC - [2008/07/23 09:56:14 | 002,054,680 | ---- | M] (Intel Corporation) -- C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe

PRC - [2008/07/23 09:56:12 | 000,174,616 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\AMT\LMS.exe

PRC - [2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINNT\explorer.exe

PRC - [2007/10/26 14:28:06 | 001,524,512 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

PRC - [2007/06/06 14:25:22 | 000,125,632 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\VPTray.exe

PRC - [2007/06/06 14:23:46 | 001,821,376 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe

PRC - [2007/06/06 14:22:34 | 000,031,424 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe

PRC - [2007/05/29 17:33:36 | 000,169,576 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

PRC - [2007/05/29 17:33:26 | 000,192,104 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

PRC - [2007/05/29 17:33:22 | 000,052,840 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe

PRC - [2007/01/10 17:27:38 | 001,160,792 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

PRC - [2005/04/28 03:22:52 | 000,102,400 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe

PRC - [2005/04/28 03:08:14 | 000,294,912 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe

PRC - [2004/07/27 10:08:22 | 000,262,144 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\memcard.exe

========== Modules (SafeList) ==========

MOD - [2010/09/05 10:36:21 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\download\virus\virus\OTL.exe

MOD - [2008/04/14 06:40:22 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\WINDOWS\system32\wuauserv.dll -- (wuauserv)

SRV - [2009/10/20 21:52:24 | 000,054,272 | ---- | M] (SolarWinds) [On_Demand | Stopped] -- C:\Program Files\SolarWinds\TFTPServer\SolarWinds TFTP Server.exe -- (SolarWinds TFTP Server)

SRV - [2009/09/29 09:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)

SRV - [2009/03/25 10:04:20 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2009/03/12 04:00:26 | 000,233,472 | ---- | M] (AVAYA Communication) [Auto | Running] -- C:\Program Files\Avaya\Avaya one-X Communicator\QosServM.exe -- (iClarityQoSService)

SRV - [2008/07/23 09:56:14 | 002,054,680 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe -- (UNS) Intel®

SRV - [2008/07/23 09:56:12 | 000,174,616 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\AMT\LMS.exe -- (LMS) Intel®

SRV - [2008/05/20 04:00:00 | 000,757,792 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINNT\system32\CCM\CcmExec.exe -- (CcmExec)

SRV - [2008/05/20 04:00:00 | 000,249,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINNT\System32\CCM\TSManager.exe -- (smstsmgr)

SRV - [2007/10/26 14:28:06 | 001,524,512 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)

SRV - [2007/08/28 20:04:25 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)

SRV - [2007/06/06 14:23:46 | 001,821,376 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)

SRV - [2007/06/06 14:22:34 | 000,031,424 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\DefWatch.exe -- (DefWatch)

SRV - [2007/05/29 17:33:36 | 000,169,576 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)

SRV - [2007/05/29 17:33:26 | 000,192,104 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)

SRV - [2007/01/10 17:27:38 | 001,160,792 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)

SRV - [2005/04/25 17:34:12 | 000,466,944 | ---- | M] (Dell) [On_Demand | Stopped] -- C:\WINNT\System32\dlbucoms.exe -- (dlbu_device)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\gxh\LOCALS~1\Temp\catchme.sys -- (catchme)

DRV - [2010/07/15 01:00:00 | 001,362,608 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100903.004\navex15.sys -- (NAVEX15)

DRV - [2010/07/15 01:00:00 | 000,085,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100903.004\naveng.sys -- (NAVENG)

DRV - [2010/06/11 01:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)

DRV - [2010/05/28 01:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)

DRV - [2010/04/15 18:57:19 | 000,038,976 | ---- | M] (microOLAP Technologies LTD) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\pssdk42.sys -- (PSSDK42)

DRV - [2010/03/02 21:21:08 | 004,630,016 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2010/01/23 19:12:13 | 000,110,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\SYMEVENT.SYS -- (SymEvent)

DRV - [2009/05/18 14:26:54 | 000,339,456 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)

DRV - [2008/09/11 10:52:48 | 006,047,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\igxpmp32.sys -- (ialm)

DRV - [2008/07/23 09:42:30 | 000,040,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\HECI.sys -- (HECI) Intel®

DRV - [2008/07/22 16:14:38 | 000,144,992 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\e1k5132.sys -- (e1kexpress) Intel®

