I apologize for the delayed response, had a few issues getting some of the programs to work as you will read below. The issues are still the same, can't run simple programs like notepad, even with safemode. Safety Center is still on it (Icon is on the desktop).
Also, it tries to jump to my JUMP Drive (1GB) when I move the files from one computer to the other.
Here is the info from the first post as well:
"This computer has at least the "Safety Center" fake security program. Plus it's disabled
all of the control panel options. Keeps saying that it can't locate system32.dll.
I was able to run DDS normally but RootRepeal would only work in Safe Mode.
In normal mode, it would cause the computer to reboot.
Before this computer had a pretty bad infection but it got reinfected by something
else."
Thanks again for the help.
Monkeyb00y
Here are the logs requested from the 2 posts, first & second.
exehelperlog.txt BELOW:
exeHelper by Raktor
Build 20091220
Run at 19:23:43 on 01/02/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Deleting file C:\Program Files\protection system\psystem.exe
Deleting file C:\Program Files\Windows Police Pro\msvcm80.dll
Deleting file C:\Program Files\Windows Police Pro\msvcp80.dll
Deleting file C:\Program Files\Windows Police Pro\msvcr80.dll
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--
ComboFix kept saying it was an infected version & that I would need to redownload it. I tried it a few different times but it still wouldn't work.
GMER kept locking up, crashing Windows, even after trying it in SAFE Mode.
-------
OTL.txt BELOW:
OTL logfile created on: 1/3/2010 1:19:59 AM - Run 1
OTL by OldTimer - Version 3.1.20.2 Folder = C:\Documents and Settings\Peeper\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
191.00 Mb Total Physical Memory | 29.00 Mb Available Physical Memory | 15.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 1056 2112 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 32.60 Gb Total Space | 4.58 Gb Free Space | 14.06% Space Free | Partition Type: NTFS
Drive D: | 4.66 Gb Total Space | 0.92 Gb Free Space | 19.81% Space Free | Partition Type: FAT32
Drive E: | 397.39 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 960.72 Mb Total Space | 959.98 Mb Free Space | 99.92% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: YOUR-7008FFA13B
Current User Name: Peeper
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 90 Days
Output = Standard
========== Processes (SafeList) ========== PRC - [2010/01/02 23:02:44 | 00,534,528 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Peeper\Desktop\OTL.exe
PRC - [2009/08/03 21:41:02 | 00,040,944 | -H-- | M] () -- C:\WINDOWS\system32\config\systemprofile\systemprofile.exe
PRC - [2009/07/21 17:15:04 | 00,034,816 | ---- | M] () -- C:\Documents and Settings\Peeper\Application Data\pridl\pridl.exe
PRC - [2009/07/20 14:39:52 | 00,058,368 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\tuvajf.exe
PRC - [2009/07/20 14:39:48 | 00,247,296 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\Application Data\digifast\digifast.exe
PRC - [2009/07/20 14:34:10 | 00,033,792 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\Application Data\cft\cft.exe
PRC - [2009/06/05 10:48:14 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/08/19 11:13:54 | 00,323,584 | ---- | M] (Motive Communications, Inc.) -- C:\Program Files\Common Files\Motive\McciCMService.exe
PRC - [2008/07/26 07:25:36 | 00,150,040 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
PRC - [2008/07/26 07:23:42 | 00,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe
PRC - [2008/04/13 19:12:19 | 01,053,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004/08/10 10:48:01 | 00,036,903 | ---- | M] () -- C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe
========== Modules (SafeList) ========== MOD - [2010/01/02 23:02:44 | 00,534,528 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Peeper\Desktop\OTL.exe
MOD - [2009/06/13 04:35:17 | 00,049,664 | -HS- | M] () -- C:\WINDOWS\system32\kuvudidi.dll
MOD - [2009/06/13 04:35:17 | 00,049,664 | ---- | M] () -- C:\WINDOWS\system32\fosopoku.dll
MOD - [2008/07/26 07:25:24 | 00,109,080 | ---- | M] (Logitech Inc.) -- C:\WINDOWS\Temp\logishrd\LVPrcInj01.dll
MOD - [2008/04/13 19:11:56 | 00,019,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\linkinfo.dll
MOD - [2004/08/10 10:48:01 | 00,024,613 | ---- | M] (BackWeb) -- C:\Documents and Settings\Peeper\Local Settings\Temp\IadHide5.dll
========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- -- (IDriverT)
SRV - File not found [On_Demand | Stopped] -- -- (aspnet_state)
SRV - [2009/09/10 20:08:00 | 01,097,096 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2009/07/13 13:02:50 | 00,542,496 | ---- | M] (Apple Inc.) [On_Demand | Stopped] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/07/12 05:23:33 | 00,190,448 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2009/06/05 10:48:14 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/01/07 11:40:56 | 00,348,752 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/08/19 11:13:54 | 00,323,584 | ---- | M] (Motive Communications, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Motive\McciCMService.exe -- (McciCMService)
