Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Laptop has gotten slower and slower and slower


  • This topic is locked This topic is locked
17 replies to this topic

#1 rmcc4444

rmcc4444

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:10:59 PM

Posted 02 August 2009 - 12:56 AM

Hello,

Hopefully I followed the instructions as described.

My laptop has gotten slower and slower and slower. I've tried multiple "cleaning" applications but nothing seems to work. One symptom I can re-produce every time is when watching a YouTube video, it it extremely choppy. It's almost as if my PC can't keep up with the video. The audio stays constant but the video skips large amounts of frames. Also, when clicking between tabs in Firefox, it's almost as if I have something intensive running in the background. I click on the tab, then a second later it will actually click on the tab. Everything is delayed.

Hopefully this is detailed enough. I would be happy to answer any questions.

Thanks...

EDIT: I uninstalled Flash using the Adobe Flash Uninstaller before running these logs.


DDS (Ver_09-07-30.01) - FAT32x86
Run by Ryan at 0:47:27.18 on Sun 08/02/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2302.1697 [GMT -5:00]

AV: avast! antivirus 4.8.1335 [VPS 090801-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\system32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
SVCHOST.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\NCH Swift Sound\VRS\vrs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\NSLU2 Flash Map Utility\StorageLink.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\NCH Swift Sound\VRS\vrs.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Ryan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank
uInternet Settings,ProxyServer = proxy-iberv:8080
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe
uRun: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\RegistryBooster.exe /S
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SkyTel] SkyTel.EXE
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [NSLU2 Flash Map Utility] c:\program files\nslu2 flash map utility\StorageLink.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [VRS] "c:\program files\nch swift sound\vrs\vrs.exe" -logon
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {43E4476A-6C11-4274-AFA4-DF665B26EAE0} - hxxps://dss-sr95la01-drac/plugins/vkvm/ActiveXVideoViewer.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1234023679968
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent -
Notify: LMIinit - LMIinit.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ryan\applic~1\mozilla\firefox\profiles\p9gzlw58.default\
FF - prefs.js: browser.startup.homepage - hxxp://tdbl.baseball.cbssports.com/scoring/live
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2009-5-3 38448]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-2-7 114768]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2009-3-1 8576]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-2-7 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-2-7 138680]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-2-8 47640]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 VRSService;VRS Recording System;c:\program files\nch swift sound\vrs\vrs.exe [2009-8-1 851972]
R3 iTurns;iTurns;c:\windows\system32\drivers\iTurnsDriver.sys [2008-11-28 10704]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\elock2burnerlockdriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\elock2fsctldriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-2-7 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-2-7 352920]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

=============== Created Last 30 ================

2009-08-01 23:42 25,992 a------- c:\windows\system32\pgdfgsvc.exe
2009-08-01 23:35 <DIR> --d----- c:\program files\NCH Swift Sound
2009-08-01 23:34 <DIR> --d----- c:\program files\Trend Micro
2009-08-01 23:16 <DIR> --d-h--- c:\docume~1\alluse~1\applic~1\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}
2009-07-26 03:45 <DIR> --d----- c:\program files\NCH Software
2009-07-26 03:45 <DIR> --d----- c:\docume~1\ryan\applic~1\NCH Software
2009-07-23 14:23 <DIR> --d----- c:\windows\SxsCaPendDel
2009-07-23 13:57 <DIR> --d----- c:\documents and settings\ryan\ErrorLogs
2009-07-23 13:53 <DIR> --d----- c:\docume~1\ryan\applic~1\TuneUp Software
2009-07-23 13:53 <DIR> --d----- c:\docume~1\alluse~1\applic~1\TuneUp Software
2009-07-23 13:52 <DIR> --dsh--- c:\docume~1\alluse~1\applic~1\{55A29068-F2CE-456C-9148-C869879E2357}
2009-07-23 13:37 <DIR> --d----- c:\docume~1\ryan\applic~1\uniblue
2009-07-23 13:37 <DIR> --d----- c:\program files\Uniblue
2009-07-20 00:54 <DIR> --d----- c:\documents and settings\ryan\.thumbnails
2009-07-20 00:52 <DIR> --d----- c:\documents and settings\ryan\.gimp-2.6
2009-07-20 00:52 <DIR> --d----- c:\documents and settings\ryan\.gegl-0.0
2009-07-20 00:51 <DIR> --d----- c:\program files\GIMP-2.0
2009-07-18 11:05 <DIR> --d----- c:\program files\LongTailVideo
2009-07-18 09:02 <DIR> --dsh--- C:\FOUND.002
2009-07-12 19:41 70,984 a------- c:\documents and settings\ryan\g2mdlhlpx.exe
2009-07-09 00:20 73,728 a------- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll
2009-07-19 08:19 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-09 00:19 410,984 a------- c:\windows\system32\deploytk.dll
2009-07-03 12:09 1,208,832 a------- c:\windows\system32\dllcache\urlmon.dll
2009-07-03 12:09 915,456 a------- c:\windows\system32\wininet.dll
2009-07-03 12:09 915,456 a------- c:\windows\system32\dllcache\wininet.dll
2009-07-03 12:09 206,848 a------- c:\windows\system32\dllcache\occache.dll
2009-07-03 12:09 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
2009-07-03 12:09 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll
2009-07-03 12:09 55,296 a------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-03 12:09 1,985,536 a------- c:\windows\system32\dllcache\iertutil.dll
2009-07-03 12:09 184,320 a------- c:\windows\system32\dllcache\iepeers.dll
2009-07-03 12:09 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll
2009-07-03 12:09 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-07-03 12:09 386,048 a------- c:\windows\system32\dllcache\iedkcs32.dll
2009-07-03 06:01 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-16 09:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 09:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-16 09:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 09:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-05 11:42 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-06-05 11:42 39,424 a------- c:\windows\system32\drivers\usbaapl.sys
2009-06-03 14:09 1,291,264 a------- c:\windows\system32\quartz.dll
2009-06-03 14:09 1,291,264 -------- c:\windows\system32\dllcache\quartz.dll
2009-05-07 10:32 345,600 a------- c:\windows\system32\localspl.dll
2009-05-07 10:32 345,600 -------- c:\windows\system32\dllcache\localspl.dll
2009-04-29 21:50 1,073,741,824 a------- c:\documents and settings\ryan\data32.dat
2009-02-15 01:04 32,768 a------- c:\documents and settings\ryan\WebVpnRegKey6-webvpn-dss-la-gov.dll

============= FINISH: 0:48:00.78 ===============

Attached Files


Edited by rmcc4444, 02 August 2009 - 12:58 AM.


BC AdBot (Login to Remove)

 


m

#2 rmcc4444

rmcc4444
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:10:59 PM

Posted 03 August 2009 - 09:00 PM

Did I leave out something? Any help is appreciated.

#3 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:04:59 AM

Posted 04 August 2009 - 06:31 AM

Hi rmc4444,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.
  • Please subscribe to this topic, if you haven't already.
  • Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
  • Please reply to this post so I know you are there.
The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day then I will close the topic.

Thanks :thumbup2:
Posted Image
m0le is a proud member of UNITE

#4 rmcc4444

rmcc4444
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:10:59 PM

Posted 04 August 2009 - 01:23 PM

Mole,

Thanks.. Before you waste time spending on my orig. posting, let me post my new logs. I tried to tweak a few things between now and then. I won't touch anything else w/o you saying so from here on out.

Thanks..

----

DDS (Ver_09-07-30.01) - FAT32x86
Run by Ryan at 13:18:33.81 on Tue 08/04/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2302.1842 [GMT -5:00]

AV: avast! antivirus 4.8.1335 [VPS 090804-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\Ati2evxx.exe
SVCHOST.EXE
SVCHOST.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
SVCHOST.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\NSLU2 Flash Map Utility\StorageLink.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Documents and Settings\Ryan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = proxy-iberv:8080
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [NSLU2 Flash Map Utility] c:\program files\nslu2 flash map utility\StorageLink.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {43E4476A-6C11-4274-AFA4-DF665B26EAE0} - hxxps://dss-sr95la01-drac/plugins/vkvm/ActiveXVideoViewer.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1234023679968
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LMIinit - LMIinit.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ryan\applic~1\mozilla\firefox\profiles\p9gzlw58.default\
FF - prefs.js: browser.startup.homepage - hxxp://tdbl.baseball.cbssports.com/scoring/live
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2009-5-3 38448]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-2-7 114768]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2009-3-1 8576]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-2-7 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-2-7 138680]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-2-8 47640]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R3 iTurns;iTurns;c:\windows\system32\drivers\iTurnsDriver.sys [2008-11-28 10704]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\elock2burnerlockdriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\elock2fsctldriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-2-7 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-2-7 352920]
S3 VRSService;VRS Recording System;c:\program files\nch swift sound\vrs\vrs.exe [2009-8-1 851972]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

