 my search engines queries get sent to I-X find sites, I have uploaded new Live One Care stuff still cant get rid of it |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Jun 10 2009, 12:30 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 4 Joined: 10-June 09 Member No.: 340,699  |
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-05-14.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume1 Install Date: 12/18/2006 5:15:16 AM System Uptime: 6/10/2009 10:46:29 AM (1 hours ago) Motherboard: ASUSTek Computer INC. | | Gamila Processor: Intel® Celeron® CPU 2.93GHz | PGA 478 | 2933/133mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 149 GiB total, 137.008 GiB free. E: is Removable F: is Removable G: is Removable H: is CDROM () I: is Removable J: is Removable ==== Disabled Device Manager Items ============= Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Realtek RTL8139/810x Family Fast Ethernet NIC Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_2A01103C&REV_10\4&1A671D0C&0&68F0 Manufacturer: Realtek Semiconductor Corp. Name: Realtek RTL8139/810x Family Fast Ethernet NIC PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_2A01103C&REV_10\4&1A671D0C&0&68F0 Service: RTL8023xp ==== System Restore Points =================== RP272: 3/13/2009 3:10:50 AM - System Checkpoint RP273: 3/14/2009 8:09:16 AM - System Checkpoint RP274: 3/15/2009 9:56:01 AM - System Checkpoint RP275: 3/16/2009 10:20:03 AM - System Checkpoint RP276: 3/17/2009 3:00:16 AM - Software Distribution Service 3.0 RP277: 3/18/2009 3:56:01 AM - System Checkpoint RP278: 3/19/2009 4:56:01 AM - System Checkpoint RP279: 3/20/2009 5:56:01 AM - System Checkpoint RP280: 3/21/2009 6:56:04 AM - System Checkpoint RP281: 3/22/2009 7:56:04 AM - System Checkpoint RP282: 3/23/2009 9:51:14 AM - System Checkpoint RP283: 3/24/2009 10:00:18 AM - System Checkpoint RP284: 3/24/2009 7:21:15 PM - Removed QuickTime RP285: 3/24/2009 8:29:32 PM - Software Distribution Service 3.0 RP286: 3/25/2009 3:00:14 AM - Software Distribution Service 3.0 RP287: 3/26/2009 3:00:17 AM - Software Distribution Service 3.0 RP288: 3/27/2009 3:49:47 AM - System Checkpoint RP289: 3/28/2009 4:49:47 AM - System Checkpoint RP290: 3/29/2009 5:49:47 AM - System Checkpoint RP291: 3/30/2009 6:49:47 AM - System Checkpoint RP292: 3/31/2009 7:49:48 AM - System Checkpoint RP293: 4/1/2009 9:16:56 AM - System Checkpoint RP294: 4/2/2009 9:49:47 AM - System Checkpoint RP295: 4/3/2009 9:49:53 AM - System Checkpoint RP296: 4/4/2009 11:05:27 AM - System Checkpoint RP297: 4/5/2009 11:49:53 AM - System Checkpoint RP298: 4/6/2009 12:49:53 PM - System Checkpoint RP299: 4/7/2009 1:49:54 PM - System Checkpoint RP300: 4/8/2009 2:49:53 PM - System Checkpoint RP301: 4/9/2009 4:00:26 PM - System Checkpoint RP302: 4/10/2009 4:49:57 PM - System Checkpoint RP303: 4/11/2009 5:04:32 PM - System Checkpoint RP304: 4/12/2009 5:47:55 PM - System Checkpoint RP305: 4/13/2009 5:49:59 PM - System Checkpoint RP306: 4/14/2009 6:51:03 PM - System Checkpoint RP307: 4/15/2009 7:49:57 PM - System Checkpoint RP308: 4/16/2009 3:00:29 AM - Software Distribution Service 3.0 RP309: 4/17/2009 3:14:32 AM - System Checkpoint RP310: 4/18/2009 3:14:36 AM - System Checkpoint RP311: 4/19/2009 4:14:36 AM - System Checkpoint RP312: 4/20/2009 5:14:36 AM - System Checkpoint RP313: 4/21/2009 6:14:36 AM - System Checkpoint RP314: 4/22/2009 7:14:36 AM - System Checkpoint RP315: 4/23/2009 8:26:36 AM - System Checkpoint RP316: 4/24/2009 8:43:25 AM - System Checkpoint RP317: 4/25/2009 9:14:42 AM - System Checkpoint RP318: 4/26/2009 10:14:43 AM - System Checkpoint RP319: 4/27/2009 11:14:42 AM - System Checkpoint RP320: 4/28/2009 12:14:42 PM - System Checkpoint RP321: 4/29/2009 3:00:24 AM - Software Distribution Service 3.0 RP322: 4/30/2009 3:14:43 AM - System Checkpoint RP323: 5/1/2009 4:14:42 AM - System Checkpoint RP324: 5/2/2009 5:14:42 AM - System Checkpoint RP325: 5/3/2009 6:14:42 AM - System Checkpoint RP326: 5/4/2009 7:14:42 AM - System Checkpoint RP327: 5/5/2009 8:14:44 AM - System Checkpoint RP328: 5/5/2009 1:22:49 PM - Removed Adobe Reader 9. RP329: 5/5/2009 1:23:15 PM - Installed Adobe Reader 9.1. RP330: 5/6/2009 2:14:49 PM - System Checkpoint RP331: 5/7/2009 3:14:49 PM - System Checkpoint RP332: 5/8/2009 3:15:52 PM - System Checkpoint RP333: 5/9/2009 4:14:47 PM - System Checkpoint RP334: 5/10/2009 5:14:47 PM - System Checkpoint RP335: 5/11/2009 6:14:49 PM - System Checkpoint RP336: 5/12/2009 6:14:53 PM - System Checkpoint RP337: 5/13/2009 3:00:28 AM - Software Distribution Service 3.0 RP338: 5/14/2009 3:14:53 AM - System Checkpoint RP339: 5/15/2009 4:14:56 AM - System Checkpoint RP340: 5/16/2009 5:14:56 AM - System Checkpoint RP341: 5/17/2009 6:14:55 AM - System Checkpoint RP342: 5/18/2009 7:14:53 AM - System Checkpoint RP343: 5/19/2009 8:14:55 AM - System Checkpoint RP344: 5/20/2009 9:29:55 AM - System Checkpoint RP345: 5/20/2009 7:49:16 PM - Installed Java™ 6 Update 13 RP346: 5/20/2009 7:49:46 PM - Installed MSN Toolbar Setup RP347: 5/21/2009 8:15:00 PM - System Checkpoint RP348: 5/22/2009 9:15:02 PM - System Checkpoint RP349: 5/23/2009 10:15:01 PM - System Checkpoint RP350: 5/24/2009 11:15:00 PM - System Checkpoint RP351: 5/26/2009 12:15:00 AM - System Checkpoint RP352: 5/27/2009 1:15:02 AM - System Checkpoint RP353: 5/27/2009 3:00:15 AM - Software Distribution Service 3.0 RP354: 5/28/2009 3:15:02 AM - System Checkpoint RP355: 5/29/2009 4:15:03 AM - System Checkpoint RP356: 5/30/2009 5:15:03 AM - System Checkpoint RP357: 5/31/2009 6:15:03 AM - System Checkpoint RP358: 6/1/2009 7:17:18 AM - System Checkpoint RP359: 6/2/2009 8:15:04 AM - System Checkpoint RP360: 6/2/2009 2:26:25 PM - Removed MSN Toolbar RP361: 6/2/2009 2:26:40 PM - Removed Microsoft Search Enhancement Pack RP362: 6/2/2009 2:26:47 PM - Removed Microsoft Default Manager RP363: 6/3/2009 3:15:07 PM - System Checkpoint RP364: 6/4/2009 4:20:31 PM - System Checkpoint RP365: 6/5/2009 5:15:06 PM - System Checkpoint RP366: 6/6/2009 6:15:04 PM - System Checkpoint RP367: 6/7/2009 6:22:04 PM - System Checkpoint RP368: 6/8/2009 7:15:07 PM - System Checkpoint RP369: 6/9/2009 10:33:54 AM - Software Distribution Service 3.0 RP370: 6/9/2009 11:02:24 AM - Cleaned registry with Windows Live OneCare safety scanner RP371: 6/9/2009 11:38:12 AM - Microsoft OneCare Protection Checkpoint RP372: 6/10/2009 10:24:22 AM - Installed Java™ 6 Update 14 RP373: 6/10/2009 11:18:33 AM - Software Distribution Service 3.0 ==== Installed Programs ====================== Absolute Poker Acrobat.com Adobe AIR Adobe Flash Player ActiveX Adobe Reader 9.1.1 Agere Systems PCI Soft Modem Apple Mobile Device Support Apple Software Update Bonjour Compatibility Pack for the 2007 Office system EPSON Printer Software EPSON Scan EPSON Stylus CX7400 Series Scanner Driver Update GTOneCare Hotfix for Windows XP (KB952287) Intel® Extreme Graphics Driver iTunes Java™ 6 Update 14 Microsoft .NET Framework 2.0 Microsoft Application