DRV - [2008/07/20 17:44:44 | 000,324,120 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\iaStor.sys -- (iastor)

DRV - [2008/05/20 04:00:00 | 000,023,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\CCM\PrepDrv.sys -- (prepdrvr)

DRV - [2008/04/14 00:06:40 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\amdagp.sys -- (amdagp)

DRV - [2008/04/14 00:06:40 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\sisagp.sys -- (sisagp)

DRV - [2008/04/13 23:06:06 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2008/04/08 17:27:04 | 000,012,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\smsmdm.sys -- (smsmdd)

DRV - [2008/03/28 12:14:02 | 000,024,064 | ---- | M] (Sonic Focus, Inc) [Kernel | Boot | Running] -- C:\WINNT\system32\drivers\sfaudio.sys -- (SFAUDIO)

DRV - [2007/10/26 14:27:00 | 000,306,300 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINNT\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)

DRV - [2007/01/31 13:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\dne2000.sys -- (DNE)

DRV - [2007/01/18 16:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2007/01/10 17:27:26 | 000,390,744 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)

DRV - [2006/09/06 15:41:20 | 000,337,592 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Symantec AntiVirus\savrt.sys -- (SAVRT)

DRV - [2006/09/06 15:41:20 | 000,054,968 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Symantec AntiVirus\Savrtpel.sys -- (SAVRTPEL)

DRV - [2005/01/26 10:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\vsdatant.sys -- (vsdatant)

DRV - [2001/08/17 14:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\sparrow.sys -- (Sparrow)

DRV - [2001/08/17 14:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\sym_u3.sys -- (sym_u3)

DRV - [2001/08/17 14:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\sym_hi.sys -- (sym_hi)

DRV - [2001/08/17 14:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\symc8xx.sys -- (symc8xx)

DRV - [2001/08/17 14:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\symc810.sys -- (symc810)

DRV - [2001/08/17 13:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\ultra.sys -- (ultra)

DRV - [2001/08/17 13:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\ql12160.sys -- (ql12160)

DRV - [2001/08/17 13:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\ql1080.sys -- (ql1080)

DRV - [2001/08/17 13:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\ql1280.sys -- (ql1280)

DRV - [2001/08/17 13:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)

DRV - [2001/08/17 13:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\mraid35x.sys -- (mraid35x)

DRV - [2001/08/17 13:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\asc.sys -- (asc)

DRV - [2001/08/17 13:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\asc3550.sys -- (asc3550)

DRV - [2001/08/17 13:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\aliide.sys -- (AliIde)

DRV - [2001/08/17 13:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINNT\system32\DRIVERS\cmdide.sys -- (CmdIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://today.slac.stanford.edu/

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://today.slac.stanford.edu/

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-395820274-3051342167-180645541-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm

IE - HKU\S-1-5-21-395820274-3051342167-180645541-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/

IE - HKU\S-1-5-21-395820274-3051342167-180645541-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-395820274-3051342167-180645541-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..network.proxy.no_proxies_on: "*.local"

FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/06/27 21:48:30 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/26 21:35:47 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/08 17:36:46 | 000,000,000 | ---D | M]

[2010/01/22 12:59:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gxh\Application Data\Mozilla\Extensions

[2010/09/02 23:41:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gxh\Application Data\Mozilla\Firefox\Profiles\3ltmo7p5.default\extensions

[2010/07/26 21:37:43 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\gxh\Application Data\Mozilla\Firefox\Profiles\3ltmo7p5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/09/02 23:41:42 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/08/08 16:51:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010/08/08 16:50:56 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/07/26 22:21:01 | 000,000,027 | ---- | M]) - C:\WINNT\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)

O2 - BHO: (AvayaIEHlprObj Class) - {E6DF0B46-7D6F-407A-A6A2-62D17A021A9A} - C:\Program Files\Avaya\Avaya one-X Communicator\AvayaIEHelper.dll (Avaya)

O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKU\S-1-5-21-395820274-3051342167-180645541-1009\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKU\S-1-5-21-395820274-3051342167-180645541-1009\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)

O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)

O4 - HKLM..\Run: [Dell Photo AIO Printer 942] C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe ()

O4 - HKLM..\Run: [DellMCM] C:\Program Files\Dell Photo AIO Printer 942\memcard.exe ()

O4 - HKLM..\Run: [DLBUCATS] C:\WINNT\System32\spool\DRIVERS\W32X86\3\DLBUtime.DLL ()

O4 - HKLM..\Run: [picon] C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe (Intel Corporation)

O4 - HKLM..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)

O4 - HKLM..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)

O4 - HKLM..\Run: [WD Button Manager] C:\WINNT\System32\WDBtnMgr.exe (Western Digital Technologies, Inc.)

