BleepingComputer.com: DDS log requested from "Am I infected..." forum

Hi,

For background it will be easiest to go here - http://www.bleepingcomputer.com/forums/topic420652.html/page__pid__2424952#entry2424952

As requested, this is the DDS log.

DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26
Run by Marty at 19:52:41 on 2011-09-30
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.571 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\NEWXP\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\NEWXP\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\NEWXP\system32\spoolsv.exe
C:\NEWXP\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\NEWXP\system32\igfxtray.exe
C:\NEWXP\system32\hkcmd.exe
C:\NEWXP\system32\igfxpers.exe
C:\Program Files\Microsoft Security Client\msseces.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Documents and Settings\Marty\Application Data\Mikogo 4\M4-Service.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\NEWXP\system32\svchost.exe -k imgsvc
C:\NEWXP\system32\wuauclt.exe
C:\Documents and Settings\Marty\Application Data\Mikogo 4\M4-Capture.exe
C:\NEWXP\system32\NOTEPAD.EXE
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: MovieBario Toolbar: {58beca16-cae6-4b7a-a0e8-153d0cbba63a} - c:\program files\moviebario\tbMovi.dll
TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
mRun: [Smapp] c:\program files\analog devices\soundmax\SMTray.exe
mRun: [DrvLsnr] c:\program files\analog devices\soundmax\DrvLsnr.exe
mRun: [igfxtray] c:\newxp\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\newxp\system32\hkcmd.exe
mRun: [igfxpers] c:\newxp\system32\igfxpers.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\marty\startm~1\programs\startup\watcht~1.lnk - c:\program files\watchtower\watchtower library 2010\e\WTLibrary.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file:///C:/NEWXP/Java/classes/xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} - hxxp://www.superadblocker.com/activex/sabspx.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1 71.242.0.12
TCP: Interfaces\{17C601B0-EE0A-4B16-8C53-232A9E6A1CCB} : DhcpNameServer = 192.168.1.1 71.242.0.12
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\marty\application data\mozilla\firefox\profiles\ne06eyl6.default\
FF - plugin: c:\progra~1\palm\packag~1\NPInstal.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: EPUBReader: {5384767E-00D9-40E9-B72F-9CC39D655D6F} - %profile%\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\newxp\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
.
---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.brc - BRI/1
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\newxp\system32\drivers\MpFilter.sys [2010-3-25 165648]
R1 MpKsl478b0101;MpKsl478b0101;c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{3e22adfc-1e64-420e-a48e-e272a3f609a4}\MpKsl478b0101.sys [2011-9-30 28752]
R1 MpKslbcdf02b9;MpKslbcdf02b9;c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{3e22adfc-1e64-420e-a48e-e272a3f609a4}\MpKslbcdf02b9.sys [2011-9-30 28752]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664]
R2 M4-Service;M4-Service;c:\documents and settings\marty\application data\mikogo 4\M4-Service.exe [2011-8-4 1003888]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-7-4 366152]
R2 mrtRate;mrtRate;c:\newxp\system32\drivers\MrtRate.sys [2011-7-27 34916]
R3 MBAMProtector;MBAMProtector;c:\newxp\system32\drivers\mbam.sys [2010-12-19 22216]
S1 MpKsl372a9a72;MpKsl372a9a72;\??\c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{fd58b86f-06fd-44c8-a40b-eacd078d026e}\mpksl372a9a72.sys --> c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{fd58b86f-06fd-44c8-a40b-eacd078d026e}\MpKsl372a9a72.sys [?]
S1 MpKsl590c4e1f;MpKsl590c4e1f;\??\c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{fb70219c-bcf8-406a-937b-7bfa4e65d224}\mpksl590c4e1f.sys --> c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{fb70219c-bcf8-406a-937b-7bfa4e65d224}\MpKsl590c4e1f.sys [?]
S1 MpKsla4d45dbb;MpKsla4d45dbb;\??\c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{40a266e9-ab7a-4d8f-991e-7af0b7c0da31}\mpksla4d45dbb.sys --> c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{40a266e9-ab7a-4d8f-991e-7af0b7c0da31}\MpKsla4d45dbb.sys [?]
S1 MpKsld3ffb146;MpKsld3ffb146;\??\c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{2589a4b2-41c4-4c9b-a970-302eaeb3091b}\mpksld3ffb146.sys --> c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{2589a4b2-41c4-4c9b-a970-302eaeb3091b}\MpKsld3ffb146.sys [?]
S1 MpKslf1daf532;MpKslf1daf532;\??\c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{e373dcfc-06dd-4391-9ffc-ed22f7a70073}\mpkslf1daf532.sys --> c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{e373dcfc-06dd-4391-9ffc-ed22f7a70073}\MpKslf1daf532.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\newxp\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-6-29 116608]
S3 PORTMON;PORTMON;\??\c:\downloads\sysinternals suite\portmsys.sys --> c:\downloads\sysinternals suite\PORTMSYS.SYS [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\newxp\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-1-22 136176]
S4 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2011-4-1 428640]
.
=============== Created Last 30 ================
.
2011-09-30 23:47:36 28752 ----a-w- c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{3e22adfc-1e64-420e-a48e-e272a3f609a4}\MpKsl478b0101.sys
2011-09-30 21:29:21 28752 ----a-w- c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{3e22adfc-1e64-420e-a48e-e272a3f609a4}\MpKslbcdf02b9.sys
2011-09-30 21:29:15 56200 ----a-w- c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{3e22adfc-1e64-420e-a48e-e272a3f609a4}\offreg.dll
2011-09-30 02:58:07 7269712 ----a-w- c:\documents and settings\all users.newxp\application data\microsoft\microsoft antimalware\definition updates\{3e22adfc-1e64-420e-a48e-e272a3f609a4}\mpengine.dll
2011-09-27 22:40:52 -------- d--h--w- c:\newxp\PIF
2011-09-26 20:53:55 -------- d-----w- c:\documents and settings\marty\application data\Avery
2011-09-26 20:12:50 -------- d-----w- c:\program files\Microsoft
2011-09-26 20:12:42 -------- d-----w- c:\program files\MSN Toolbar
2011-09-26 20:10:26 -------- d-----w- c:\program files\Bing Bar Installer
2011-09-26 20:10:20 -------- d-----w- c:\program files\HP Photo Creations
2011-09-26 20:10:20 -------- d-----w- c:\documents and settings\all users.newxp\application data\HP Photo Creations
2011-09-26 20:10:16 -------- d-----w- c:\program files\Coupons
2011-09-26 20:09:48 232296 ----a-w- c:\newxp\system32\hpinksts8811.dll
2011-09-26 20:09:47 267112 ----a-w- c:\newxp\system32\hpinksts8811LM.dll
2011-09-26 20:09:47 213864 ----a-w- c:\newxp\system32\hpinkcoi8811.dll
2011-09-26 20:07:59 -------- d-----w- c:\documents and settings\marty\local settings\application data\HP
2011-09-26 17:35:43 -------- d-----w- c:\documents and settings\marty\local settings\application data\Paint.NET
2011-09-14 01:59:20 -------- d-----w- c:\documents and settings\marty\temp
2011-09-05 18:27:59 -------- d-----w- c:\newxp\Performance
2011-09-05 18:27:52 -------- d-----w- c:\documents and settings\marty\local settings\application data\Microsoft Corporation
2011-09-03 10:17:37 599040 -c----w- c:\newxp\system32\dllcache\crypt32.dll
.
==================== Find3M ====================
.
2011-09-09 09:12:13 599040 ----a-w- c:\newxp\system32\crypt32.dll
2011-08-31 21:00:50 22216 ----a-w- c:\newxp\system32\drivers\mbam.sys
2011-07-15 13:29:31 456320 ----a-w- c:\newxp\system32\drivers\mrxsmb.sys
2011-07-11 18:35:46 73728 ----a-w- c:\newxp\system32\javacpl.cpl
2011-07-11 18:35:45 472808 ----a-w- c:\newxp\system32\deployJava1.dll
2011-07-08 14:02:00 10496 ----a-w- c:\newxp\system32\drivers\ndistapi.sys
2011-07-03 16:12:36 404640 ----a-w- c:\newxp\system32\FlashPlayerCPLApp.cpl
.
============= FINISH: 19:53:00.32 ===============