SRV - [2008/07/26 07:25:36 | 00,150,040 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008/07/26 07:23:42 | 00,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
========== Driver Services (SafeList) ========== DRV - [2009/07/17 20:47:30 | 00,018,944 | -H-- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\protect.sys -- (protect)
DRV - [2009/04/03 10:18:26 | 00,130,936 | ---- | M] (PC Tools) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2009/03/19 15:32:48 | 00,023,400 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2008/07/26 10:26:22 | 00,041,752 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2008/07/26 10:22:34 | 02,570,520 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008/07/26 07:25:02 | 00,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2008/04/25 05:38:22 | 00,071,184 | ---- | M] (Raxco Software, Inc.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\DefragFs.sys -- (DefragFS)
DRV - [2008/04/13 19:11:56 | 00,002,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\mndisk.sys -- (mndisk)
DRV - [2008/04/13 11:39:15 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2008/01/28 15:56:47 | 00,018,304 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2008/01/28 15:56:38 | 00,019,712 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2007/11/26 15:33:52 | 00,835,792 | ---- | M] (Authentium, Inc) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Css-Dvp.sys -- (CSS DVP)
DRV - [2007/02/13 17:36:14 | 00,063,289 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pv_wdm.sys -- (JL2004A)
DRV - [2004/12/16 13:36:30 | 00,042,496 | ---- | M] (VIA Technologies, Inc. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fetnd5bv.sys -- (FETND5BV)
DRV - [2004/12/07 20:08:58 | 00,172,672 | ---- | M] (Copyright © VIA/S3 Graphics Co, Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vtmini.sys -- (viagfx)
DRV - [2004/10/01 10:24:02 | 02,279,424 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/08/04 07:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2004/08/03 21:10:34 | 00,730,653 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ialmnt5.sys -- (ialm)
DRV - [2004/08/03 16:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
DRV - [2004/07/19 19:33:14 | 00,218,112 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
DRV - [2004/07/17 06:20:34 | 00,012,160 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2004/06/29 19:07:18 | 01,268,204 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2003/12/12 08:54:14 | 00,391,424 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)
DRV - [2003/12/02 20:23:20 | 00,142,336 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
DRV - [2003/11/12 03:41:00 | 00,041,984 | ---- | M] (VIA Technologies, Inc. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fetnd5b.sys -- (FETNDISB)
DRV - [2003/07/18 18:58:20 | 00,036,992 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys -- (SISAGP)
DRV - [2003/07/02 13:42:00 | 00,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2002/10/04 19:04:10 | 00,046,976 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139)
DRV - [2002/07/30 00:43:50 | 00,023,808 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)
DRV - [2001/08/17 13:53:32 | 00,006,784 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\serscan.sys -- (StillCam)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.yahoo.com/IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =
http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
http://www.google.com/ieIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
http://search.live.com/sphome.aspx IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://track.moreniche.com/hit.php?w=155970&s=147IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://track.moreniche.com/hit.php?w=155970&s=147IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://track.moreniche.com/hit.php?w=155970&s=147IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ========== FF - prefs.js..browser.startup.homepage: "
http://www.yahoo.com/"FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3789
FF - prefs.js..extensions.enabledItems: browserhighlighter@ebay.com:1.0.14907
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/09/13 14:38:31 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/09/13 13:23:42 | 00,000,000 | ---D | M]
[2009/02/09 16:14:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Mozilla\Extensions
[2010/01/03 00:27:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Mozilla\Firefox\Profiles\jz1l2yuv.default\extensions
[2009/06/16 09:38:36 | 00,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Peeper\Application Data\Mozilla\Firefox\Profiles\jz1l2yuv.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/05/01 00:52:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Mozilla\Firefox\Profiles\jz1l2yuv.default\extensions\moveplayer@movenetworks.com