=============== Created Last 30 ================

2009-08-04 01:22 1,002,846 a------- c:\windows\system32\obama_joker_11x17_300dpi.bmp
2009-08-03 23:37 <DIR> --d-h--- c:\docume~1\alluse~1\applic~1\{CC51AE54-B346-4954-ADDB-30BD4F138CF2}
2009-08-03 23:36 <DIR> --d----- c:\program files\iXi Tools
2009-08-03 23:31 520,192 -------- c:\windows\system32\ati2sgag.exe
2009-08-03 23:20 <DIR> --d----- C:\ATI
2009-08-03 23:06 552 a------- c:\windows\system32\d3d8caps.dat
2009-08-03 22:55 2,155,520 a------- c:\windows\system32\drivers\ati2mtag.sys
2009-08-03 22:55 2,155,520 a------- c:\windows\system32\dllcache\ati2mtag.sys
2009-08-03 22:55 870,784 a------- c:\windows\system32\dllcache\ati3d1ag.dll
2009-08-03 22:55 870,784 a------- c:\windows\system32\ati3d1ag.dll
2009-08-03 22:55 327,040 a------- c:\windows\system32\drivers\ati2mtaa.sys
2009-08-03 22:55 327,040 a------- c:\windows\system32\dllcache\ati2mtaa.sys
2009-08-03 22:55 377,984 a------- c:\windows\system32\dllcache\ati2dvaa.dll
2009-08-03 22:55 377,984 a------- c:\windows\system32\ati2dvaa.dll
2009-08-03 22:55 <DIR> --d----- c:\program files\Driver Cleaner Pro
2009-08-03 22:29 212,240 a------- c:\windows\system32\RichTx32.ocx
2009-08-03 22:29 124,688 a------- c:\windows\system32\MSWinSck.ocx
2009-08-03 22:29 1,753,088 a------- c:\windows\system32\ExGrid.dll
2009-08-03 22:29 614,400 a------- c:\windows\system32\ExButton.dll
2009-08-03 22:29 602,112 a------- c:\windows\system32\ExMenu.dll
2009-08-03 22:29 516,096 a------- c:\windows\system32\ExTab.dll
2009-08-03 22:29 307,200 a------- c:\windows\system32\ExPMenu.dll
2009-08-03 22:29 368,912 a------- c:\windows\system32\vbar332.dll
2009-08-03 22:29 140,288 a------- c:\windows\system32\COMDLG32.OCX
2009-08-03 22:29 118,784 a------- c:\windows\system32\eWebControl.dll
2009-08-03 22:29 <DIR> --d----- c:\program files\common files\eSellerate
2009-08-03 22:29 <DIR> --d----- c:\program files\AnswersThatWork
2009-08-03 22:24 360,580 a------- c:\windows\eSellerateEngine.dll
2009-08-03 22:24 <DIR> --d----- c:\program files\Hot CPU Tester Pro 4 LE
2009-08-03 22:09 27,136 a------- c:\windows\system32\PCWizard.cpl
2009-08-03 22:09 <DIR> --d----- c:\program files\CPUID
2009-08-03 18:55 <DIR> --d----- c:\program files\TalkShoe
2009-08-02 02:15 <DIR> --d----- c:\program files\iPod
2009-08-02 02:15 <DIR> --d----- c:\program files\iTunes
2009-08-01 23:42 25,992 a------- c:\windows\system32\pgdfgsvc.exe
2009-08-01 23:35 <DIR> --d----- c:\program files\NCH Swift Sound
2009-08-01 23:34 <DIR> --d----- c:\program files\Trend Micro
2009-07-26 03:45 <DIR> --d----- c:\program files\NCH Software
2009-07-26 03:45 <DIR> --d----- c:\docume~1\ryan\applic~1\NCH Software
2009-07-23 14:23 <DIR> --d----- c:\windows\SxsCaPendDel
2009-07-23 13:57 <DIR> --d----- c:\documents and settings\ryan\ErrorLogs
2009-07-23 13:53 <DIR> --d----- c:\docume~1\ryan\applic~1\TuneUp Software
2009-07-23 13:53 <DIR> --d----- c:\docume~1\alluse~1\applic~1\TuneUp Software
2009-07-23 13:52 <DIR> --dsh--- c:\docume~1\alluse~1\applic~1\{55A29068-F2CE-456C-9148-C869879E2357}
2009-07-23 13:37 <DIR> --d----- c:\docume~1\ryan\applic~1\uniblue
2009-07-20 00:54 <DIR> --d----- c:\documents and settings\ryan\.thumbnails
2009-07-20 00:52 <DIR> --d----- c:\documents and settings\ryan\.gimp-2.6
2009-07-20 00:52 <DIR> --d----- c:\documents and settings\ryan\.gegl-0.0
2009-07-20 00:51 <DIR> --d----- c:\program files\GIMP-2.0
2009-07-18 09:02 <DIR> --dsh--- C:\FOUND.002
2009-07-12 19:41 70,984 a------- c:\documents and settings\ryan\g2mdlhlpx.exe
2009-07-09 00:20 73,728 a------- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll
2009-07-19 08:19 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-09 00:19 410,984 a------- c:\windows\system32\deploytk.dll
2009-07-03 12:09 1,208,832 a------- c:\windows\system32\dllcache\urlmon.dll
2009-07-03 12:09 915,456 a------- c:\windows\system32\wininet.dll
2009-07-03 12:09 915,456 a------- c:\windows\system32\dllcache\wininet.dll
2009-07-03 12:09 206,848 a------- c:\windows\system32\dllcache\occache.dll
2009-07-03 12:09 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
2009-07-03 12:09 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll
2009-07-03 12:09 55,296 a------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-03 12:09 1,985,536 a------- c:\windows\system32\dllcache\iertutil.dll
2009-07-03 12:09 184,320 a------- c:\windows\system32\dllcache\iepeers.dll
2009-07-03 12:09 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll
2009-07-03 12:09 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-07-03 12:09 386,048 a------- c:\windows\system32\dllcache\iedkcs32.dll
2009-07-03 06:01 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-16 09:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 09:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-16 09:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 09:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-05 11:42 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-06-03 14:09 1,291,264 a------- c:\windows\system32\quartz.dll
2009-06-03 14:09 1,291,264 -------- c:\windows\system32\dllcache\quartz.dll
2009-05-07 10:32 345,600 a------- c:\windows\system32\localspl.dll
2009-05-07 10:32 345,600 -------- c:\windows\system32\dllcache\localspl.dll
2009-04-29 21:50 1,073,741,824 a------- c:\documents and settings\ryan\data32.dat
2009-02-15 01:04 32,768 a------- c:\documents and settings\ryan\WebVpnRegKey6-webvpn-dss-la-gov.dll

============= FINISH: 13:19:13.59 ===============

Attached Files


Edited by rmcc4444, 04 August 2009 - 01:26 PM.


#5 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:04:59 AM

Posted 04 August 2009 - 02:01 PM

Hi rmmc4444,

There's some evidence of malware in both logs.

Let's do some further scans to see just what we're dealing with.

We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop:
  • Extract RootRepeal.exe from the zip archive.
  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all six boxes: Posted Image
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.
Please run this tool also

Please download and run Process Explorer

If Process explorer won't execute rename it Iexplore.exe

Under File and Save As, create a log and post here

copy and paste the log into your next reply


Finally

We need to create an OTL Report
  • Please download OTL By OldTimer
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:[list]
    OTListIt.txt <-- Will be opened
    Extra.txt <-- Will be minimized
If any of the tools won't run then stop the steps and post back to let me know. RootRepeal may not run but the others should. :thumbup2:
Posted Image
m0le is a proud member of UNITE

#6 rmcc4444

rmcc4444
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:10:59 PM

Posted 04 August 2009 - 06:07 PM

Thank you for your assistance. It's greatly appreciated.

Below are the requested logs..

RootRepeal

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/04 17:57
Program Version: Version 1.3.3.0
Windows Version: Windows XP Media Center Edition SP3
==================================================

Drivers
-------------------
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA5A6C000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: c:\documents and settings\ryan\local settings\temp\nse52.tmp
Status: Allocation size mismatch (API: 75530240, Raw: 74842112)

Path: c:\documents and settings\ryan\local settings\application data\mozilla\firefox\profiles\p9gzlw58.default\urlclassifier3.sqlite
Status: Allocation size mismatch (API: 37257216, Raw: 36634624)

Path: c:\documents and settings\ryan\local settings\application data\mozilla\firefox\profiles\p9gzlw58.default\cache\_cache_001_
Status: Allocation size mismatch (API: 1409024, Raw: 622592)

Path: c:\documents and settings\ryan\local settings\application data\mozilla\firefox\profiles\p9gzlw58.default\cache\_cache_002_
Status: Allocation size mismatch (API: 1310720, Raw: 655360)

Path: c:\documents and settings\ryan\local settings\application data\mozilla\firefox\profiles\p9gzlw58.default\cache\_cache_003_
Status: Allocation size mismatch (API: 1835008, Raw: 1376256)

SSDT
-------------------
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d856b8

#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d85574

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d85a52

#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d8514c

#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d8564e

#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d8508c

#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d850f0

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d8576e

#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d8572e

#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8d858ae

==EOF==


-------------------------------

Process Explorer

Process PID CPU Description Company Name
System Idle Process 0 98.46
SERVICES.EXE 1952 0.77 Services and Controller app Microsoft Corporation
DPCs n/a 0.77 Deferred Procedure Calls
WinPatrol.exe 2168 WinPatrol System Monitor BillP Studios
WINLOGON.EXE 1868 Windows NT Logon Application Microsoft Corporation
vlc.exe 1552 VLC media player the VideoLAN Team
System 4
SVCHOST.EXE 748 Generic Host Process for Win32 Services Microsoft Corporation
SVCHOST.EXE 472 Generic Host Process for Win32 Services Microsoft Corporation
SVCHOST.EXE 596 Generic Host Process for Win32 Services Microsoft Corporation
SVCHOST.EXE 696 Generic Host Process for Win32 Services Microsoft Corporation
SVCHOST.EXE 336 Generic Host Process for Win32 Services Microsoft Corporation
SVCHOST.EXE 844 Generic Host Process for Win32 Services Microsoft Corporation
SVCHOST.EXE 364 Generic Host Process for Win32 Services Microsoft Corporation
SVCHOST.EXE 2588 Generic Host Process for Win32 Services Microsoft Corporation
StorageLink.exe 2264 Storage Link MFC Application
SPOOLSV.EXE 1788 Spooler SubSystem App Microsoft Corporation
SMSS.EXE 1192 Windows NT Session Manager Microsoft Corporation
RootRepeal.exe 3612 RootRepeal
RAMAINT.EXE 640 LogMeIn Maintenance Service LogMeIn, Inc.
procexp.exe 1716 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
PG2.EXE 2408 PeerGuardian 2 Phoenix Labs
notepad.exe 1028 Notepad Microsoft Corporation
notepad.exe 4060 Notepad Microsoft Corporation
notepad.exe 3956 Notepad Microsoft Corporation
mDNSResponder.exe 1256 Bonjour Service Apple Inc.
MCRDSVC.EXE 1144 MCRD Device Service Microsoft Corporation
LSSrvc.exe 576 Hewlett-Packard Company
LSASS.EXE 1964 LSA Shell (Export Version) Microsoft Corporation
LogMeInSystray.exe 2192 LogMeIn Desktop Application LogMeIn, Inc.
LogMeIn.exe 1500 LogMeIn LogMeIn, Inc.
LMIGuardian.exe 1556 LMIGuardian LogMeIn, Inc.
LMIGuardian.exe 1344 LMIGuardian LogMeIn, Inc.
JAVA.EXE 824 Java™ Platform SE binary Sun Microsystems, Inc.
iTunesHelper.exe 2404 iTunesHelper Module Apple Inc.
iPodService.exe 3456 iPodService Module Apple Inc.
Interrupts n/a Hardware Interrupts
firefox.exe 2760 Firefox Mozilla Corporation
EXPLORER.EXE 4072 Windows Explorer Microsoft Corporation
ehSched.exe 264 Media Center Scheduler Service Microsoft Corporation
ehRecvr.exe 204 Media Center Receiver Service Microsoft Corporation
CVPND.EXE 1584 Cisco Systems VPN Client Cisco Systems, Inc.
CTFMON.EXE 2984 CTF Loader Microsoft Corporation
CSRSS.EXE 1480 Client Server Runtime Process Microsoft Corporation
ATI2EVXX.EXE 284 ATI External Event Utility EXE Module ATI Technologies Inc.
ATI2EVXX.EXE 680 ATI External Event Utility EXE Module ATI Technologies Inc.
aswUpdSv.exe 1356 avast! Antivirus updating service ALWIL Software
ashServ.exe 1412 avast! antivirus service ALWIL Software
ashDisp.exe 2140 avast! service GUI component ALWIL Software
AppleMobileDeviceService.exe 1176 Apple Mobile Device Service Apple Inc.
ALG.EXE 3048 Application Layer Gateway Service Microsoft Corporation