Error Reporting Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Professional Edition 2003 Microsoft Protection Service Microsoft Windows Live OneCare Resources v2.5.2900.24 Microsoft Windows OneCare Live AntiSpyware and AntiVirus Microsoft Windows OneCare Live v2.5.2900.24 Microsoft Windows OneCare Live v2.5.2900.24 Idcrl Install Mozilla Sunbird (0.9) NVIDIA Drivers PANTECH PC USB Modem Software PANTECH UM175 Driver PX Engine QuickTime Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB961373) Update for Windows Internet Explorer 8 (KB971180) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955839) Update for Windows XP (KB967715) VZAccess Manager WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 8 Windows Live OneCare Windows Live OneCare safety scanner Windows XP Service Pack 3 ==== Event Viewer Messages From Past Week ======== 6/4/2009 12:26:22 PM, error: PlugPlayManager [12] - The device 'PANTECH UM175 WWAN Driver #3' (USB\VID_106c&PID_3714&MI_03\6&154cfd13&0&8515) disappeared from the system without first being prepared for removal. ==== End Of File =========================== DDS (Ver_09-05-14.01) - NTFSx86 Run by Owner at 11:19:52.34 on Wed 06/10/2009 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.93 [GMT -6:00] AV: Windows Live OneCare *On-access scanning enabled* (Updated) {427ADFC3-B354-4A51-BE34-A9D4218E45C4} FW: Windows Live OneCare Firewall *enabled* {A3899D22-27E6-4A7E-AE4E-2C106646DAAB} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\system32\agrsmsvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe C:\WINDOWS\system32\svchost.exe -k podmena C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe C:\Program Files\Microsoft Windows OneCare Live\winss.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Microsoft Windows OneCare Live\WinSSUI.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\SoftwareDistribution\Download\Install\dotnetfx35_x86.exe c:\0d90398480a9c1235d1416cea3ea\dotnetfx35setup.exe c:\ed0d4975f3a5baa4324b36c506f7\setup.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\WINDOWS\system32\msiexec.exe C:\Documents and Settings\Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uSearch Bar = uWindow Title = Windows Internet Explorer provided by Comcast mWindow Title = Windows Internet Explorer provided by Comcast BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [EPSON Stylus CX7400 Series] c:\windows\system32\spool\drivers\w32x86\3\e_faticda.exe /fu "c:\windows\temp\E_S67.tmp" /EF "HKCU" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [AlcxMonitor] ALCXMNTR.EXE mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [OneCareUI] "c:\program files\microsoft windows onecare live\winssnotify.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} - hxxp://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www1.snapfish.com/SnapfishActivia.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1166490846906 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab TCP: {29B15F6F-4BAF-4843-B0D2-F23A94265554} = 66.174.92.14 66.174.95.44 Notify: igfxcui - igfxsrvc.dll ============= SERVICES / DRIVERS =============== R1 podmenadrv;podmenadrv;c:\program files\podmena\podmena.sys [2009-6-9 9472] R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\microsoft windows onecare live\OcHealthMon.exe [2009-3-22 24936] R2 podmena;podmena;c:\windows\system32\svchost.exe -k podmena [2004-8-4 14336] R3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\drivers\PTDUBus.sys [2008-9-8 29824] R3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\drivers\PTDUMdm.sys [2008-9-8 41344] R3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\drivers\PTDUVsp.sys [2008-9-8 39936] R3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\drivers\PTDUWWAN.sys [2008-9-8 59776] S3 PTDMBus;PANTECH USB Modem Composite Device Driver ;c:\windows\system32\drivers\PTDMBus.sys [2008-7-20 29952] S3 PTDMMdm;PANTECH USB Modem Drivers ;c:\windows\system32\drivers\PTDMMdm.sys [2008-7-20 41856] S3 PTDMVsp;PANTECH USB Modem Serial Port ;c:\windows\system32\drivers\PTDMVsp.sys [2008-7-20 39936] S3 PTDMWWAN;PANTECH USB Modem WWAN Driver;c:\windows\system32\drivers\PTDMWWAN.sys [2008-7-20 59520] =============== Created Last 30 ================ 2009-06-10 11:18 <DIR> --d----- C:\ed0d4975f3a5baa4324b36c506f7 2009-06-10 11:18 <DIR> --d----- C:\0d90398480a9c1235d1416cea3ea 2009-06-09 11:23 91,328 a------- c:\windows\system32\drivers\msfwdrv.sys 2009-06-09 11:23 116,416 a------- c:\windows\system32\drivers\msfwhlpr.sys 2009-06-09 11:22 53,168 a------- c:\windows\system32\drivers\MpFilter.sys 2009-06-09 11:03 <DIR> --d----- c:\program files\Microsoft Windows OneCare Live 2009-06-09 10:45 2,146 ----h--- c:\windows\f5087.dat 2009-06-09 10:41 <DIR> --dsh--- c:\documents and settings\owner\IECompatCache 2009-06-09 10:40 <DIR> --dsh--- c:\documents and settings\owner\PrivacIE 2009-06-09 10:39 <DIR> --dsh--- c:\documents and settings\owner\IETldCache 2009-06-09 10:38 <DIR> --d----- c:\windows\ie8updates 2009-06-09 10:37 102,912 -c------ c:\windows\system32\dllcache\iecompat.dll 2009-06-09 10:35 <DIR> -cd-h--- c:\windows\ie8 2009-06-09 09:39 1 a------- c:\windows\dk39fi4fe.dat 2009-06-09 08:46 <DIR> --d----- c:\program files\podmena 2009-06-09 08:46 1 a------- c:\windows\9g2234wesdf3dfgjf23 2009-06-09 08:46 2 ----h--- c:\windows\ro122458.dat 2009-06-09 08:46 2 ----h--- c:\windows\ro122390.dat 2009-06-09 08:46 1 ----h--- c:\windows\msmark2.dat 2009-06-09 08:46 1 ----h--- c:\windows\f23567.dat 2009-06-09 08:46 2 ----h--- c:\windows\ro122366.dat 2009-05-20 19:53 <DIR> --d----- c:\program files\Microsoft ==================== Find3M ==================== 2009-05-21 11:33 410,984 a------- c:\windows\system32\deploytk.dll 2006-12-18 18:51 1,187,360 ac------ c:\program files\sp26761.exe ============= FINISH: 11:20:42.29 ===============
Attached File(s)
|
 |
 
|
|
Jun 10 2009, 01:24 PM
Post
#2
|
|
 Bleepin' Peaceful Group: HJT Team Posts: 4,479 Joined: 9-December 08 Member No.: 267,653 |
Hi and welcome to the HijackThis Logs and Virus/Trojan/Spyware/Malware Removal forum,
I am  and I am here to help you!I ask that you refrain from running tools other than those we suggest to you while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process. Please perform all steps in the order received and do not proceed if you need clarification. In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond to your topic and facilitate the cleaning of your machine. After 5 days if a topic is not replied to we assume it has been abandoned and it is closed. As I am in training an Expert Coach will assist me in your fix. Your benefit will be "four eyes and two brains" but responses may be somewhat delayed so please be patient!!!! I would also like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please be courteous and appreciative for the assistance provided! ********** I need a deeper look at your computer. Please do this.......
