Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Redirect after clicking on search results


  • This topic is locked This topic is locked
51 replies to this topic

#1 hydrodumps

hydrodumps

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 28 March 2011 - 06:48 PM

I believe my computer has been infected with a virus or malware that redirects me when I click on a link after starting an initial search. I have installed and ran malwarebytes antimalware which found 48 infected files and removed them however the problem still persists. I downloaded HiJackThis and have copied the log but have no clue what to remove, if anything... Here it is below, do you guys see anything?? I need some help, driving me nuts for a week now!!!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:17:12 PM, on 3/28/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\4e76a21cf962b5a5ea233f8f812674\dotnetfx35setup.exe
c:\c1b05e70d7da2e8fca31\setup.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\dotnetfx35_x86.exe
c:\c8121c1a634212c372\dotnetfx35setup.exe
c:\4c5e93caa50228997b5555ea43\setup.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\logon.scr
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://rd.yahoo.com/customize/sbcydsl/defaults/*http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: <html><head><title>Object moved</title></head><body>
O1 - Hosts: <h2>Object moved to <a href="http://searchportal.information.com?a_id=1637&amp;domainname=ipinu.com&amp;adultfilter=off&amp;popunder=off">here</a>.</h2>
O1 - Hosts: </body></html>
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Avery Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Legacy VGA Drivers V1.0] C:\WINDOWS\certproc32.exe
O4 - HKCU\..\Run: [AcerVGA Drivers V1.2] C:\WINDOWS\initview32.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Sony DVDRam Version 1.8B] C:\WINDOWS\uiengine32.exe
O4 - HKCU\..\Run: [Prauge DVDRam Version 2.3A] C:\WINDOWS\system32\spfx\hypinit32.exe
O4 - HKUS\S-1-5-18\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Prauge DVDRam Version 2.3A] C:\WINDOWS\system32\spfx\hypinit32.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Pool 2 - http://origin.games.yahoo.net/games/clients/y/poti_x.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE

--
End of file - 11370 bytes

Edited by hamluis, 28 March 2011 - 07:59 PM.
Moved from XP forum to Malware Removal Logs.


BC AdBot (Login to Remove)

 


#2 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:01:09 AM

Posted 03 April 2011 - 09:01 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.
If you are unable to create a log because your computer cannot start up successfully please provide detailed information about the Windows version you are using: What we in particular need to know is version, edition and if it is a 32bit or a 64bit system.
If you are unsure about any of these caracteristics, just let us know and we'll help you figuring it out. Please also tell us if you have your Windows CD/DVD handy.


Please include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.
We need to create an OTL Report
  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • In the custom scan box paste the following:
    msconfig
    safebootminimal
    activex
    drivers32
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    wininit.exe
    hlp.dat
    /md5stop
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt<--Will be minimized

In the upper right hand corner of the topic you will see a button called Watch Topic.I suggest you click it and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#3 hydrodumps

hydrodumps
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 06 April 2011 - 02:21 PM

Thank you for the response I realy need this assistance! I do believe I have the original Windows XP disks!

OTL logfile created on: 4/6/2011 11:34:02 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Hydro Heaven\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

254.00 Mb Total Physical Memory | 49.00 Mb Available Physical Memory | 19.00% Memory free
625.00 Mb Paging File | 209.00 Mb Available in Paging File | 33.00% Paging File free
Paging file location(s): c:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 30.45 Gb Free Space | 40.89% Space Free | Partition Type: NTFS

Computer Name: HYDROHEAVEN1 | User Name: Hydro Heaven | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/06 11:33:11 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hydro Heaven\Desktop\OTL.exe
PRC - [2010/04/15 11:28:29 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/06/10 04:27:04 | 000,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
PRC - [2008/06/10 04:27:03 | 000,329,104 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
PRC - [2008/02/09 17:06:33 | 000,238,968 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2008/02/09 17:06:27 | 000,062,840 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
PRC - [2008/02/09 17:06:25 | 003,220,856 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
PRC - [2008/02/09 17:06:15 | 000,308,600 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
PRC - [2008/01/25 18:47:02 | 000,149,864 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004/07/01 13:15:46 | 000,131,072 | ---- | M] (Musicmatch, Inc.) -- C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
PRC - [2003/07/14 10:55:44 | 000,212,992 | ---- | M] (Yahoo!, Inc.) -- C:\Program Files\Yahoo!\browser\ycommon.exe
PRC - [2003/07/11 15:51:16 | 000,057,344 | ---- | M] (Yahoo!, Inc.) -- C:\Program Files\Yahoo!\browser\ybrwicon.exe
PRC - [2003/06/11 02:52:26 | 000,122,880 | ---- | M] (Visual Networks) -- C:\Program Files\Visual Networks\Visual IP InSight\SBC\ipmon32.exe
PRC - [2003/06/11 02:52:24 | 000,380,928 | ---- | M] (Visual Networks) -- C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
PRC - [2002/09/10 22:26:26 | 000,368,706 | ---- | M] () -- C:\Program Files\BroadJump\Client Foundation\CFD.exe


========== Modules (SafeList) ==========

MOD - [2011/04/06 11:33:11 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hydro Heaven\Desktop\OTL.exe
MOD - [2004/08/04 00:57:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
MOD - [2003/06/11 02:52:24 | 000,098,304 | ---- | M] (Visual Networks) -- C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPHk2KS2.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Disabled | Stopped] -- -- (AppMgmt)
SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/08/04 12:34:19 | 001,245,064 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2008/02/09 17:06:33 | 000,238,968 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2008/02/09 17:06:25 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand | Running] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
SRV - [2008/01/25 18:47:02 | 000,149,864 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (LiveUpdate Notice)
SRV - [2008/01/25 18:47:02 | 000,149,864 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)
SRV - [2008/01/25 18:47:02 | 000,149,864 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2008/01/25 18:47:02 | 000,149,864 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2003/05/19 17:07:38 | 000,086,016 | ---- | M] (Yahoo! Inc.) [On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\YPcservice.exe -- (YPCService)
SRV - [2003/03/03 11:33:40 | 000,143,360 | ---- | M] (Intel® Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc)


========== Driver Services (SafeList) ==========

DRV - [2008/08/04 12:34:03 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS -- (SymEvent)
DRV - [2008/02/06 14:43:54 | 000,031,408 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - [2008/02/06 14:43:54 | 000,031,408 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\SymIM.sys -- (SymIM)
DRV - [2008/02/05 12:34:44 | 000,188,464 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2008/02/05 12:34:44 | 000,096,432 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMFW.SYS -- (SYMFW)
DRV - [2008/02/05 12:34:44 | 000,038,576 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS -- (SYMIDS)
DRV - [2008/02/05 12:34:44 | 000,037,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS)
DRV - [2008/02/05 12:34:44 | 000,022,320 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2008/02/05 12:34:44 | 000,013,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS -- (SYMDNS)
DRV - [2008/01/31 18:51:16 | 000,317,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.sys -- (SRTSPL)
DRV - [2008/01/31 18:51:16 | 000,279,088 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.sys -- (SRTSP)
DRV - [2008/01/31 18:51:16 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.sys -- (SRTSPX)
DRV - [2008/01/22 02:00:00 | 000,895,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080122.037\NAVEX15.SYS -- (NAVEX15)
DRV - [2008/01/22 02:00:00 | 000,385,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2008/01/22 02:00:00 | 000,109,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2008/01/22 02:00:00 | 000,082,256 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080122.037\NAVENG.SYS -- (NAVENG)
DRV - [2008/01/16 21:05:42 | 000,447,024 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2007/11/06 17:07:08 | 000,158,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\20071204.001\SymIDSCo.sys -- (SYMIDSCO)
DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys -- (dsunidrv)
DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2004/08/03 22:29:49 | 000,019,455 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)
DRV - [2004/08/03 22:29:47 | 000,012,063 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)
DRV - [2004/08/03 22:29:45 | 000,023,615 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)
DRV - [2004/08/03 22:29:43 | 000,033,599 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)
DRV - [2004/08/03 22:29:42 | 000,019,551 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)
DRV - [2004/08/03 22:29:41 | 000,029,311 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)
DRV - [2004/08/03 22:29:37 | 000,012,415 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)
DRV - [2004/08/03 22:29:37 | 000,012,127 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)
DRV - [2004/08/03 22:29:37 | 000,011,775 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)
DRV - [2004/08/03 22:29:36 | 000,161,020 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)
DRV - [2002/11/08 11:45:06 | 000,017,217 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://rd.yahoo.com/customize/sbcydsl/defaults/cs/*http://www.yahoo.com/search/ie.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/mywaybiz
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/mywaybiz
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
IE - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/04/15 11:30:50 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2011/03/18 09:53:25 | 000,000,224 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: <html><head><title>Object moved</title></head><body>
O1 - Hosts: <h2>Object moved to <a href="http://searchportal.information.com?a_id=1637&amp;domainname=ipinu.com&amp;adultfilter=off&amp;popunder=off">here</a>.</h2>
O1 - Hosts: </body></html>
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Avery Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Avery Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\..\Toolbar\ShellBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\..\Toolbar\WebBrowser: (Avery Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe ()
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [IPInSightLAN 02] C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe (Visual Networks)
O4 - HKLM..\Run: [IPInSightMonitor 02] C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe (Visual Networks)
O4 - HKLM..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [osCheck] C:\Program Files\Norton AntiVirus\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe (Yahoo!, Inc.)
O4 - HKU\.DEFAULT..\Run: [Prauge DVDRam Version 2.3A] File not found
O4 - HKU\.DEFAULT..\Run: [Yahoo! Pager] File not found
O4 - HKU\S-1-5-18..\Run: [Prauge DVDRam Version 2.3A] File not found
O4 - HKU\S-1-5-18..\Run: [Yahoo! Pager] File not found
O4 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007..\Run: [AcerVGA Drivers V1.2] File not found
O4 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007..\Run: [Legacy VGA Drivers V1.0] File not found
O4 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007..\Run: [Microsoft Works Update Detection] File not found
O4 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007..\Run: [Prauge DVDRam Version 2.3A] File not found
O4 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007..\Run: [Sony DVDRam Version 1.8B] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-3359005984-3577352339-825049218-1007\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB (Reg Error: Key error.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} http://download.yahoo.com/dl/installs/ymail/ymmapi.dll (YahooYMailTo Class)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Yahoo! Pool 2 http://origin.games.yahoo.net/games/clients/y/poti_x.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Filter\text/html {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Hydro Heaven\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Hydro Heaven\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 06:59:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{412730ce-8f2a-11dd-a34b-001111025647}\Shell\Auto\command - "" = E:\autorun.bat
O33 - MountPoints2\{412730ce-8f2a-11dd-a34b-001111025647}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{412730ce-8f2a-11dd-a34b-001111025647}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.bat
O33 - MountPoints2\{412730ce-8f2a-11dd-a34b-001111025647}\Shell\explore\Command - "" = E:\autorun.bat
O33 - MountPoints2\{4ed21ba4-3276-11d9-a15e-001111025647}\Shell\Auto\command - "" = E:\autorun.bat
O33 - MountPoints2\{4ed21ba4-3276-11d9-a15e-001111025647}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4ed21ba4-3276-11d9-a15e-001111025647}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.bat
O33 - MountPoints2\{4ed21ba4-3276-11d9-a15e-001111025647}\Shell\explore\Command - "" = E:\autorun.bat
O33 - MountPoints2\{851cb33e-1150-11dc-a290-001111025647}\Shell\Auto\command - "" = E:\autorun.bat
O33 - MountPoints2\{851cb33e-1150-11dc-a290-001111025647}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{851cb33e-1150-11dc-a290-001111025647}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.bat
O33 - MountPoints2\{851cb33e-1150-11dc-a290-001111025647}\Shell\explore\Command - "" = E:\autorun.bat
O33 - MountPoints2\{9428bd2e-e6ab-11de-a388-001111025647}\Shell\Auto\command - "" = F:\autorun.bat
O33 - MountPoints2\{9428bd2e-e6ab-11de-a388-001111025647}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9428bd2e-e6ab-11de-a388-001111025647}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.bat
O33 - MountPoints2\{9428bd2e-e6ab-11de-a388-001111025647}\Shell\explore\Command - "" = F:\autorun.bat
O33 - MountPoints2\{9428bd31-e6ab-11de-a388-001111025647}\Shell\Auto\command - "" = E:\autorun.bat
O33 - MountPoints2\{9428bd31-e6ab-11de-a388-001111025647}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9428bd31-e6ab-11de-a388-001111025647}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.bat
O33 - MountPoints2\{9428bd31-e6ab-11de-a388-001111025647}\Shell\explore\Command - "" = E:\autorun.bat
O33 - MountPoints2\{aa8539b5-f138-11d8-a13e-001111025647}\Shell\Auto\command - "" = E:\autorun.bat
O33 - MountPoints2\{aa8539b5-f138-11d8-a13e-001111025647}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{aa8539b5-f138-11d8-a13e-001111025647}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.bat
O33 - MountPoints2\{aa8539b5-f138-11d8-a13e-001111025647}\Shell\explore\Command - "" = E:\autorun.bat
O33 - MountPoints2\{d453604e-7cf1-11dc-a2ad-001111025647}\Shell\Auto\command - "" = E:\autorun.bat
O33 - MountPoints2\{d453604e-7cf1-11dc-a2ad-001111025647}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d453604e-7cf1-11dc-a2ad-001111025647}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.bat
O33 - MountPoints2\{d453604e-7cf1-11dc-a2ad-001111025647}\Shell\explore\Command - "" = E:\autorun.bat
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