----------------------------

OTListIt.txt

OTL logfile created on: 8/4/2009 6:05:12 PM - Run 1
OTL by OldTimer - Version 3.0.10.4 Folder = C:\Documents and Settings\Ryan\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.55 Gb Available Physical Memory | 77.61% Memory free
4.00 Gb Paging File | 3.72 Gb Available in Paging File | 93.06% Paging File free
Paging file location(s): D:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 99.98 Gb Total Space | 59.54 Gb Free Space | 59.55% Space Free | Partition Type: FAT32
Drive D: | 6.89 Gb Total Space | 4.64 Gb Free Space | 67.36% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
Drive F: | 2.86 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JERICHO
Current User Name: Ryan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2007/06/13 14:15:40 | 00,483,328 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2007/06/13 14:15:40 | 00,483,328 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2009/02/05 15:01:26 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009/02/05 15:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009/06/05 11:48:14 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/04/17 09:08:46 | 01,528,608 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2006/10/09 16:16:56 | 00,237,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\eHome\ehRecvr.exe
PRC - [2005/08/05 13:56:32 | 00,102,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\eHome\ehSched.exe
PRC - [2006/02/17 15:26:32 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe
PRC - [2008/10/16 20:35:28 | 00,116,032 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\RaMaint.exe
PRC - [2008/07/24 18:46:10 | 00,063,040 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe
PRC - [2008/10/16 20:35:24 | 00,087,360 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardian.exe
PRC - [2005/08/05 13:27:08 | 00,099,328 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\mcrdsvc.exe
PRC - [2008/04/13 18:12:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2009/02/05 15:08:46 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2008/10/09 09:52:56 | 00,333,120 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
PRC - [2008/07/24 18:46:10 | 00,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
PRC - [2004/04/30 11:33:20 | 00,245,760 | ---- | M] () -- C:\Program Files\NSLU2 Flash Map Utility\StorageLink.exe
PRC - [2008/10/16 20:35:24 | 00,087,360 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardian.exe
PRC - [2009/07/13 14:03:10 | 00,292,128 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2007/01/30 00:39:34 | 01,432,064 | ---- | M] (Phoenix Labs) -- C:\Program Files\PeerGuardian2\pg2.exe
PRC - [2009/07/13 14:02:50 | 00,542,496 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/08/03 21:53:32 | 00,908,280 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/07/09 00:19:56 | 00,144,792 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\java.exe
PRC - [2009/07/30 15:45:38 | 00,470,528 | ---- | M] ( ) -- C:\Documents and Settings\Ryan\Desktop\RootRepeal\RootRepeal.exe
PRC - [2009/07/26 16:17:46 | 00,135,416 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\vlc.exe
PRC - [2009/08/04 18:01:06 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ryan\Desktop\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2009/06/05 11:48:14 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running])
SRV - [2008/07/25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2009/02/05 15:01:26 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv [Auto | Running])
SRV - [2007/06/13 14:15:40 | 00,483,328 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2007/06/13 14:29:00 | 00,520,192 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2009/02/05 15:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Auto | Running])
SRV - [2009/02/05 15:08:26 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner [On_Demand | Stopped])
SRV - [2009/02/05 15:06:04 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner [On_Demand | Stopped])
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running])
SRV - [2008/07/25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2008/04/17 09:08:46 | 01,528,608 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND [Auto | Running])
SRV - [2006/10/09 16:16:56 | 00,237,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\eHome\ehRecvr.exe -- (ehRecvr [Auto | Running])
SRV - [2005/08/05 13:56:32 | 00,102,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\eHome\ehSched.exe -- (ehSched [Auto | Running])
SRV - [2008/07/29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2008/04/13 18:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [On_Demand | Stopped])
SRV - [2008/07/29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped])
SRV - [2009/07/13 14:02:50 | 00,542,496 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running])
SRV - [2008/04/13 18:11:56 | 00,028,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\irmon.dll -- (Irmon [Auto | Running])
SRV - [2006/02/17 15:26:32 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService [Auto | Running])
SRV - [2008/10/16 20:35:28 | 00,116,032 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\RaMaint.exe -- (LMIMaint [Auto | Running])
SRV - [2008/07/24 18:46:10 | 00,063,040 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn [Auto | Running])
SRV - [2005/08/05 13:27:08 | 00,099,328 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ehome\mcrdsvc.exe -- (McrdSvc [Auto | Running])
SRV - [2004/08/10 04:11:50 | 00,085,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mhn.dll -- (MHN [On_Demand | Stopped])
SRV - [2007/06/29 19:16:56 | 00,800,040 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService [On_Demand | Stopped])
SRV - [2008/07/29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])
SRV - [2007/06/27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService [On_Demand | Stopped])
SRV - [2009/08/01 23:35:40 | 00,851,972 | ---- | M] (NCH Software) -- C:\Program Files\NCH Swift Sound\VRS\vrs.exe -- (VRSService [On_Demand | Stopped])
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2009/02/05 15:05:12 | 00,026,944 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4 [System | Running])
DRV - [2004/08/10 20:00:00 | 00,005,248 | ---- | M] (Acer Laboratories Inc.) -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde [Boot | Running])
DRV - [2008/04/13 12:36:40 | 00,043,008 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp [Boot | Running])
DRV - [2005/03/09 15:53:00 | 00,036,352 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\System32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running])
DRV - [2006/01/25 10:44:52 | 00,488,448 | ---- | M] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\DRIVERS\ar5211.sys -- (AR5211 [On_Demand | Running])
DRV - [2004/08/10 20:00:00 | 00,026,496 | ---- | M] (Advanced System Products, Inc.) -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc [Boot | Running])
DRV - [2004/08/10 20:00:00 | 00,014,848 | ---- | M] (Advanced System Products, Inc.) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550 [Boot | Running])
DRV - [2009/02/05 15:07:12 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\DRIVERS\aswFsBlk.sys -- (aswFsBlk [Auto | Running])
DRV - [2009/02/05 15:08:10 | 00,094,032 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2 [Auto | Running])
DRV - [2009/02/05 15:06:10 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr [On_Demand | Stopped])
DRV - [2009/02/05 15:07:24 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP [System | Running])
DRV - [2009/02/05 15:06:20 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi [System | Running])
DRV - [2007/06/13 14:24:14 | 02,155,520 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2006/05/09 20:22:50 | 00,806,272 | ---- | M] (Bison Electronics. Inc. ) -- C:\WINDOWS\System32\Drivers\BisonCam.sys -- (Cam5603D [On_Demand | Running])
DRV - [2004/08/10 20:00:00 | 00,006,656 | ---- | M] (CMD Technology, Inc.) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde [Boot | Running])
DRV - [2007/01/18 17:28:02 | 00,005,275 | ---- | M] (Cisco Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\CVirtA.sys -- (CVirtA [On_Demand | Stopped])
DRV - [2008/04/17 09:07:52 | 00,306,299 | ---- | M] (Cisco Systems, Inc.) -- C:\WINDOWS\System32\Drivers\CVPNDRVA.sys -- (CVPNDRVA [Auto | Running])
DRV - [2004/08/10 20:00:00 | 00,179,584 | ---- | M] (Mylex Corporation) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k [Boot | Running])
DRV - [2008/03/29 17:36:28 | 00,125,328 | ---- | M] (Deterministic Networks, Inc.) -- C:\WINDOWS\System32\DRIVERS\dne2000.sys -- (DNE [On_Demand | Running])
DRV - [2006/05/24 19:19:40 | 00,061,056 | ---- | M] (ENE Technology Inc.) -- C:\WINDOWS\System32\DRIVERS\EMS7SK.sys -- (EMSCR [On_Demand | Running])
DRV - [2006/05/24 19:19:48 | 00,040,064 | ---- | M] (ENE Technology Inc.) -- C:\WINDOWS\System32\DRIVERS\ESD7SK.sys -- (ESDCR [On_Demand | Running])
DRV - [2006/05/24 19:19:44 | 00,074,752 | ---- | M] (ENE Technology Inc.) -- C:\WINDOWS\System32\DRIVERS\ESM7SK.sys -- (ESMCR [On_Demand | Running])
DRV - [2009/03/19 16:32:48 | 00,023,400 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Running])
DRV - [2008/04/13 10:36:06 | 00,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running])
DRV - [2008/01/17 19:30:36 | 00,038,448 | ---- | M] (Paragon Software Group) -- C:\WINDOWS\system32\drivers\hotcore3.sys -- (hotcore3 [Boot | Running])
DRV - [2006/06/12 01:59:52 | 00,208,384 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys -- (HSFHWAZL [On_Demand | Running])
DRV - [2006/06/12 02:00:42 | 00,990,592 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys -- (HSF_DPV [On_Demand | Running])
DRV - [2006/01/11 16:12:54 | 00,194,048 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\HSXHWAZL.sys -- (HSXHWAZL [On_Demand | Stopped])
DRV - [2006/06/28 01:25:24 | 04,304,384 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running])
DRV - [2001/08/17 13:51:32 | 00,018,688 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\irsir.sys -- (irsir [On_Demand | Stopped])
DRV - [2008/11/28 13:26:56 | 00,010,704 | ---- | M] (Pixbyte Development SL) -- C:\WINDOWS\System32\DRIVERS\iTurnsDriver.sys -- (iTurns [On_Demand | Running])
DRV - [2008/07/24 18:46:12 | 00,012,856 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\RaInfo.sys -- (LMIInfo [Auto | Running])
DRV - [2008/07/24 18:45:20 | 00,010,144 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\DRIVERS\lmimirr.sys -- (lmimirr [On_Demand | Running])
DRV - [2008/10/16 20:35:58 | 00,083,288 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP [Disabled | Stopped])
DRV - [2008/07/24 18:46:10 | 00,047,640 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver [Auto | Running])
DRV - [2006/02/14 20:57:46 | 00,012,672 | ---- | M] (Conexant) -- C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys -- (mdmxsdk [Auto | Running])
DRV - [2004/08/10 20:00:00 | 00,017,280 | ---- | M] (American Megatrends Inc.) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x [Boot | Running])
DRV - [2008/04/13 12:53:10 | 00,040,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\NMnt.sys -- (nm [On_Demand | Stopped])
DRV - [2006/05/12 12:47:30 | 00,006,144 | ---- | M] (NewTech Infosystems, Inc.) -- C:\WINDOWS\System32\DRIVERS\NTIDrvr.sys -- (NTIDrvr [On_Demand | Running])
DRV - [2004/08/10 20:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008/08/20 12:58:58 | 00,044,944 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2004/08/10 20:00:00 | 00,040,320 | ---- | M] (QLogic Corporation) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080 [Boot | Running])
DRV - [2004/08/10 20:00:00 | 00,045,312 | ---- | M] (QLogic Corporation) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160 [Boot | Running])
DRV - [2004/08/10 20:00:00 | 00,049,024 | ---- | M] (QLogic Corporation) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280 [Boot | Running])
DRV - [2008/12/02 06:05:34 | 00,118,656 | ---- | M] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\System32\DRIVERS\Rtnicxp.sys -- (RTL8023xp [On_Demand | Running])
DRV - [2008/04/13 10:39:16 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2008/04/13 12:36:40 | 00,040,960 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp [Boot | Running])
DRV - [2004/12/09 14:54:12 | 00,046,592 | ---- | M] (SMSC) -- C:\WINDOWS\System32\DRIVERS\smcirda.sys -- (SMCIRDA [On_Demand | Stopped])
DRV - [2004/08/10 20:00:00 | 00,019,072 | ---- | M] (Adaptec, Inc.) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow [Boot | Running])
DRV - [2004/08/10 20:00:00 | 00,016,256 | ---- | M] (Symbios Logic Inc.) -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810 [Boot | Running])
DRV - [2004/08/10 20:00:00 | 00,032,640 | ---- | M] (LSI Logic) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx [Boot | Running])
DRV - [2004/08/10 20:00:00 | 00,028,384 | ---- | M] (LSI Logic) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi [Boot | Running])
DRV - [2004/08/10 20:00:00 | 00,030,688 | ---- | M] (LSI Logic) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3 [Boot | Running])
DRV - [2008/01/17 19:30:36 | 00,032,352 | ---- | M] (Windows ® 2000 DDK provider) -- C:\WINDOWS\System32\DRIVERS\UimBus.sys -- (UimBus [System | Running])
DRV - [2008/01/17 19:30:36 | 00,131,456 | ---- | M] (Paragon) -- C:\WINDOWS\System32\Drivers\Uim_IM.sys -- (Uim_IM [System | Running])
DRV - [2004/08/10 20:00:00 | 00,036,736 | ---- | M] (Promise Technology, Inc.) -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra [Boot | Running])
DRV - [2009/06/05 11:42:38 | 00,039,424 | ---- | M] (Apple, Inc.) -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL [On_Demand | Stopped])
DRV - [2008/04/13 12:45:12 | 00,060,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbaudio.sys -- (usbaudio [On_Demand | Stopped])
DRV - [2001/12/19 11:45:00 | 00,008,576 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\VCdRom.sys -- (vcdrom [System | Running])
DRV - [2005/01/26 11:22:20 | 00,280,344 | ---- | M] (Zone Labs LLC) -- C:\WINDOWS\System32\vsdatant.sys -- (vsdatant [On_Demand | Stopped])
DRV - [2006/06/12 01:59:46 | 00,727,808 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys -- (winachsf [On_Demand | Running])
DRV - [2007/01/30 00:16:42 | 00,006,144 | ---- | M] () -- C:\Program Files\PeerGuardian2\pgfilter.sys -- (pgfilter [On_Demand | Running])