********** With your next post please provide: * RSIT log.txt * RSIT info.txt ********** I will review your logs and post instructions forthcoming. Regards, t -------------------- Proud member - Unified Network of Instructors and Trained Eliminators
 I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost! http://organdonor.gov/donor/index.htm |
|
|
|
|
Jun 10 2009, 02:07 PM
Post
#3
|
|
|
New Member Group: Members Posts: 4 Joined: 10-June 09 Member No.: 340,699 |
Logfile of random's system information tool 1.06 (written by random/random)
Run by Owner at 2009-06-10 13:03:07 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 140 GB (91%) free of 153 GB Total RAM: 503 MB (20% free) HijackThis download failed ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-21 41368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-21 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2004-08-20 155648] "HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2004-08-20 118784] "AlcxMonitor"=C:\WINDOWS\ALCXMNTR.EXE [2004-09-07 57344] "AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2004-06-29 88363] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312] "OneCareUI"=C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe [2009-03-22 63864] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-05-21 148888] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "EPSON Stylus CX7400 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE [2007-02-15 179200] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxsrvc.dll [2004-08-20 344064] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\OneCareMP] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Documents and Settings\Owner\Desktop\LimeWire\LimeWire.exe"="C:\Documents and Settings\Owner\Desktop\LimeWire\LimeWire.exe:*:Enabled:LimeWire" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" ======List of files/folders created in the last 1 months====== 2009-06-10 13:03:09 ----D---- C:\Program Files\trend micro 2009-06-10 13:03:07 ----D---- C:\rsit 2009-06-10 11:33:24 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$ 2009-06-10 11:33:15 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$ 2009-06-10 11:33:07 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$ 2009-06-10 11:32:56 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$ 2009-06-10 11:25:48 ----D---- C:\WINDOWS\system32\XPSViewer 2009-06-10 11:25:41 ----D---- C:\Program Files\MSBuild 2009-06-10 11:25:27 ----D---- C:\Program Files\Reference Assemblies 2009-06-10 11:24:37 ----N---- C:\WINDOWS\system32\xpsshhdr.dll 2009-06-10 11:24:37 ----N---- C:\WINDOWS\system32\prntvpt.dll 2009-06-10 11:24:36 ----N---- C:\WINDOWS\system32\xpssvcs.dll 2009-06-10 11:24:35 ----D---- C:\f7166f7cead627bc0ffef4212ccd8357 2009-06-10 11:21:47 ----SHD---- C:\Config.Msi 2009-06-10 11:07:11 ----A---- C:\WINDOWS\system32\SET281.tmp 2009-06-10 11:07:10 ----A---- C:\WINDOWS\system32\SET27C.tmp 2009-06-10 11:07:09 ----A---- C:\WINDOWS\system32\SET27D.tmp 2009-06-10 11:07:08 ----A---- C:\WINDOWS\system32\SET27E.tmp 2009-06-10 11:07:04 ----A---- C:\WINDOWS\system32\SET282.tmp 2009-06-10 11:04:58 ----D---- C:\WINDOWS\LastGood 2009-06-10 10:25:06 ----A---- C:\WINDOWS\system32\javaws.exe 2009-06-10 10:25:06 ----A---- C:\WINDOWS\system32\javaw.exe 2009-06-10 10:25:06 ----A---- C:\WINDOWS\system32\java.exe 2009-06-09 11:19:14 ----RSD---- C:\WINDOWS\assembly 2009-06-09 11:18:27 ----D---- C:\WINDOWS\Microsoft.NET 2009-06-09 11:03:28 ----D---- C:\Program Files\Microsoft Windows OneCare Live 2009-06-09 10:49:31 ----D---- C:\Program Files\Windows Live Safety Center 2009-06-09 10:38:09 ----D---- C:\WINDOWS\ie8updates 2009-06-09 10:35:46 ----HDC---- C:\WINDOWS\ie8 2009-06-09 08:46:23 ----D---- C:\Program Files\podmena 2009-05-20 19:53:35 ----D---- C:\Program Files\Microsoft ======List of files/folders modified in the last 1 months====== 2009-06-10 13:03:09 ----D---- C:\Program Files 2009-06-10 13:02:46 ----A---- C:\WINDOWS\ModemLog_PANTECH UM175 #3.txt 2009-06-10 11:37:34 ----SHD---- C:\WINDOWS\Installer 2009-06-10 11:34:33 ----D---- C:\WINDOWS\Prefetch 2009-06-10 11:34:15 ----HD---- C:\WINDOWS\inf 2009-06-10 11:34:13 ----D---- C:\WINDOWS 2009-06-10 11:34:04 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-06-10 11:33:59 ----D---- C:\Program Files\Internet Explorer 2009-06-10 11:33:58 ----D---- C:\WINDOWS\system32 2009-06-10 11:33:31 ----HD---- C:\WINDOWS\$hf_mig$ 2009-06-10 11:33:28 ----A---- C:\WINDOWS\imsins.BAK 2009-06-10 11:31:04 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-06-10 11:30:36 ----D---- C:\WINDOWS\WinSxS 2009-06-10 11:25:43 ----D---- C:\WINDOWS\system32\en-us 2009-06-10 11:25:35 ----RSD---- C:\WINDOWS\Fonts 2009-06-10 11:25:05 ----D---- C:\WINDOWS\system32\spool 2009-06-10 11:24:43 ----D---- C:\WINDOWS\system32\CatRoot2 2009-06-10 11:24:22 ----D---- C:\WINDOWS\Temp 2009-06-10 10:50:21 ----HD---- C:\Documents and Settings\Owner\Application Data\Move Networks 2009-06-10 10:46:04 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-06-10 10:45:17 ----D---- C:\Program Files\Common Files 2009-06-10 10:24:50 ----D---- C:\Program Files\Java 2009-06-10 09:42:12 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft 2009-06-09 12:44:46 ----SD---- C:\Documents and Settings\Owner\Application Data\Microsoft 2009-06-09 11:39:17 ----SD---- C:\WINDOWS\system32\Microsoft 2009-06-09 11:34:05 ----D---- C:\WINDOWS\system32\config 2009-06-09 11:23:10 ----D---- C:\WINDOWS\system32\drivers 2009-06-09 11:23:08 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-06-09 11:18:31 ----D---- C:\WINDOWS\system32\mui 2009-06-09 10:49:32 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-06-09 10:39:23 ----D---- C:\WINDOWS\Media 2009-06-09 10:39:23 ----D---- C:\WINDOWS\Help 2009-06-09 10:35:39 ----D---- C:\WINDOWS\system32\CatRoot 2009-06-09 08:55:53 ----D---- C:\Documents and Settings\All Users\Application Data\NOS 2009-06-09 08:55:51 ----D---- C:\Program Files\NOS 2009-06-02 14:26:27 ----D---- C:\Program Files\MSN 2009-06-01 10:51:12 ----A---- C:\WINDOWS\system32\MRT.exe 2009-05-21 11:33:57 ----A---- C:\WINDOWS\system32\deploytk.dll ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352] R1 MSFWHLPR;MSFWHLPR; C:\WINDOWS\system32\DRIVERS\msfwhlpr.sys [2007-11-27 116416] R1 podmenadrv;podmenadrv; \??\C:\Program Files\podmena\podmena.sys [] R2 MSFWDrv;MSFWDrv; C:\WINDOWS\system32\DRIVERS\msfwdrv.sys [2007-11-27 91328] R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776] R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2008-03-21 1203776] R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-10-01 2279424] R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\AN983.sys [2004-08-03 36224] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400] R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2004-08-20 737874] R3 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2008-05-15 53168] R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 PTDUBus;PANTECH UM175 Composite Device Driver ; C:\WINDOWS\system32\DRIVERS\PTDUBus.sys [2008-03-11 29824] R3 PTDUMdm;PANTECH UM175 Drivers; C:\WINDOWS\system32\DRIVERS\PTDUMdm.sys [2008-03-11 41344] R3 PTDUVsp;PANTECH UM175 Diagnostic Port; C:\WINDOWS\system32\DRIVERS\PTDUVsp.sys [2008-03-11 39936] R3 PTDUWWAN;PANTECH UM175 WWAN Driver; C:\WINDOWS\system32\DRIVERS\PTDUWWAN.sys [2008-03-11 59776] R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608] S3 dot4;MS IEEE-1284.4 Driver; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976] S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928] S3 dot4usb;Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-17 23808] S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] S3 PTDMBus;PANTECH USB Modem Composite Device Driver ; C:\WINDOWS\system32\DRIVERS\PTDMBus.sys [2007-08-17 29952] S3 PTDMMdm;PANTECH USB Modem Drivers ; C:\WINDOWS\system32\DRIVERS\PTDMMdm.sys [2007-08-17 41856] S3 PTDMVsp;PANTECH USB Modem Serial Port ; C:\WINDOWS\system32\DRIVERS\PTDMVsp.sys [2007-08-17 39936] S3 PTDMWWAN;PANTECH USB Modem WWAN Driver; C:\WINDOWS\system32\DRIVERS\PTDMWWAN.sys [2007-08-17 59520] S3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2008-02-25 105088] S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992] S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552] S3 UNDPX2A;UNDPX2A; \??