MsConfig - Services: "YPCService"
MsConfig - Services: "SymWSC"
MsConfig - Services: "SNDSrvc"
MsConfig - Services: "SBService"
MsConfig - Services: "SAVScan"
MsConfig - Services: "NetSvc"
MsConfig - Services: "navapsvc"
MsConfig - Services: "MDM"
MsConfig - Services: "LexBceS"
MsConfig - Services: "ccSetMgr"
MsConfig - Services: "ccPwdSvc"
MsConfig - Services: "ccProxy"
MsConfig - Services: "ccEvtMgr"
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe - (Microsoft® Corporation)
MsConfig - StartUpFolder: C:^Documents and Settings^Hydro Heaven^Start Menu^Programs^Startup^Connection Manager.lnk - - File not found
MsConfig - StartUpReg: BJCFD - hkey= - key= - C:\Program Files\BroadJump\Client Foundation\CFD.exe ()
MsConfig - StartUpReg: ccApp - hkey= - key= - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
MsConfig - StartUpReg: ctfmon.exe - hkey= - key= - File not found
MsConfig - StartUpReg: Dell AIO Printer A940 - hkey= - key= - C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe (Dell Computer Corporation)
MsConfig - StartUpReg: dla - hkey= - key= - File not found
MsConfig - StartUpReg: HotKeysCmds - hkey= - key= - File not found
MsConfig - StartUpReg: IgfxTray - hkey= - key= - File not found
MsConfig - StartUpReg: IPInSightLAN 02 - hkey= - key= - C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe (Visual Networks)
MsConfig - StartUpReg: IPInSightMonitor 02 - hkey= - key= - C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe (Visual Networks)
MsConfig - StartUpReg: Microsoft Works Portfolio - hkey= - key= - C:\Program Files\Microsoft Works\WksSb.exe (Microsoft® Corporation)
MsConfig - StartUpReg: Microsoft Works Update Detection - hkey= - key= - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
MsConfig - StartUpReg: mmtask - hkey= - key= - File not found
MsConfig - StartUpReg: MMTray - hkey= - key= - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: PCMService - hkey= - key= - C:\Program Files\Dell\Media Experience\PCMService.exe (CyberLink Corp.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
MsConfig - StartUpReg: Sonic RecordNow! - hkey= - key= - File not found
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe ()
MsConfig - StartUpReg: Symantec NetDriver Monitor - hkey= - key= - File not found
MsConfig - StartUpReg: tgcmdprovidersbc - hkey= - key= - File not found
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: UpdateManager - hkey= - key= - C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
MsConfig - StartUpReg: URLLSTCK.exe - hkey= - key= - File not found
MsConfig - StartUpReg: WorksFUD - hkey= - key= - C:\Program Files\Microsoft Works\wkfud.exe (Microsoft® Corporation)
MsConfig - StartUpReg: YBrowser - hkey= - key= - C:\Program Files\Yahoo!\browser\ybrwicon.exe (Yahoo!, Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 1
MsConfig - State: "startup" - 1

SafeBootMin: AppMgmt - File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {00F0EE7F-2C61-4EBD-A209-00281BDC869C} - Yahoo! Toolbar
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - Internet Explorer Classes for Java
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - Reg Error: Value error.
ActiveX: {270C7F22-6D59-4041-B865-76C48D190D91} - Yahoo! Search Settings Update
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2cc9d512-6db6-4f1c-8979-9a41fae88de0} - Q837009
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4a01a151-e350-4839-a2b8-03dc39d6c8e5} - Reg Error: Value error.
ActiveX: {4d64f3ba-f112-4efe-a02e-96680859937c} - KB918899
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5b7bf89d-d196-4c32-a303-a57b8ab7f18d} - KB918439
ActiveX: {5c9ff2bf-938d-47fe-85d9-9dbab4f65018} - KB897715
ActiveX: {5f3c70b3-ac2f-432c-8f9c-1624df61f54f} - Microsoft Data Access Components KB870669
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {795d0712-722c-43ec-906a-fc5e678eada9} - Q831167
ActiveX: {79844cfb-ac65-4e10-a06a-c974234f40d0} - KB883939
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {8FD9D712-A285-4834-9F46-705AD5146A6B} - NoIETour
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
ActiveX: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\advpack.dll,LaunchINFSectionEx C:\Program Files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {dd772a76-bef3-44d7-8b39-502c8504c1f1} - KB925486
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894
ActiveX: {f15ee071-deb7-4cbb-951f-431c98338d8e} - KB911567
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{64A10DCF-7FF1-4600-9824-DE0BCC2AA72E} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: AcerVGA Drivers V1.2 - C:\WINDOWS\initview32.exe
ActiveX: AcerVGA Engine Drivers V1.2 - C:\WINDOWS\iuengine32.exe
ActiveX: Creative Audio Studio V2.8 - C:\WINDOWS\unimontr.exe
ActiveX: IntelliMouse Explorer V2.3 - C:\WINDOWS\netpefr32.exe
ActiveX: Legacy VGA Drivers V1.0 - C:\WINDOWS\certproc32.exe
ActiveX: Prauge DVDRam Version 2.3A - C:\WINDOWS\system32\spfx\hypinit32.exe
ActiveX: Sony DVDRam Version 1.8B - C:\WINDOWS\uiengine32.exe

Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/04/06 11:33:03 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Hydro Heaven\Desktop\OTL.exe
[2011/04/06 03:01:11 | 000,000,000 | ---D | C] -- C:\21979999e6d87ae953b2
[2011/04/06 03:00:53 | 000,000,000 | ---D | C] -- C:\97caf4734c16104c31e3b0a35a0daacc
[2011/04/04 12:44:20 | 000,000,000 | ---D | C] -- C:\3552f69b16fcf3183e0a55465790
[2011/04/04 12:43:06 | 000,000,000 | ---D | C] -- C:\e7398452facfa2dbcb445e6d080ba53d
[2011/04/04 12:24:36 | 000,000,000 | ---D | C] -- C:\9d3668a048fbe5a335e49b7fbee7
[2011/04/04 12:24:04 | 000,000,000 | ---D | C] -- C:\141d18b248f4ce98d61f88eaa5
[2011/04/04 10:27:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/04/04 10:25:08 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/04/04 10:24:25 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011/04/04 09:53:37 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011/04/04 03:01:23 | 000,000,000 | ---D | C] -- C:\f863f3b11fb74681f4
[2011/04/04 03:01:05 | 000,000,000 | ---D | C] -- C:\38b23c5a8b718f7297
[2011/04/03 03:01:35 | 000,000,000 | ---D | C] -- C:\d8c96c8ab58be0675e
[2011/04/03 03:01:19 | 000,000,000 | ---D | C] -- C:\6909b529d2fe84911368
[2011/04/02 03:01:08 | 000,000,000 | ---D | C] -- C:\afa1e6ce7bff4e6849526076246b28b0
[2011/04/02 03:00:47 | 000,000,000 | ---D | C] -- C:\c8180544575f6128ca
[2011/04/01 03:01:06 | 000,000,000 | ---D | C] -- C:\eda2a69f6d636a2666e114d777e4
[2011/04/01 03:00:48 | 000,000,000 | ---D | C] -- C:\beb7f2035a9a66472063497a2d185f
[2011/03/29 03:00:53 | 000,000,000 | ---D | C] -- C:\41335d4b0a13f8cd0c3f
[2011/03/29 03:00:43 | 000,000,000 | ---D | C] -- C:\91a12a64a7ccf3f6b279
[2011/03/28 16:13:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hydro Heaven\Start Menu\Programs\HiJackThis
[2011/03/28 16:13:01 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2011/03/28 03:01:01 | 000,000,000 | ---D | C] -- C:\4c5e93caa50228997b5555ea43
[2011/03/28 03:00:50 | 000,000,000 | ---D | C] -- C:\c8121c1a634212c372
[2011/03/27 03:01:04 | 000,000,000 | ---D | C] -- C:\c1b05e70d7da2e8fca31
[2011/03/27 03:00:54 | 000,000,000 | ---D | C] -- C:\4e76a21cf962b5a5ea233f8f812674
[2011/03/25 16:01:28 | 000,000,000 | ---D | C] -- C:\b84d12ad8cc36ee704
[2011/03/25 16:01:17 | 000,000,000 | ---D | C] -- C:\e4d72cf4ab4b89bd2d51b94b51
[2011/03/25 15:47:17 | 000,000,000 | ---D | C] -- C:\0189f62ef5ca56e75c72
[2011/03/25 15:47:03 | 000,000,000 | ---D | C] -- C:\4ced9128e613121bd5b7ee7406
[2011/03/25 13:58:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hydro Heaven\Application Data\Malwarebytes
[2011/03/25 13:57:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/03/25 13:57:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/25 13:57:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/03/25 13:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/03/25 04:51:26 | 000,000,000 | ---D | C] -- C:\43ea85f74ca6298408c125cb
[2011/03/25 04:51:06 | 000,000,000 | ---D | C] -- C:\d2e95bb56671a5e35839f1
[2011/03/25 03:01:13 | 000,000,000 | ---D | C] -- C:\ba8bb58ba05a15235d3fca
[2011/03/25 03:00:57 | 000,000,000 | ---D | C] -- C:\e07b5f78abbcda20dc
[2011/03/24 15:16:12 | 000,000,000 | ---D | C] -- C:\7faf097f7f0b72ae90734a1b4b2087a9
[2011/03/24 15:16:02 | 000,000,000 | ---D | C] -- C:\fe1fa432e229bb8bb1e26bb490a571
[2011/03/24 14:40:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\FileASSASSIN
[2011/03/23 14:15:56 | 000,000,000 | ---D | C] -- C:\Program Files\FileASSASSIN
[2011/03/23 10:09:20 | 000,000,000 | ---D | C] -- C:\78c68814a4dc8ec6c0
[2011/03/23 10:08:31 | 000,000,000 | ---D | C] -- C:\a97906d189099487805a
[2011/03/23 09:51:42 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Hydro Heaven\Recent
[2011/03/22 09:49:35 | 000,000,000 | ---D | C] -- C:\6d82027c440cd9ceea668bfd47b2
[2011/03/22 09:48:37 | 000,000,000 | ---D | C] -- C:\619e2eb2f189a5afddc5
[2011/03/21 17:30:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2011/03/21 03:01:09 | 000,000,000 | ---D | C] -- C:\ebf49712726611c4b3d62aeb
[2011/03/21 03:00:57 | 000,000,000 | ---D | C] -- C:\a60396851ea72ac777e8b6f1cf1a5a
[2011/03/20 03:00:55 | 000,000,000 | ---D | C] -- C:\cb4ad89582905337832dbde7
[2011/03/20 03:00:45 | 000,000,000 | ---D | C] -- C:\9a5254d4f90b9a1c32f949
[2011/03/19 03:00:58 | 000,000,000 | ---D | C] -- C:\d61800eba5eaa0abda111b7cf73e50
[2011/03/19 03:00:51 | 000,000,000 | ---D | C] -- C:\0390e136c34628855a906328
[2011/03/18 09:45:56 | 000,000,000 | ---D | C] -- C:\9cefc04c5d5f7618bb090cdb06
[2011/03/18 09:45:45 | 000,000,000 | ---D | C] -- C:\1823b6418a54d99915
[2011/03/17 03:01:06 | 000,000,000 | ---D | C] -- C:\a20740977e64b4fd239342
[2011/03/17 03:00:53 | 000,000,000 | ---D | C] -- C:\7600e7e077d7af71810602e6e9aa2f
[2011/03/16 03:01:06 | 000,000,000 | ---D | C] -- C:\15fac2618c4736111f9c97e66f15
[2011/03/16 03:00:55 | 000,000,000 | ---D | C] -- C:\457a0e790144130dc7e8a7dafc13
[2011/03/15 03:00:49 | 000,000,000 | ---D | C] -- C:\3063cfb827455ff71c
[2011/03/15 03:00:42 | 000,000,000 | ---D | C] -- C:\07fddc78c114d16b4c8473f6f661991e
[2011/03/14 03:01:25 | 000,000,000 | ---D | C] -- C:\362bb3ba65772e1b1b84885b804138
[2011/03/14 03:00:57 | 000,000,000 | ---D | C] -- C:\747ec74a5fb236372f76998bdf
[2011/03/13 04:01:35 | 000,000,000 | ---D | C] -- C:\457675a6e6e9a11349b1e65fb87d
[2011/03/13 04:01:15 | 000,000,000 | ---D | C] -- C:\3903347445a07e14c412
[2011/03/12 11:55:29 | 000,000,000 | ---D | C] -- C:\Program Files\iPod(2)
[2011/03/12 11:54:46 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes(2)
[2011/03/12 04:01:51 | 000,000,000 | ---D | C] -- C:\e20db771e3fc18fea42188
[2011/03/12 04:01:32 | 000,000,000 | ---D | C] -- C:\179ebbc409e4d6620f984f09c23e4982
[2011/03/08 04:01:49 | 000,000,000 | ---D | C] -- C:\d8583ee418e8720245
[2011/03/08 04:01:32 | 000,000,000 | ---D | C] -- C:\12d4b582791e08ecc18200
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/06 11:33:11 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hydro Heaven\Desktop\OTL.exe
[2011/04/06 11:10:33 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/04/06 11:01:03 | 000,000,248 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/04/06 10:07:53 | 000,000,292 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3359005984-3577352339-825049218-1007.job
[2011/04/06 10:07:50 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3359005984-3577352339-825049218-1010.job
[2011/04/06 10:07:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/04/06 10:07:07 | 266,391,552 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/05 16:48:00 | 000,001,188 | ---- | M] () -- C:\WINDOWS\DELLSTAT.INI
[2011/04/05 09:38:08 | 000,000,570 | ---- | M] () -- C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Hydro Heaven.job
[2011/04/04 12:28:18 | 266,424,320 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2011/04/04 10:27:04 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/04/04 09:58:54 | 000,001,854 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/04/04 09:58:54 | 000,001,854 | ---- | M] () -- C:\Documents and Settings\Hydro Heaven\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/04/02 14:25:00 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3359005984-3577352339-825049218-1010.job
[2011/04/01 23:22:17 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/03/30 11:46:02 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3359005984-3577352339-825049218-1007.job
[2011/03/28 16:13:08 | 000,001,998 | ---- | M] () -- C:\Documents and Settings\Hydro Heaven\Desktop\HiJackThis.lnk
[2011/03/25 13:57:41 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/24 16:26:20 | 000,017,408 | ---- | M] () -- C:\Documents and Settings\Hydro Heaven\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/23 14:15:57 | 000,000,730 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\FileASSASSIN.lnk
[2011/03/23 10:17:57 | 000,406,744 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT
[2011/03/23 10:17:56 | 000,064,700 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT
[2011/03/22 10:51:31 | 000,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/03/22 10:18:37 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2011/03/22 09:42:51 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~21028660
[2011/03/21 17:36:52 | 000,000,384 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\21028660
[2011/03/21 17:33:59 | 000,000,128 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~21028660r
[2011/03/18 09:53:25 | 000,000,224 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
[2011/03/09 15:19:07 | 000,027,830 | ---- | M] () -- C:\Documents and Settings\Hydro Heaven\My Documents\innoutcrane.tif
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/04 10:27:04 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/03/28 16:13:08 | 000,001,998 | ---- | C] () -- C:\Documents and Settings\Hydro Heaven\Desktop\HiJackThis.lnk
[2011/03/28 08:33:01 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/25 13:57:41 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/23 14:15:57 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\FileASSASSIN.lnk
[2011/03/23 10:03:31 | 266,391,552 | -HS- | C] () -- C:\hiberfil.sys
[2011/03/21 17:25:49 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~21028660r
[2011/03/21 17:25:48 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~21028660
[2011/03/21 17:24:10 | 000,000,384 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\21028660
[2011/03/09 15:19:07 | 000,027,830 | ---- | C] () -- C:\Documents and Settings\Hydro Heaven\My Documents\innoutcrane.tif
[2010/09/16 12:07:39 | 000,112,796 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/05/18 17:06:58 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\OptCVw7.dll
[2010/05/18 17:06:58 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\OptCVm6.dll
[2010/05/18 17:06:58 | 000,114,749 | ---- | C] () -- C:\WINDOWS\System32\cxts001.dll
[2010/05/18 17:06:58 | 000,057,400 | ---- | C] () -- C:\WINDOWS\System32\trs.dll
[2010/05/18 17:06:58 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\BS_Register.exe
[2010/05/18 17:06:57 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\OptCVa6.dll
[2009/07/17 05:15:14 | 000,545,792 | ---- | C] () -- C:\WINDOWS\inew.dll
[2009/05/03 13:33:51 | 000,227,328 | ---- | C] () -- C:\WINDOWS\socks.dll
[2008/12/09 14:20:25 | 000,097,280 | ---- | C] () -- C:\WINDOWS\scan.dll
[2008/10/14 14:40:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QFN.ini
[2008/10/14 14:40:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QDQICK.ini
[2008/08/04 02:28:52 | 000,000,720 | ---- | C] () -- C:\WINDOWS\avscan.ini
[2008/04/08 11:44:52 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2005/06/27 13:13:22 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/06/27 12:34:58 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2005/01/18 13:59:23 | 000,017,408 | ---- | C] () -- C:\Documents and Settings\Hydro Heaven\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/11/02 13:28:15 | 000,000,051 | ---- | C] () -- C:\WINDOWS\dbghist.ini
[2004/11/02 10:54:55 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbavs.dll
[2004/11/02 10:53:45 | 000,000,177 | ---- | C] () -- C:\WINDOWS\System32\dlbacoin.ini
[2004/09/08 17:07:06 | 000,000,064 | ---- | C] () -- C:\WINDOWS\QBWCD.INI
[2004/09/08 17:07:04 | 000,006,472 | ---- | C] () -- C:\WINDOWS\Icoadb32.dat
[2004/08/11 10:41:58 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/08/03 15:17:18 | 000,002,425 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2004/08/02 14:39:52 | 000,001,188 | ---- | C] () -- C:\WINDOWS\DELLSTAT.INI
[2004/07/30 10:30:26 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Hydro Heaven\Application Data\dm.ini
[2004/07/28 15:04:54 | 000,061,678 | -H-- | C] () -- C:\Documents and Settings\Hydro Heaven\Application Data\PFP120JPR.{PB
[2004/07/28 15:04:54 | 000,012,358 | -H-- | C] () -- C:\Documents and Settings\Hydro Heaven\Application Data\PFP120JCM.{PB
[2004/07/22 15:23:15 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\YCRWin32.dll
[2004/07/16 04:57:06 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/07/16 04:52:45 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2004/07/16 04:45:20 | 000,001,535 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2004/07/16 04:40:50 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/07/16 04:28:08 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2004/07/16 04:26:44 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/07/16 04:26:40 | 000,406,744 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2004/07/16 04:26:40 | 000,064,700 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2004/07/16 04:26:29 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/07/16 04:13:04 | 000,000,550 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/03/26 14:59:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/07/16 13:54:55 | 000,004,594 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/07/16 13:54:54 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/07/16 13:41:25 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/07/16 13:41:23 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/07/16 13:33:50 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/07/16 13:33:39 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/07/16 13:27:41 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/07/16 13:26:37 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2003/07/14 12:30:28 | 000,197,120 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[2003/07/14 12:30:27 | 000,034,816 | ---- | C] () -- C:\WINDOWS\patch.exe
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/09/03 07:05:08 | 000,505,008 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/03 06:59:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2002/09/03 06:56:30 | 000,023,444 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2002/08/29 03:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[1979/12/31 22:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: EXPLORER.EXE >
[2007/06/13 04:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\explorer.exe
[2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\SYSTEM32\DLLCACHE\explorer.exe
[2004/08/04 00:56:49 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2004/08/04 00:56:49 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2003/07/16 13:28:11 | 001,004,032 | ---- | M] (Microsoft Corporation) MD5=A82B28BFC2E4455FE43022A498C0EF0A -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 00:56:57 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2004/08/04 00:56:57 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\SYSTEM32\winlogon.exe
[2002/08/29 03:00:00 | 000,516,608 | ---- | M] (Microsoft Corporation) MD5=2246D8D8F4714A2CEDB21AB9B1849ABB -- C:\I386\WINLOGON.EXE
[2003/07/16 13:51:38 | 000,516,608 | ---- | M] (Microsoft Corporation) MD5=2246D8D8F4714A2CEDB21AB9B1849ABB -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2004/05/26 18:38:46 | 000,483,328 | ---- | M] (Microsoft Corporation) MD5=E7F9D2E4E4A94A6F58014E5FFA16A65E -- C:\WINDOWS\SoftwareDistribution\Download\0bfb0fd6d1529228f4175fc177388244\sp1qfe\winlogon.exe

< End of report >



OTL Extras logfile created on: 4/6/2011 11:34:02 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Hydro Heaven\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

254.00 Mb Total Physical Memory | 49.00 Mb Available Physical Memory | 19.00% Memory free
625.00 Mb Paging File | 209.00 Mb Available in Paging File | 33.00% Paging File free
Paging file location(s): c:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 30.45 Gb Free Space | 40.89% Space Free | Partition Type: NTFS