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005\S-1-5-21-2900185301-1179372326-1382423368-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005\S-1-5-21-2900185301-1179372326-1382423368-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005\S-1-5-21-2900185301-1179372326-1382423368-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy-iberv:8080

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://tdbl.baseball.cbssports.com/scoring/live"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: {37fa1426-b82d-11db-8314-0800200c9a66}:1.3
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.2
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.gopher: ""
FF - prefs.js..network.proxy.backup.gopher_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "proxy-iberv"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.gopher: "proxy-iberv"
FF - prefs.js..network.proxy.gopher_port: 8080
FF - prefs.js..network.proxy.http: "proxy-iberv"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxy-iberv"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "proxy-iberv"
FF - prefs.js..network.proxy.ssl_port: 8080


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/06/28 21:41:12 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/06/28 21:41:12 | 00,000,000 | ---D | M]

[2009/06/28 21:41:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ryan\Application Data\mozilla\Extensions
[2009/06/28 21:41:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ryan\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/06/28 21:41:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ryan\Application Data\mozilla\Firefox\Profiles\p9gzlw58.default\extensions
[2009/07/31 17:42:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ryan\Application Data\mozilla\Firefox\Profiles\p9gzlw58.default\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}
[2009/07/23 14:21:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ryan\Application Data\mozilla\Firefox\Profiles\p9gzlw58.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009/08/04 00:00:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ryan\Application Data\mozilla\Firefox\Profiles\p9gzlw58.default\extensions\foxmarks@kei.com
[2009/07/25 05:59:00 | 00,008,349 | ---- | M] () -- C:\Documents and Settings\Ryan\Application Data\Mozilla\FireFox\Profiles\p9gzlw58.default\searchplugins\oneriot.xml
[2009/06/28 21:41:12 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/06/28 21:41:12 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/07/09 00:20:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/03 21:53:32 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/08/03 21:53:32 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/07/09 00:19:56 | 00,410,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2007/04/10 17:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\np-mswmp.dll
[2009/08/03 21:53:34 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2009/08/03 22:33:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2009/08/03 22:33:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2009/08/03 22:33:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2009/08/03 22:33:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2009/08/03 22:33:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2009/08/03 22:33:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2009/08/03 22:33:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2009/06/24 06:27:00 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/06/24 06:27:00 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/06/24 06:27:00 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/06/24 06:27:00 | 00,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/06/24 06:27:00 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/06/24 06:27:00 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/06/24 06:27:00 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (830 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 applian.securesites.com
O1 - Hosts: 127.0.0.1 applianorders.securesites.net
O1 - Hosts: 192.168.1.110 orwell
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [NSLU2 Flash Map Utility] C:\Program Files\NSLU2 Flash Map Utility\StorageLink.exe ()
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe (Phoenix Labs)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-2900185301-1179372326-1382423368-1005\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {43E4476A-6C11-4274-AFA4-DF665B26EAE0} https://dss-sr95la01-drac/plugins/vkvm/Acti...VideoViewer.cab (Session Viewer)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1234023679968 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/05/12 12:48:08 | 00,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O33 - MountPoints2\{261a433f-5e10-11de-a3b5-0016ce6183c7}\Shell\AutoRun\command - "" = G:\.\Vado\Vado.exe -- File not found
O33 - MountPoints2\{549d6666-f50a-11dd-a373-806d6172696f}\Shell\play\command - "" = C:\Program Files\VideoLAN\VLC\vlc.exe -- [2009/07/26 16:17:46 | 00,135,416 | ---- | M] ()
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2 C:\WINDOWS\*.tmp files]
[2009/08/04 18:02:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ryan\Application Data\vlc
[2009/08/04 18:01:09 | 00,514,048 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ryan\Desktop\OTL.exe
[2009/08/04 17:57:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ryan\Desktop\RootRepeal
[2009/08/04 17:57:08 | 00,462,996 | ---- | C] () -- C:\Documents and Settings\Ryan\Desktop\RootRepeal.zip
[2009/08/04 17:56:17 | 00,000,627 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2009/08/04 17:54:36 | 18,015,723 | ---- | C] () -- C:\vlc-1.0.1-win32.exe
[2009/08/04 13:20:24 | 00,002,913 | ---- | C] () -- C:\Documents and Settings\Ryan\Desktop\Attach.zip
[2009/08/04 01:22:29 | 01,002,846 | ---- | C] () -- C:\WINDOWS\System32\obama_joker_11x17_300dpi.bmp
[2009/08/03 23:37:00 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{CC51AE54-B346-4954-ADDB-30BD4F138CF2}
[2009/08/03 23:36:59 | 00,000,874 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Driver Updater Pro.lnk
[2009/08/03 23:36:59 | 00,000,000 | ---D | C] -- C:\Program Files\iXi Tools
[2009/08/03 23:31:38 | 00,520,192 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2009/08/03 23:20:13 | 00,000,000 | ---D | C] -- C:\ATI
[2009/08/03 23:06:13 | 00,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/08/03 22:55:47 | 02,155,520 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtag.sys
[2009/08/03 22:55:47 | 02,155,520 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\ati2mtag.sys
[2009/08/03 22:55:47 | 00,870,784 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\dllcache\ati3d1ag.dll
[2009/08/03 22:55:47 | 00,870,784 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\ati3d1ag.dll
[2009/08/03 22:55:47 | 00,327,040 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtaa.sys
[2009/08/03 22:55:47 | 00,327,040 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\ati2mtaa.sys
[2009/08/03 22:55:45 | 00,377,984 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\ati2dvaa.dll
[2009/08/03 22:55:45 | 00,377,984 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2dvaa.dll
[2009/08/03 22:55:14 | 00,001,546 | ---- | C] () -- C:\Documents and Settings\Ryan\Desktop\Driver Cleaner Pro.lnk
[2009/08/03 22:55:13 | 00,000,000 | ---D | C] -- C:\Program Files\Driver Cleaner Pro
[2009/08/03 22:29:45 | 00,000,764 | ---- | C] () -- C:\Documents and Settings\Ryan\Desktop\The Ultimate Troubleshooter.lnk
[2009/08/03 22:29:42 | 00,212,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\RichTx32.ocx
[2009/08/03 22:29:42 | 00,124,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSWinSck.ocx
[2009/08/03 22:29:40 | 01,753,088 | ---- | C] (Exontrol Inc.) -- C:\WINDOWS\System32\ExGrid.dll
[2009/08/03 22:29:40 | 00,614,400 | ---- | C] (Exontrol Inc.) -- C:\WINDOWS\System32\ExButton.dll
[2009/08/03 22:29:40 | 00,602,112 | ---- | C] (Exontrol Inc.) -- C:\WINDOWS\System32\ExMenu.dll
[2009/08/03 22:29:40 | 00,516,096 | ---- | C] (Exontrol Inc.) -- C:\WINDOWS\System32\ExTab.dll
[2009/08/03 22:29:40 | 00,307,200 | ---- | C] (Exontrol Inc.) -- C:\WINDOWS\System32\ExPMenu.dll
[2009/08/03 22:29:39 | 00,368,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\vbar332.dll
[2009/08/03 22:29:39 | 00,140,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\COMDLG32.OCX
[2009/08/03 22:29:39 | 00,118,784 | ---- | C] (eSellerate Inc.) -- C:\WINDOWS\System32\eWebControl.dll
[2009/08/03 22:29:39 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\eSellerate
[2009/08/03 22:29:38 | 00,000,000 | ---D | C] -- C:\Program Files\AnswersThatWork
[2009/08/03 22:24:39 | 00,001,633 | ---- | C] () -- C:\Documents and Settings\Ryan\Desktop\Hot CPU Tester Pro.lnk
[2009/08/03 22:24:38 | 00,360,580 | ---- | C] (eSellerate Inc.) -- C:\WINDOWS\eSellerateEngine.dll
[2009/08/03 22:24:37 | 00,000,000 | ---D | C] -- C:\Program Files\Hot CPU Tester Pro 4 LE
[2009/08/03 22:09:49 | 00,027,136 | ---- | C] (CPUID) -- C:\WINDOWS\System32\PCWizard.cpl
[2009/08/03 22:09:47 | 00,000,000 | ---D | C] -- C:\Program Files\CPUID
[2009/08/03 18:55:55 | 00,000,000 | ---D | C] -- C:\Program Files\TalkShoe
[2009/08/02 02:17:04 | 00,000,000 | ---D | C] -- C:\Program Files\Safari
[2009/08/02 02:15:33 | 00,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/08/02 02:15:15 | 00,000,000 | ---D | C] -- C:\Program Files\iPod
[2009/08/02 02:15:11 | 00,000,000 | ---D | C] -- C:\Program Files\iTunes
[2009/08/01 23:45:23 | 00,359,932 | ---- | C] () -- C:\Documents and Settings\Ryan\Desktop\dds.scr
[2009/08/01 23:42:32 | 00,025,992 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\WINDOWS\System32\pgdfgsvc.exe
[2009/08/01 23:35:40 | 00,000,658 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VRS Recording System.lnk
[2009/08/01 23:35:39 | 00,000,000 | ---D | C] -- C:\Program Files\NCH Swift Sound
[2009/08/01 23:35:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/08/01 23:34:16 | 00,001,642 | ---- | C] () -- C:\Documents and Settings\Ryan\Desktop\HijackThis.lnk
[2009/08/01 23:34:15 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/07/29 04:47:51 | 16,488,1800 | ---- | C] () -- C:\Documents and Settings\Ryan\My Documents\vlc-record-2009-07-29-04h47m18s-Everyday Anarchy (Freedomain Radio)-.mp3
[2009/07/26 03:46:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ryan\My Documents\Debut
[2009/07/26 03:46:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NCH Software
[2009/07/26 03:45:23 | 00,000,683 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Debut Video Capture Software.lnk
[2009/07/26 03:45:20 | 00,000,000 | ---D | C] -- C:\Program Files\NCH Software
[2009/07/26 03:45:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ryan\Application Data\NCH Software
[2009/07/25 06:46:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ryan\My Documents\iMacros
[2009/07/23 14:23:48 | 00,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2009/07/23 13:53:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ryan\Application Data\TuneUp Software
[2009/07/23 13:53:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2009/07/23 13:52:38 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
[2009/07/23 13:37:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ryan\Application Data\uniblue
[2009/07/20 00:51:55 | 00,000,698 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\GIMP 2.lnk
[2009/07/20 00:51:35 | 00,000,000 | ---D | C] -- C:\Program Files\GIMP-2.0
[2009/07/18 20:52:15 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Ryan\My Documents\FileZilla_3.2.6.1_win32-setup.exe
[2009/07/18 09:02:32 | 00,000,000 | -HSD | C] -- C:\FOUND.002
[2009/07/15 19:54:03 | 00,000,382 | ---- | C] () -- C:\WINDOWS\tasks\SmartDefrag.job
[2009/07/15 19:47:26 | 00,000,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Smart Defrag.lnk
[2009/07/09 00:20:07 | 00,148,888 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/07/09 00:20:07 | 00,144,792 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/07/09 00:20:07 | 00,144,792 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/07/09 00:20:07 | 00,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2009/07/09 00:19:50 | 00,000,000 | ---D | C] -- C:\Program Files\Java
[2009/06/29 02:11:56 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009/06/24 20:31:45 | 00,000,610 | ---- | C] () -- C:\WINDOWS\smrpro.INI
[2009/05/03 01:55:19 | 00,011,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\UimFIO.sys
[2009/05/03 01:00:10 | 04,244,744 | ---- | C] () -- C:\WINDOWS\System32\qtp-mt334.dll
[2009/05/03 01:00:10 | 00,247,560 | ---- | C] () -- C:\WINDOWS\System32\prgiso.dll
[2009/04/03 22:07:52 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/02/07 19:46:56 | 00,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009/02/07 06:05:12 | 00,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2009/02/07 04:27:12 | 00,002,790 | ---- | C] () -- C:\WINDOWS\AntiV.INI
[2008/04/17 09:08:56 | 00,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2008/04/17 09:08:44 | 00,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2006/05/12 16:02:02 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/05/12 12:48:34 | 00,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2006/05/12 12:47:32 | 00,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2006/05/12 12:47:32 | 00,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2006/05/12 12:47:32 | 00,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2006/05/12 12:47:32 | 00,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2006/05/12 12:17:00 | 00,000,507 | ---- | C] () -- C:\WINDOWS\win.ini
[2006/05/12 12:07:10 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini
[2006/03/10 14:15:44 | 00,036,404 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005/08/05 14:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/03/28 15:45:26 | 00,000,081 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2004/08/10 20:00:00 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/02/13 13:49:00 | 00,356,352 | ---- | C] () -- C:\WINDOWS\EMCRI.dll
[2003/09/22 13:49:36 | 00,015,190 | ---- | C] () -- C:\WINDOWS\M2000Twn.ini
[2001/12/26 15:12:30 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001/09/03 22:46:38 | 00,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001/07/30 15:33:56 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001/07/23 21:04:36 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll

========== Files - Modified Within 30 Days ==========

[2 C:\WINDOWS\*.tmp files]
[2009/08/04 18:01:06 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ryan\Desktop\OTL.exe
[2009/08/04 17:57:04 | 00,462,996 | ---- | M] () -- C:\Documents and Settings\Ryan\Desktop\RootRepeal.zip
[2009/08/04 17:56:18 | 00,000,627 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2009/08/04 17:55:28 | 18,015,723 | ---- | M] () -- C:\vlc-1.0.1-win32.exe
[2009/08/04 17:54:26 | 00,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{73DDBE0E-B45D-4F1A-A6A0-052D1186E53E}.job
[2009/08/04 13:20:26 | 00,002,913 | ---- | M] () -- C:\Documents and Settings\Ryan\Desktop\Attach.zip
[2009/08/04 08:07:42 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/08/04 08:07:38 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/08/04 01:21:22 | 01,002,846 | ---- | M] () -- C:\WINDOWS\System32\obama_joker_11x17_300dpi.bmp
[2009/08/03 23:37:18 | 03,172,936 | -H-- | M] () -- C:\Documents and Settings\Ryan\Local Settings\Application Data\IconCache.db
[2009/08/03 23:37:00 | 00,000,874 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Driver Updater Pro.lnk
[2009/08/03 23:21:30 | 00,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/08/03 23:06:38 | 00,001,456 | ---- | M] () -- C:\Documents and Settings\Ryan\Desktop\CCleaner.lnk
[2009/08/03 23:06:14 | 00,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/08/03 22:55:16 | 00,001,546 | ---- | M] () -- C:\Documents and Settings\Ryan\Desktop\Driver Cleaner Pro.lnk
[2009/08/03 22:29:46 | 00,000,764 | ---- | M] () -- C:\Documents and Settings\Ryan\Desktop\The Ultimate Troubleshooter.lnk
[2009/08/03 22:24:40 | 00,001,633 | ---- | M] () -- C:\Documents and Settings\Ryan\Desktop\Hot CPU Tester Pro.lnk
[2009/08/02 22:00:00 | 00,000,382 | ---- | M] () -- C:\WINDOWS\tasks\SmartDefrag.job
[2009/08/02 02:25:12 | 00,001,724 | -H-- | M] () -- C:\Documents and Settings\Ryan\My Documents\Default.rdp
[2009/08/02 02:15:34 | 00,001,804 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/08/02 00:39:54 | 00,110,992 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/08/01 23:45:16 | 00,359,932 | ---- | M] () -- C:\Documents and Settings\Ryan\Desktop\dds.scr
[2009/08/01 23:42:34 | 00,025,992 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\WINDOWS\System32\pgdfgsvc.exe
[2009/08/01 23:35:42 | 00,000,658 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VRS Recording System.lnk
[2009/08/01 23:34:18 | 00,001,642 | ---- | M] () -- C:\Documents and Settings\Ryan\Desktop\HijackThis.lnk
[2009/07/30 18:23:46 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/07/29 07:50:14 | 16,488,1800 | ---- | M] () -- C:\Documents and Settings\Ryan\My Documents\vlc-record-2009-07-29-04h47m18s-Everyday Anarchy (Freedomain Radio)-.mp3
[2009/07/26 21:21:16 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Ryan\My Documents\FileZilla_3.2.6.1_win32-setup.exe
[2009/07/26 03:45:24 | 00,000,683 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Debut Video Capture Software.lnk
[2009/07/23 14:22:02 | 00,511,568 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/07/23 14:22:02 | 00,434,706 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/07/23 14:22:02 | 00,068,444 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/07/22 03:57:34 | 00,000,600 | ---- | M] () -- C:\Documents and Settings\Ryan\Local Settings\Application Data\PUTTY.RND
[2009/07/20 00:51:56 | 00,000,698 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\GIMP 2.lnk
[2009/07/19 18:48:58 | 11,067,392 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ieframe.dll
[2009/07/19 18:48:58 | 11,067,392 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
[2009/07/19 08:19:00 | 05,937,152 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mshtml.dll
[2009/07/19 08:19:00 | 05,937,152 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2009/07/15 19:47:28 | 00,000,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Smart Defrag.lnk
[2009/07/12 19:26:56 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/07/09 00:19:56 | 00,410,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2009/07/09 00:19:56 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/07/09 00:19:56 | 00,144,792 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/07/09 00:19:56 | 00,144,792 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/07/09 00:19:56 | 00,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2009/07/07 10:10:56 | 24,539,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
< End of report >

-------------------------------

Extra.txt

OTL Extras logfile created on: 8/4/2009 6:05:12 PM - Run 1
OTL by OldTimer - Version 3.0.10.4 Folder = C:\Documents and Settings\Ryan\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.55 Gb Available Physical Memory | 77.61% Memory free
4.00 Gb Paging File | 3.72 Gb Available in Paging File | 93.06% Paging File free
Paging file location(s): D:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 99.98 Gb Total Space | 59.54 Gb Free Space | 59.55% Space Free | Partition Type: FAT32
Drive D: | 6.89 Gb Total Space | 4.64 Gb Free Space | 67.36% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
Drive F: | 2.86 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JERICHO
Current User Name: Ryan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2900185301-1179372326-1382423368-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\WINDOWS\System32\ftp.exe" = C:\WINDOWS\System32\ftp.exe:*:Enabled:File Transfer Program -- (Microsoft Corporation)
"C:\Program Files\NSLU2 Flash Map Utility\StorageLink.exe" = C:\Program Files\NSLU2 Flash Map Utility\StorageLink.exe:*:Enabled:Storage Link -- ()
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour -- (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 14
"{2D6ED011-055B-4041-B198-BB903827EBFB}" = Safari
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{49CC1A6A-3A1A-4EE7-913F-8106B51B59D1}" = Paragon Partition Manager 9.0 Special Edition
"{4A57592C-FF92-4083-97A9-92783BD5AFB4}" = Acer OrbiCam
"{4C271126-C295-4828-A901-5910AE0C258B}" = Cisco Systems VPN Client 5.0.03.0530
"{50C9E7FB-FF2A-4E37-AA87-068ACA70D4C2}" = Paragon Hard Disk Manager 8.5 Special Edition
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A39D5C2-A28B-421D-925A-0390FD1E5529}_is1" = Hot CPU Tester Pro 4.4.1
"{5D0EE2EF-CD4F-40CB-B6ED-A71B39E59742}" = Paragon Total Defrag 2009
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7D1FA102-9B90-48B0-8DF8-735BBA5F4093}" = Driver Updater Pro
"{7F831576-6246-42C7-B523-55B3F96509CC}" = LogMeIn
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{92B79901-C57D-409F-8D2F-4E5337383569}" = OpenOffice.org 3.0
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1.2
"{AF5A39FE-51FB-4BA3-B399-2D1F0C65D617}_is1" = AusLogics System Information
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}" = Apple Mobile Device Support
"{C7325E7B-6844-4D46-9515-365BCE0DC185}" = NSLU2 Flash Map Utility
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CADBCBBA-6CDD-4119-B5ED-4AE075B153E7}" = MobileMe Control Panel
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF097717-F174-4144-954A-FBC4BF301033}" = Nero 7 Ultra Edition
"{D755C7A3-C03E-4460-8C00-AC6E55505FB5}" = LightScribe 1.4.74.1
"{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1B8DB67-D30E-4FF9-A85F-3CEE51825AA2}" = SMSC IrCC V5.1.3600.7
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"Any Video Converter_is1" = Any Video Converter 2.7.0
"Aspell English Dictionary_is1" = Aspell English Dictionary-0.50-2
"ATI Display Driver" = ATI Display Driver
"Audacity_is1" = Audacity 1.2.6
"AudibleManager" = AudibleManager
"avast!" = avast! Antivirus
"Avidemux 2.4" = Avidemux 2.4
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"CCleaner" = CCleaner (remove only)
"CNXT_MODEM_PCI_VEN_14F1&DEV_2BFA&SUBSYS_1025009F" = Soft Data Fax Modem with SmartCP
"CrossLoop_is1" = CrossLoop 2.43
"Debut" = Debut Video Capture Software
"Driver Cleaner Pro" = DH Driver Cleaner Professional Edition
"Driver Updater Pro" = Driver Updater Pro
"FileZilla Client" = FileZilla Client 3.2.4.1
"GNU Aspell_is1" = GNU Aspell 0.50-3
"GTK 2.0" = GTK+ Runtime 2.14.7 rev a (remove only)
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"iTurns" = iTurns 2.0.4.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.2)" = Mozilla Firefox (3.5.2)
"MP3 Book Helper_is1" = MP3 Book Helper version 2.3.4.24
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nmap" = Nmap 4.85BETA3
"PC Wizard 2009_is1" = PC Wizard 2009.1.88
"PeerGuardian_is1" = PeerGuardian 2.0
"Pidgin" = Pidgin
"Revo Uninstaller" = Revo Uninstaller 1.83
"Smart Defrag_is1" = Smart Defrag 1.20
"Super Mp3 Recorder Professional_is1" = Super Mp3 Recorder Professional v6.2
"TalkShoe Live! 2.0" = TalkShoe Live! 2.0
"The Ultimate Troubleshooter" = The Ultimate Troubleshooter
"thinkorswim" = thinkorswim
"TightVNC_is1" = TightVNC 1.3.10
"VLC media player" = VLC media player 1.0.1
"VRS" = VRS Recording System
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPatrol" = WinPatrol 2008
"WinRAR archiver" = WinRAR archiver
"WM Capture" = WM Capture
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xming_is1" = Xming 6.9.0.31

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2900185301-1179372326-1382423368-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.1.0.366
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 5/7/2009 9:45:39 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\SYSTEM32\WUDFSVC.DLL failed, 0000A413.