\C:\WINDOWS\system32\drivers\UNDPX2A.SYS [] S3 USB_RNDIS;USB Remote NDIS Network Device Driver; C:\WINDOWS\system32\DRIVERS\usb8023.sys [2008-04-13 12800] S3 USBCM;Scientific-Atlanta USB Cable Modem Driver; C:\WINDOWS\system32\DRIVERS\Sacm2A.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\WINDOWS\system32\agrsmsvc.exe [2008-03-18 13312] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424] R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-05-21 152984] R2 msfwsvc;OneCare Firewall; C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe [2007-11-27 755264] R2 OcHealthMon;Windows Live OneCare Health Monitor; C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe [2009-03-22 24936] R2 OneCareMP;OneCare AntiSpyware and AntiVirus; C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe [2008-07-09 18704] R2 podmena;podmena; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336] R2 winss;Windows Live OneCare; C:\Program Files\Microsoft Windows OneCare Live\winss.exe [2009-03-22 1131896] R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168] S2 spupdsvc;Windows Service Pack Installer update service; C:\WINDOWS\system32\spupdsvc.exe [2009-01-07 26144] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104] S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096] -----------------EOF----------------- info.txt logfile of random's system information tool 1.06 2009-06-10 13:03:16 ======Uninstall list====== -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Acrobat.com-->MsiExec.exe /X{287ECFA4-719A-2143-A09B-D6A12DE54E40} Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723} Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 9.1.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001} Agere Systems PCI Soft Modem-->agrsmdel Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13} Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033} Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B} Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE} EPSON Printer Software-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r EPSON Stylus CX7400 Series Scanner Driver Update-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{24ADC0E4-8D3E-40C4-9106-F2DE5E9112F1}\Setup.exe" -l0x9 GTOneCare-->MsiExec.exe /X{8B21B9EF-6DBF-4F63-8CC7-9F6A56D1EE8E} Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT="" Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT="" Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" Intel® Extreme Graphics Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562 iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3} Java™ 6 Update 14-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF} Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7} Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe" Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe" Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9} Microsoft Protection Service-->MsiExec.exe /I{85CFDC2D-710E-49D5-B799-F3743CA506BA} Microsoft Windows Live OneCare Resources v2.5.2900.24-->MsiExec.exe /I{5660022E-F3F2-4126-8CC5-9726C47150EB} Microsoft Windows OneCare Live AntiSpyware and AntiVirus-->MsiExec.exe /I{E26B83D1-C0BB-41BC-8F44-31D5354DD6AF} Microsoft Windows OneCare Live v2.5.2900.24 Idcrl Install-->MsiExec.exe /I{3851147E-5A91-4469-BA4D-13FFFCC8A920} Microsoft Windows OneCare Live v2.5.2900.24-->MsiExec.exe /I{D07A8E7E-D324-4945-BA8C-E532AD008FF3} Mozilla Sunbird (0.9)-->C:\Program Files\Mozilla Sunbird\uninstall\uninst.exe PANTECH PC USB Modem Software-->C:\Program Files\PANTECH\PANTECH USB Modem\PTDMUninstall.exe PANTECH UM175 Driver-->C:\Program Files\PANTECH\PANTECH UM175\PTDUUninstall.exe PX Engine-->MsiExec.exe /I{6513E869-647F-40FD-A55D-CFC92579B9BA} QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F} Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe" Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe" Security Update for Windows Media Player 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe" Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe" Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe" Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe" Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe" Security Update for Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe" Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe" Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe" Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe" Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe" Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe" Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe" Security Update for Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe" Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe" Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe" Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe" Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe" Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe" Security Update for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe" Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe" Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe" Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe" Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe" Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe" Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe" Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe" Security Update for Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe" Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe" Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe" Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe" Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe" Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe" Security Update for Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe" Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe" Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe" Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe" Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe" Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe" Security Update for Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe" Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe" Update for Windows Internet Explorer 8 (KB971180)-->"C:\WINDOWS\ie8updates\KB971180-IE8\spuninst\spuninst.exe" Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe" Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe" Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe" Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe" VZAccess Manager-->C:\PROGRA~1\VERIZO~1\VZACCE~1\UNWISE.EXE C:\PROGRA~1\VERIZO~1\VZACCE~1\INSTALL.LOG Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe" Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT Windows Live OneCare-->"C:\Program Files\Microsoft Windows OneCare Live\OCSetup.exe" /u Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe" ======Security center information====== AV: Windows Live OneCare FW: Windows Live OneCare Firewall ======System event log====== Computer Name: HOME-9FE1BF7784 Event Code: 16 Message: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection. Record Number: 6718 Source Name: Windows Update Agent Time Written: 20090114025525.000000-420 Event Type: error User: Computer Name: HOME-9FE1BF7784 Event Code: 16 Message: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection. Record Number: 6717 Source Name: Windows