Computer Name: HYDROHEAVEN1 | User Name: Hydro Heaven | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"28952:TCP" = 28952:TCP:*:Enabled:BND
"19330:TCP" = 19330:TCP:*:Enabled:BND
"5033:TCP" = 5033:TCP:*:Enabled:BND
"31645:TCP" = 31645:TCP:*:Enabled:BND
"18984:TCP" = 18984:TCP:*:Enabled:BND
"16906:TCP" = 16906:TCP:*:Enabled:BND
"15085:TCP" = 15085:TCP:*:Enabled:BND
"30224:TCP" = 30224:TCP:*:Enabled:BND
"5617:TCP" = 5617:TCP:*:Enabled:BND
"6620:TCP" = 6620:TCP:*:Enabled:BND
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"32077:TCP" = 32077:TCP:*:Enabled:BND
"10447:TCP" = 10447:TCP:*:Enabled:BND
"30333:TCP" = 30333:TCP:*:Enabled:BND
"21014:TCP" = 21014:TCP:*:Enabled:BND
"21658:TCP" = 21658:TCP:*:Enabled:BND
"16497:TCP" = 16497:TCP:*:Enabled:BND
"28838:TCP" = 28838:TCP:*:Enabled:BND
"21673:TCP" = 21673:TCP:*:Enabled:BND
"26791:TCP" = 26791:TCP:*:Enabled:BND
"22728:TCP" = 22728:TCP:*:Enabled:BND
"21601:TCP" = 21601:TCP:*:Enabled:BND
"17259:TCP" = 17259:TCP:*:Enabled:BND
"30294:TCP" = 30294:TCP:*:Enabled:BND
"9176:TCP" = 9176:TCP:*:Enabled:BND
"25137:TCP" = 25137:TCP:*:Enabled:BND
"14701:TCP" = 14701:TCP:*:Enabled:BND
"2528:TCP" = 2528:TCP:*:Enabled:BND
"15940:TCP" = 15940:TCP:*:Enabled:BND
"10992:TCP" = 10992:TCP:*:Enabled:BND
"5780:TCP" = 5780:TCP:*:Enabled:BND
"25661:TCP" = 25661:TCP:*:Enabled:BND
"14106:TCP" = 14106:TCP:*:Enabled:BND
"18175:TCP" = 18175:TCP:*:Enabled:BND
"31003:TCP" = 31003:TCP:*:Enabled:BND
"2702:TCP" = 2702:TCP:*:Enabled:BND
"26052:TCP" = 26052:TCP:*:Enabled:BND
"10838:TCP" = 10838:TCP:*:Enabled:BND
"22195:TCP" = 22195:TCP:*:Enabled:BND
"5455:TCP" = 5455:TCP:*:Enabled:BND
"21311:TCP" = 21311:TCP:*:Enabled:BND
"23689:TCP" = 23689:TCP:*:Enabled:BND
"5146:TCP" = 5146:TCP:*:Enabled:BND
"3783:TCP" = 3783:TCP:*:Enabled:BND
"21373:TCP" = 21373:TCP:*:Enabled:BND
"14755:TCP" = 14755:TCP:*:Enabled:BND
"8562:TCP" = 8562:TCP:*:Enabled:BND
"1999:TCP" = 1999:TCP:*:Enabled:BND
"14209:TCP" = 14209:TCP:*:Enabled:BND
"7591:TCP" = 7591:TCP:*:Enabled:BND
"24664:TCP" = 24664:TCP:*:Enabled:BND
"18049:TCP" = 18049:TCP:*:Enabled:BND
"14826:TCP" = 14826:TCP:*:Enabled:BND
"26517:TCP" = 26517:TCP:*:Enabled:BND
"31560:TCP" = 31560:TCP:*:Enabled:BND
"3835:TCP" = 3835:TCP:*:Enabled:BND
"6374:TCP" = 6374:TCP:*:Enabled:BND
"8910:TCP" = 8910:TCP:*:Enabled:BND
"11447:TCP" = 11447:TCP:*:Enabled:BND
"13989:TCP" = 13989:TCP:*:Enabled:BND
"26553:TCP" = 26553:TCP:*:Enabled:BND
"11355:TCP" = 11355:TCP:*:Enabled:BND
"29218:TCP" = 29218:TCP:*:Enabled:BND
"6355:TCP" = 6355:TCP:*:Enabled:BND
"25385:TCP" = 25385:TCP:*:Enabled:BND
"23679:TCP" = 23679:TCP:*:Enabled:BND
"9244:TCP" = 9244:TCP:*:Enabled:BND
"11790:TCP" = 11790:TCP:*:Enabled:BND
"14340:TCP" = 14340:TCP:*:Enabled:BND
"19494:TCP" = 19494:TCP:*:Enabled:BND
"10284:TCP" = 10284:TCP:*:Enabled:BND
"31423:TCP" = 31423:TCP:*:Enabled:BND
"1194:TCP" = 1194:TCP:*:Enabled:BND
"3730:TCP" = 3730:TCP:*:Enabled:BND
"6270:TCP" = 6270:TCP:*:Enabled:BND
"13816:TCP" = 13816:TCP:*:Enabled:BND
"16362:TCP" = 16362:TCP:*:Enabled:BND
"18901:TCP" = 18901:TCP:*:Enabled:BND
"21438:TCP" = 21438:TCP:*:Enabled:BND
"23974:TCP" = 23974:TCP:*:Enabled:BND
"26513:TCP" = 26513:TCP:*:Enabled:BND
"29049:TCP" = 29049:TCP:*:Enabled:BND
"31592:TCP" = 31592:TCP:*:Enabled:BND
"1364:TCP" = 1364:TCP:*:Enabled:BND
"3919:TCP" = 3919:TCP:*:Enabled:BND
"30707:TCP" = 30707:TCP:*:Enabled:BND
"28428:TCP" = 28428:TCP:*:Enabled:BND
"5180:TCP" = 5180:TCP:*:Enabled:BND
"7517:TCP" = 7517:TCP:*:Enabled:BND
"10053:TCP" = 10053:TCP:*:Enabled:BND
"12593:TCP" = 12593:TCP:*:Enabled:BND
"15129:TCP" = 15129:TCP:*:Enabled:BND
"17668:TCP" = 17668:TCP:*:Enabled:BND
"20205:TCP" = 20205:TCP:*:Enabled:BND
"22741:TCP" = 22741:TCP:*:Enabled:BND
"25280:TCP" = 25280:TCP:*:Enabled:BND
"27820:TCP" = 27820:TCP:*:Enabled:BND
"18600:TCP" = 18600:TCP:*:Enabled:BND
"21175:TCP" = 21175:TCP:*:Enabled:BND
"23711:TCP" = 23711:TCP:*:Enabled:BND
"26251:TCP" = 26251:TCP:*:Enabled:BND
"28787:TCP" = 28787:TCP:*:Enabled:BND
"31323:TCP" = 31323:TCP:*:Enabled:BND
"1095:TCP" = 1095:TCP:*:Enabled:BND
"3634:TCP" = 3634:TCP:*:Enabled:BND
"6180:TCP" = 6180:TCP:*:Enabled:BND
"8719:TCP" = 8719:TCP:*:Enabled:BND
"11256:TCP" = 11256:TCP:*:Enabled:BND
"31244:TCP" = 31244:TCP:*:Enabled:BND
"1019:TCP" = 1019:TCP:*:Enabled:BND
"6062:TCP" = 6062:TCP:*:Enabled:BND
"8601:TCP" = 8601:TCP:*:Enabled:BND
"32149:TCP" = 32149:TCP:*:Enabled:BND
"4457:TCP" = 4457:TCP:*:Enabled:BND
"6993:TCP" = 6993:TCP:*:Enabled:BND
"14543:TCP" = 14543:TCP:*:Enabled:BND
"19586:TCP" = 19586:TCP:*:Enabled:BND
"1113:TCP" = 1113:TCP:*:Enabled:BND
"24662:TCP" = 24662:TCP:*:Enabled:BND
"27198:TCP" = 27198:TCP:*:Enabled:BND
"29737:TCP" = 29737:TCP:*:Enabled:BND
"7205:TCP" = 7205:TCP:*:Enabled:BND
"12425:TCP" = 12425:TCP:*:Enabled:BND
"15016:TCP" = 15016:TCP:*:Enabled:BND
"22566:TCP" = 22566:TCP:*:Enabled:BND
"25106:TCP" = 25106:TCP:*:Enabled:BND
"27645:TCP" = 27645:TCP:*:Enabled:BND
"27495:TCP" = 27495:TCP:*:Enabled:BND
"30067:TCP" = 30067:TCP:*:Enabled:BND
"32607:TCP" = 32607:TCP:*:Enabled:BND
"2375:TCP" = 2375:TCP:*:Enabled:BND
"4917:TCP" = 4917:TCP:*:Enabled:BND
"7454:TCP" = 7454:TCP:*:Enabled:BND
"20136:TCP" = 20136:TCP:*:Enabled:BND
"24928:TCP" = 24928:TCP:*:Enabled:BND
"27496:TCP" = 27496:TCP:*:Enabled:BND
"30039:TCP" = 30039:TCP:*:Enabled:BND
"11567:TCP" = 11567:TCP:*:Enabled:BND
"2154:TCP" = 2154:TCP:*:Enabled:BND
"28462:TCP" = 28462:TCP:*:Enabled:BND
"24449:TCP" = 24449:TCP:*:Enabled:BND
"20412:TCP" = 20412:TCP:*:Enabled:BND
"11192:TCP" = 11192:TCP:*:Enabled:BND
"16366:TCP" = 16366:TCP:*:Enabled:BND
"18935:TCP" = 18935:TCP:*:Enabled:BND
"24043:TCP" = 24043:TCP:*:Enabled:BND
"26579:TCP" = 26579:TCP:*:Enabled:BND
"1426:TCP" = 1426:TCP:*:Enabled:BND
"24978:TCP" = 24978:TCP:*:Enabled:BND
"12489:TCP" = 12489:TCP:*:Enabled:BND
"23796:TCP" = 23796:TCP:*:Enabled:BND
"14573:TCP" = 14573:TCP:*:Enabled:BND
"28950:TCP" = 28950:TCP:*:Enabled:BND
"31487:TCP" = 31487:TCP:*:Enabled:BND
"18305:TCP" = 18305:TCP:*:Enabled:BND
"9085:TCP" = 9085:TCP:*:Enabled:BND
"32633:TCP" = 32633:TCP:*:Enabled:BND
"33530:TCP" = 33530:TCP:*:Enabled:BND
"5942:TCP" = 5942:TCP:*:Enabled:BND
"29494:TCP" = 29494:TCP:*:Enabled:BND
"11057:TCP" = 11057:TCP:*:Enabled:BND
"1837:TCP" = 1837:TCP:*:Enabled:BND
"16162:TCP" = 16162:TCP:*:Enabled:BND
"10223:TCP" = 10223:TCP:*:Enabled:BND
"24519:TCP" = 24519:TCP:*:Enabled:BND
"13208:TCP" = 13208:TCP:*:Enabled:BND
"15744:TCP" = 15744:TCP:*:Enabled:BND
"12902:TCP" = 12902:TCP:*:Enabled:BND
"3692:TCP" = 3692:TCP:*:Enabled:BND
"29845:TCP" = 29845:TCP:*:Enabled:BND
"20625:TCP" = 20625:TCP:*:Enabled:BND
"23194:TCP" = 23194:TCP:*:Enabled:BND
"13974:TCP" = 13974:TCP:*:Enabled:BND
"9934:TCP" = 9934:TCP:*:Enabled:BND
"33482:TCP" = 33482:TCP:*:Enabled:BND
"15082:TCP" = 15082:TCP:*:Enabled:BND
"17621:TCP" = 17621:TCP:*:Enabled:BND
"8401:TCP" = 8401:TCP:*:Enabled:BND
"10937:TCP" = 10937:TCP:*:Enabled:BND
"27740:TCP" = 27740:TCP:*:Enabled:BND
"9297:TCP" = 9297:TCP:*:Enabled:BND
"23595:TCP" = 23595:TCP:*:Enabled:BND
"26164:TCP" = 26164:TCP:*:Enabled:BND
"1779:TCP" = 1779:TCP:*:Enabled:BND
"10798:TCP" = 10798:TCP:*:Enabled:BND
"13370:TCP" = 13370:TCP:*:Enabled:BND
"4150:TCP" = 4150:TCP:*:Enabled:BND
"11925:TCP" = 11925:TCP:*:Enabled:BND
"28766:TCP" = 28766:TCP:*:Enabled:BND
"15306:TCP" = 15306:TCP:*:Enabled:BND
"23320:TCP" = 23320:TCP:*:Enabled:BND
"28516:TCP" = 28516:TCP:*:Enabled:BND
"20949:TCP" = 20949:TCP:*:Enabled:BND
"24559:TCP" = 24559:TCP:*:Enabled:BND
"20565:TCP" = 20565:TCP:*:Enabled:BND
"23144:TCP" = 23144:TCP:*:Enabled:BND
"4736:TCP" = 4736:TCP:*:Enabled:BND
"29092:TCP" = 29092:TCP:*:Enabled:BND
"24344:TCP" = 24344:TCP:*:Enabled:BND
"27522:TCP" = 27522:TCP:*:Enabled:BND
"30035:TCP" = 30035:TCP:*:Enabled:BND
"23355:TCP" = 23355:TCP:*:Enabled:BND
"25891:TCP" = 25891:TCP:*:Enabled:BND
"16674:TCP" = 16674:TCP:*:Enabled:BND
"19214:TCP" = 19214:TCP:*:Enabled:BND
"9994:TCP" = 9994:TCP:*:Enabled:BND
"24322:TCP" = 24322:TCP:*:Enabled:BND
"8386:TCP" = 8386:TCP:*:Enabled:BND
"10954:TCP" = 10954:TCP:*:Enabled:BND
"4241:TCP" = 4241:TCP:*:Enabled:BND
"27789:TCP" = 27789:TCP:*:Enabled:BND
"9382:TCP" = 9382:TCP:*:Enabled:BND
"23740:TCP" = 23740:TCP:*:Enabled:BND
"14520:TCP" = 14520:TCP:*:Enabled:BND
"28815:TCP" = 28815:TCP:*:Enabled:BND
"10415:TCP" = 10415:TCP:*:Enabled:BND
"1205:TCP" = 1205:TCP:*:Enabled:BND
"15503:TCP" = 15503:TCP:*:Enabled:BND
"20622:TCP" = 20622:TCP:*:Enabled:BND
"11398:TCP" = 11398:TCP:*:Enabled:BND
"25759:TCP" = 25759:TCP:*:Enabled:BND
"7319:TCP" = 7319:TCP:*:Enabled:BND
"14142:TCP" = 14142:TCP:*:Enabled:BND
"4939:TCP" = 4939:TCP:*:Enabled:BND
"28824:TCP" = 28824:TCP:*:Enabled:BND
"10417:TCP" = 10417:TCP:*:Enabled:BND
"12985:TCP" = 12985:TCP:*:Enabled:BND
"3765:TCP" = 3765:TCP:*:Enabled:BND
"16326:TCP" = 16326:TCP:*:Enabled:BND
"19309:TCP" = 19309:TCP:*:Enabled:BND
"8112:TCP" = 8112:TCP:*:Enabled:BND
"22469:TCP" = 22469:TCP:*:Enabled:BND
"25395:TCP" = 25395:TCP:*:Enabled:BND
"15722:TCP" = 15722:TCP:*:Enabled:BND
"30050:TCP" = 30050:TCP:*:Enabled:BND
"20831:TCP" = 20831:TCP:*:Enabled:BND
"2391:TCP" = 2391:TCP:*:Enabled:BND
"28511:TCP" = 28511:TCP:*:Enabled:BND
"31060:TCP" = 31060:TCP:*:Enabled:BND
"15307:TCP" = 15307:TCP:*:Enabled:BND
"29788:TCP" = 29788:TCP:*:Enabled:BND
"22999:TCP" = 22999:TCP:*:Enabled:BND
"19649:TCP" = 19649:TCP:*:Enabled:BND
"24722:TCP" = 24722:TCP:*:Enabled:BND
"30631:TCP" = 30631:TCP:*:Enabled:BND
"28626:TCP" = 28626:TCP:*:Enabled:BND
"12788:TCP" = 12788:TCP:*:Enabled:BND
"15357:TCP" = 15357:TCP:*:Enabled:BND
"20573:TCP" = 20573:TCP:*:Enabled:BND