Error - 5/7/2009 9:45:39 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\SYSTEM32\WZCSVC.DLL failed, 0000A413.

Error - 5/7/2009 9:45:39 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\SYSTEM32\XMLPROV.DLL failed, 0000A413.

Error - 5/7/2009 9:45:55 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Program Files\Alwil Software\Avast4\setup\avast.setup failed, 0000A413.

Error - 5/7/2009 9:46:24 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\m8vp85zm.default\sessionstore.js
failed, 0000A413.

Error - 5/7/2009 9:46:24 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\m8vp85zm.default\sessionstore-1.js
failed, 0000A413.

Error - 5/7/2009 9:46:24 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\m8vp85zm.default\sessionstore.js
failed, 0000A413.

Error - 5/7/2009 9:46:34 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\m8vp85zm.default\sessionstore.js
failed, 0000A413.

Error - 5/7/2009 9:46:34 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\m8vp85zm.default\sessionstore-1.js
failed, 0000A413.

Error - 5/7/2009 9:46:34 PM | Computer Name = JERICHO | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\m8vp85zm.default\sessionstore.js
failed, 0000A413.

[ Application Events ]
Error - 6/11/2009 9:48:37 PM | Computer Name = JERICHO | Source = Application Hang | ID = 1002
Description = Hanging application vlc.exe, version 0.9.9.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 6/15/2009 1:18:43 AM | Computer Name = JERICHO | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.0.3399, faulting module
xul.dll, version 1.9.0.3399, fault address 0x005ebec0.

Error - 6/15/2009 1:18:47 AM | Computer Name = JERICHO | Source = Application Error | ID = 1001
Description = Fault bucket 1249915547.

Error - 6/17/2009 11:07:15 PM | Computer Name = JERICHO | Source = Application Error | ID = 1000
Description = Faulting application vlc.exe, version 0.9.9.0, faulting module libasf_plugin.dll,
version 0.0.0.0, fault address 0x00004ee3.

Error - 6/20/2009 3:19:25 AM | Computer Name = JERICHO | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.1.3453, faulting module
js3250.dll, version 4.0.0.0, fault address 0x00031827.

Error - 6/20/2009 3:19:30 AM | Computer Name = JERICHO | Source = Application Error | ID = 1001
Description = Fault bucket 1328787400.

Error - 6/20/2009 3:20:25 AM | Computer Name = JERICHO | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.1.3454, faulting module
js3250.dll, version 4.0.0.0, fault address 0x0001f8b7.

Error - 6/20/2009 3:20:32 AM | Computer Name = JERICHO | Source = Application Error | ID = 1001
Description = Fault bucket 1328805199.

Error - 6/20/2009 3:21:16 AM | Computer Name = JERICHO | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.1.3454, faulting module
js3250.dll, version 4.0.0.0, fault address 0x0001f8b7.

Error - 6/20/2009 3:22:12 AM | Computer Name = JERICHO | Source = Application Error | ID = 1001
Description = Fault bucket 1328805199.

[ System Events ]
Error - 8/3/2009 11:58:29 PM | Computer Name = JERICHO | Source = DCOM | ID = 10010
Description = The server {7F6316B4-4D69-4765-B0A3-B2598F2FA80A} did not register
with DCOM within the required timeout.

Error - 8/4/2009 12:38:52 AM | Computer Name = JERICHO | Source = Service Control Manager | ID = 7000
Description = The eLock2BurnerLockDriver service failed to start due to the following
error: %%2

Error - 8/4/2009 12:38:52 AM | Computer Name = JERICHO | Source = Service Control Manager | ID = 7000
Description = The eLock2FSCTLDriver service failed to start due to the following
error: %%2

Error - 8/4/2009 12:39:17 AM | Computer Name = JERICHO | Source = DCOM | ID = 10010
Description = The server {7F6316B4-4D69-4765-B0A3-B2598F2FA80A} did not register
with DCOM within the required timeout.

Error - 8/4/2009 1:08:49 AM | Computer Name = JERICHO | Source = Service Control Manager | ID = 7000
Description = The eLock2BurnerLockDriver service failed to start due to the following
error: %%2

Error - 8/4/2009 1:08:49 AM | Computer Name = JERICHO | Source = Service Control Manager | ID = 7000
Description = The eLock2FSCTLDriver service failed to start due to the following
error: %%2

Error - 8/4/2009 1:09:13 AM | Computer Name = JERICHO | Source = DCOM | ID = 10010
Description = The server {7F6316B4-4D69-4765-B0A3-B2598F2FA80A} did not register
with DCOM within the required timeout.

Error - 8/4/2009 9:07:59 AM | Computer Name = JERICHO | Source = Service Control Manager | ID = 7000
Description = The eLock2BurnerLockDriver service failed to start due to the following
error: %%2

Error - 8/4/2009 9:07:59 AM | Computer Name = JERICHO | Source = Service Control Manager | ID = 7000
Description = The eLock2FSCTLDriver service failed to start due to the following
error: %%2

Error - 8/4/2009 9:08:24 AM | Computer Name = JERICHO | Source = DCOM | ID = 10010
Description = The server {7F6316B4-4D69-4765-B0A3-B2598F2FA80A} did not register
with DCOM within the required timeout.


< End of report >

#7 rmcc4444

rmcc4444
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:10:59 PM

Posted 04 August 2009 - 06:11 PM

An off-topic question. I have selected to track this topic but I didn't get an email alert when you responded. Am I missing something?

#8 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:04:59 AM

Posted 04 August 2009 - 07:00 PM

Go to My Controls (a bit below the Tutorial tab at the top of the page.)

Down the left hand side find Options and under there is Email settings.

Then scroll down to Board Preferences and by Enable 'Email Notification' by default? is a drop down menu.

Choose Immediate email notification.

Click the Amend my email settings button below that.

Done.



I will be back with new instructions soon. :thumbup2:
Posted Image
m0le is a proud member of UNITE

#9 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:04:59 AM

Posted 04 August 2009 - 07:28 PM

Nothing really nasty is turning up in the log.

The hosts file is usually pointing towards 127.0.0.1 which is the local host.

This entry below does not.

O1 - Hosts: 192.168.1.110 orwell

Are you using a remote access system, do you recognise "orwell"?


In the meantime,

Let's try and shift the malware that is there.

Please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

If you are using Firefox and this has caused page loading problems then please clear your private data. To do this go
to the Tools menu, select Clear Private Data, and then check Cache. Click Clear Private Data Now.

Then close Firefox and then reopen it.


Next

Backup Your Registry with ERUNT
  • Please use the following link and scroll down to ERUNT and download it.
    http://aumha.org/freeware/freeware.php
  • For version with the Installer:
    Use the setup program to install ERUNT on your computer
  • For the zipped version:
    Unzip all the files into a folder of your choice.
Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

We need to execute an OTM script
  • Please download OTM by OldTimer and save it to your desktop.
  • Double click the Posted Image icon on your desktop.
  • Paste the following code under the Posted Image area. Do not include the word "Code".
    :Files
    C:\Program Files\Common Files\eSellerate
    C:\WINDOWS\eSellerateEngine.dll
  • Push the large Posted Image button.
  • OTM may ask to reboot the machine. Please do so if asked.
  • Copy/Paste the contents under the Posted Image line here in your next reply.
  • If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
Post the OTM log.


Finally

Please download Posted Image Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application or, if you are using Vista, right-click and select Run As Administrator on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Full Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

Please also post a new DDS log.

Just to recap I need the following:
  • Please let me know that you have run ATF
  • The log from OTM
  • The log from MBAM
  • The DDS logs
Thanks :thumbup2:
Posted Image
m0le is a proud member of UNITE

#10 rmcc4444

rmcc4444
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:10:59 PM

Posted 04 August 2009 - 09:00 PM

Orwell is a NAS device hooked into my wireless router.

ATF cleaned 916.34 MB of data.

OTM Log File

========== FILES ==========
C:\Program Files\Common Files\eSellerate\DLLs moved successfully.
C:\Program Files\Common Files\eSellerate moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\eSellerateEngine.dll
C:\WINDOWS\eSellerateEngine.dll NOT unregistered.
C:\WINDOWS\eSellerateEngine.dll moved successfully.

OTM by OldTimer - Version 3.0.0.5 log created on 08042009_194655


---

MB Log

Malwarebytes' Anti-Malware 1.40
Database version: 2561
Windows 5.1.2600 Service Pack 3

8/4/2009 8:39:39 PM
mbam-log-2009-08-04 (20-39-39).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 174252
Time elapsed: 41 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

-----

New DDS Log


DDS (Ver_09-07-30.01) - FAT32x86
Run by Ryan at 20:40:42.70 on Tue 08/04/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2302.1510 [GMT -5:00]

AV: avast! antivirus 4.8.1335 [VPS 090804-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\NSLU2 Flash Map Utility\StorageLink.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Ryan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = proxy-iberv:8080
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [NSLU2 Flash Map Utility] c:\program files\nslu2 flash map utility\StorageLink.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {43E4476A-6C11-4274-AFA4-DF665B26EAE0} - hxxps://dss-sr95la01-drac/plugins/vkvm/ActiveXVideoViewer.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1234023679968
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LMIinit - LMIinit.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ryan\applic~1\mozilla\firefox\profiles\p9gzlw58.default\
FF - prefs.js: browser.startup.homepage - hxxp://tdbl.baseball.cbssports.com/scoring/live
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2009-5-3 38448]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-2-7 114768]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2009-3-1 8576]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-2-7 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-2-7 138680]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-2-8 47640]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R3 iTurns;iTurns;c:\windows\system32\drivers\iTurnsDriver.sys [2008-11-28 10704]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-2-7 38160]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\elock2burnerlockdriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\elock2fsctldriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-2-7 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-2-7 352920]
S3 VRSService;VRS Recording System;c:\program files\nch swift sound\vrs\vrs.exe [2009-8-1 851972]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