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/421359 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

• If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  
• A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
  
  • Please do this even if you have previously posted logs for us.
    
  • If you were unable to produce the logs originally please try once more.
    
  • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    
  • If you are unsure about any of these characteristics just post what you can and we will guide you.
  
  
• Please tell us if you have your original Windows CD/DVD available.
  
• Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

• Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
  
  
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  
• Notepad will open with the results.
  
• Follow the instructions that pop up for posting the results.
  
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:



As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.

• Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.
  
  
  
• Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
  
  
  
• Please reply to this post so I know you are there.

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

----------------------------------------------

Please run aswMBR so we can double-check Gmer's findings

Please download aswMBR ( 511KB ) to your desktop.

• Double click the aswMBR.exe icon to run it
  
• Click the Scan button to start the scan
  
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Hi M0le,

I am sorry it has taken me this long to respond. I had issues with gmer and kept trying to rerun it. Each time it would get to some point and just crash my computer. I would get a Windows message that my computer had recovered from a fatal error with the typical dialog to send info to Microsoft about the problem. The last time it took several hours to run and I thought it would finally make it through and it did the same thing. I gave up. If it helps any, the first time it ran (before it crashed) it showed about 10 listings that had something to do with IE.

What should I do at this point?

Thanks you kindly for your help.

MartyL

Can you run aswMBR as shown in my post above?

The earliest I can run it is tonight. I will do that and be in touch tomorrow.

Hi m0le,

Here is the file from aswMBR.

Well, that seems clean.

Please run OTL, a scanner, next

• Download OTL to your desktop.
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Under the Standard Registry box change it to All.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Hi m0le,

Here are the outputs from OTL

>>> OTL.TXT <<<

OTL logfile created on: 10/13/2011 10:43:56 PM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\Marty\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.48 Mb Total Physical Memory | 600.12 Mb Available Physical Memory | 59.10% Memory free
1.64 Gb Paging File | 1.33 Gb Available in Paging File | 81.40% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\NEWXP | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 133.23 Gb Free Space | 57.21% Space Free | Partition Type: NTFS

Computer Name: MARTY-HOME | User Name: Marty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Marty\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Documents and Settings\Marty\Application Data\Mikogo 4\M4-Capture.exe ()
PRC - C:\Documents and Settings\Marty\Application Data\Mikogo 4\M4-Service.exe ()
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
PRC - C:\NEWXP\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe (adi)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\Marty\Application Data\Mikogo 4\M4-Capture.exe ()
MOD - C:\Documents and Settings\Marty\Application Data\Mikogo 4\M4-Service.exe ()
MOD - C:\Program Files\BillP Studios\WinPatrol\sqlite3.dll ()
MOD - C:\NEWXP\system32\DLAAPI_W.DLL ()
MOD - C:\NEWXP\system32\HPBHEALR.DLL ()


========== Win32 Services (SafeList) ==========

SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (M4-Service) -- C:\Documents and Settings\Marty\Application Data\Mikogo 4\M4-Service.exe ()
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (UMVPFSrv) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (Pml Driver HPZ12) -- C:\NEWXP\system32\HPZipm12.exe (HP)
SRV - (IDriverT) -- C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (SoundMAX Agent Service (default)) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
SRV - (Visual Studio Analyzer RPC bridge) -- C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\VARPC.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (MpKslecd577dc) -- c:\Documents and Settings\All Users.NEWXP\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8F13E7E5-3A40-414F-8361-B738E0F0808A}\MpKslecd577dc.sys (Microsoft Corporation)
DRV - (MBAMProtector) -- C:\NEWXP\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (LVUVC) Logitech Webcam C210(UVC) -- C:\NEWXP\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) -- C:\NEWXP\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) -- C:\NEWXP\system32\drivers\LVPr2Mon.sys ()
DRV - (b57w2k) -- C:\NEWXP\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (Blfp) -- C:\NEWXP\system32\drivers\baspxp32.sys (Broadcom Corporation)
DRV - (PalmUSBD) -- C:\NEWXP\system32\drivers\PalmUSBD.sys (PalmSource, Inc.)
DRV - (BUFADPT) -- C:\NEWXP\system32\BUFADPT.SYS (BUFFALO INC.)
DRV - (DLARTL_M) -- C:\NEWXP\system32\drivers\DLARTL_M.SYS (Roxio)
DRV - (DLACDBHM) -- C:\NEWXP\system32\drivers\DLACDBHM.SYS (Roxio)
DRV - (DLADResM) -- C:\NEWXP\system32\DLA\DLADResM.SYS (Roxio)
DRV - (DLAUDFAM) -- C:\NEWXP\system32\DLA\DLAUDFAM.SYS (Roxio)
DRV - (DLABMFSM) -- C:\NEWXP\system32\DLA\DLABMFSM.SYS (Roxio)
DRV - (DLAUDF_M) -- C:\NEWXP\system32\DLA\DLAUDF_M.SYS (Roxio)
DRV - (DLAOPIOM) -- C:\NEWXP\system32\DLA\DLAOPIOM.SYS (Roxio)
DRV - (DLABOIOM) -- C:\NEWXP\system32\DLA\DLABOIOM.SYS (Roxio)
DRV - (DLAPoolM) -- C:\NEWXP\system32\DLA\DLAPoolM.SYS (Roxio)
DRV - (DLAIFS_M) -- C:\NEWXP\system32\DLA\DLAIFS_M.SYS (Roxio)
DRV - (mrtRate) -- C:\NEWXP\System32\drivers\MrtRate.sys (Marimba, Inc.)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\NEWXP\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\NEWXP\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\NEWXP\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1
FF - prefs.js..extensions.enabledItems: {5384767E-00D9-40E9-B72F-9CC39D655D6F}:1.4.1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.3