"23109:TCP" = 23109:TCP:*:Enabled:BND
"13889:TCP" = 13889:TCP:*:Enabled:BND
"16428:TCP" = 16428:TCP:*:Enabled:BND
"30724:TCP" = 30724:TCP:*:Enabled:BND
"33293:TCP" = 33293:TCP:*:Enabled:BND
"15624:TCP" = 15624:TCP:*:Enabled:BND
"24762:TCP" = 24762:TCP:*:Enabled:BND
"13817:TCP" = 13817:TCP:*:Enabled:BND
"5285:TCP" = 5285:TCP:*:Enabled:BND
"19626:TCP" = 19626:TCP:*:Enabled:BND
"12956:TCP" = 12956:TCP:*:Enabled:BND
"29853:TCP" = 29853:TCP:*:Enabled:BND
"20633:TCP" = 20633:TCP:*:Enabled:BND
"23172:TCP" = 23172:TCP:*:Enabled:BND
"4700:TCP" = 4700:TCP:*:Enabled:BND
"3251:TCP" = 3251:TCP:*:Enabled:BND
"20050:TCP" = 20050:TCP:*:Enabled:BND
"1610:TCP" = 1610:TCP:*:Enabled:BND
"4146:TCP" = 4146:TCP:*:Enabled:BND
"6695:TCP" = 6695:TCP:*:Enabled:BND
"21059:TCP" = 21059:TCP:*:Enabled:BND
"23628:TCP" = 23628:TCP:*:Enabled:BND
"14412:TCP" = 14412:TCP:*:Enabled:BND
"19549:TCP" = 19549:TCP:*:Enabled:BND
"10329:TCP" = 10329:TCP:*:Enabled:BND
"18372:TCP" = 18372:TCP:*:Enabled:BND
"28195:TCP" = 28195:TCP:*:Enabled:BND
"18975:TCP" = 18975:TCP:*:Enabled:BND
"12356:TCP" = 12356:TCP:*:Enabled:BND
"26717:TCP" = 26717:TCP:*:Enabled:BND
"17501:TCP" = 17501:TCP:*:Enabled:BND
"20073:TCP" = 20073:TCP:*:Enabled:BND
"10856:TCP" = 10856:TCP:*:Enabled:BND
"27818:TCP" = 27818:TCP:*:Enabled:BND
"30387:TCP" = 30387:TCP:*:Enabled:BND
"32959:TCP" = 32959:TCP:*:Enabled:BND
"14552:TCP" = 14552:TCP:*:Enabled:BND
"17092:TCP" = 17092:TCP:*:Enabled:BND
"31397:TCP" = 31397:TCP:*:Enabled:BND
"33092:TCP" = 33092:TCP:*:Enabled:BND
"22467:TCP" = 22467:TCP:*:Enabled:BND
"24342:TCP" = 24342:TCP:*:Enabled:BND
"28977:TCP" = 28977:TCP:*:Enabled:BND
"25257:TCP" = 25257:TCP:*:Enabled:BND
"16152:TCP" = 16152:TCP:*:Enabled:BND
"7157:TCP" = 7157:TCP:*:Enabled:BND
"19204:TCP" = 19204:TCP:*:Enabled:BND
"10421:TCP" = 10421:TCP:*:Enabled:BND
"13166:TCP" = 13166:TCP:*:Enabled:BND
"27756:TCP" = 27756:TCP:*:Enabled:BND
"18833:TCP" = 18833:TCP:*:Enabled:BND
"13275:TCP" = 13275:TCP:*:Enabled:BND
"21961:TCP" = 21961:TCP:*:Enabled:BND
"18434:TCP" = 18434:TCP:*:Enabled:BND
"12074:TCP" = 12074:TCP:*:Enabled:BND
"19592:TCP" = 19592:TCP:*:Enabled:BND
"18813:TCP" = 18813:TCP:*:Enabled:BND
"18012:TCP" = 18012:TCP:*:Enabled:BND
"30189:TCP" = 30189:TCP:*:Enabled:BND
"32898:TCP" = 32898:TCP:*:Enabled:BND
"26502:TCP" = 26502:TCP:*:Enabled:BND
"17752:TCP" = 17752:TCP:*:Enabled:BND
"11392:TCP" = 11392:TCP:*:Enabled:BND
"16454:TCP" = 16454:TCP:*:Enabled:BND
"31890:TCP" = 31890:TCP:*:Enabled:BND
"25565:TCP" = 25565:TCP:*:Enabled:BND
"19169:TCP" = 19169:TCP:*:Enabled:BND
"10471:TCP" = 10471:TCP:*:Enabled:BND
"13213:TCP" = 13213:TCP:*:Enabled:BND
"14478:TCP" = 14478:TCP:*:Enabled:BND
"2809:TCP" = 2809:TCP:*:Enabled:BND
"19430:TCP" = 19430:TCP:*:Enabled:BND
"23028:TCP" = 23028:TCP:*:Enabled:BND
"23933:TCP" = 23933:TCP:*:Enabled:BND
"23138:TCP" = 23138:TCP:*:Enabled:BND
"4824:TCP" = 4824:TCP:*:Enabled:BND
"31280:TCP" = 31280:TCP:*:Enabled:BND
"23625:TCP" = 23625:TCP:*:Enabled:BND
"16925:TCP" = 16925:TCP:*:Enabled:BND
"9395:TCP" = 9395:TCP:*:Enabled:BND
"23756:TCP" = 23756:TCP:*:Enabled:BND
"31305:TCP" = 31305:TCP:*:Enabled:BND
"1923:TCP" = 1923:TCP:*:Enabled:BND
"30514:TCP" = 30514:TCP:*:Enabled:BND
"16760:TCP" = 16760:TCP:*:Enabled:BND
"28318:TCP" = 28318:TCP:*:Enabled:BND
"5851:TCP" = 5851:TCP:*:Enabled:BND
"29733:TCP" = 29733:TCP:*:Enabled:BND
"16474:TCP" = 16474:TCP:*:Enabled:BND
"3188:TCP" = 3188:TCP:*:Enabled:BND
"1753:TCP" = 1753:TCP:*:Enabled:BND
"7609:TCP" = 7609:TCP:*:Enabled:BND
"26919:TCP" = 26919:TCP:*:Enabled:BND
"10959:TCP" = 10959:TCP:*:Enabled:BND
"16859:TCP" = 16859:TCP:*:Enabled:BND
"8878:TCP" = 8878:TCP:*:Enabled:BND
"3366:TCP" = 3366:TCP:*:Enabled:BND
"13553:TCP" = 13553:TCP:*:Enabled:BND
"7107:TCP" = 7107:TCP:*:Enabled:BND
"1570:TCP" = 1570:TCP:*:Enabled:BND
"5929:TCP" = 5929:TCP:*:Enabled:BND
"1850:TCP" = 1850:TCP:*:Enabled:BND
"17576:TCP" = 17576:TCP:*:Enabled:BND
"29594:TCP" = 29594:TCP:*:Enabled:BND
"7177:TCP" = 7177:TCP:*:Enabled:BND
"26639:TCP" = 26639:TCP:*:Enabled:BND
"30637:TCP" = 30637:TCP:*:Enabled:BND
"8045:TCP" = 8045:TCP:*:Enabled:BND
"16291:TCP" = 16291:TCP:*:Enabled:BND
"21334:TCP" = 21334:TCP:*:Enabled:BND
"21742:TCP" = 21742:TCP:*:Enabled:BND
"17601:TCP" = 17601:TCP:*:Enabled:BND
"32285:TCP" = 32285:TCP:*:Enabled:BND
"2086:TCP" = 2086:TCP:*:Enabled:BND
"7165:TCP" = 7165:TCP:*:Enabled:BND
"3089:TCP" = 3089:TCP:*:Enabled:BND
"16200:TCP" = 16200:TCP:*:Enabled:BND
"33198:TCP" = 33198:TCP:*:Enabled:BND
"29123:TCP" = 29123:TCP:*:Enabled:BND
"14415:TCP" = 14415:TCP:*:Enabled:BND
"6257:TCP" = 6257:TCP:*:Enabled:BND
"8794:TCP" = 8794:TCP:*:Enabled:BND
"2110:TCP" = 2110:TCP:*:Enabled:BND
"4649:TCP" = 4649:TCP:*:Enabled:BND
"28635:TCP" = 28635:TCP:*:Enabled:BND
"3612:TCP" = 3612:TCP:*:Enabled:BND
"27160:TCP" = 27160:TCP:*:Enabled:BND
"24791:TCP" = 24791:TCP:*:Enabled:BND
"6352:TCP" = 6352:TCP:*:Enabled:BND
"7162:TCP" = 7162:TCP:*:Enabled:BND
"26595:TCP" = 26595:TCP:*:Enabled:BND
"22526:TCP" = 22526:TCP:*:Enabled:BND
"2797:TCP" = 2797:TCP:*:Enabled:BND
"19730:TCP" = 19730:TCP:*:Enabled:BND
"19836:TCP" = 19836:TCP:*:Enabled:BND
"22408:TCP" = 22408:TCP:*:Enabled:BND
"20833:TCP" = 20833:TCP:*:Enabled:BND
"33632:TCP" = 33632:TCP:*:Enabled:BND
"21017:TCP" = 21017:TCP:*:Enabled:BND
"19411:TCP" = 19411:TCP:*:Enabled:BND
"18038:TCP" = 18038:TCP:*:Enabled:BND
"4706:TCP" = 4706:TCP:*:Enabled:BND
"12390:TCP" = 12390:TCP:*:Enabled:BND
"31823:TCP" = 31823:TCP:*:Enabled:BND
"3386:TCP" = 3386:TCP:*:Enabled:BND
"1987:TCP" = 1987:TCP:*:Enabled:BND
"3811:TCP" = 3811:TCP:*:Enabled:BND
"29941:TCP" = 29941:TCP:*:Enabled:BND
"28567:TCP" = 28567:TCP:*:Enabled:BND
"15269:TCP" = 15269:TCP:*:Enabled:BND
"13339:TCP" = 13339:TCP:*:Enabled:BND
"30269:TCP" = 30269:TCP:*:Enabled:BND
"28481:TCP" = 28481:TCP:*:Enabled:BND
"17895:TCP" = 17895:TCP:*:Enabled:BND
"4566:TCP" = 4566:TCP:*:Enabled:BND
"21502:TCP" = 21502:TCP:*:Enabled:BND
"29183:TCP" = 29183:TCP:*:Enabled:BND
"15855:TCP" = 15855:TCP:*:Enabled:BND
"11779:TCP" = 11779:TCP:*:Enabled:BND
"19459:TCP" = 19459:TCP:*:Enabled:BND
"32979:TCP" = 32979:TCP:*:Enabled:BND
"17141:TCP" = 17141:TCP:*:Enabled:BND
"3809:TCP" = 3809:TCP:*:Enabled:BND
"32505:TCP" = 32505:TCP:*:Enabled:BND
"28560:TCP" = 28560:TCP:*:Enabled:BND
"29742:TCP" = 29742:TCP:*:Enabled:BND
"25670:TCP" = 25670:TCP:*:Enabled:BND
"20212:TCP" = 20212:TCP:*:Enabled:BND
"24983:TCP" = 24983:TCP:*:Enabled:BND
"23473:TCP" = 23473:TCP:*:Enabled:BND
"30355:TCP" = 30355:TCP:*:Enabled:BND
"27672:TCP" = 27672:TCP:*:Enabled:BND
"6321:TCP" = 6321:TCP:*:Enabled:BND
"12939:TCP" = 12939:TCP:*:Enabled:BND
"29712:TCP" = 29712:TCP:*:Enabled:BND
"20456:TCP" = 20456:TCP:*:Enabled:BND
"1049:TCP" = 1049:TCP:*:Enabled:BND
"13397:TCP" = 13397:TCP:*:Enabled:BND
"4206:TCP" = 4206:TCP:*:Enabled:BND
"15054:TCP" = 15054:TCP:*:Enabled:BND
"11576:TCP" = 11576:TCP:*:Enabled:BND
"13920:TCP" = 13920:TCP:*:Enabled:BND
"7024:TCP" = 7024:TCP:*:Enabled:BND
"31448:TCP" = 31448:TCP:*:Enabled:BND
"3536:TCP" = 3536:TCP:*:Enabled:BND
"7811:TCP" = 7811:TCP:*:Enabled:BND
"32150:TCP" = 32150:TCP:*:Enabled:BND
"4393:TCP" = 4393:TCP:*:Enabled:BND
"16943:TCP" = 16943:TCP:*:Enabled:BND
"10592:TCP" = 10592:TCP:*:Enabled:BND
"27362:TCP" = 27362:TCP:*:Enabled:BND
"27067:TCP" = 27067:TCP:*:Enabled:BND
"20533:TCP" = 20533:TCP:*:Enabled:BND
"25554:TCP" = 25554:TCP:*:Enabled:BND
"19605:TCP" = 19605:TCP:*:Enabled:BND
"10353:TCP" = 10353:TCP:*:Enabled:BND
"6110:TCP" = 6110:TCP:*:Enabled:BND
"8617:TCP" = 8617:TCP:*:Enabled:BND
"22883:TCP" = 22883:TCP:*:Enabled:BND
"4139:TCP" = 4139:TCP:*:Enabled:BND
"17362:TCP" = 17362:TCP:*:Enabled:BND
"2217:TCP" = 2217:TCP:*:Enabled:BND
"5302:TCP" = 5302:TCP:*:Enabled:BND
"7922:TCP" = 7922:TCP:*:Enabled:BND
"7183:TCP" = 7183:TCP:*:Enabled:BND
"7036:TCP" = 7036:TCP:*:Enabled:BND
"28665:TCP" = 28665:TCP:*:Enabled:BND
"21740:TCP" = 21740:TCP:*:Enabled:BND
"13720:TCP" = 13720:TCP:*:Enabled:BND
"16269:TCP" = 16269:TCP:*:Enabled:BND
"18772:TCP" = 18772:TCP:*:Enabled:BND
"1065:TCP" = 1065:TCP:*:Enabled:BND
"3568:TCP" = 3568:TCP:*:Enabled:BND
"13644:TCP" = 13644:TCP:*:Enabled:BND
"2656:TCP" = 2656:TCP:*:Enabled:BND
"18931:TCP" = 18931:TCP:*:Enabled:BND
"9711:TCP" = 9711:TCP:*:Enabled:BND
"24752:TCP" = 24752:TCP:*:Enabled:BND
"6367:TCP" = 6367:TCP:*:Enabled:BND
"21053:TCP" = 21053:TCP:*:Enabled:BND
"13303:TCP" = 13303:TCP:*:Enabled:BND
"3868:TCP" = 3868:TCP:*:Enabled:BND
"2136:TCP" = 2136:TCP:*:Enabled:BND
"29694:TCP" = 29694:TCP:*:Enabled:BND
"32201:TCP" = 32201:TCP:*:Enabled:BND
"16322:TCP" = 16322:TCP:*:Enabled:BND
"28885:TCP" = 28885:TCP:*:Enabled:BND
"6938:TCP" = 6938:TCP:*:Enabled:BND
"10210:TCP" = 10210:TCP:*:Enabled:BND
"24473:TCP" = 24473:TCP:*:Enabled:BND
"21054:TCP" = 21054:TCP:*:Enabled:BND
"6835:TCP" = 6835:TCP:*:Enabled:BND
"32933:TCP" = 32933:TCP:*:Enabled:BND
"9514:TCP" = 9514:TCP:*:Enabled:BND
"6157:TCP" = 6157:TCP:*:Enabled:BND
"21211:TCP" = 21211:TCP:*:Enabled:BND
"23718:TCP" = 23718:TCP:*:Enabled:BND
"17819:TCP" = 17819:TCP:*:Enabled:BND
"21910:TCP" = 21910:TCP:*:Enabled:BND
"21786:TCP" = 21786:TCP:*:Enabled:BND
"18994:TCP" = 18994:TCP:*:Enabled:BND
"13895:TCP" = 13895:TCP:*:Enabled:BND
"8718:TCP" = 8718:TCP:*:Enabled:BND
"4593:TCP" = 4593:TCP:*:Enabled:BND
"17124:TCP" = 17124:TCP:*:Enabled:BND
"23827:TCP" = 23827:TCP:*:Enabled:BND
"26334:TCP" = 26334:TCP:*:Enabled:BND
"29214:TCP" = 29214:TCP:*:Enabled:BND
"22321:TCP" = 22321:TCP:*:Enabled:BND
"6565:TCP" = 6565:TCP:*:Enabled:BND
"19257:TCP" = 19257:TCP:*:Enabled:BND
"15278:TCP" = 15278:TCP:*:Enabled:BND
"17898:TCP" = 17898:TCP:*:Enabled:BND