[2010/01/03 00:17:37 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/01/03 00:17:34 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\browserhighlighter@ebay.com
[2009/07/20 14:40:17 | 00,211,968 | ---- | M] () -- C:\Program Files\Mozilla Firefox\components\dfff.dll
[2009/07/13 05:07:08 | 00,089,600 | ---- | M] () -- C:\Program Files\Mozilla Firefox\components\WWShow.dll
[2009/02/17 04:13:28 | 00,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll
O1 HOSTS File: (26 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 jL.chura.pl
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {e3405779-0f64-4fe7-924f-5c0c3090375f} - C:\WINDOWS\System32\kuvudidi.dll ()
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [HelpCenter4.1] C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [kegemihulu] C:\WINDOWS\System32\royomuya.dll ()
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKU\.DEFAULT..\Run: [cft] C:\WINDOWS\system32\config\systemprofile\Application Data\cft\cft.exe ()
O4 - HKU\.DEFAULT..\Run: [DigiFast] C:\WINDOWS\system32\config\systemprofile\Application Data\digifast\digifast.exe ()
O4 - HKU\.DEFAULT..\Run: [Download] C:\Program Files\HelpCenterDecomJob\ssGet.exe ()
O4 - HKU\.DEFAULT..\Run: [L9lVqKBeE] C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\tuvajf.exe ()
O4 - HKU\.DEFAULT..\Run: [pridl] C:\Documents and Settings\Peeper\Application Data\pridl\pridl.exe ()
O4 - HKU\.DEFAULT..\Run: [systemprofile] C:\WINDOWS\System32\config\systemprofile\systemprofile.exe ()
O4 - HKU\S-1-5-18..\Run: [cft] C:\WINDOWS\system32\config\systemprofile\Application Data\cft\cft.exe ()
O4 - HKU\S-1-5-18..\Run: [DigiFast] C:\WINDOWS\system32\config\systemprofile\Application Data\digifast\digifast.exe ()
O4 - HKU\S-1-5-18..\Run: [Download] C:\Program Files\HelpCenterDecomJob\ssGet.exe ()
O4 - HKU\S-1-5-18..\Run: [L9lVqKBeE] C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\tuvajf.exe ()
O4 - HKU\S-1-5-18..\Run: [pridl] C:\Documents and Settings\Peeper\Application Data\pridl\pridl.exe ()
O4 - HKU\S-1-5-18..\Run: [systemprofile] C:\WINDOWS\System32\config\systemprofile\systemprofile.exe ()
O4 - HKLM..\RunOnce: [áN@] Reg Error: Invalid data type. File not found
O4 - HKLM..\RunOnce: [ÑN@] Reg Error: Invalid data type. File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EditLevel = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCommonGroups = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EditLevel = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCommonGroups = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1847359679-148087881-2726939249-1010\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (fosopoku.dll) - C:\WINDOWS\System32\fosopoku.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 08:39:16 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001/07/27 15:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2004/04/30 07:01:14 | 00,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2003/09/26 10:47:00 | 00,000,057 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{7fd05896-c1e5-11db-a506-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{7fd05896-c1e5-11db-a506-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fd05898-c1e5-11db-a506-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{7fd05898-c1e5-11db-a506-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fd05898-c1e5-11db-a506-806d6172696f}\Shell\AutoRun\command - "" = E:\BANDLINK\BLAUNCH.EXE -- [2004/03/05 07:44:08 | 00,176,128 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk /r \??\C:) - File not found
O34 - HKLM BootExecute: (PDBoot.exe) - File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
========== Files/Folders - Created Within 90 Days ========== [2010/01/03 00:16:50 | 00,534,528 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Peeper\Desktop\OTL.exe
[2010/01/02 19:32:51 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/11/09 14:31:01 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot2
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[146 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 90 Days ========== [2010/01/03 01:21:57 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\boguyepe
[2010/01/03 00:13:16 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/03 00:13:11 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/03 00:13:09 | 20,085,5552 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/02 23:04:36 | 00,000,597 | ---- | M] () -- C:\Documents and Settings\Peeper\Desktop\OTL-Code.html
[2010/01/02 23:02:44 | 00,534,528 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Peeper\Desktop\OTL.exe
[2010/01/02 20:12:36 | 00,316,416 | ---- | M] () -- C:\Documents and Settings\Peeper\Desktop\nn5pj5cb.exe
[2010/01/02 19:40:48 | 00,262,144 | -H-- | M] () -- C:\Documents and Settings\Peeper\NTUSER.DAT
[2010/01/02 18:22:45 | 00,000,042 | -HS- | M] () -- C:\Documents and Settings\Peeper\ntuser.ini