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\NEWXP\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\NEWXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@palmsource.com/installer,version=1.0: C:\PROGRA~1\Palm\PACKAG~1\NPInstal.dll ()
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.23\npGoogleOneClick8.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\NEWXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2010/11/06 00:00:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2011/07/11 14:35:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/26 16:10:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/11 09:47:54 | 000,000,000 | ---D | M]

[2010/10/10 23:44:00 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marty\Application Data\Mozilla\Extensions
[2010/10/10 23:44:00 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marty\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2011/10/12 11:48:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marty\Application Data\Mozilla\Firefox\Profiles\ne06eyl6.default\extensions
[2010/11/12 23:18:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Marty\Application Data\Mozilla\Firefox\Profiles\ne06eyl6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/07/06 23:51:52 | 000,000,000 | ---D | M] (EPUBReader) -- C:\Documents and Settings\Marty\Application Data\Mozilla\Firefox\Profiles\ne06eyl6.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2011/10/12 11:48:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/10/10 23:43:35 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011/07/11 14:36:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/07/11 14:35:52 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/04/01 13:58:18 | 000,023,000 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2010/04/01 13:58:19 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2008/01/25 17:35:11 | 000,254,064 | ---- | M] () -- C:\Program Files\mozilla firefox\components\ffe.dll
[2011/07/11 14:35:50 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/04/01 13:58:20 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2006/10/26 20:12:16 | 000,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL
[2011/06/06 12:55:30 | 000,183,696 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2011/06/22 23:00:24 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2011/06/22 23:00:24 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2011/06/22 23:00:24 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2011/06/22 23:00:25 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2011/06/22 23:00:25 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2011/06/22 23:00:25 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2011/06/22 23:00:25 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2010/04/01 11:56:18 | 000,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2010/04/01 11:56:18 | 000,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2010/04/01 11:56:18 | 000,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2010/04/01 11:56:18 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2010/04/01 11:56:18 | 000,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2010/04/01 11:56:18 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2010/04/01 11:56:18 | 000,001,096 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

========== Chrome ==========

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\8.0.552.237\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\Google\Chrome\Application\8.0.552.237\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\8.0.552.237\gcswf32.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: PalmSource Package Installer (Enabled) = C:\PROGRA~1\Palm\PACKAG~1\NPInstal.dll
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\NEWXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2006/02/28 08:00:00 | 000,000,734 | ---- | M]) - C:\NEWXP\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\NEWXP\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\NEWXP\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\NEWXP\system32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (MovieBario Toolbar) - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - C:\Program Files\MovieBario\tbMovi.dll File not found
O4 - HKLM..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe (adi)
O4 - HKLM..\Run: [igfxhkcmd] C:\NEWXP\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxpers] C:\NEWXP\system32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxtray] C:\NEWXP\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - Startup: C:\Documents and Settings\Marty\Start Menu\Programs\Startup\Watchtower Library 2010 - English.lnk = C:\Program Files\Watchtower\Watchtower Library 2010\E\WTLibrary.exe (Watch Tower Bible and Tract Society of Pennsylvania.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\NEWXP\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\NEWXP\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\NEWXP\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\NEWXP\system32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} http://www.superadblocker.com/activex/sabspx.cab (SABScanProcesses Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file:///C:/NEWXP/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.242.0.12
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{17C601B0-EE0A-4B16-8C53-232A9E6A1CCB}: DhcpNameServer = 192.168.1.1 71.242.0.12
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\NEWXP\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\NEWXP\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\NEWXP\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\NEWXP\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\NEWXP\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\NEWXP\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\NEWXP\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\NEWXP\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\NEWXP\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\NEWXP\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\NEWXP\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\NEWXP\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\NEWXP\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\NEWXP\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\NEWXP\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\NEWXP\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\NEWXP\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\NEWXP\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\NEWXP\system32\userinit.exe) -C:\NEWXP\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) -C:\NEWXP\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) -C:\NEWXP\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") -C:\NEWXP\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - C:\NEWXP\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - C:\NEWXP\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - C:\NEWXP\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - (%SystemRoot%\System32\dimsntfy.dll) - C:\NEWXP\system32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\NEWXP\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - C:\NEWXP\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - C:\NEWXP\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - C:\NEWXP\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - C:\NEWXP\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) - C:\NEWXP\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\NEWXP\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - C:\NEWXP\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\NEWXP\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\NEWXP\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\NEWXP\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\NEWXP\system32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\NEWXP\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\NEWXP\system32\browseui.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\NEWXP\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) -C:\NEWXP\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) -C:\NEWXP\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) -C:\NEWXP\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) -C:\NEWXP\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) -C:\NEWXP\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) -C:\NEWXP\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) -C:\NEWXP\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) -C:\NEWXP\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) -C:\NEWXP\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/03/04 23:10:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{4d08c630-36eb-11e0-a3c4-00110a323ff1}\Shell - "" = AutoRun
O33 - MountPoints2\{4d08c630-36eb-11e0-a3c4-00110a323ff1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4d08c630-36eb-11e0-a3c4-00110a323ff1}\Shell\AutoRun\command - "" = E:\TL_Bootstrap.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/10/13 22:41:35 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marty\Desktop\OTL.exe
[2011/10/12 11:19:27 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Marty\Desktop\aswMBR.exe
[2011/10/11 13:52:43 | 000,000,000 | ---D | C] -- C:\Program Files\Avery
[2011/10/07 21:18:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.NEWXP\Application Data\PDF Writer
[2011/10/07 21:18:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marty\Local Settings\Application Data\PDF Writer
[2011/10/07 21:18:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marty\Application Data\PDF Writer
[2011/10/07 21:06:13 | 000,000,000 | ---D | C] -- C:\NEWXP\System32\Adobe
[2011/10/07 14:29:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.NEWXP\Start Menu\Programs\Bullzip
[2011/10/07 14:29:50 | 000,227,840 | ---- | C] (Bullzip) -- C:\NEWXP\System32\bzFlRdr.dll
[2011/10/07 14:29:50 | 000,135,168 | ---- | C] (Bullzip) -- C:\NEWXP\System32\bzpdfc.dll
[2011/10/07 14:29:50 | 000,103,424 | ---- | C] (Bullzip) -- C:\NEWXP\System32\bzDCT.dll
[2011/10/07 14:29:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Bullzip
[2011/10/07 14:29:46 | 000,196,608 | ---- | C] (Bullzip) -- C:\NEWXP\System32\bzpdf.dll
[2011/10/07 14:29:41 | 000,000,000 | ---D | C] -- C:\Program Files\Bullzip
[2011/10/03 20:22:33 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Marty\Recent
[2011/10/01 02:46:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marty\Desktop\Serious Error Files
[2011/09/30 20:01:43 | 000,000,000 | ---D | C] -- C:\NEWXP\Minidump
[2011/09/30 19:39:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marty\Desktop\gmer
[2011/09/30 19:32:37 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Marty\Start Menu\Programs\Administrative Tools
[2011/09/27 23:50:18 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marty\Desktop\TFC.exe
[2011/09/27 18:40:52 | 000,000,000 | -H-D | C] -- C:\NEWXP\PIF
[2011/09/27 18:26:38 | 001,548,080 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Marty\Desktop\RTKK.com
[2011/09/26 20:19:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marty\Start Menu\Programs\Irfan View
[2011/09/26 16:53:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marty\Application Data\Avery
[2011/09/26 16:51:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.NEWXP\Start Menu\Programs\Avery Dennison
[2011/09/26 16:50:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.NEWXP\Application Data\Avery
[2011/09/26 16:12:50 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft
[2011/09/26 16:12:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.NEWXP\Start Menu\Programs\Microsoft Silverlight
[2011/09/26 16:11:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2011/09/26 16:10:20 | 000,000,000 | ---D | C] -- C:\Program Files\HP Photo Creations
[2011/09/26 16:10:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.NEWXP\Application Data\HP Photo Creations
[2011/09/26 16:09:48 | 000,232,296 | ---- | C] (Hewlett-Packard Co.) -- C:\NEWXP\System32\hpinksts8811.dll
[2011/09/26 16:09:47 | 000,267,112 | ---- | C] (Hewlett-Packard Co.) -- C:\NEWXP\System32\hpinksts8811LM.dll
[2011/09/26 16:09:47 | 000,213,864 | ---- | C] (Hewlett-Packard Co.) -- C:\NEWXP\System32\hpinkcoi8811.dll
[2011/09/26 16:07:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marty\Local Settings\Application Data\HP
[2011/09/26 13:35:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marty\Local Settings\Application Data\Paint.NET