"26186:TCP" = 26186:TCP:*:Enabled:BND
"24458:TCP" = 24458:TCP:*:Enabled:BND
"7577:TCP" = 7577:TCP:*:Enabled:BND
"3800:TCP" = 3800:TCP:*:Enabled:BND
"22161:TCP" = 22161:TCP:*:Enabled:BND
"3736:TCP" = 3736:TCP:*:Enabled:BND
"5572:TCP" = 5572:TCP:*:Enabled:BND
"29087:TCP" = 29087:TCP:*:Enabled:BND
"18155:TCP" = 18155:TCP:*:Enabled:BND
"23178:TCP" = 23178:TCP:*:Enabled:BND
"7180:TCP" = 7180:TCP:*:Enabled:BND
"3738:TCP" = 3738:TCP:*:Enabled:BND
"2882:TCP" = 2882:TCP:*:Enabled:BND
"20420:TCP" = 20420:TCP:*:Enabled:BND
"17001:TCP" = 17001:TCP:*:Enabled:BND
"29483:TCP" = 29483:TCP:*:Enabled:BND
"23493:TCP" = 23493:TCP:*:Enabled:BND
"28565:TCP" = 28565:TCP:*:Enabled:BND
"15845:TCP" = 15845:TCP:*:Enabled:BND
"16616:TCP" = 16616:TCP:*:Enabled:BND
"24156:TCP" = 24156:TCP:*:Enabled:BND
"32457:TCP" = 32457:TCP:*:Enabled:BND
"23205:TCP" = 23205:TCP:*:Enabled:BND
"12230:TCP" = 12230:TCP:*:Enabled:BND
"29039:TCP" = 29039:TCP:*:Enabled:BND
"29937:TCP" = 29937:TCP:*:Enabled:BND
"7213:TCP" = 7213:TCP:*:Enabled:BND
"10670:TCP" = 10670:TCP:*:Enabled:BND
"31346:TCP" = 31346:TCP:*:Enabled:BND
"12841:TCP" = 12841:TCP:*:Enabled:BND
"27104:TCP" = 27104:TCP:*:Enabled:BND
"17851:TCP" = 17851:TCP:*:Enabled:BND
"9391:TCP" = 9391:TCP:*:Enabled:BND
"11898:TCP" = 11898:TCP:*:Enabled:BND
"28668:TCP" = 28668:TCP:*:Enabled:BND
"24432:TCP" = 24432:TCP:*:Enabled:BND
"20190:TCP" = 20190:TCP:*:Enabled:BND
"26011:TCP" = 26011:TCP:*:Enabled:BND
"31021:TCP" = 31021:TCP:*:Enabled:BND
"17559:TCP" = 17559:TCP:*:Enabled:BND
"27932:TCP" = 27932:TCP:*:Enabled:BND
"24608:TCP" = 24608:TCP:*:Enabled:BND
"7659:TCP" = 7659:TCP:*:Enabled:BND
"25719:TCP" = 25719:TCP:*:Enabled:BND
"2592:TCP" = 2592:TCP:*:Enabled:BND
"16881:TCP" = 16881:TCP:*:Enabled:BND
"7629:TCP" = 7629:TCP:*:Enabled:BND
"24470:TCP" = 24470:TCP:*:Enabled:BND
"29715:TCP" = 29715:TCP:*:Enabled:BND
"27702:TCP" = 27702:TCP:*:Enabled:BND
"9197:TCP" = 9197:TCP:*:Enabled:BND
"14259:TCP" = 14259:TCP:*:Enabled:BND
"26800:TCP" = 26800:TCP:*:Enabled:BND
"20051:TCP" = 20051:TCP:*:Enabled:BND
"11595:TCP" = 11595:TCP:*:Enabled:BND
"27600:TCP" = 27600:TCP:*:Enabled:BND
"18348:TCP" = 18348:TCP:*:Enabled:BND
"20851:TCP" = 20851:TCP:*:Enabled:BND
"30953:TCP" = 30953:TCP:*:Enabled:BND
"12448:TCP" = 12448:TCP:*:Enabled:BND
"30081:TCP" = 30081:TCP:*:Enabled:BND
"20828:TCP" = 20828:TCP:*:Enabled:BND
"10977:TCP" = 10977:TCP:*:Enabled:BND
"16107:TCP" = 16107:TCP:*:Enabled:BND
"6855:TCP" = 6855:TCP:*:Enabled:BND
"31452:TCP" = 31452:TCP:*:Enabled:BND
"15463:TCP" = 15463:TCP:*:Enabled:BND
"7974:TCP" = 7974:TCP:*:Enabled:BND
"11265:TCP" = 11265:TCP:*:Enabled:BND
"4516:TCP" = 4516:TCP:*:Enabled:BND
"4629:TCP" = 4629:TCP:*:Enabled:BND
"19650:TCP" = 19650:TCP:*:Enabled:BND
"12973:TCP" = 12973:TCP:*:Enabled:BND
"3724:TCP" = 3724:TCP:*:Enabled:BND
"29743:TCP" = 29743:TCP:*:Enabled:BND
"9610:TCP" = 9610:TCP:*:Enabled:BND
"14690:TCP" = 14690:TCP:*:Enabled:BND
"25168:TCP" = 25168:TCP:*:Enabled:BND
"9179:TCP" = 9179:TCP:*:Enabled:BND
"33469:TCP" = 33469:TCP:*:Enabled:BND
"17578:TCP" = 17578:TCP:*:Enabled:BND
"14964:TCP" = 14964:TCP:*:Enabled:BND
"15872:TCP" = 15872:TCP:*:Enabled:BND
"5005:TCP" = 5005:TCP:*:Enabled:BND
"28520:TCP" = 28520:TCP:*:Enabled:BND
"31037:TCP" = 31037:TCP:*:Enabled:BND
"15983:TCP" = 15983:TCP:*:Enabled:BND
"24317:TCP" = 24317:TCP:*:Enabled:BND
"28718:TCP" = 28718:TCP:*:Enabled:BND
"11300:TCP" = 11300:TCP:*:Enabled:BND
"13804:TCP" = 13804:TCP:*:Enabled:BND
"15359:TCP" = 15359:TCP:*:Enabled:BND
"9411:TCP" = 9411:TCP:*:Enabled:BND
"23674:TCP" = 23674:TCP:*:Enabled:BND
"14421:TCP" = 14421:TCP:*:Enabled:BND
"7676:TCP" = 7676:TCP:*:Enabled:BND
"24416:TCP" = 24416:TCP:*:Enabled:BND
"17670:TCP" = 17670:TCP:*:Enabled:BND
"30204:TCP" = 30204:TCP:*:Enabled:BND
"2547:TCP" = 2547:TCP:*:Enabled:BND
"31073:TCP" = 31073:TCP:*:Enabled:BND
"22615:TCP" = 22615:TCP:*:Enabled:BND
"9992:TCP" = 9992:TCP:*:Enabled:BND
"3247:TCP" = 3247:TCP:*:Enabled:BND
"26624:TCP" = 26624:TCP:*:Enabled:BND
"10580:TCP" = 10580:TCP:*:Enabled:BND
"33151:TCP" = 33151:TCP:*:Enabled:BND
"2886:TCP" = 2886:TCP:*:Enabled:BND
"20099:TCP" = 20099:TCP:*:Enabled:BND
"17474:TCP" = 17474:TCP:*:Enabled:BND
"27511:TCP" = 27511:TCP:*:Enabled:BND
"11519:TCP" = 11519:TCP:*:Enabled:BND
"3763:TCP" = 3763:TCP:*:Enabled:BND
"1862:TCP" = 1862:TCP:*:Enabled:BND
"31277:TCP" = 31277:TCP:*:Enabled:BND
"18635:TCP" = 18635:TCP:*:Enabled:BND
"11886:TCP" = 11886:TCP:*:Enabled:BND
"10026:TCP" = 10026:TCP:*:Enabled:BND
"31845:TCP" = 31845:TCP:*:Enabled:BND
"4130:TCP" = 4130:TCP:*:Enabled:BND
"12500:TCP" = 12500:TCP:*:Enabled:BND
"20860:TCP" = 20860:TCP:*:Enabled:BND
"2355:TCP" = 2355:TCP:*:Enabled:BND
"28403:TCP" = 28403:TCP:*:Enabled:BND
"8576:TCP" = 8576:TCP:*:Enabled:BND
"11105:TCP" = 11105:TCP:*:Enabled:BND
"13736:TCP" = 13736:TCP:*:Enabled:BND
"6990:TCP" = 6990:TCP:*:Enabled:BND
"29620:TCP" = 29620:TCP:*:Enabled:BND
"29231:TCP" = 29231:TCP:*:Enabled:BND
"25354:TCP" = 25354:TCP:*:Enabled:BND
"30423:TCP" = 30423:TCP:*:Enabled:BND
"32953:TCP" = 32953:TCP:*:Enabled:BND
"10418:TCP" = 10418:TCP:*:Enabled:BND
"20582:TCP" = 20582:TCP:*:Enabled:BND
"18993:TCP" = 18993:TCP:*:Enabled:BND
"3073:TCP" = 3073:TCP:*:Enabled:BND
"26608:TCP" = 26608:TCP:*:Enabled:BND
"8201:TCP" = 8201:TCP:*:Enabled:BND
"2864:TCP" = 2864:TCP:*:Enabled:BND
"19699:TCP" = 19699:TCP:*:Enabled:BND
"3769:TCP" = 3769:TCP:*:Enabled:BND
"4684:TCP" = 4684:TCP:*:Enabled:BND
"21669:TCP" = 21669:TCP:*:Enabled:BND
"15979:TCP" = 15979:TCP:*:Enabled:BND
"11805:TCP" = 11805:TCP:*:Enabled:BND
"28644:TCP" = 28644:TCP:*:Enabled:BND
"27065:TCP" = 27065:TCP:*:Enabled:BND
"6978:TCP" = 6978:TCP:*:Enabled:BND
"12096:TCP" = 12096:TCP:*:Enabled:BND
"5402:TCP" = 5402:TCP:*:Enabled:BND
"18070:TCP" = 18070:TCP:*:Enabled:BND
"2783:TCP" = 2783:TCP:*:Enabled:BND
"29129:TCP" = 29129:TCP:*:Enabled:BND
"33436:TCP" = 33436:TCP:*:Enabled:BND
"1567:TCP" = 1567:TCP:*:Enabled:BND
"2482:TCP" = 2482:TCP:*:Enabled:BND
"7890:TCP" = 7890:TCP:*:Enabled:BND
"28438:TCP" = 28438:TCP:*:Enabled:BND
"19218:TCP" = 19218:TCP:*:Enabled:BND
"3327:TCP" = 3327:TCP:*:Enabled:BND
"14060:TCP" = 14060:TCP:*:Enabled:BND
"30895:TCP" = 30895:TCP:*:Enabled:BND
"21731:TCP" = 21731:TCP:*:Enabled:BND
"20792:TCP" = 20792:TCP:*:Enabled:BND
"12729:TCP" = 12729:TCP:*:Enabled:BND
"3519:TCP" = 3519:TCP:*:Enabled:BND
"13143:TCP" = 13143:TCP:*:Enabled:BND
"27445:TCP" = 27445:TCP:*:Enabled:BND
"8979:TCP" = 8979:TCP:*:Enabled:BND
"32906:TCP" = 32906:TCP:*:Enabled:BND
"5201:TCP" = 5201:TCP:*:Enabled:BND
"22452:TCP" = 22452:TCP:*:Enabled:BND
"3370:TCP" = 3370:TCP:*:Enabled:BND
"29442:TCP" = 29442:TCP:*:Enabled:BND
"22745:TCP" = 22745:TCP:*:Enabled:BND
"13868:TCP" = 13868:TCP:*:Enabled:BND
"31500:TCP" = 31500:TCP:*:Enabled:BND
"23005:TCP" = 23005:TCP:*:Enabled:BND
"30633:TCP" = 30633:TCP:*:Enabled:BND
"31545:TCP" = 31545:TCP:*:Enabled:BND
"10960:TCP" = 10960:TCP:*:Enabled:BND
"1721:TCP" = 1721:TCP:*:Enabled:BND
"16016:TCP" = 16016:TCP:*:Enabled:BND
"21409:TCP" = 21409:TCP:*:Enabled:BND
"14725:TCP" = 14725:TCP:*:Enabled:BND
"29364:TCP" = 29364:TCP:*:Enabled:BND
"24330:TCP" = 24330:TCP:*:Enabled:BND
"15097:TCP" = 15097:TCP:*:Enabled:BND
"20169:TCP" = 20169:TCP:*:Enabled:BND
"13822:TCP" = 13822:TCP:*:Enabled:BND
"12945:TCP" = 12945:TCP:*:Enabled:BND
"25622:TCP" = 25622:TCP:*:Enabled:BND
"27155:TCP" = 27155:TCP:*:Enabled:BND
"25521:TCP" = 25521:TCP:*:Enabled:BND
"5457:TCP" = 5457:TCP:*:Enabled:BND
"11301:TCP" = 11301:TCP:*:Enabled:BND
"13860:TCP" = 13860:TCP:*:Enabled:BND
"3559:TCP" = 3559:TCP:*:Enabled:BND
"12817:TCP" = 12817:TCP:*:Enabled:BND
"1481:TCP" = 1481:TCP:*:Enabled:BND
"6546:TCP" = 6546:TCP:*:Enabled:BND
"10764:TCP" = 10764:TCP:*:Enabled:BND
"30207:TCP" = 30207:TCP:*:Enabled:BND
"19340:TCP" = 19340:TCP:*:Enabled:BND
"6306:TCP" = 6306:TCP:*:Enabled:BND
"18422:TCP" = 18422:TCP:*:Enabled:BND
"31362:TCP" = 31362:TCP:*:Enabled:BND
"30982:TCP" = 30982:TCP:*:Enabled:BND
"32730:TCP" = 32730:TCP:*:Enabled:BND
"5028:TCP" = 5028:TCP:*:Enabled:BND
"20021:TCP" = 20021:TCP:*:Enabled:BND
"13438:TCP" = 13438:TCP:*:Enabled:BND
"27737:TCP" = 27737:TCP:*:Enabled:BND
"17245:TCP" = 17245:TCP:*:Enabled:BND
"31547:TCP" = 31547:TCP:*:Enabled:BND
"25034:TCP" = 25034:TCP:*:Enabled:BND
"7051:TCP" = 7051:TCP:*:Enabled:BND
"20649:TCP" = 20649:TCP:*:Enabled:BND
"19740:TCP" = 19740:TCP:*:Enabled:BND
"13088:TCP" = 13088:TCP:*:Enabled:BND
"15657:TCP" = 15657:TCP:*:Enabled:BND
"32783:TCP" = 32783:TCP:*:Enabled:BND
"4266:TCP" = 4266:TCP:*:Enabled:BND
"6799:TCP" = 6799:TCP:*:Enabled:BND
"32890:TCP" = 32890:TCP:*:Enabled:BND
"22353:TCP" = 22353:TCP:*:Enabled:BND
"28712:TCP" = 28712:TCP:*:Enabled:BND
"8609:TCP" = 8609:TCP:*:Enabled:BND
"32141:TCP" = 32141:TCP:*:Enabled:BND
"23270:TCP" = 23270:TCP:*:Enabled:BND
"4164:TCP" = 4164:TCP:*:Enabled:BND
"5870:TCP" = 5870:TCP:*:Enabled:BND
"12329:TCP" = 12329:TCP:*:Enabled:BND
"3135:TCP" = 3135:TCP:*:Enabled:BND
"8207:TCP" = 8207:TCP:*:Enabled:BND
"9442:TCP" = 9442:TCP:*:Enabled:BND
"7870:TCP" = 7870:TCP:*:Enabled:BND
"31408:TCP" = 31408:TCP:*:Enabled:BND
"12887:TCP" = 12887:TCP:*:Enabled:BND
"29513:TCP" = 29513:TCP:*:Enabled:BND
"16672:TCP" = 16672:TCP:*:Enabled:BND
"18649:TCP" = 18649:TCP:*:Enabled:BND
"33010:TCP" = 33010:TCP:*:Enabled:BND
"27898:TCP" = 27898:TCP:*:Enabled:BND
"32107:TCP" = 32107:TCP:*:Enabled:BND
"30498:TCP" = 30498:TCP:*:Enabled:BND
"17477:TCP" = 17477:TCP:*:Enabled:BND
"8244:TCP" = 8244:TCP:*:Enabled:BND
"22543:TCP" = 22543:TCP:*:Enabled:BND
"25429:TCP" = 25429:TCP:*:Enabled:BND
"6963:TCP" = 6963:TCP:*:Enabled:BND
"12051:TCP" = 12051:TCP:*:Enabled:BND