Update Agent Time Written: 20090112025524.000000-420 Event Type: error User: Computer Name: HOME-9FE1BF7784 Event Code: 12 Message: The device 'PANTECH UM175 WWAN Driver #3' (USB\VID_106c&PID_3714&MI_03\6&154cfd13&0&8515) disappeared from the system without first being prepared for removal. Record Number: 6715 Source Name: PlugPlayManager Time Written: 20090109121330.000000-420 Event Type: error User: Computer Name: HOME-9FE1BF7784 Event Code: 36 Message: The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized. Record Number: 6704 Source Name: W32Time Time Written: 20090104001713.000000-420 Event Type: warning User: Computer Name: HOME-9FE1BF7784 Event Code: 4226 Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. Record Number: 6703 Source Name: Tcpip Time Written: 20090103115526.000000-420 Event Type: warning User: =====Application event log===== Computer Name: HOME-9FE1BF7784 Event Code: 1000 Message: Faulting application iexplore.exe, version 6.0.2900.5512, faulting module kernel32.dll, version 5.1.2600.5512, fault address 0x00009e7a. Record Number: 620 Source Name: Application Error Time Written: 20081119112747.000000-420 Event Type: error User: Computer Name: HOME-9FE1BF7784 Event Code: 63 Message: A provider, OffProv12, has been registered in the WMI namespace, Root\MSAPPS12, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Record Number: 505 Source Name: WinMgmt Time Written: 20081001181626.000000-360 Event Type: warning User: NT AUTHORITY\SYSTEM Computer Name: HOME-9FE1BF7784 Event Code: 63 Message: A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Record Number: 487 Source Name: WinMgmt Time Written: 20081001171259.000000-360 Event Type: warning User: HOME-9FE1BF7784\Owner Computer Name: HOME-9FE1BF7784 Event Code: 1000 Message: Faulting application vzaccess manager.exe, version 6.8.1.2090, faulting module unknown, version 0.0.0.0, fault address 0x00f65036. Record Number: 480 Source Name: Application Error Time Written: 20080920161812.000000-360 Event Type: error User: Computer Name: HOME-9FE1BF7784 Event Code: 1000 Message: Faulting application vzaccess manager.exe, version 6.8.1.2090, faulting module unknown, version 0.0.0.0, fault address 0x00f65036. Record Number: 478 Source Name: Application Error Time Written: 20080919214346.000000-360 Event Type: error User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\ "windir"=%SystemRoot% "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=15 "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel "PROCESSOR_REVISION"=0401 "NUMBER_OF_PROCESSORS"=1 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip -----------------EOF----------------- |
|
|
|
|
Jun 10 2009, 02:22 PM
Post
#4
|
|
|
Bleepin' Peaceful Group: HJT Team Posts: 4,479 Joined: 9-December 08 Member No.: 267,653 |
Hi again,
Your infection prevented part of the download.  We have other options though. I would like you to do this first......********** We need to create an OTL Report
********** With your next post please provide: * OTListIt.txt * OTListIt Extra.txt ********** Regards, t -------------------- Proud member - Unified Network of Instructors and Trained Eliminators
I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost! http://organdonor.gov/donor/index.htm |
|
|
|
icon on your desktop.
button.|
Jun 10 2009, 06:36 PM
Post
#5
|
|
|
New Member Group: Members Posts: 4 Joined: 10-June 09 Member No.: 340,699 |
Thanks so much for your help!
OTL logfile created on: 6/10/2009 5:28:55 PM - Run 1 OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Owner\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 503.48 Mb Total Physical Memory | 134.39 Mb Available Physical Memory | 26.69% Memory free 1.20 Gb Paging File | 0.64 Gb Available in Paging File | 53.19% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 149.05 Gb Total Space | 136.23 Gb Free Space | 91.40% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: HOME-9FE1BF7784 Current User Name: Owner Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Output = Standard File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - [2008/07/09 17:05:22 | 00,018,704 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe PRC - [2008/04/13 18:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2008/03/18 16:27:12 | 00,013,312 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\agrsmsvc.exe PRC - [2009/03/26 15:31:20 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe PRC - [2009/05/21 11:34:05 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009/03/22 10:59:34 | 00,024,936 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe PRC - [2007/11/27 22:56:32 | 00,755,264 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe PRC - [2009/03/22 11:00:16 | 01,131,896 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\winss.exe PRC - [2004/08/20 15:55:14 | 00,155,648 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\igfxtray.exe PRC - [2004/08/20 15:51:14 | 00,118,784 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\hkcmd.exe PRC - [2004/09/07 15:47:52 | 00,057,344 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\ALCXMNTR.EXE PRC - [2004/06/29 09:06:38 | 00,088,363 | ---- | M] (Agere Systems) -- C:\WINDOWS\AGRSMMSG.exe PRC - [2009/04/02 16:11:02 | 00,342,312 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe PRC - [2009/03/22 10:59:56 | 00,063,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe PRC - [2009/05/21 11:34:07 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2007/02/15 06:00:00 | 00,179,200 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE PRC - [2008/04/13 18:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe PRC - [2009/04/02 16:10:56 | 00,656,168 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe PRC - [2009/02/06 04:10:02 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE PRC - [2008/04/13 18:12:40 | 00,073,728 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmplayer.exe PRC - [2008/05/22 11:46:46 | 01,746,224 | ---- | M] (Smith Micro Software, Inc.) -- C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe PRC - [2009/06/10 17:27:32 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe ========== Win32 Services (SafeList) ========== SRV - [2008/03/18 16:27:12 | 00,013,312 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\agrsmsvc.exe -- (AgereModemAudio [Auto | Running]) SRV - [2009/03/26 15:31:20 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running]) SRV - [2008/07/25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running]) SRV - [2008/07/25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2008/04/13 18:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2009/04/02 16:10:56 | 00,656,168 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running]) SRV - [2009/05/21 11:34:05 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2007/11/27 22:56:32 | 00,755,264 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe -- (msfwsvc [Auto | Running]) SRV - [2009/03/22 10:59:34 | 00,024,936 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe -- (OcHealthMon [Auto | Running]) SRV - [2008/07/09 17:05:22 | 00,018,704 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe -- (OneCareMP [Auto | Running]) SRV - [2003/07/28 10:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2009/06/09 08:46:23 | 00,036,864 | ---- | M] () -- C:\Program Files\podmena\podmena.dll -- (podmena [Auto | Running]) SRV - [2009/03/22 11:00:16 | 01,131,896 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\winss.exe -- (winss [Auto | Running]) SRV - [2009/01/07 18:21:00 | 00,026,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spupdsvc.exe -- (spupdsvc [Auto | Stopped]) SRV - [2008/07/29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - [2008/07/29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - [2008/07/29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped]) ========== Driver Services (SafeList) ========== DRV - [2005/02/23 14:58:56 | 00,011,776 | ---- | M] (Arcsoft, Inc.) -- C:\WINDOWS\system32\drivers\Afc.sys -- (Afc [On_Demand | Running]) DRV - [2008/03/21 16:13:00 | 01,203,776 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\DRIVERS\AGRSM.sys -- (AgereSoftModem [On_Demand | Running]) DRV - [2004/10/01 12:24:02 | 02,279,424 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM [On_Demand | Running]) DRV - [2004/08/03 16:31:20 | 00,036,224 | ---- | M] (ADMtek Incorporated.) -- C:\WINDOWS\system32\DRIVERS\AN983.sys -- (AN983 [On_Demand | Running]) DRV - [2009/03/19 16:32:48 | 00,023,400 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Running]) DRV - [2004/08/20 16:26:00 | 00,737,874 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\DRIVERS\ialmnt5.sys -- (ialm [On_Demand | Running]) DRV - [2008/05/15 16:15:16 | 00,053,168 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\MpFilter.sys -- (MpFilter [On_Demand | Running]) DRV - [2007/11/27 22:56:28 | 00,091,328 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\msfwdrv.sys -- (MSFWDrv [Auto | Running]) DRV - [2007/11/27 22:56:30 | 00,116,416 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\msfwhlpr.sys -- (MSFWHLPR [System | Running]) DRV - [2009/06/09 08:46:23 | 00,009,472 | ---- | M] (podmena) -- C:\Program Files\podmena\podmena.sys -- (podmenadrv [System | Running]) DRV - [2007/08/17 19:56:34 | 00,029,952 | ---- | M] (DEVGURU Co,LTD.) -- C:\WINDOWS\system32\DRIVERS\PTDMBus.sys -- (PTDMBus [On_Demand | Stopped]) DRV - [2007/08/17 19:56:38 | 00,041,856 | ---- | M] (DEVGURU Co,LTD.) -- C:\WINDOWS\system32\DRIVERS\PTDMMdm.sys -- (PTDMMdm [On_Demand | Stopped]) DRV - [2007/08/17 19:56:40 | 00,039,936 | ---- | M] (DEVGURU Co,LTD.) -- C:\WINDOWS\system32\DRIVERS\PTDMVsp.sys -- (PTDMVsp [On_Demand | Stopped]) DRV - [2007/08/17 19:56:46 | 00,059,520 | ---- | M] (DEVGURU Co,LTD.) -- C:\WINDOWS\system32\DRIVERS\PTDMWWAN.sys -- (PTDMWWAN [On_Demand | Stopped]) DRV - [2008/03/11 16:58:44 | 00,029,824 | ---- | M] (DEVGURU Co,LTD.) -- C:\WINDOWS\system32\DRIVERS\PTDUBus.sys -- (PTDUBus [On_Demand | Running]) DRV - [2008/03/11 16:58:48 | 00,041,344 | ---- | M] (DEVGURU Co,LTD.) -- C:\WINDOWS\system32\DRIVERS\PTDUMdm.sys -- (PTDUMdm [On_Demand | Running]) DRV - [2008/03/11 16:58:50 | 00,039,936 | ---- | M] (DEVGURU Co,LTD.) -- C:\WINDOWS\system32\DRIVERS\PTDUVsp.sys -- (PTDUVsp [On_Demand | Running]) DRV - [2008/03/11 16:58:56 | 00,059,776 | ---- | M] (DEVGURU Co,LTD.) -- C:\WINDOWS\system32\DRIVERS\PTDUWWAN.sys -- (PTDUWWAN [On_Demand | Running]) DRV - [2004/08/04 06:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2008/02/13 03:00:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2008/02/25 12:54:56 | 00,105,088 | ---- | M] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys -- (RTL8023xp [On_Demand | Stopped]) DRV - [2004/08/03 16:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\system32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Stopped]) DRV - [2007/11/13 04:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2001/08/17 15:56:16 | 00,007,552 | ---- | M] (Sony Corporation) -- C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS -- (SONYPVU1 [On_Demand | Stopped]) DRV - [2004/06/10 17:31:20 | 00,135,168 | R--- | M] () -- C:\WINDOWS\UNDPX2A.exe -- (UNDPX2A [On_Demand | Stopped]) DRV - [2008/04/13 12:56:49 | 00,012,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\usb8023.sys -- (USB_RNDIS [On_Demand | Stopped]) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-823518204-1532298954-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKU\S-1-5-21-823518204-1532298954-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKU\S-1-5-21-823518204-1532298954-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ IE - HKU\S-1-5-21-823518204-1532298954-682003330-1003\S-1-5-21-823518204-1532298954-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/01/23 13:47:43 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2009/06/10 11:27:11 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Sunbird 0.9\extensions\\Components: C:\PROGRAM FILES\MOZILLA SUNBIRD\COMPONENTS [2009/05/09 09:04:20 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Sunbird 0.9\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA SUNBIRD\PLUGINS O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found O3 - HKU\S-1-5-21-823518204-1532298954-682003330-1003\..\Toolbar\ShellBrowser: (no name) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - Reg Error: Key error. File not found O3 - HKU\S-1-5-21-823518204-1532298954-682003330-1003\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - Reg Error: Key error. File not found O3 - HKU\S-1-5-21-823518204-1532298954-682003330-1003\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated) O4 - HKLM..\Run: [AGRSMMSG] AGRSMMSG.exe (Agere Systems) O4 - HKLM..\Run: [AlcxMonitor] ALCXMNTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.) O4 - HKLM..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" (Microsoft Corporation) O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKU\S-1-5-21-823518204-1532298954-682003330-1003..\Run: [EPSON Stylus CX7400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE /FU "C:\WINDOWS\TEMP\E_S67.tmp" /EF "HKCU" (SEIKO EPSON CORPORATION) O4 - HKU\S-1-5-21-823518204-1532298954-682003330-1003..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-823518204-1532298954-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1...toUploader5.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0...heckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} http://h20270.www2.hp.com/ediags/gmn/insta...staller_gmn.cab (VerifyGMN Class) O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www1.snapfish.com/SnapfishActivia.cab (Snapfish Activia) O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/...lscbase5483.cab (Windows Live Safety Center Base Module) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1166490846906 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx (Get_ActiveX Control) O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flas...ent/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation) O24 - Desktop Components:0 (My Current Home Page) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/12/18 06:09:19 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009/06/10 17:27:27 | 00,000,000 | ---D | M] ========== Files/Folders - Created Within 30 Days ========== [7 C:\WINDOWS\System32\*.tmp files] [4 C:\WINDOWS\*.tmp files] [2009/06/10 17:27:21 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe [2009/06/10 13:03:09 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro [2009/06/10 13:03:07 | 00,000,000 | ---D | C] -- C:\rsit [2009/06/10 13:02:14 | 00,781,909 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\RSIT.exe [2009/06/10 11:25:48 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\XPSViewer [2009/06/10 11:25:41 | 00,000,000 | ---D | C] -- C:\Program Files\MSBuild [2009/06/10 11:25:27 | 00,000,000 | ---D | C] -- C:\Program Files\Reference Assemblies [2009/06/10 11:24:37 | 00,597,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe [2009/06/10 11:24:37 | 00,575,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsshhdr.dll [2009/06/10 11:24:37 | 00,575,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpsshhdr.dll [2009/06/10 11:24:37 | 00,117,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\prntvpt.dll [2009/06/10 11:24:37 | 00,089,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll [2009/06/10 11:24:36 | 01,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpssvcs.dll [2009/06/10 11:24:36 | 01,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpssvcs.dll [2009/06/10 11:24:35 | 00,000,000 | ---D | C] -- C:\f7166f7cead627bc0ffef4212ccd8357 [2009/06/10 11:21:47 | 00,000,000 | -HSD | C] -- C:\Config.Msi [2009/06/10 11:17:58 | 00,359,893 