[2010/01/02 18:22:44 | 01,381,776 | -H-- | M] () -- C:\Documents and Settings\Peeper\Local Settings\Application Data\IconCache.db
[2010/01/02 18:22:42 | 00,000,512 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/01/02 18:22:42 | 00,000,281 | RHS- | M] () -- C:\boot.ini
[2010/01/02 18:22:42 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/01/02 17:22:44 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/11/09 14:31:42 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2009/11/09 14:31:42 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2009/11/09 13:33:40 | 00,441,626 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/11/09 13:33:40 | 00,381,692 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/11/09 13:33:40 | 00,053,436 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[146 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ========== [2010/01/03 00:16:53 | 00,000,597 | ---- | C] () -- C:\Documents and Settings\Peeper\Desktop\OTL-Code.html
[2010/01/02 19:31:20 | 00,316,416 | ---- | C] () -- C:\Documents and Settings\Peeper\Desktop\nn5pj5cb.exe
[2010/01/02 18:23:41 | 20,085,5552 | -HS- | C] () -- C:\hiberfil.sys
[2009/09/18 08:17:53 | 00,117,760 | ---- | C] () -- C:\WINDOWS\System32\capesnp.dll
[2009/07/27 23:25:08 | 00,066,560 | ---- | C] () -- C:\WINDOWS\System32\drivers\rxerxtaprmdmdeqx.sys
[2009/07/17 20:47:30 | 00,018,944 | -H-- | C] () -- C:\WINDOWS\System32\drivers\protect.sys
[2009/07/15 02:10:32 | 00,049,475 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/06/20 16:29:31 | 00,089,088 | -HS- | C] () -- C:\WINDOWS\System32\hugewejo.dll
[2009/06/20 16:29:31 | 00,038,400 | -HS- | C] () -- C:\WINDOWS\System32\muzaloda.dll
[2009/06/20 04:29:22 | 00,088,576 | -HS- | C] () -- C:\WINDOWS\System32\malufige.dll
[2009/06/20 04:29:22 | 00,038,400 | -HS- | C] () -- C:\WINDOWS\System32\kebajupa.dll
[2009/06/19 16:28:54 | 00,088,576 | -HS- | C] () -- C:\WINDOWS\System32\wekedahu.dll
[2009/06/19 16:28:54 | 00,037,888 | -HS- | C] () -- C:\WINDOWS\System32\kavanaga.dll
[2009/06/19 04:28:46 | 00,088,064 | -HS- | C] () -- C:\WINDOWS\System32\vazipuve.dll
[2009/06/19 04:28:46 | 00,038,400 | -HS- | C] () -- C:\WINDOWS\System32\zimusure.dll
[2009/06/18 16:28:47 | 00,088,576 | -HS- | C] () -- C:\WINDOWS\System32\pivumuwe.dll
[2009/06/18 16:28:47 | 00,037,888 | -HS- | C] () -- C:\WINDOWS\System32\bedoyoso.dll
[2009/06/18 04:28:38 | 00,089,088 | -HS- | C] () -- C:\WINDOWS\System32\bonafefa.dll
[2009/06/18 04:28:38 | 00,038,400 | -HS- | C] () -- C:\WINDOWS\System32\dohakopo.dll
[2009/06/17 16:28:23 | 00,089,088 | -HS- | C] () -- C:\WINDOWS\System32\galaloko.dll
[2009/06/17 16:28:23 | 00,037,888 | -HS- | C] () -- C:\WINDOWS\System32\talewagi.dll
[2009/06/17 02:03:15 | 00,088,576 | -HS- | C] () -- C:\WINDOWS\System32\tafayamo.dll
[2009/06/17 02:03:15 | 00,038,400 | -HS- | C] () -- C:\WINDOWS\System32\fayohiyo.dll
[2009/06/16 14:03:06 | 00,088,064 | -HS- | C] () -- C:\WINDOWS\System32\ribogazu.dll
[2009/06/16 14:03:06 | 00,037,376 | -HS- | C] () -- C:\WINDOWS\System32\mutamufe.dll
[2009/06/16 00:26:27 | 00,088,576 | -HS- | C] () -- C:\WINDOWS\System32\sojeseko.dll
[2009/06/16 00:26:27 | 00,037,888 | -HS- | C] () -- C:\WINDOWS\System32\relebopi.dll
[2009/06/15 12:26:26 | 00,088,576 | -HS- | C] () -- C:\WINDOWS\System32\nigatali.dll
[2009/06/15 12:26:26 | 00,037,888 | -HS- | C] () -- C:\WINDOWS\System32\kitujefo.dll
[2009/06/14 17:51:19 | 00,088,064 | -HS- | C] () -- C:\WINDOWS\System32\nijopido.dll
[2009/06/14 17:51:19 | 00,037,376 | -HS- | C] () -- C:\WINDOWS\System32\fatopoze.dll
[2009/06/14 04:35:10 | 00,037,376 | -HS- | C] () -- C:\WINDOWS\System32\mipibote.dll
[2009/06/13 16:34:38 | 00,088,064 | -HS- | C] () -- C:\WINDOWS\System32\saneneje.dll
[2009/06/13 16:34:38 | 00,038,400 | -HS- | C] () -- C:\WINDOWS\System32\ludizibi.dll
[2009/06/13 04:35:17 | 00,049,664 | -HS- | C] () -- C:\WINDOWS\System32\royomuya.dll
[2009/06/13 04:35:17 | 00,049,664 | -HS- | C] () -- C:\WINDOWS\System32\kuvudidi.dll
[2009/06/13 04:35:17 | 00,049,664 | ---- | C] () -- C:\WINDOWS\System32\fosopoku.dll
[2009/06/13 04:34:33 | 00,088,576 | -HS- | C] () -- C:\WINDOWS\System32\kurutudo.dll
[2009/06/13 04:34:33 | 00,049,664 | -HS- | C] () -- C:\WINDOWS\System32\lusonige.dll
[2009/06/13 04:34:33 | 00,037,376 | -HS- | C] () -- C:\WINDOWS\System32\jotofuza.dll
[2009/06/12 16:33:55 | 00,088,576 | -HS- | C] () -- C:\WINDOWS\System32\kehitulo.dll
[2009/06/12 16:33:55 | 00,037,376 | -HS- | C] () -- C:\WINDOWS\System32\bodizeya.dll
[2009/04/28 23:56:02 | 04,918,917 | ---- | C] () -- C:\WINDOWS\System32\wiadllcra.dll
[2009/04/28 23:56:02 | 04,833,518 | ---- | C] () -- C:\WINDOWS\System32\exeripand.dll
[2009/04/28 23:56:02 | 03,927,986 | ---- | C] () -- C:\WINDOWS\System32\loapiaras.dll
[2009/04/28 23:56:02 | 02,128,841 | ---- | C] () -- C:\WINDOWS\System32\giripjeand.dll
[2009/04/28 23:56:02 | 01,648,344 | ---- | C] () -- C:\WINDOWS\System32\lopevapi.dll