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.EXE" = C:\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.EXE:*:Enabled:Yahoo! Messenger
"C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe" = C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe:*:Enabled:Yahoo! FT Server
"c:\progra~1\yahoo!\browser\ybrowser.exe" = c:\progra~1\yahoo!\browser\ybrowser.exe:*:Enabled:Internet Explorer -- (Yahoo!, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{04410044-9149-45C6-A806-F2BF9CFCE762}" = Microsoft Encarta Encyclopedia Standard 2004
"{097346E0-6A51-11D1-AD16-00A0C95E0503}(SBC)" = Visual IP InSight(SBC)
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{11F1920A-56A2-4642-B6E0-3B31A12C9288}" = Dell Solution Center
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{1D643CD7-4DD6-11D7-A4E0-000874180BB3}" = Microsoft Money 2004
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Dell Media Experience
"{264C2B41-D2B0-4508-854E-016ED64C7F73}" = Outdoor Objects Catalog
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}" = SymNet
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}" = Component Framework
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{34EEB1F5-E939-40A1-A6BA-957282A4B2C8}" = Norton AntiVirus Help
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{4468EF97-A253-4699-9E1C-88CAE2C6832D}" = ABBYY FineReader 5.0 Sprint
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{62120008-8E1E-4807-860D-A8B48F8552DB}" = Norton Protection Center
"{68D60342-7686-45C9-B8EB-40EF843D0460}" = Dell Networking Guide
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" = Norton AntiVirus
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{81A34902-9D0B-4920-A25C-4CDC5D14B328}" = Jasc Paint Shop Pro 8 Dell Edition
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8C64E145-54BA-11D6-91B1-00500462BE80}" = Microsoft Money 2004 System Pack
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90D55A3F-1D99-4C94-A77E-46DC14F0BF08}" = Help and Support Customization
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{A1B7B9B3-E1D2-41CA-9B4A-F18DC2710704}" = Microsoft Works 6.0
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A790BEB1-BCCF-4EC6-807B-5708B36E8A79}" = Intel® PROSet
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B24E05CC-46FF-4787-BBB8-5CD516AFB118}" = ccCommon
"{BD3DCAB0-3FE5-44FB-90DA-EFB0A2CD1387}" = Works Synchronization
"{C73F2967-062E-48F2-A462-D335B8950183}" = Safari
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}" = Jasc Paint Shop Photo Album
"{CF5193F7-6B37-11D5-B7D2-00AA00A204F1}" = Microsoft Money 2002 System Pack
"{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}" = Symantec Real Time Storage Protection Component
"{DC19E750-988B-4005-A355-85EF66055EFE}" = Works Suite OS Pack
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{FB98D390-54A4-4CD1-93D3-FBC96A6F07A3}" = DesignPro 5
"{FC4ED75D-916C-4A8C-BB67-3C6F6E06D62B}" = Banctec Service Agreement
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AdobeESD" = Adobe Download Manager 1.2 (Remove Only)
"BroadJump Client Foundation" = BroadJump Client Foundation
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Dell AIO Printer A940" = Dell AIO Printer A940
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"FileASSASSIN" = FileASSASSIN
"ie8" = Windows Internet Explorer 8
"InstallShield_{FB98D390-54A4-4CD1-93D3-FBC96A6F07A3}" = DesignPro 5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PROSet" = Intel® PRO Network Adapters and Drivers
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"QuickBooks 99" = QuickBooks 99
"RealPlayer 12.0" = RealPlayer
"SymSetup.{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" = Norton AntiVirus (Symantec Corporation)
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 2
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Works2002Setup" = Microsoft Works 2002 Setup Launcher
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update
"YOUReality_is1" = YOUReality1.2