========== Files - Modified Within 30 Days ==========

[2011/10/13 22:41:45 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marty\Desktop\OTL.exe
[2011/10/13 21:21:15 | 000,048,919 | ---- | M] () -- C:\Documents and Settings\Marty\My Documents\MDL_P.wsp
[2011/10/13 20:03:18 | 000,002,261 | ---- | M] () -- C:\Documents and Settings\All Users.NEWXP\Desktop\Skype.lnk
[2011/10/13 19:52:02 | 000,012,644 | ---- | M] () -- C:\NEWXP\System32\wpa.dbl
[2011/10/13 19:51:21 | 000,002,048 | --S- | M] () -- C:\NEWXP\bootstat.dat
[2011/10/13 19:51:19 | 000,518,544 | ---- | M] () -- C:\NEWXP\System32\FNTCACHE.DAT
[2011/10/13 18:25:34 | 000,475,764 | ---- | M] () -- C:\NEWXP\System32\perfh009.dat
[2011/10/13 18:25:34 | 000,076,798 | ---- | M] () -- C:\NEWXP\System32\perfc009.dat
[2011/10/13 18:19:05 | 000,001,393 | ---- | M] () -- C:\NEWXP\imsins.BAK
[2011/10/13 08:48:46 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\MBR.dat
[2011/10/12 11:19:39 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Marty\Desktop\aswMBR.exe
[2011/10/12 11:06:17 | 000,000,187 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\Inbox.url
[2011/10/11 15:52:06 | 001,360,896 | ---- | M] () -- C:\Documents and Settings\Marty\My Documents\Martins Cleaning-Front Final.zdl
[2011/10/09 13:18:38 | 000,122,091 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\Equifax_FACT_Rpt_10092011.pdf
[2011/10/04 23:57:43 | 000,000,241 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\Sell It Yourself on cars.com Manage Your Ads.url
[2011/10/03 20:21:01 | 000,000,697 | ---- | M] () -- C:\Documents and Settings\All Users.NEWXP\Desktop\CCleaner.lnk
[2011/10/03 16:42:25 | 000,000,116 | ---- | M] () -- C:\NEWXP\NeroDigital.ini
[2011/10/03 16:42:19 | 000,005,632 | ---- | M] () -- C:\Documents and Settings\Marty\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/03 04:35:11 | 005,971,456 | ---- | M] (Microsoft Corporation) -- C:\NEWXP\System32\dllcache\mshtml.dll
[2011/09/30 19:39:04 | 000,294,216 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\gmer.zip
[2011/09/30 19:28:03 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Marty\defogger_reenable
[2011/09/30 19:23:55 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\Defogger.exe
[2011/09/27 23:50:38 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marty\Desktop\TFC.exe
[2011/09/27 18:27:10 | 001,548,080 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Marty\Desktop\RTKK.com
[2011/09/27 00:08:59 | 000,334,848 | ---- | M] () -- C:\Documents and Settings\Marty\My Documents\Martins Cleaning-Front.zdl
[2011/09/26 20:18:03 | 000,017,438 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\Small Bucket Trim.TIF
[2011/09/26 20:13:19 | 000,017,442 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\Small Bucket Trim.JPG
[2011/09/26 19:53:14 | 000,023,968 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\30156569.jpg
[2011/09/26 19:36:24 | 000,032,400 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\Small Bucket.jpg
[2011/09/26 16:10:22 | 000,000,787 | ---- | M] () -- C:\Documents and Settings\All Users.NEWXP\Desktop\HP Photo Creations.lnk
[2011/09/26 16:09:52 | 000,001,992 | ---- | M] () -- C:\Documents and Settings\All Users.NEWXP\Desktop\HP Deskjet 1000 J110 series.lnk
[2011/09/26 13:36:40 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\Shortcut to PaintDotNet.exe.lnk
[2011/09/26 11:41:20 | 000,611,328 | ---- | M] (Microsoft Corporation) -- C:\NEWXP\System32\uiautomationcore.dll
[2011/09/26 11:41:20 | 000,220,160 | ---- | M] (Microsoft Corporation) -- C:\NEWXP\System32\dllcache\oleacc.dll
[2011/09/26 11:41:14 | 000,020,480 | ---- | M] (Microsoft Corporation) -- C:\NEWXP\System32\oleaccrc.dll
[2011/09/26 11:41:14 | 000,020,480 | ---- | M] (Microsoft Corporation) -- C:\NEWXP\System32\dllcache\oleaccrc.dll
[2011/09/25 12:51:01 | 000,105,847 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\WT-Sept_25_SCRIPTURES.pdf
[2011/09/23 17:51:03 | 000,000,806 | ---- | M] () -- C:\Documents and Settings\All Users.NEWXP\Desktop\Foxit Reader 5.0.lnk
[2011/09/15 23:51:31 | 000,000,175 | ---- | M] () -- C:\NEWXP\EQ3D.ini
[2011/09/14 21:04:12 | 000,000,626 | ---- | M] () -- C:\Documents and Settings\Marty\Desktop\Honda Odyssey (2005).lnk
[2011/09/14 11:29:23 | 000,000,019 | ---- | M] () -- C:\Documents and Settings\Marty\My Documents\PDVD_MediaDisc.PlayList