[2009/04/28 23:56:02 | 01,480,318 | ---- | C] () -- C:\WINDOWS\System32\pocodllet.dll
[2009/04/28 23:56:02 | 01,298,528 | ---- | C] () -- C:\WINDOWS\System32\bcranig.dll
[2009/04/28 23:56:02 | 01,260,491 | ---- | C] () -- C:\WINDOWS\System32\32jeexje.dll
[2009/04/28 23:56:02 | 00,913,439 | ---- | C] () -- C:\WINDOWS\System32\lowdopo.dll
[2009/04/10 14:29:24 | 00,066,482 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2008/10/02 13:41:32 | 00,054,134 | ---- | C] () -- C:\Program Files\INSTALL.LOG
[2008/07/26 07:25:02 | 00,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/11/05 19:53:17 | 00,009,728 | ---- | C] () -- C:\Documents and Settings\Peeper\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/08/16 11:25:50 | 00,001,232 | ---- | C] () -- C:\WINDOWS\System32\drivers\JL2004A_PhotoViewer_Tools.sys
[2007/03/19 23:04:46 | 00,000,128 | ---- | C] () -- C:\Documents and Settings\Peeper\Local Settings\Application Data\fusioncache.dat
[2007/02/28 13:51:26 | 00,000,396 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/02/25 23:18:04 | 00,000,393 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2007/02/25 23:10:44 | 00,001,963 | ---- | C] () -- C:\WINDOWS\yahtzee.ini
[2007/02/25 23:09:07 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2007/02/25 23:07:52 | 00,000,889 | ---- | C] () -- C:\WINDOWS\disney.ini
[2006/09/26 12:41:23 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
[2006/09/26 12:41:23 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
[2006/06/29 12:38:16 | 00,000,070 | ---- | C] () -- C:\WINDOWS\8200978A.ini
[2005/10/24 10:54:24 | 00,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll
[2005/09/30 13:58:48 | 00,007,262 | ---- | C] () -- C:\WINDOWS\hpdj3840.ini
[2005/09/30 13:57:57 | 00,000,414 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
[2004/09/17 17:37:42 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2004/09/17 16:36:16 | 00,002,304 | ---- | C] () -- C:\WINDOWS\System32\mndisk.sys
[2004/08/11 09:19:36 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/08/10 10:56:42 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll
[2004/08/10 10:55:59 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/08/10 10:55:59 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll
[2004/08/10 10:49:42 | 00,167,936 | ---- | C] () -- C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2004/08/10 10:42:09 | 00,025,960 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2004/08/10 10:41:29 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2004/08/10 10:25:46 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/08/10 09:52:17 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 08:57:41 | 00,299,073 | ---- | C] () -- C:\WINDOWS\System32\PythonCOM22.dll
[2004/08/10 08:57:41 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes22.dll
[2004/08/10 08:57:14 | 00,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2004/08/10 08:44:56 | 00,000,802 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 08:19:50 | 00,000,553 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
========== LOP Check ========== ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. >[2009/11/09 12:48:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\19937964
[2004/08/10 10:09:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2008/12/26 22:26:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple
[2008/12/26 22:28:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2009/07/11 19:17:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AT&T
[2006/09/26 14:32:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Geek Squad
[2009/06/15 14:15:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Google
[2009/07/12 05:24:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Google Updater
[2009/05/14 00:15:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[2009/05/07 02:36:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Logishrd
[2009/04/10 14:37:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Logitech
[2009/05/14 00:22:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/06/30 20:39:13 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2008/10/02 10:41:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Motive
[2009/02/04 02:16:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2009/03/06 19:46:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Norton
[2009/02/09 16:31:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2009/07/12 20:49:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Tools
[2008/07/08 20:36:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QuickTime
[2004/08/10 08:47:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SBSI
[2009/08/09 19:21:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype
[2009/02/09 16:34:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Symantec
[2009/11/09 13:36:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2006/08/02 10:26:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/07/13 16:56:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Yahoo!