O4 - HKU\S-1-5-21-395820274-3051342167-180645541-1009..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Camera Monitor HD.lnk = C:\Program Files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe (PIXELA CORPORATION)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\WINNT\Installer\{871DF2BE-41D2-4334-AC33-839AF16FC8FE}\Icon3E5562ED7.ico ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-395820274-3051342167-180645541-1009\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-395820274-3051342167-180645541-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-395820274-3051342167-180645541-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-395820274-3051342167-180645541-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKU\.DEFAULT\..Trusted Domains: bis-dev ([]http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: bis-dev ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: exch-mail ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: idoc ([]http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: idoc ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: localhost ([]* in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: mdweb ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: oraweb ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: psoft-fstgren2 ([]http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: psoft-fstgren2 ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([*.slac] * in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([*.slac] http in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([*.slac] https in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([*.win.slac] http in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([*.win.slac] https in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([bis-dev.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([bis-dev.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([exch-mail.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([idoc.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([idoc.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([mdweb.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([oraweb.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([psoft-fstgren2.win.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([psoft-fstgren2.win.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([today.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([today.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([webtest.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www2.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-bis.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-bis.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-conf.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-doc.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-glast.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-glast.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-internal.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-mail.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-project.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-public.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-remedy2.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-sslonly.slac] https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([www-user.slac] http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([xweb.slac] http in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([xweb.slac] https in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([xweb.win.slac] http in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([xweb.win.slac] https in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([xweb2.win.slac] * in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: stanford.edu ([xweb2.win.slac] https in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: today ([]http in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: today ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: web001 ([]file in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: web002 ([]file in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: web003 ([]file in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: web004 ([]file in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: web005 ([]file in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: web006 ([]file in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: web007 ([]file in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: webtest ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: www-bis ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: www-doc ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: www-glast ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: www-internal ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: www-mail ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: www-remedy2 ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: www-sslonly ([]https in Local intranet)

O15 - HKU\.DEFAULT\..Trusted Domains: xweb ([]http in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: xweb ([]https in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([*] in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: bis-dev ([]http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: bis-dev ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: exch-mail ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: idoc ([]http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: idoc ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: localhost ([]* in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: mdweb ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: oraweb ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: psoft-fstgren2 ([]http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: psoft-fstgren2 ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([*.slac] * in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([*.slac] http in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([*.slac] https in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([*.win.slac] http in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([*.win.slac] https in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([bis-dev.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([bis-dev.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([exch-mail.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([idoc.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([idoc.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([mdweb.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([oraweb.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([psoft-fstgren2.win.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([psoft-fstgren2.win.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([today.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([today.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([webtest.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www2.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-bis.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-bis.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-conf.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-doc.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-glast.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-glast.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-internal.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-mail.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-project.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-public.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-remedy2.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-sslonly.slac] https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([www-user.slac] http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([xweb.slac] http in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([xweb.slac] https in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([xweb.win.slac] http in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([xweb.win.slac] https in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([xweb2.win.slac] * in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: stanford.edu ([xweb2.win.slac] https in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: today ([]http in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: today ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: web001 ([]file in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: web002 ([]file in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: web003 ([]file in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: web004 ([]file in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: web005 ([]file in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: web006 ([]file in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: web007 ([]file in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: webtest ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: www-bis ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: www-doc ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: www-glast ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: www-internal ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: www-mail ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: www-remedy2 ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: www-sslonly ([]https in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Domains: xweb ([]http in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: xweb ([]https in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([*] in Local intranet)

O15 - HKU\S-1-5-21-395820274-3051342167-180645541-1009\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)

O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} http://download.sp.f-secure.com/ols/f-secu.../fslauncher.cab (F-Secure Online Scanner Launcher)

O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2...78f/wvc1dmo.cab (Reg Error: Key error.)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1237491250312 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1238002861267 (MUWebControl Class)