=============== Created Last 30 ================

2009-08-04 19:48 687,104 a------- c:\windows\isRS-000.tmp
2009-08-04 19:46 <DIR> --d----- C:\_OTM
2009-08-04 19:09 <DIR> --d----- c:\program files\XviD
2009-08-04 19:08 <DIR> --d----- c:\program files\AutoGK
2009-08-04 19:07 <DIR> --d----- C:\download
2009-08-04 18:58 24 a--sh--- c:\windows\7763329197986674
2009-08-04 18:58 40 ---sh--- c:\windows\system32\.zreglib
2009-08-04 18:55 <DIR> --d----- c:\program files\SlySoft
2009-08-04 01:22 1,002,846 a------- c:\windows\system32\obama_joker_11x17_300dpi.bmp
2009-08-03 23:37 <DIR> --d-h--- c:\docume~1\alluse~1\applic~1\{CC51AE54-B346-4954-ADDB-30BD4F138CF2}
2009-08-03 23:36 <DIR> --d----- c:\program files\iXi Tools
2009-08-03 23:31 520,192 -------- c:\windows\system32\ati2sgag.exe
2009-08-03 23:20 <DIR> --d----- C:\ATI
2009-08-03 23:06 552 a------- c:\windows\system32\d3d8caps.dat
2009-08-03 22:55 2,155,520 a------- c:\windows\system32\drivers\ati2mtag.sys
2009-08-03 22:55 2,155,520 a------- c:\windows\system32\dllcache\ati2mtag.sys
2009-08-03 22:55 870,784 a------- c:\windows\system32\dllcache\ati3d1ag.dll
2009-08-03 22:55 870,784 a------- c:\windows\system32\ati3d1ag.dll
2009-08-03 22:55 327,040 a------- c:\windows\system32\drivers\ati2mtaa.sys
2009-08-03 22:55 327,040 a------- c:\windows\system32\dllcache\ati2mtaa.sys
2009-08-03 22:55 377,984 a------- c:\windows\system32\dllcache\ati2dvaa.dll
2009-08-03 22:55 377,984 a------- c:\windows\system32\ati2dvaa.dll
2009-08-03 22:55 <DIR> --d----- c:\program files\Driver Cleaner Pro
2009-08-03 22:29 212,240 a------- c:\windows\system32\RichTx32.ocx
2009-08-03 22:29 124,688 a------- c:\windows\system32\MSWinSck.ocx
2009-08-03 22:29 1,753,088 a------- c:\windows\system32\ExGrid.dll
2009-08-03 22:29 614,400 a------- c:\windows\system32\ExButton.dll
2009-08-03 22:29 602,112 a------- c:\windows\system32\ExMenu.dll
2009-08-03 22:29 516,096 a------- c:\windows\system32\ExTab.dll
2009-08-03 22:29 307,200 a------- c:\windows\system32\ExPMenu.dll
2009-08-03 22:29 368,912 a------- c:\windows\system32\vbar332.dll
2009-08-03 22:29 140,288 a------- c:\windows\system32\COMDLG32.OCX
2009-08-03 22:29 118,784 a------- c:\windows\system32\eWebControl.dll
2009-08-03 22:29 <DIR> --d----- c:\program files\AnswersThatWork
2009-08-03 22:24 <DIR> --d----- c:\program files\Hot CPU Tester Pro 4 LE
2009-08-03 22:09 27,136 a------- c:\windows\system32\PCWizard.cpl
2009-08-03 22:09 <DIR> --d----- c:\program files\CPUID
2009-08-03 18:55 <DIR> --d----- c:\program files\TalkShoe
2009-08-02 02:15 <DIR> --d----- c:\program files\iPod
2009-08-02 02:15 <DIR> --d----- c:\program files\iTunes
2009-08-01 23:42 25,992 a------- c:\windows\system32\pgdfgsvc.exe
2009-08-01 23:35 <DIR> --d----- c:\program files\NCH Swift Sound
2009-08-01 23:34 <DIR> --d----- c:\program files\Trend Micro
2009-07-26 03:45 <DIR> --d----- c:\program files\NCH Software
2009-07-26 03:45 <DIR> --d----- c:\docume~1\ryan\applic~1\NCH Software
2009-07-24 03:39 104,512 a------- c:\windows\system32\drivers\AnyDVD.sys
2009-07-23 14:23 <DIR> --d----- c:\windows\SxsCaPendDel
2009-07-23 13:57 <DIR> --d----- c:\documents and settings\ryan\ErrorLogs
2009-07-23 13:53 <DIR> --d----- c:\docume~1\ryan\applic~1\TuneUp Software
2009-07-23 13:53 <DIR> --d----- c:\docume~1\alluse~1\applic~1\TuneUp Software
2009-07-23 13:52 <DIR> --dsh--- c:\docume~1\alluse~1\applic~1\{55A29068-F2CE-456C-9148-C869879E2357}
2009-07-23 13:37 <DIR> --d----- c:\docume~1\ryan\applic~1\uniblue
2009-07-20 00:54 <DIR> --d----- c:\documents and settings\ryan\.thumbnails
2009-07-20 00:52 <DIR> --d----- c:\documents and settings\ryan\.gimp-2.6
2009-07-20 00:52 <DIR> --d----- c:\documents and settings\ryan\.gegl-0.0
2009-07-20 00:51 <DIR> --d----- c:\program files\GIMP-2.0
2009-07-18 09:02 <DIR> --dsh--- C:\FOUND.002
2009-07-12 19:41 70,984 a------- c:\documents and settings\ryan\g2mdlhlpx.exe
2009-07-09 00:20 73,728 a------- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2009-08-03 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll
2009-07-19 08:19 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-09 00:19 410,984 a------- c:\windows\system32\deploytk.dll
2009-07-03 12:09 1,208,832 a------- c:\windows\system32\dllcache\urlmon.dll
2009-07-03 12:09 915,456 a------- c:\windows\system32\wininet.dll
2009-07-03 12:09 915,456 a------- c:\windows\system32\dllcache\wininet.dll
2009-07-03 12:09 206,848 a------- c:\windows\system32\dllcache\occache.dll
2009-07-03 12:09 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
2009-07-03 12:09 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll
2009-07-03 12:09 55,296 a------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-03 12:09 1,985,536 a------- c:\windows\system32\dllcache\iertutil.dll
2009-07-03 12:09 184,320 a------- c:\windows\system32\dllcache\iepeers.dll
2009-07-03 12:09 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll
2009-07-03 12:09 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-07-03 12:09 386,048 a------- c:\windows\system32\dllcache\iedkcs32.dll
2009-07-03 06:01 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-16 09:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 09:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-16 09:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 09:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-05 11:42 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-06-03 14:09 1,291,264 a------- c:\windows\system32\quartz.dll
2009-06-03 14:09 1,291,264 -------- c:\windows\system32\dllcache\quartz.dll
2009-05-25 07:01 89,256 a------- c:\windows\system32\ElbyCDIO.dll
2009-05-07 10:32 345,600 a------- c:\windows\system32\localspl.dll
2009-05-07 10:32 345,600 -------- c:\windows\system32\dllcache\localspl.dll
2009-04-29 21:50 1,073,741,824 a------- c:\documents and settings\ryan\data32.dat
2009-02-15 01:04 32,768 a------- c:\documents and settings\ryan\WebVpnRegKey6-webvpn-dss-la-gov.dll

============= FINISH: 20:41:35.06 ===============

--

New attach.txt is attached as attach.zip

Thanks...

Attached Files



#11 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:04:59 AM

Posted 05 August 2009 - 01:03 PM

Hi rmcc4444,

Use Windows Explorer to find and delete this file:

c:\windows\isRS-000.tmp

As an example:
To delete C:\WINDOWS\badfile.dll
Double click the My Computer icon on your Desktop. Or click on the Windows KEY + E.
Double click on Local Disc (C:\)
Double click on the Windows folder,
Right click on badfile.dll and then from the menu that appears, click on Delete



Then run this online scan

I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image
Can you give us a bit more background about the problems on your laptop? What actions make it slow? Booting? Games? Other applications being opened?

So far, I'm not finding much evidence of malware, however the temp file above tells me that something has been here.
Posted Image
m0le is a proud member of UNITE

#12 rmcc4444

rmcc4444
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:10:59 PM

Posted 05 August 2009 - 01:33 PM

I will reply to this as soon as I get home from work.

Thanks..

#13 rmcc4444

rmcc4444
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:10:59 PM

Posted 05 August 2009 - 07:38 PM

I don't have that file on my computer. See here...

Posted Image


--

Before running ESET I disabled Avast. Here is the results..

C:\files\FLV.Recorder.v3.5.Incl.Keymaker-CORE\cr-fr350.zip probably a variant of Win32/Agent trojan deleted - quarantined

--

I was looking for a Flash recorder a while back so I think that is where that came from. It's *probably* a harmless keygen, but you're the expert.


---

The main symptoms of my computer are that things get very slow. You know when you have defrag running in the background and everything else you do slows down? Well, that's what it feels like lately. I can say it has gotten better since I started this process though, however, it still seems a bit slow. I've tried uninstalling and re-installing Firefox, Flash, Codecs, VLC, etc.

#14 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:04:59 AM

Posted 05 August 2009 - 08:26 PM

The file that ESET found was an infected file. Keygens aren't harmless.

They are a known way to attract malware to your system. As well as being illegal, 'Cracks' and 'Keygens' are often associated or loaded with malware, and should be avoided (along with 'crack' sites).

Trojan.Agent is targeted by MBAM but it found no files associated with Agent which appears to show that it is no longer there. Your symptoms imply that files are still running.

Please download ComboFix from one of these locations:* IMPORTANT !!! Save ComboFix.exe to your Desktop but rename it Combo-Fix.exe
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combo-Fix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Please keep me updated on the system performance as well as posting the log.

Thanks :thumbup2:
Posted Image
m0le is a proud member of UNITE

#15 rmcc4444

rmcc4444
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:10:59 PM

Posted 05 August 2009 - 10:32 PM

Here ya go:

ComboFix 09-08-04.04 - Ryan 08/05/2009 22:17.1.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2302.1626 [GMT -5:00]
Running from: c:\documents and settings\Ryan\Desktop\Combo-Fix.exe
AV: avast! antivirus 4.8.1335 [VPS 090805-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\2b490a.msi
c:\windows\Installer\2e3bc0.msi
c:\windows\Installer\3f4d7ad.msi
c:\windows\kb913800.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF


((((((((((((((((((((((((( Files Created from 2009-07-06 to 2009-08-06 )))))))))))))))))))))))))))))))
.