[2009/04/06 14:58:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/06/15 10:00:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
< %ALLUSERSPROFILE%\Application Data\*.exe /s >[2009/02/04 12:56:14 | 00,075,112 | ---- | M] (GEAR Software, Inc.) -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\DifXInstall32.exe
[2009/07/16 21:30:13 | 00,075,040 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
[2006/09/26 11:39:03 | 05,512,975 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Geek Squad\MRI\Definition Cache\ewido-signatures4-full-current.exe
[2005/01/21 21:32:16 | 00,079,504 | ---- | M] (Symantec Corporation) -- C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\ExItem3253_symnet$20consumer_5.2.1_english\setup.exe
[2005/04/05 10:17:26 | 00,079,504 | ---- | M] (Symantec Corporation) -- C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\ExItem3263_symnet$20consumer_5.4.4_english\setup.exe
< %APPDATA%\*. >[2008/10/04 09:25:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Adobe
[2007/10/31 22:39:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\AdobeUM
[2009/06/15 15:07:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Apple Computer
[2009/05/15 02:02:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\ArcSoft
[2009/07/11 19:17:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\AT&T
[2009/03/15 16:24:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Google
[2009/08/15 21:40:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\gtk-2.0
[2007/10/13 16:40:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Help
[2004/08/10 08:39:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Identities
[2007/12/16 19:31:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Leadertech
[2008/10/04 09:25:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Macromedia
[2009/05/14 00:23:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Malwarebytes
[2009/06/30 20:46:25 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Peeper\Application Data\Microsoft
[2009/07/14 19:21:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Motive
[2009/05/01 00:53:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Move Networks
[2009/02/09 16:14:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Mozilla
[2009/07/12 20:49:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\PC Tools
[2009/07/21 17:15:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\pridl
[2007/12/17 16:17:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Real
[2004/08/10 11:16:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\SampleView
[2009/03/07 04:09:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Serif
[2009/09/13 15:34:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Skype
[2009/09/13 15:32:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\skypePM
[2004/08/10 09:09:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Sun
[2004/08/11 08:55:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Symantec
[2009/07/14 19:25:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\WinPatrol
[2009/02/05 14:55:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Peeper\Application Data\Yahoo!