========== Files Created - No Company Name ==========

[2011/10/13 18:17:20 | 000,001,393 | ---- | C] () -- C:\NEWXP\imsins.BAK
[2011/10/13 08:47:30 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\MBR.dat
[2011/10/11 15:41:52 | 001,360,896 | ---- | C] () -- C:\Documents and Settings\Marty\My Documents\Martins Cleaning-Front Final.zdl
[2011/10/09 13:18:35 | 000,122,091 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\Equifax_FACT_Rpt_10092011.pdf
[2011/10/03 20:21:01 | 000,000,697 | ---- | C] () -- C:\Documents and Settings\All Users.NEWXP\Desktop\CCleaner.lnk
[2011/09/30 19:38:58 | 000,294,216 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\gmer.zip
[2011/09/30 19:28:03 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Marty\defogger_reenable
[2011/09/30 19:23:51 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\Defogger.exe
[2011/09/26 23:22:11 | 000,334,848 | ---- | C] () -- C:\Documents and Settings\Marty\My Documents\Martins Cleaning-Front.zdl
[2011/09/26 20:13:53 | 000,017,438 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\Small Bucket Trim.TIF
[2011/09/26 20:13:19 | 000,017,442 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\Small Bucket Trim.JPG
[2011/09/26 19:53:54 | 000,032,400 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\Small Bucket.jpg
[2011/09/26 19:42:48 | 000,023,968 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\30156569.jpg
[2011/09/26 16:10:22 | 000,000,787 | ---- | C] () -- C:\Documents and Settings\All Users.NEWXP\Desktop\HP Photo Creations.lnk
[2011/09/26 16:09:52 | 000,001,992 | ---- | C] () -- C:\Documents and Settings\All Users.NEWXP\Desktop\HP Deskjet 1000 J110 series.lnk
[2011/09/26 13:36:40 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\Shortcut to PaintDotNet.exe.lnk
[2011/09/25 12:50:57 | 000,105,847 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\WT-Sept_25_SCRIPTURES.pdf
[2011/09/14 21:04:12 | 000,000,626 | ---- | C] () -- C:\Documents and Settings\Marty\Desktop\Honda Odyssey (2005).lnk
[2011/07/30 00:14:06 | 000,000,044 | ---- | C] () -- C:\NEWXP\SMWizard.INI
[2011/07/27 15:14:17 | 000,000,024 | ---- | C] () -- C:\NEWXP\qfnonl.ini
[2011/07/27 14:37:20 | 000,000,730 | ---- | C] () -- C:\NEWXP\QUICKEN.INI
[2011/07/27 14:37:19 | 000,000,185 | ---- | C] () -- C:\NEWXP\intuprof.ini
[2011/07/27 14:37:18 | 000,006,838 | ---- | C] () -- C:\NEWXP\ICOADB32.DAT
[2011/04/10 17:35:41 | 000,056,056 | ---- | C] () -- C:\NEWXP\System32\DLAAPI_W.DLL
[2011/04/10 17:35:41 | 000,000,120 | ---- | C] () -- C:\NEWXP\wininit.ini
[2011/03/22 23:58:22 | 000,014,168 | ---- | C] () -- C:\NEWXP\System32\drivers\iKeyLFT2.dll
[2011/02/12 17:03:47 | 000,002,427 | ---- | C] () -- C:\NEWXP\System32\lgAxconfig.ini
[2011/02/05 19:30:07 | 000,005,632 | ---- | C] () -- C:\Documents and Settings\Marty\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/26 21:28:12 | 000,077,824 | R--- | C] () -- C:\NEWXP\System32\HPZIDS01.dll
[2011/01/26 21:23:26 | 000,117,431 | ---- | C] () -- C:\NEWXP\hpoins11.dat
[2011/01/20 19:46:00 | 000,000,116 | ---- | C] () -- C:\NEWXP\NeroDigital.ini
[2010/12/29 22:10:39 | 000,000,175 | ---- | C] () -- C:\NEWXP\EQ3D.ini
[2010/11/09 22:45:32 | 000,102,744 | ---- | C] () -- C:\NEWXP\System32\LogiDPPApp.exe
[2010/11/09 22:45:30 | 010,877,272 | ---- | C] () -- C:\NEWXP\System32\LogiDPP.dll
[2010/11/09 22:45:20 | 000,331,608 | ---- | C] () -- C:\NEWXP\System32\DevManagerCore.dll
[2010/11/09 22:31:42 | 000,027,872 | ---- | C] () -- C:\NEWXP\System32\lvcoinst.ini
[2010/10/20 21:15:38 | 000,000,500 | ---- | C] () -- C:\NEWXP\ODBC.INI
[2010/10/20 21:04:34 | 000,006,550 | ---- | C] () -- C:\NEWXP\jautoexp.dat
[2010/10/11 21:31:18 | 000,921,600 | ---- | C] () -- C:\NEWXP\System32\vorbisenc.dll
[2010/10/11 21:31:18 | 000,188,416 | ---- | C] () -- C:\NEWXP\System32\vorbis.dll
[2010/10/11 21:31:16 | 000,237,568 | ---- | C] () -- C:\NEWXP\System32\OggDS.dll
[2010/10/11 21:31:15 | 000,045,056 | ---- | C] () -- C:\NEWXP\System32\Ogg.dll
[2010/10/11 20:32:50 | 000,017,867 | ---- | C] () -- C:\NEWXP\hplj1010.ini
[2010/10/10 23:43:48 | 000,000,000 | ---- | C] () -- C:\NEWXP\nsreg.dat
[2010/10/10 18:16:11 | 000,118,819 | ---- | C] () -- C:\NEWXP\Keyfinder Advanced 2007 (Full Version) Uninstaller.exe
[2010/10/10 01:44:50 | 000,000,044 | ---- | C] () -- C:\NEWXP\System32\msssc.dll
[2010/10/09 23:34:17 | 000,002,048 | --S- | C] () -- C:\NEWXP\bootstat.dat
[2010/10/09 23:26:34 | 000,021,640 | ---- | C] () -- C:\NEWXP\System32\emptyregdb.dat
[2010/10/09 19:14:27 | 000,004,254 | ---- | C] () -- C:\NEWXP\ODBCINST.INI
[2010/10/09 19:13:05 | 000,518,544 | ---- | C] () -- C:\NEWXP\System32\FNTCACHE.DAT
[2010/08/15 23:32:06 | 000,348,632 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/05/07 18:43:30 | 000,025,824 | ---- | C] () -- C:\NEWXP\System32\drivers\LVPr2Mon.sys
[2010/02/04 20:26:18 | 000,018,038 | ---- | C] () -- C:\NEWXP\UN900121.INI
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\NEWXP\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\NEWXP\System32\OGAEXEC.exe
[2007/04/19 22:42:44 | 000,011,634 | ---- | C] () -- C:\NEWXP\hpomdl11.dat
[2007/04/11 12:12:44 | 000,000,000 | ---- | C] () -- C:\NEWXP\System32\px.ini
[2006/09/24 23:02:34 | 000,520,192 | ---- | C] () -- C:\NEWXP\System32\CddbPlaylist2Roxio.dll
[2006/09/24 23:02:34 | 000,204,800 | ---- | C] () -- C:\NEWXP\System32\CddbFileTaggerRoxio.dll
[2006/02/28 08:00:00 | 013,107,200 | ---- | C] () -- C:\NEWXP\System32\oembios.bin
[2006/02/28 08:00:00 | 000,673,088 | ---- | C] () -- C:\NEWXP\System32\mlang.dat
[2006/02/28 08:00:00 | 000,475,764 | ---- | C] () -- C:\NEWXP\System32\perfh009.dat
[2006/02/28 08:00:00 | 000,272,128 | ---- | C] () -- C:\NEWXP\System32\perfi009.dat
[2006/02/28 08:00:00 | 000,218,003 | ---- | C] () -- C:\NEWXP\System32\dssec.dat
[2006/02/28 08:00:00 | 000,076,798 | ---- | C] () -- C:\NEWXP\System32\perfc009.dat
[2006/02/28 08:00:00 | 000,046,258 | ---- | C] () -- C:\NEWXP\System32\mib.bin
[2006/02/28 08:00:00 | 000,028,626 | ---- | C] () -- C:\NEWXP\System32\perfd009.dat
[2006/02/28 08:00:00 | 000,004,569 | ---- | C] () -- C:\NEWXP\System32\secupd.dat
[2006/02/28 08:00:00 | 000,004,461 | ---- | C] () -- C:\NEWXP\System32\oembios.dat
[2006/02/28 08:00:00 | 000,001,804 | ---- | C] () -- C:\NEWXP\System32\dcache.bin
[2006/02/28 08:00:00 | 000,000,741 | ---- | C] () -- C:\NEWXP\System32\noise.dat
[2003/08/29 05:23:49 | 000,094,274 | ---- | C] () -- C:\NEWXP\System32\HPBHEALR.DLL
[2001/07/07 04:00:00 | 000,003,399 | ---- | C] () -- C:\NEWXP\System32\hptcpmon.ini
[1999/06/01 00:00:00 | 000,030,720 | ---- | C] () -- C:\NEWXP\REGTLIB.EXE
[1998/12/06 16:56:04 | 000,024,576 | ---- | C] () -- C:\NEWXP\System32\verinst.exe
[1998/06/10 00:00:00 | 000,015,120 | ---- | C] () -- C:\NEWXP\System32\REPUTIL.DLL
[1998/05/18 00:00:00 | 000,014,017 | ---- | C] () -- C:\NEWXP\JAUTOEXP.INI