2009-08-05 23:19 . 2009-08-05 23:19 -------- d-----w- c:\program files\ESET
2009-08-05 00:46 . 2009-08-05 00:46 -------- d-----w- C:\_OTM
2009-08-05 00:44 . 2009-08-05 00:44 -------- d-----w- c:\program files\ERUNT
2009-08-05 00:09 . 2009-08-05 00:09 -------- d-----w- c:\program files\XviD
2009-08-05 00:09 . 2009-08-05 00:09 -------- d-----w- c:\program files\Gabest
2009-08-05 00:08 . 2009-08-05 00:08 -------- d-----w- c:\program files\AutoGK
2009-08-05 00:07 . 2009-08-05 00:07 -------- d-----w- C:\download
2009-08-04 23:58 . 2009-08-04 23:58 -------- d-----w- c:\documents and settings\All Users\Application Data\SlySoft
2009-08-04 23:55 . 2009-08-04 23:55 -------- d-----w- c:\program files\SlySoft
2009-08-04 23:02 . 2009-08-04 23:02 -------- d-----w- c:\documents and settings\Ryan\Application Data\vlc
2009-08-04 04:37 . 2009-08-04 04:37 -------- d--h--w- c:\documents and settings\All Users\Application Data\{CC51AE54-B346-4954-ADDB-30BD4F138CF2}
2009-08-04 04:37 . 2009-03-10 13:37 2339555 ----a-w- c:\documents and settings\All Users\Application Data\{CC51AE54-B346-4954-ADDB-30BD4F138CF2}\DriverUpdaterPro.exe
2009-08-04 04:36 . 2009-08-04 04:37 -------- d-----w- c:\program files\iXi Tools
2009-08-04 04:31 . 2007-06-13 19:29 520192 ------w- c:\windows\system32\ati2sgag.exe
2009-08-04 04:20 . 2009-08-04 04:20 -------- d-----w- C:\ATI
2009-08-04 04:06 . 2009-08-04 04:06 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-08-04 03:55 . 2008-04-13 23:11 870784 ----a-w- c:\windows\system32\dllcache\ati3d1ag.dll
2009-08-04 03:55 . 2008-04-13 23:11 870784 ----a-w- c:\windows\system32\ati3d1ag.dll
2009-08-04 03:55 . 2007-06-13 19:24 2155520 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-08-04 03:55 . 2007-06-13 19:24 2155520 ----a-w- c:\windows\system32\dllcache\ati2mtag.sys
2009-08-04 03:55 . 2004-08-04 03:29 327040 ----a-w- c:\windows\system32\drivers\ati2mtaa.sys
2009-08-04 03:55 . 2004-08-04 03:29 327040 ----a-w- c:\windows\system32\dllcache\ati2mtaa.sys
2009-08-04 03:55 . 2008-04-13 23:11 377984 ----a-w- c:\windows\system32\dllcache\ati2dvaa.dll
2009-08-04 03:55 . 2008-04-13 23:11 377984 ----a-w- c:\windows\system32\ati2dvaa.dll
2009-08-04 03:55 . 2009-08-04 03:55 -------- d-----w- c:\program files\Driver Cleaner Pro
2009-08-04 03:29 . 2007-06-08 18:53 1753088 ----a-w- c:\windows\system32\ExGrid.dll
2009-08-04 03:29 . 2007-06-05 15:20 602112 ----a-w- c:\windows\system32\ExMenu.dll
2009-08-04 03:29 . 2007-06-05 15:19 516096 ----a-w- c:\windows\system32\ExTab.dll
2009-08-04 03:29 . 2007-04-03 21:51 614400 ----a-w- c:\windows\system32\ExButton.dll
2009-08-04 03:29 . 2007-04-03 21:51 307200 ----a-w- c:\windows\system32\ExPMenu.dll
2009-08-04 03:29 . 2005-10-04 13:11 118784 ----a-w- c:\windows\system32\eWebControl.dll
2009-08-04 03:29 . 1998-04-24 05:00 368912 ----a-w- c:\windows\system32\vbar332.dll
2009-08-04 03:29 . 2009-08-04 03:29 -------- d-----w- c:\program files\AnswersThatWork
2009-08-04 03:24 . 2009-08-04 03:24 -------- d-----w- c:\program files\Hot CPU Tester Pro 4 LE
2009-08-04 03:09 . 2009-08-04 03:09 -------- d-----w- c:\program files\CPUID
2009-08-03 23:55 . 2009-08-03 23:55 -------- d-----w- c:\program files\TalkShoe
2009-08-03 04:07 . 2009-08-03 04:07 1089 ----a-w- c:\documents and settings\Ryan\Application Data\.purple\certificates\x509\tls_peers\login.yahoo.com
2009-08-03 04:02 . 2009-08-03 04:02 2095 ----a-w- c:\documents and settings\Ryan\Application Data\.purple\certificates\x509\tls_peers\login.live.com
2009-08-02 07:17 . 2009-08-02 07:17 -------- d-----w- c:\program files\Safari
2009-08-02 07:15 . 2009-08-02 07:15 -------- d-----w- c:\program files\iPod
2009-08-02 07:15 . 2009-08-02 07:15 -------- d-----w- c:\program files\iTunes
2009-08-02 07:08 . 2009-08-02 07:08 75040 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-08-02 04:42 . 2009-08-02 04:42 25992 ----a-w- c:\windows\system32\pgdfgsvc.exe
2009-08-02 04:35 . 2009-08-02 04:35 122880 ----a-w- c:\documents and settings\All Users\Application Data\NCH Swift Sound\VRS\mp3el.exe
2009-08-02 04:35 . 2009-08-02 04:35 -------- d-----w- c:\program files\NCH Swift Sound
2009-08-02 04:35 . 2009-08-02 04:35 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-08-02 04:34 . 2009-08-02 04:34 -------- d-----w- c:\program files\Trend Micro
2009-07-26 08:46 . 2009-07-26 08:46 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software
2009-07-26 08:45 . 2009-07-26 08:45 -------- d-----w- c:\program files\NCH Software
2009-07-26 08:45 . 2009-07-26 08:45 -------- d-----w- c:\documents and settings\Ryan\Application Data\NCH Software
2009-07-24 08:39 . 2009-07-24 08:39 104512 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
2009-07-23 19:23 . 2009-07-23 19:23 -------- d-----w- c:\windows\SxsCaPendDel
2009-07-23 18:57 . 2009-07-23 18:57 -------- d-----w- c:\documents and settings\Ryan\ErrorLogs
2009-07-23 18:55 . 2009-07-23 20:04 102512 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-07-23 18:53 . 2009-07-23 18:53 -------- d-----w- c:\documents and settings\Ryan\Application Data\TuneUp Software
2009-07-23 18:53 . 2009-07-23 18:53 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-07-23 18:52 . 2009-07-23 18:52 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-07-23 18:37 . 2009-07-23 18:37 -------- d-----w- c:\documents and settings\Ryan\Application Data\uniblue
2009-07-20 05:54 . 2009-07-20 05:54 -------- d-----w- c:\documents and settings\Ryan\.thumbnails
2009-07-20 05:52 . 2009-07-20 05:52 -------- d-----w- c:\documents and settings\Ryan\.gimp-2.6
2009-07-20 05:52 . 2009-07-20 05:52 -------- d-----w- c:\documents and settings\Ryan\.gegl-0.0
2009-07-20 05:51 . 2009-07-20 05:51 -------- d-----w- c:\program files\GIMP-2.0
2009-07-18 14:02 . 2009-07-18 14:02 -------- d-sh--w- C:\FOUND.002
2009-07-13 00:41 . 2009-07-13 00:41 70984 ----a-w- c:\documents and settings\Ryan\g2mdlhlpx.exe
2009-07-09 05:19 . 2009-07-09 05:19 -------- d-----w- c:\program files\Java

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-05 07:45 . 2006-05-12 19:18 15560 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-08-04 09:57 . 2009-02-10 03:55 1 ----a-w- c:\documents and settings\Ryan\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-08-04 04:21 . 2009-02-11 15:26 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-08-03 18:36 . 2009-02-07 13:04 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 18:36 . 2009-02-07 13:04 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-09 05:19 . 2009-02-07 14:21 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-09 05:19 . 2009-06-09 23:21 152576 ----a-w- c:\documents and settings\Ryan\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-03 17:09 . 2006-01-09 16:02 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 23:24 . 2009-06-29 23:24 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-06-29 23:23 . 2009-06-29 23:23 -------- d-----w- c:\program files\QuickTime
2009-06-29 07:24 . 2009-06-29 07:24 -------- d-----w- c:\program files\ATI Technologies
2009-06-29 07:00 . 2009-06-29 07:00 -------- d-----w- c:\documents and settings\Ryan\Application Data\Auslogics
2009-06-29 07:00 . 2009-06-29 07:00 -------- d-----w- c:\program files\Auslogics
2009-06-29 00:16 . 2009-06-29 00:16 -------- d-----w- c:\program files\Citrix
2009-06-27 02:19 . 2009-06-27 02:19 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-06-27 02:18 . 2009-06-27 02:18 -------- d-----w- c:\documents and settings\Ryan\Application Data\McAfee
2009-06-25 01:31 . 2009-06-25 01:31 -------- d-----w- c:\program files\Admiresoft
2009-06-23 07:38 . 2009-06-23 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit
2009-06-18 07:27 . 2009-06-18 07:27 -------- d-----w- c:\program files\Bonjour
2009-06-16 14:36 . 2004-08-11 01:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-11 01:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-13 03:03 . 2009-06-13 03:03 -------- d-----w- c:\program files\thinkorswim
2009-06-08 06:24 . 2009-06-08 06:24 -------- d-----w- c:\program files\ProcessExplorer
2009-06-05 16:42 . 2009-06-18 07:24 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-06-05 16:42 . 2009-03-01 22:42 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-03 19:09 . 2005-06-28 23:55 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-25 12:01 . 2009-05-25 12:01 89256 ----a-w- c:\windows\system32\ElbyCDIO.dll
2009-05-17 06:23 . 2009-05-17 06:23 2141 ----a-w- c:\documents and settings\Ryan\Application Data\.purple\certificates\x509\tls_peers\omega.contacts.msn.com
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2007-01-30 1432064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"NSLU2 Flash Map Utility"="c:\program files\NSLU2 Flash Map Utility\StorageLink.exe" [2004-04-30 245760]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-21 177472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-17 01:35 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\System32\\ftp.exe"=
"c:\\Program Files\\NSLU2 Flash Map Utility\\StorageLink.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [5/3/2009 1:00 AM 38448]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2/7/2009 7:15 AM 114768]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [3/1/2009 5:52 PM 8576]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/7/2009 7:15 AM 20560]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 6:46 PM 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2/8/2009 11:42 PM 47640]
R3 iTurns;iTurns;c:\windows\system32\drivers\iTurnsDriver.sys [11/28/2008 1:26 PM 10704]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\eLock2BurnerLockDriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\eLock2FSCTLDriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?]
S3 VRSService;VRS Recording System;c:\program files\NCH Swift Sound\VRS\vrs.exe [8/1/2009 11:35 PM 851972]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-05 c:\windows\Tasks\User_Feed_Synchronization-{73DDBE0E-B45D-4F1A-A6A0-052D1186E53E}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]

2009-08-03 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-07-16 14:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = proxy-iberv:8080
uInternet Settings,ProxyOverride = *.local
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {43E4476A-6C11-4274-AFA4-DF665B26EAE0} - hxxps://dss-sr95la01-drac/plugins/vkvm/ActiveXVideoViewer.cab
FF - ProfilePath - c:\documents and settings\Ryan\Application Data\Mozilla\Firefox\Profiles\p9gzlw58.default\
FF - prefs.js: browser.startup.homepage - hxxp://tdbl.baseball.cbssports.com/scoring/live
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-05 22:22
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(184)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'explorer.exe'(3344)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-08-06 22:25 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-06 03:25

Pre-Run: 59,604,926,464 bytes free
Post-Run: 59,489,583,104 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer

284 --- E O F --- 2009-08-02 00:31



---

System performance has definitely improved. However, its still a bit choppy. It seems the longer Firefox is open, the slower things get. Saying that, It no longer seems like my drive is being defragged when I try to navigate around the web.

Any other tricks up your sleeve to further optimize this sucker? :thumbup2:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users