< %APPDATA%\*.exe /s >[2009/09/05 09:09:08 | 01,924,440 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\Peeper\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2009/07/21 17:15:04 | 00,034,816 | ---- | M] () -- C:\Documents and Settings\Peeper\Application Data\pridl\pridl.exe
< MD5 for: AGP440.SYS >[2008/04/13 13:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\dllcache\agp440.sys
[2008/04/13 13:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
< MD5 for: ATAPI.SYS >[2008/04/13 13:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 13:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 16:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
< MD5 for: EVENTLOG.DLL >[2008/04/13 19:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/13 19:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/03 16:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
< MD5 for: NETLOGON.DLL >[2008/04/13 19:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/03 16:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
< MD5 for: SCECLI.DLL >[2004/08/03 16:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll
< %systemroot%\*. /mp /s > ========== Alternate Data Streams ========== @Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
< End of report >
---------------------
Extras.txt BELOW:
OTL Extras logfile created on: 1/3/2010 1:19:59 AM - Run 1
OTL by OldTimer - Version 3.1.20.2 Folder = C:\Documents and Settings\Peeper\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
191.00 Mb Total Physical Memory | 29.00 Mb Available Physical Memory | 15.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 1056 2112 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 32.60 Gb Total Space | 4.58 Gb Free Space | 14.06% Space Free | Partition Type: NTFS
Drive D: | 4.66 Gb Total Space | 0.92 Gb Free Space | 19.81% Space Free | Partition Type: FAT32
Drive E: | 397.39 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 960.72 Mb Total Space | 959.98 Mb Free Space | 99.92% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: YOUR-7008FFA13B
Current User Name: Peeper
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 90 Days
Output = Standard
========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- C:\WINDOWS\hh.exe File not found
.cpl [@ = cplfile] -- Reg Error: Value error. File not found
.hta [@ = htafile] -- Reg Error: Value error. File not found
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.inf [@ = inffile] -- Reg Error: Value error. File not found
.ini [@ = inifile] -- C:\WINDOWS\System32\NOTEPAD.EXE File not found
.js [@ = JSFile] -- C:\WINDOWS\System32\WScript.exe File not found
.jse [@ = JSEFile] -- C:\WINDOWS\System32\WScript.exe File not found
.reg [@ = regfile] -- regedit.exe "%1"
.vbe [@ = VBEFile] -- Reg Error: Value error. File not found
.vbs [@ = VBSFile] -- WScript.exe "%1" %*
.wsf [@ = WSFFile] -- C:\WINDOWS\System32\WScript.exe File not found
.wsh [@ = WSHFile] -- C:\WINDOWS\System32\WScript.exe File not found
[HKEY_USERS\S-1-5-21-1847359679-148087881-2726939249-1010\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 File not found
batfile [open] -- "%1" %*
batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 File not found
chm.file [open] -- "C:\WINDOWS\hh.exe" %1 File not found
cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 File not found
cmdfile [open] -- "%1" %*
cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 File not found
comfile [open] -- "%1" %*
cplfile [cplopen] -- Reg Error: Value error.
exefile [open] -- "%1" %*
htafile [open] -- Reg Error: Value error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 File not found
inffile [open] -- Reg Error: Value error.
inffile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 File not found
inifile [open] -- C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1 File not found
inifile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 File not found
jsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 File not found
jsfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* File not found
jsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 File not found
jsefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 File not found
jsefile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* File not found
jsefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 File not found
piffile [open] -- "%1" %*
regfile [edit] -- %SystemRoot%\system32\NOTEPAD.EXE %1 File not found
regfile [open] -- regedit.exe "%1"
regfile [merge] -- Reg Error: Key error.
regfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 File not found
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 File not found
txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" File not found
vbefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 File not found
vbefile [open] -- Reg Error: Value error.
vbefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 File not found
vbsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 File not found
vbsfile [open] -- WScript.exe "%1" %*
vbsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 File not found
wsffile [edit] -- %SystemRoot%\System32\Notepad.exe %1 File not found
wsffile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* File not found
wsffile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 File not found
wshfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* File not found
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"8085:TCP" = 8085:TCP:*:Enabled:drv
========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe" = C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe:*:Enabled:BackWeb for Presario -- ()
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- File not found
"C:\Program Files\att-nap\McciBrowser.exe" = C:\Program Files\att-nap\McciBrowser.exe:*:Enabled:motivebrowser.exe -- (Motive Communications, Inc.)
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" = C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer -- (Microsoft Corporation)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour -- (Apple Inc.)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- File not found