========== LOP Check ==========

[2011/09/26 16:50:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.NEWXP\Application Data\Avery
[2010/11/04 19:29:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.NEWXP\Application Data\HotSync
[2010/10/14 22:20:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.NEWXP\Application Data\InstallMate
[2011/02/14 20:47:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.NEWXP\Application Data\LGMOBILEAX
[2011/03/13 14:30:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.NEWXP\Application Data\NCH Swift Sound
[2011/07/31 13:15:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.NEWXP\Application Data\Nitro PDF
[2011/10/07 21:18:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.NEWXP\Application Data\PDF Writer
[2011/07/26 12:16:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.NEWXP\Application Data\RoboForm
[2011/10/11 13:55:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Avery
[2011/08/26 11:00:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\BACS.exe
[2011/07/31 13:12:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Downloaded Installations
[2011/09/27 09:37:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Dropbox
[2011/07/30 00:47:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Efficient Password Manager
[2011/02/19 14:53:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\ElevatedDiagnostics
[2011/10/13 22:17:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Foxit Software
[2010/11/04 19:29:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\HotSync
[2011/08/24 23:13:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\KeePass
[2011/08/03 13:35:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Leadertech
[2011/08/10 23:31:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Mikogo 4
[2010/10/10 23:39:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\MSNInstaller
[2011/01/15 23:48:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\NCH Swift Sound
[2011/08/25 17:42:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\NesterSoft
[2011/07/31 13:17:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Nitro PDF
[2011/10/07 21:18:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\PDF Writer
[2011/07/25 21:22:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\TeamViewer
[2011/02/24 15:56:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Uniblue
[2011/01/15 22:13:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\Watchtower
[2010/10/14 22:20:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marty\Application Data\WinPatrol