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\dds.scr [2009/06/10 11:07:11 | 00,246,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieproxy.dll [2009/06/10 11:07:11 | 00,012,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpshims.dll [2009/06/10 11:04:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood [2009/06/09 11:34:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\microsoft [2009/06/09 11:23:08 | 00,091,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\msfwdrv.sys [2009/06/09 11:23:04 | 00,116,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\msfwhlpr.sys [2009/06/09 11:22:12 | 00,053,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\MpFilter.sys [2009/06/09 11:19:14 | 00,000,000 | R-SD | C] -- C:\WINDOWS\assembly [2009/06/09 11:18:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET [2009/06/09 11:03:28 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Windows OneCare Live [2009/06/09 10:49:31 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center [2009/06/09 10:45:22 | 00,002,146 | -H-- | C] () -- C:\WINDOWS\f5087.dat [2009/06/09 10:38:09 | 00,000,000 | ---D | C] -- C:\WINDOWS\ie8updates [2009/06/09 10:37:35 | 00,102,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iecompat.dll [2009/06/09 10:35:46 | 00,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [2009/06/09 09:39:40 | 00,000,001 | ---- | C] () -- C:\WINDOWS\dk39fi4fe.dat [2009/06/09 08:46:23 | 00,000,000 | ---D | C] -- C:\Program Files\podmena [2009/06/09 08:46:19 | 00,000,001 | ---- | C] () -- C:\WINDOWS\9g2234wesdf3dfgjf23 [2009/06/09 08:46:17 | 00,000,002 | -H-- | C] () -- C:\WINDOWS\ro122458.dat [2009/06/09 08:46:15 | 00,000,002 | -H-- | C] () -- C:\WINDOWS\ro122390.dat [2009/06/09 08:46:15 | 00,000,001 | -H-- | C] () -- C:\WINDOWS\msmark2.dat [2009/06/09 08:46:14 | 00,000,001 | -H-- | C] () -- C:\WINDOWS\f23567.dat [2009/06/09 08:46:13 | 00,000,002 | -H-- | C] () -- C:\WINDOWS\ro122366.dat [2009/05/28 11:19:35 | 00,025,088 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\pmy cover letter.doc [2009/05/28 10:45:49 | 00,025,600 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\cover letter edu.doc [2009/05/27 10:50:29 | 00,024,064 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\References edu.doc [2009/05/20 19:53:35 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft [2009/05/20 10:34:28 | 00,130,563 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Job Opening EMPLOYMENT SPECIALIST - LIMITED-TERM POSITION WITH BENEFITS.mht [2008/11/25 15:51:34 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008/08/17 17:33:56 | 00,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini [2008/08/17 16:49:39 | 00,000,079 | ---- | C] () -- C:\WINDOWS\EPSCX7400.ini [2007/03/13 14:14:58 | 00,053,693 | R--- | C] () -- C:\WINDOWS\UNDPX2A.sys [2004/08/04 06:00:00 | 00,000,573 | ---- | C] () -- C:\WINDOWS\win.ini [2004/08/04 06:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2003/01/07 13:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI ========== Files - Modified Within 30 Days ========== [7 C:\WINDOWS\System32\*.tmp files] [4 C:\WINDOWS\*.tmp files] [2009/06/10 17:27:32 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe [2009/06/10 13:02:46 | 00,781,909 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\RSIT.exe [2009/06/10 11:33:28 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/06/10 11:31:04 | 00,488,244 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/06/10 11:31:04 | 00,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009/06/10 11:31:04 | 00,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009/06/10 11:19:45 | 00,359,893 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\dds.scr [2009/06/10 10:54:57 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/06/10 10:46:46 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/06/10 10:46:45 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Owner\Local Settings\desktop.ini [2009/06/10 10:46:43 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/06/09 10:45:22 | 00,002,146 | -H-- | M] () -- C:\WINDOWS\f5087.dat [2009/06/09 10:39:33 | 00,000,076 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\desktop.ini [2009/06/09 09:39:40 | 00,000,001 | ---- | M] () -- C:\WINDOWS\dk39fi4fe.dat [2009/06/09 08:46:19 | 00,000,001 | ---- | M] () -- C:\WINDOWS\9g2234wesdf3dfgjf23 [2009/06/09 08:46:17 | 00,000,002 | -H-- | M] () -- C:\WINDOWS\ro122458.dat [2009/06/09 08:46:15 | 00,000,002 | -H-- | M] () -- C:\WINDOWS\ro122390.dat [2009/06/09 08:46:15 | 00,000,001 | -H-- | M] () -- C:\WINDOWS\msmark2.dat [2009/06/09 08:46:14 | 00,000,001 | -H-- | M] () -- C:\WINDOWS\f23567.dat [2009/06/09 08:46:13 | 00,000,002 | -H-- | M] () -- C:\WINDOWS\ro122366.dat [2009/06/05 22:58:04 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2009/06/01 10:51:12 | 23,635,392 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009/06/01 09:03:30 | 00,025,600 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\cover letter edu.doc [2009/05/28 11:19:35 | 00,025,088 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\pmy cover letter.doc [2009/05/27 10:50:30 | 00,024,064 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\References edu.doc [2009/05/26 15:50:46 | 00,017,395 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\resume edu.docx [2009/05/24 15:37:40 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk [2009/05/20 19:37:17 | 00,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk [2009/05/20 10:34:29 | 00,130,563 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Job Opening EMPLOYMENT SPECIALIST - LIMITED-TERM POSITION WITH BENEFITS.mht [2009/05/12 23:15:55 | 05,936,128 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll [2009/05/12 23:15:55 | 00,915,456 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll [2009/05/11 23:11:53 | 00,102,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iecompat.dll < End of report > Current Boot Mode: Normal Scan Mode: All users Output = Standard File Age = 30 Days Company Name Whitelist: On ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 1 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "EnableFirewall" = 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List "8085:TCP" = 8085:TCP:*:Enabled:podmena ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [2008/04/13 12:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] File not found -- C:\Documents and Settings\Owner\Desktop\LimeWire\LimeWire.exe:*:Enabled:LimeWire [2008/04/13 12:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour [2009/04/02 16:10:58 | 13,646,632 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour "{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime "{24ADC0E4-8D3E-40C4-9106-F2DE5E9112F1}" = EPSON Stylus CX7400 Series Scanner Driver Update "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 14 "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3851147E-5A91-4469-BA4D-13FFFCC8A920}" = Microsoft Windows OneCare Live v2.5.2900.24 Idcrl Install "{5660022E-F3F2-4126-8CC5-9726C47150EB}" = Microsoft Windows Live OneCare Resources v2.5.2900.24 "{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}" = iTunes "{6513E869-647F-40FD-A55D-CFC92579B9BA}" = PX Engine "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{85CFDC2D-710E-49D5-B799-F3743CA506BA}" = Microsoft Protection Service "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver "{8B21B9EF-6DBF-4F63-8CC7-9F6A56D1EE8E}" = GTOneCare "{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1.1 "{AFA20D47-69C3-4030-8DF8-D37466E70F13}" = Apple Mobile Device Support "{B29B0066-547B-402c-9C0D-090E2F928A01}" = PANTECH PC USB Modem Software "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C13AF9C7-8E06-4354-B629-DF6192CE4A66}" = PANTECH UM175 Driver "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D07A8E7E-D324-4945-BA8C-E532AD008FF3}" = Microsoft