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"{14589F05-C658-4594-9429-D437BA688686}" = IntelliMover Data Transfer Demo
"{1A103D70-5C9B-4E1A-B306-5106C68F9914}" = Microsoft Plus! Dancer LE
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3AF8FCCD-F51A-4014-9002-F195E1CBC876}" = Logitech QuickCam
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{4532168B-140A-48D1-91F3-4F52EEE3DBA3}" = ArcSoft Collage Creator
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{5DFDEAAA-E050-482E-A5B6-138CAE53F7BF}" = Radialpoint Security Services
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A6A9D7C4-1E5B-42FD-98F5-E067A942AEE1}" = AQUAZONE "Virtual Aquarium Collection"
"{AC76BA86-0000-0000-0000-6028747ADE01}" = Adobe Acrobat - Reader 6.0.2 Update
"{AC76BA86-7AD7-1033-7B44-A00000000001}" = Adobe Reader 6.0.1
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}" = Apple Mobile Device Support
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D0122362-6333-4DE4-93F6-A5A2F3CC101A}" = Compaq Organize
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skypeâ„¢ 4.1
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"BackWeb-6750491 Uninstaller" = Compaq Connections
"BellsouthHelpCenter4.0b_is1" = FastAccess® DSL Help Center 4.3
"Clickables Online" = Clickables Online
"Desktop XP Screensaver Manager_is1" = Desktop XP Screensaver Manager 1.2 Powered by AdVantage
"Help and Support Additions" = Help and Support Additions
"Hoyle Casino '98" = Hoyle Casino '98
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"lvdrivers_11.80" = Logitech QuickCam Driver Package
"MerlinReportAgent" = ATT High Speed Internet Service Report Agent
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox (3.0.14)" = Mozilla Firefox (3.0.14)
"Network Play System (Patching)" = Network Play System (Patching)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA GART Driver" = NVIDIA GART Driver
"Photo Viewer_is1" = Uninstall Photo Viewer
"PS2" = PS2
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Python 2.2.1" = Python 2.2.1
"RealPlayer 6.0" = RealPlayer
"S3" = VIA/S3G Display Driver
"SafetyCenter" = SafetyCenter
"Sierra Utilities" = Sierra Utilities
"Spyware Doctor" = Spyware Doctor 6.0
"The Weather Channel Desktop 6" = The Weather Channel Desktop 6
"VN_VUIns_Rhine_VIA" = VIA Rhine-Family Fast Ethernet Adapter
"VTDisplay" = S3 S3Display
"VTGamma2" = S3 S3Gamma2
"VTInfo2" = S3 S3Info2
"VTOverlay" = S3 S3Overlay
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahtzeev1" = Yahtzee
========== HKEY_USERS Uninstall List ========== [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"digifast" = DigiFast
========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"digifast" = DigiFast
========== Last 10 Event Log Errors ========== [ Application Events ]
Error - 9/18/2009 3:02:52 PM | Computer Name = YOUR-7008FFA13B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved
Error - 9/18/2009 3:20:46 PM | Computer Name = YOUR-7008FFA13B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.
Error - 9/18/2009 3:28:26 PM | Computer Name = YOUR-7008FFA13B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.
Error - 9/18/2009 5:12:45 PM | Computer Name = YOUR-7008FFA13B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.
Error - 9/19/2009 6:31:53 PM | Computer Name = YOUR-7008FFA13B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.
Error - 9/19/2009 6:39:23 PM | Computer Name = YOUR-7008FFA13B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.
Error - 11/9/2009 12:45:00 PM | Computer Name = YOUR-7008FFA13B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved
Error - 11/9/2009 1:43:32 PM | Computer Name = YOUR-7008FFA13B | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16850, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x000101b3.
Error - 11/9/2009 1:46:32 PM | Computer Name = YOUR-7008FFA13B | Source = Application Error | ID = 1004
Description = Faulting application iexplore.exe, version 7.0.6000.16850, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x000101b3.
Error - 11/9/2009 2:02:16 PM | Computer Name = YOUR-7008FFA13B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved
[ System Events ]
Error - 1/2/2010 7:57:02 PM | Computer Name = YOUR-7008FFA13B | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring
the volume.
Error - 1/2/2010 8:41:03 PM | Computer Name = YOUR-7008FFA13B | Source = System Error | ID = 1003
Description = Error code 100000d1, parameter1 e1a98000, parameter2 00000002, parameter3
00000000, parameter4 f91ea151.
Error - 1/2/2010 8:41:23 PM | Computer Name = YOUR-7008FFA13B | Source = Service Control Manager | ID = 7023
Description = The Network Security service terminated with the following error:
%%126
Error - 1/2/2010 8:41:23 PM | Computer Name = YOUR-7008FFA13B | Source = Service Control Manager | ID = 7023
Description = The drv service terminated with the following error: %%126
Error - 1/2/2010 8:41:23 PM | Computer Name = YOUR-7008FFA13B | Source = Service Control Manager | ID = 7000
Description = The Security Services Driver (x86) service failed to start due to
the following error: %%2
Error - 1/2/2010 8:41:23 PM | Computer Name = YOUR-7008FFA13B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd
Error - 1/3/2010 1:14:54 AM | Computer Name = YOUR-7008FFA13B | Source = Service Control Manager | ID = 7023
Description = The Network Security service terminated with the following error:
%%126
Error - 1/3/2010 1:14:54 AM | Computer Name = YOUR-7008FFA13B | Source = Service Control Manager | ID = 7023
Description = The drv service terminated with the following error: %%126
Error - 1/3/2010 1:14:54 AM | Computer Name = YOUR-7008FFA13B | Source = Service Control Manager | ID = 7000
Description = The Security Services Driver (x86) service failed to start due to
the following error: %%2
Error - 1/3/2010 1:14:54 AM | Computer Name = YOUR-7008FFA13B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd
< End of report >
Edited by Monkeyb00y, 03 January 2010 - 02:54 PM.