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\What_it_means_to_be_poor.pps:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\What Kids Learn In Religion.DOC:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\VITAMIN C - Titrating to Bowel Tolerance.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\The_Tiny_Frog_Race.pps:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\templeanimation.wmv:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\shoveling.wmv:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\MontBlancMassif-FrenchAlps.pps:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (8).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (7).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (6).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (5).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (4).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (29).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (28).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (26).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (25).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (24).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (23).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (22).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (21).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (20).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (19).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (18).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (17).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (16).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (15).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (14).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (12).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (11).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (10).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\IMAGE (1).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\Coconut Crab 2.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\Coconut Crab 1.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\Cactus.pps:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\buckets.wmv:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\Bricks.wmv:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Marty\My Documents\Bach_duo_1.wmv:Roxio EMC Stream

< End of report >

>>> EXTRAS.TXT <<<

OTL Extras logfile created on: 10/13/2011 10:43:56 PM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\Marty\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.48 Mb Total Physical Memory | 600.12 Mb Available Physical Memory | 59.10% Memory free
1.64 Gb Paging File | 1.33 Gb Available in Paging File | 81.40% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\NEWXP | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 133.23 Gb Free Space | 57.21% Space Free | Partition Type: NTFS

Computer Name: MARTY-HOME | User Name: Marty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe" = C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe:*:Disabled:javaw -- ()
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\VARPC.EXE" = C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\VARPC.EXE:*:Enabled:Microsoft ® Visual Studio VSA RPC Event Creator -- (Microsoft Corporation)
"C:\Documents and Settings\Marty\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\Marty\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox -- (Dropbox, Inc.)
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Disabled:hpfccopy.exe -- (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Disabled:hpoews01.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Disabled:hpofxm08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Disabled:hposfx08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Disabled:hposid01.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Disabled:hpqcopy.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Disabled:hpqdia.exe -- ( )
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Disabled:hpqkygrp.exe -- (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Disabled:hpqnrs08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Disabled:hpqphunl.exe -- (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Disabled:hpqscnvw.exe -- ()
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Disabled:hpqste08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Disabled:hpqtra08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Disabled:hpzwiz01.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\NEWXP\system32\muzapp.exe" = C:\NEWXP\system32\muzapp.exe:*:Disabled:MUZ AOD APP player -- (Musiccity Co.Ltd.)
"C:\NEWXP\Network Diagnostic\xpnetdiag.exe" = C:\NEWXP\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\TeamViewer\Version6\TeamViewer.exe" = C:\Program Files\TeamViewer\Version6\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe" = C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
"C:\Program Files\BUFFALO\AirStation\ecset\ecset.exe" = C:\Program Files\BUFFALO\AirStation\ecset\ecset.exe:*:Enabled:Ethernet Converter Manager -- (BUFFALO INC.)
"C:\NEWXP\system32\dpvsetup.exe" = C:\NEWXP\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\NEWXP\system32\rundll32.exe" = C:\NEWXP\system32\rundll32.exe:*:Enabled:Run a DLL as an App -- (Microsoft Corporation)
"C:\Program Files\Logitech\Vid HD\Vid.exe" = C:\Program Files\Logitech\Vid HD\Vid.exe:*:Enabled:Logitech Vid HD -- (Logitech Inc.)
"C:\Documents and Settings\Marty\temp\TeamViewer\Version5\TeamViewer.exe" = C:\Documents and Settings\Marty\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer -- (TeamViewer GmbH)
"C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\USBSetup.exe" = C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\USBSetup.exe:LocalSubNet:Enabled:HP Device Setup -- (Hewlett-Packard Co.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{007811BF-E310-4285-BFC6-55DB29B3EDDE}" = WinPatrol
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}" = WD Diagnostics
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java™ 6 Update 26
"{292C47B2-8DB7-47BF-896C-C3C5EE8108C4}" = hp LaserJet 1010 Series
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{32821558-2C36-4FD0-A891-CA65360B0EC7}" = DesignPro 5
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{363790D2-DA98-41DD-9C9F-69FA36B169DE}" = PanoStandAlone
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4ABB4D92-0682-4887-A0BC-CE5F920DDD23}" = Watchtower Library 2009 - English
"{4EA684E9-5C81-4033-A696-3019EC57AC3A}" = HPProductAssistant
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{57729BE1-DE2C-45DB-9FFA-5C1949679B3E}" = Watchtower Library 2010 - English
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7196E6BD-4B65-43F9-9D30-73A8E58D0E84}" = Avery Wizard 4.0
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme
"{736CE9DD-F589-485B-ACFF-78C235A57066}" = WinPatrol 2007 Step 2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7BB045C3-D5E4-4620-B536-DC11AACD5942}" = Broadcom Management Programs
"{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}" = ProductContextNPI
"{83073C45-3003-4671-9A86-243AAADD915A}" = Microsoft Calculator Plus
"{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{938B1CD7-7C60-491E-AA90-1F1888168240}" = Roxio MyDVD Basic v9
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95C42225-F0E2-4480-AD65-560D854F252E}" = Palm Desktop by ACCESS
"{996512CF-F35B-48DE-9291-557FA5316967}" = ScannerCopy
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{9FC8D8F8-AF3A-4488-98AF-51C6DEC732F2}" = c3100_Help
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}" = HP Photosmart, Officejet and Deskjet 7.0.A
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C20CE592-B0F8-4D20-BF31-0151CA6331A6}" = Samsung Media Studio
"{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}" = SolutionCenter
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp
"{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}" = HP Deskjet 1000 J110 series Help
"{EB8C9964-09AC-48bf-8B98-027609C78251}" = C3100
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F157460F-720E-482f-8625-AD7843891E5F}" = InstantShareDevicesMFC
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{F4B1B985-F308-4DBA-BFD7-CCCB8839234B}" = HP Deskjet 1000 J110 series Basic Device Software
"{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA
"{F870B987-18BC-45FC-9BE8-35C02DCDA10F}" = Broadcom NetXtreme Ethernet Controller
"{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations
"{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Brain Workshop_is1" = Brain Workshop 4.8.1
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 7.2.0.1319
"CCleaner" = CCleaner
"ESET Online Scanner" = ESET Online Scanner v3
"ExpressBurn" = Express Burn Disc Burning Software
"Foxit Reader_is1" = Foxit Reader 5.0
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"HP Photo Creations" = HP Photo Creations
"HP Solution Center & Imaging Support Tools" = HP Solution Center 7.0
"HPOCR" = OCR Software by I.R.I.S 7.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{32821558-2C36-4FD0-A891-CA65360B0EC7}" = DesignPro 5
"Keyfinder Advanced 2007 (Full Version)" = Keyfinder Advanced 2007 (Full Version)
"Logitech Vid" = Logitech Vid HD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"MovieBario Toolbar" = MovieBario Toolbar
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"ProcessQuickLink 2_is1" = Uniblue ProcessQuickLink 2
"PROHYBRIDR" = 2007 Microsoft Office system
"Quicken Basic 2000" = Quicken Basic 2000
"Speccy" = Speccy
"TeamViewer 6" = TeamViewer 6
"TIMELEFT3_is1" = TimeLeft
"UN900121" = BUFFALO Ethernet Converter Manager
"Visual Studio 6.0 Enterprise Edition" = Microsoft Visual Studio 6.0 Enterprise Edition
"WavePad" = WavePad Sound Editor
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WebPost" = Microsoft Web Publishing Wizard 1.53
"Whisper 32" = Whisper 32
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinPatrol 2007" = WinPatrol 2007 Restore/Remove First