Windows OneCare Live v2.5.2900.24 "{E26B83D1-C0BB-41BC-8F44-31D5354DD6AF}" = Microsoft Windows OneCare Live AntiSpyware and AntiVirus "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Agere Systems Soft Modem" = Agere Systems PCI Soft Modem "EPSON Printer and Utilities" = EPSON Printer Software "EPSON Scanner" = EPSON Scan "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie8" = Windows Internet Explorer 8 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Sunbird (0.9)" = Mozilla Sunbird (0.9) "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "NVIDIA Drivers" = NVIDIA Drivers "VZAccess Manager" = VZAccess Manager "Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner "Windows XP Service Pack" = Windows XP Service Pack 3 "WinSS" = Windows Live OneCare ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Absolute Poker" = Absolute Poker ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-823518204-1532298954-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Absolute Poker" = Absolute Poker ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 11/19/2008 2:27:47 PM | Computer Name = HOME-9FE1BF7784 | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 6.0.2900.5512, faulting module kernel32.dll, version 5.1.2600.5512, fault address 0x00009e7a. Error - 11/25/2008 5:33:07 PM | Computer Name = HOME-9FE1BF7784 | Source = Microsoft Office 12 | ID = 5000 Description = Error - 12/16/2008 10:30:26 PM | Computer Name = HOME-9FE1BF7784 | Source = Application Hang | ID = 1002 Description = Hanging application iexplore.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 12/16/2008 10:30:27 PM | Computer Name = HOME-9FE1BF7784 | Source = Application Hang | ID = 1002 Description = Hanging application iexplore.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 3/22/2009 8:51:58 PM | Computer Name = HOME-9FE1BF7784 | Source = Application Hang | ID = 1002 Description = Hanging application iexplore.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000. [ System Events ] Error - 6/4/2009 2:26:22 PM | Computer Name = HOME-9FE1BF7784 | Source = PlugPlayManager | ID = 12 Description = The device 'PANTECH UM175 WWAN Driver #3' (USB\VID_106c&PID_3714&MI_03\6&154cfd13&0&8515) disappeared from the system without first being prepared for removal. Error - 6/6/2009 12:57:08 PM | Computer Name = HOME-9FE1BF7784 | Source = PlugPlayManager | ID = 12 Description = The device 'PANTECH UM175 WWAN Driver #3' (USB\VID_106c&PID_3714&MI_03\6&154cfd13&0&8515) disappeared from the system without first being prepared for removal. Error - 6/7/2009 4:12:46 PM | Computer Name = HOME-9FE1BF7784 | Source = PlugPlayManager | ID = 12 Description = The device 'PANTECH UM175 WWAN Driver #3' (USB\VID_106c&PID_3714&MI_03\6&154cfd13&0&8515) disappeared from the system without first being prepared for removal. Error - 6/9/2009 1:35:04 PM | Computer Name = HOME-9FE1BF7784 | Source = DCOM | ID = 10010 Description = The server {D6015EC3-FA16-4813-9CA1-DA204574F5DA} did not register with DCOM within the required timeout. Error - 6/10/2009 3:37:39 PM | Computer Name = HOME-9FE1BF7784 | Source = PlugPlayManager | ID = 12 Description = The device 'PANTECH UM175 WWAN Driver #3' (USB\VID_106c&PID_3714&MI_03\6&154cfd13&0&8515) disappeared from the system without first being prepared for removal. Error - 6/10/2009 3:37:49 PM | Computer Name = HOME-9FE1BF7784 | Source = W32Time | ID = 39452689 Description = Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) Error - 6/10/2009 3:37:49 PM | Computer Name = HOME-9FE1BF7784 | Source = W32Time | ID = 39452701 Description = The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time. Error - 6/10/2009 3:38:44 PM | Computer Name = HOME-9FE1BF7784 | Source = PlugPlayManager | ID = 12 Description = The device 'PANTECH UM175 WWAN Driver #3' (USB\VID_106c&PID_3714&MI_03\6&154cfd13&0&8515) disappeared from the system without first being prepared for removal. Error - 6/10/2009 3:45:57 PM | Computer Name = HOME-9FE1BF7784 | Source = Windows Update Agent | ID = 20 Description = Installation Failure: Windows failed to install the following update with error 0x8024002d: Security Update for Microsoft Office Excel 2003 (KB969681). Error - 6/10/2009 3:52:13 PM | Computer Name = HOME-9FE1BF7784 | Source = PlugPlayManager | ID = 12 Description = The device 'PANTECH UM175 WWAN Driver #3' (USB\VID_106c&PID_3714&MI_03\6&154cfd13&0&8515) disappeared from the system without first being prepared for removal. < End of report > |
|
|
|
|
Jun 10 2009, 07:21 PM
Post
#6
|
|
|
Bleepin' Peaceful Group: HJT Team Posts: 4,479 Joined: 9-December 08 Member No.: 267,653 |
Let's begin,
 P2P Warning Your log indicates that you have/had Limewire installed. • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs. - They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. - Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. - The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology. Note: It is pretty much certain that if you continue to use P2P programs, then you will get infected again. I would recommend that you uninstall Limewire, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel>> Add / Remove Programs. If you wish to keep it, please do not use it until your computer is cleaned. ********** We need to execute an OTM script
If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. ********** Please download GMER from one of the following locations and save it to your desktop:
********** We need to create a New FULL OTL Report
With your next post please provide: * OTM.log * Gmer.log * OTL.txt * OTL Extra.txt * How is your computer running now? -------------------- Proud member - Unified Network of Instructors and Trained Eliminators
I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost! http://organdonor.gov/donor/index.htm |
|
|
|
icon on your desktop.
area. Do not include the word "Code".
button.
line here in your next reply.
|
Jun 11 2009, 09:29 AM
Post
#7
|
|
|
New Member Group: Members Posts: 4 Joined: 10-June 09 Member No.: 340,699 |
everything seems to be working well now- thank you very much for your help!!!!!!!!!
|
|
|
|
|
Jun 11 2009, 09:51 AM
Post
#8
|
|
|
Bleepin' Peaceful Group: HJT Team Posts: 4,479 Joined: 9-December 08 Member No.: 267,653 |
Hi,
I need to take a look at those logs! Although your computer is running better you may very well still be infected!! Please provide: * OTM.log * Gmer.log * OTL.txt * OTL Extra.txt Thanks, t -------------------- Proud member - Unified Network of Instructors and Trained Eliminators
I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost! http://organdonor.gov/donor/index.htm |
|
|
|
|
Jun 14 2009, 06:45 PM
Post
#9
|
|
|
Bleepin' Peaceful Group: HJT Team Posts: 4,479 Joined: 9-December 08 Member No.: 267,653 |
Hello again,
Are you still there? I need to take a look at those logs! Although your computer is running better you may very well still be infected!! Please provide: * OTM.log * Gmer.log * OTL.txt * OTL Extra.txt If I do not hear from you soon this thread will be closed. Thanks, t -------------------- Proud member - Unified Network of Instructors and Trained Eliminators
I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost! http://organdonor.gov/donor/index.htm |
|
|
|
|
Jun 19 2009, 07:56 AM
Post
#10
|
|
 Forum Addict Group: HJT Team Coach Posts: 7,376 Joined: 27-October 06 From: Florida Member No.: 92,376 |
Due to lack of feedback, this topic has been closed.
If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic. -------------------- Please do not pm for help, post it in the forums instead.
If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications. If I have helped you then please consider donating to continue the fight against malware  |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 9th February 2010 - 03:59 PM |
© 2003-2010 All Rights Reserved Bleeping Computer LLC.