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://ilc.webex.com/client/T26L/webex/ieatgpc.cab (GpcContainer Class)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.76.182 68.87.78.134

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINNT\System32\ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINNT\System32\igfxdev.dll (Intel Corporation)

O20 - Winlogon\Notify\NavLogon: DllName - C:\WINNT\system32\NavLogon.dll - C:\WINNT\system32\NavLogon.dll (Symantec Corporation)

O20 - Winlogon\Notify\polsumgr: DllName - sdmngr.dll - C:\WINNT\System32\sdmngr.dll (AutoProf

ghnew1 · September 5, 2010

OTL Extras logfile created on: 9/5/2010 10:36:40 AM - Run 1

OTL by OldTimer - Version 3.2.11.0 Folder = C:\download\virus\virus

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free

5.00 Gb Paging File | 4.00 Gb Available in Paging File | 88.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files

Drive C: | 232.82 Gb Total Space | 162.22 Gb Free Space | 69.67% Space Free | Partition Type: NTFS

Drive D: | 1.41 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

Drive G: | 37.24 Gb Total Space | 1.34 Gb Free Space | 3.59% Space Free | Partition Type: NTFS

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: GXH-HOME

Current User Name: gxh

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-395820274-3051342167-180645541-1009\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP

"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DoNotAllowExceptions" = 0

"EnableFirewall" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

"135:TCP" = 135:TCP:*:Enabled:TCP Port 135

"5000:TCP" = 5000:TCP:*:Enabled:TCP Port 5000

"5001:TCP" = 5001:TCP:*:Enabled:TCP Port 5001

"5002:TCP" = 5002:TCP:*:Enabled:TCP Port 5002

"5003:TCP" = 5003:TCP:*:Enabled:TCP Port 5003

"5004:TCP" = 5004:TCP:*:Enabled:TCP Port 5004

"5005:TCP" = 5005:TCP:*:Enabled:TCP Port 5005

"5006:TCP" = 5006:TCP:*:Enabled:TCP Port 5006

"5007:TCP" = 5007:TCP:*:Enabled:TCP Port 5007

"5008:TCP" = 5008:TCP:*:Enabled:TCP Port 5008

"5009:TCP" = 5009:TCP:*:Enabled:TCP Port 5009

"5010:TCP" = 5010:TCP:*:Enabled:TCP Port 5010

"5011:TCP" = 5011:TCP:*:Enabled:TCP Port 5011

"5012:TCP" = 5012:TCP:*:Enabled:TCP Port 5012

"5013:TCP" = 5013:TCP:*:Enabled:TCP Port 5013

"5014:TCP" = 5014:TCP:*:Enabled:TCP Port 5014

"5015:TCP" = 5015:TCP:*:Enabled:TCP Port 5015

"5016:TCP" = 5016:TCP:*:Enabled:TCP Port 5016

"5017:TCP" = 5017:TCP:*:Enabled:TCP Port 5017

"5018:TCP" = 5018:TCP:*:Enabled:TCP Port 5018

"5019:TCP" = 5019:TCP:*:Enabled:TCP Port 5019

"5020:TCP" = 5020:TCP:*:Enabled:TCP Port 5020

"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP

"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"D:\setup\hpznui01.exe" = D:\setup\hpznui01.exe:*:Enabled:hpznui01.exe -- File not found

"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)

"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)

"C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe:*:Enabled:hpofxs08.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe:*:Enabled:hpqfxt08.exe -- (TODO: <Company name>)

"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)

"C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\WINNT\system32\dlbucoms.exe" = C:\WINNT\system32\dlbucoms.exe:*:Enabled:Dell_942 Server -- (Dell)

"C:\WINNT\system32\spool\drivers\w32x86\3\DLBUPSWX.EXE" = C:\WINNT\system32\spool\drivers\w32x86\3\DLBUPSWX.EXE:*:Enabled:Dell_942 Printer Status -- ()

"C:\WINNT\system32\ftp.exe" = C:\WINNT\system32\ftp.exe:*:Enabled:File Transfer Program -- (Microsoft Corporation)

"C:\Program Files\Avaya\Avaya one-X Communicator\SparkEmulator.exe" = C:\Program Files\Avaya\Avaya one-X Communicator\SparkEmulator.exe:*:Enabled:Spark Endpoint Emulator R1.1 (14) -- (Avaya, Inc.)

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)

"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)

"C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)