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Mikogo 4" = Mikogo 4
"Scripture Flash Cards" = Scripture Flash Cards

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/11/2011 7:42:09 AM | Computer Name = MARTY-HOME | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8107.0,
P5 mpsigdwn.dll, P6 3.0.8107.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P8 NIL, P9 NIL, P10 NIL.

Error - 3/12/2011 6:59:55 PM | Computer Name = MARTY-HOME | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 0, P2 moaccapability, P3 3.0.8107.0, P4
0, P5 0, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

Error - 3/12/2011 9:07:09 PM | Computer Name = MARTY-HOME | Source = Application Hang | ID = 1002
Description = Hanging application mbam.exe, version 1.50.1.3, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 3/12/2011 9:07:20 PM | Computer Name = MARTY-HOME | Source = Application Hang | ID = 1001
Description = Fault bucket -2060348231.

Error - 3/13/2011 2:28:38 PM | Computer Name = MARTY-HOME | Source = Application Error | ID = 1000
Description = Faulting application wmplayer.exe, version 10.0.0.3802, faulting module
ntdll.dll, version 5.1.2600.6055, fault address 0x00036822.

Error - 3/21/2011 9:00:42 PM | Computer Name = MARTY-HOME | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/26/2011 12:06:14 AM | Computer Name = MARTY-HOME | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8107.0,
P5 mpsigdwn.dll, P6 3.0.8107.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P8 NIL, P9 NIL, P10 NIL.

Error - 3/27/2011 2:44:58 AM | Computer Name = MARTY-HOME | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/27/2011 2:44:58 AM | Computer Name = MARTY-HOME | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/1/2011 6:50:01 AM | Computer Name = MARTY-HOME | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8107.0,
P5 mpsigdwn.dll, P6 3.0.8107.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P8 NIL, P9 NIL, P10 NIL.

[ System Events ]
Error - 10/11/2011 9:55:08 AM | Computer Name = MARTY-HOME | Source = Service Control Manager | ID = 7034
Description = The M4-Service service terminated unexpectedly. It has done this
1 time(s).

Error - 10/12/2011 12:44:58 AM | Computer Name = MARTY-HOME | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 10/12/2011 10:55:41 AM | Computer Name = MARTY-HOME | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 10/12/2011 11:07:09 AM | Computer Name = MARTY-HOME | Source = Microsoft Antimalware | ID = 2001
Description = %%860 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.113.1445.0 Update Source: %%859 Update Stage:
%%854 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7702.0 Error
code: 0x80070643 Error description: Fatal error during installation.

Error - 10/12/2011 11:07:23 AM | Computer Name = MARTY-HOME | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Definition Update for Microsoft Security Essentials - KB2310138
(Definition 1.113.1508.0).

Error - 10/12/2011 5:47:03 PM | Computer Name = MARTY-HOME | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 10/12/2011 10:50:11 PM | Computer Name = MARTY-HOME | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 10/13/2011 9:25:09 AM | Computer Name = MARTY-HOME | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 10/13/2011 5:02:53 PM | Computer Name = MARTY-HOME | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 10/13/2011 7:53:21 PM | Computer Name = MARTY-HOME | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt


< End of report >

I'm struggling to find any evidence of any malware and I even have the preknowledge that there has been some infection in the machine.

As boopme says in the other thread there is something about IE8 which means that more windows open than explorer.exe processes run.

IE8 runs each tab as a separate service, so if a tab crashes it does not crash the browser. There is also one extra for Ieframe.
The Ieframe is a dynamic link library allowing multiple programs access to IE.

The number of iexplore.exes in task manager should be the number of tabs open plus one which is what Process Explorer shows. The memory being used is not overly high so I would not be suspecting malware in that case.

Is this your problem in a nutshell?

The problem originally was that my PC seems to access IE pages slowly, sometimes painfully so. The time I opened this report I had a Google page open with multiple images of mops. At one point my PC slowed down so much that it took literally almost 10 seconds for me to get scrolling to even move. This went on until I shut down IE. I believe I had two pages open. When I reopened IE and went to look at the images again IE bogged down. I went to Task Manager to see what was going on and found the multiple instances and the 100 some meg memory usage of one page and like 70 meg of the second page. Interestingly, when I open multiple pages in Firefox I only get one instance of it in Task Manager and it doesn't use nearly as much memory as IE. That is what prompted my initial request for help.

I now have another problem that I would very much appreciate your help with. I am presuming that the three different thumb drives that I have are all probably infected with the original malware that Boopme found so using them will reinfect my system. Since ESET Online Scanner found the problems should I be replacing MS Security Essentials with ESET? What do you recommend to best prevent viruses/malware?

Thanks kindly,

MartyL

Quote

This is a difficult question because the ESET online scanner and MSE are different things. The MSE suite is a recommended security suite but their targets are different to the ESET program. ESET looks in a lot of places for the minor infections such as cached copies in java, the system restore folder and infected files. MSE is not used for this but for some rootkits, trojans and worms - some adware and spyware too.

I would suggest you keep MSE and use ESET online occasionally along with MalwareBytes. Two standalone options which can work alongside the suite.


Can you emulate the problem you are talking about with IE

Please download Process Explorer

Please open Process Explorer.

Select each of the iexplore.exe processes.

Right click them and select Properties, then the Services tab.

Under Services Registered in Process, you will find the Service and Display name.

Please take note of what these are and include it in your next reply.

Hi m0le,

I am sorry again that it took me so long to get back to you. I didn't get the email notification that you had replied to my last post.

I downloaded and ran ProcessExplorer. When I right click on the IE proceses and select properties there is no Services tab in the properties dialog.

Marty

Please download and run Process Explorer

If Process explorer won't execute rename it Iexplore.exe

Under File and Save As, create a log and post here

Copy and paste the log into your next reply