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3359005984-3577352339-825049218-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Media Player" = Move Media Player
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/24/2011 8:05:54 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 3/24/2011 8:06:35 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 3/29/2011 8:41:21 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/31/2011 12:01:05 AM | Computer Name = HYDROHEAVEN1 | Source = Application Error | ID = 1000
Description = Faulting application ccSvcHst.exe, version 107.0.4.2, faulting module
ntdll.dll, version 5.1.2600.3520, fault address 0x0000108d.

Error - 4/1/2011 12:18:20 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/1/2011 12:18:20 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2011 4:23:07 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2011 4:23:07 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2011 4:23:07 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2011 11:14:03 PM | Computer Name = HYDROHEAVEN1 | Source = Application Error | ID = 1000
Description = Faulting application ccSvcHst.exe, version 107.0.4.2, faulting module
ntdll.dll, version 5.1.2600.3520, fault address 0x0000108d.

[ Application Events ]
Error - 3/24/2011 8:05:54 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 3/24/2011 8:06:35 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 3/29/2011 8:41:21 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/31/2011 12:01:05 AM | Computer Name = HYDROHEAVEN1 | Source = Application Error | ID = 1000
Description = Faulting application ccSvcHst.exe, version 107.0.4.2, faulting module
ntdll.dll, version 5.1.2600.3520, fault address 0x0000108d.

Error - 4/1/2011 12:18:20 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/1/2011 12:18:20 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2011 4:23:07 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2011 4:23:07 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2011 4:23:07 PM | Computer Name = HYDROHEAVEN1 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2011 11:14:03 PM | Computer Name = HYDROHEAVEN1 | Source = Application Error | ID = 1000
Description = Faulting application ccSvcHst.exe, version 107.0.4.2, faulting module
ntdll.dll, version 5.1.2600.3520, fault address 0x0000108d.

[ System Events ]
Error - 4/1/2011 10:04:01 PM | Computer Name = HYDROHEAVEN1 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80242007: Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework
3.5 Family Update for .NET versions 2.0 through 3.5 (KB951847) x86.

Error - 4/2/2011 10:04:14 PM | Computer Name = HYDROHEAVEN1 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80242007: Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework
3.5 Family Update for .NET versions 2.0 through 3.5 (KB951847) x86.

Error - 4/3/2011 10:04:53 PM | Computer Name = HYDROHEAVEN1 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80242007: Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework
3.5 Family Update for .NET versions 2.0 through 3.5 (KB951847) x86.

Error - 4/4/2011 3:34:02 PM | Computer Name = HYDROHEAVEN1 | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1460

Error - 4/4/2011 3:46:38 PM | Computer Name = HYDROHEAVEN1 | Source = System Error | ID = 1003
Description = Error code 00000050, parameter1 fe49f000, parameter2 00000000, parameter3
804f1899, parameter4 00000000.

Error - 4/5/2011 7:52:43 AM | Computer Name = HYDROHEAVEN1 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80242007: Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework
3.5 Family Update for .NET versions 2.0 through 3.5 (KB951847) x86.

Error - 4/6/2011 1:05:17 PM | Computer Name = HYDROHEAVEN1 | Source = Service Control Manager | ID = 7031
Description = The Symantec Event Manager service terminated unexpectedly. It has
done this 1 time(s). The following corrective action will be taken in 200 milliseconds:
Restart the service.

Error - 4/6/2011 1:05:17 PM | Computer Name = HYDROHEAVEN1 | Source = Service Control Manager | ID = 7031
Description = The Symantec Settings Manager service terminated unexpectedly. It
has done this 1 time(s). The following corrective action will be taken in 100
milliseconds: Restart the service.

Error - 4/6/2011 1:05:17 PM | Computer Name = HYDROHEAVEN1 | Source = Service Control Manager | ID = 7034
Description = The Symantec Lic NetConnect service service terminated unexpectedly.
It has done this 1 time(s).

Error - 4/6/2011 1:05:17 PM | Computer Name = HYDROHEAVEN1 | Source = Service Control Manager | ID = 7034
Description = The LiveUpdate Notice service terminated unexpectedly. It has done
this 1 time(s).


< End of report >

#4 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:01:09 AM

Posted 06 April 2011 - 03:45 PM

Hi,

are you still being redirected? Please also run a scan with RkU:
Please download Rootkit Unhooker from one of the following links and save it to your desktop. Link 1 (.exe file) Link 2 (zipped file) Link 3 (.rar file) In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.
  • Double-click on RKUnhookerLE.exe to start the program. Vista/Windows 7 users right-click and select Run As Administrator.
  • Click the Report tab, then click Scan.
  • Check Drivers, Stealth, and uncheck the rest.
  • Click OK.
  • Wait until it's finished and then go to File > Save Report.
  • Save the report to your Desktop.
  • Copy and paste the contents of the report into your next reply.
-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#5 hydrodumps

hydrodumps
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 06 April 2011 - 04:28 PM

Here is the report I ran, thanks for your assistance!

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 2)
Number of processors #1
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2181376 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2181376 bytes
0x804D7000 RAW 2181376 bytes
0x804D7000 WMIxWDM 2181376 bytes
0xBF800000 Win32k 1851392 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1851392 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xB4813000 C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080122.037\NAVEX15.SYS 888832 bytes (Symantec Corporation, AV Engine)
0xBF05E000 C:\WINDOWS\System32\ialmdd5.DLL 765952 bytes (Intel Corporation, DirectDraw® Driver for Intel® Graphics Technology)
0xF858C000 C:\WINDOWS\System32\DRIVERS\ialmnt5.sys 684032 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0xF846C000 C:\WINDOWS\system32\drivers\smwdm.sys 581632 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio )
0xF9144000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xB51E0000 C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys 458752 bytes (Symantec Corporation, SPBBC Driver)
0xB5125000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 454656 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xB50C5000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 393216 bytes (Symantec Corporation, Symantec Eraser Control Driver)
0xF83C7000 C:\WINDOWS\System32\DRIVERS\update.sys 364544 bytes (Microsoft Corporation, Update Driver)
0xB54EF000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 360448 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xB4B3D000 C:\WINDOWS\System32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)
0xB48EC000 C:\WINDOWS\System32\Drivers\SRTSP.SYS 299008 bytes (Symantec Corporation, Symantec AutoProtect)
0xB3A42000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF9277000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xF9117000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xB54C2000 C:\WINDOWS\System32\Drivers\SYMTDI.SYS 184320 bytes (Symantec Corporation, Network Dispatch Driver)
0xB4CFC000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 180224 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xB5194000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB53E0000 C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\ipsdefs\20071204.001\SymIDSCo.sys 176128 bytes (Symantec Corporation, IDS Core Driver)
0xB531C000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xB549D000 C:\WINDOWS\system32\Drivers\SYMEVENT.SYS 151552 bytes (Symantec Corporation, Symantec Event Library)
0xF8531000 C:\WINDOWS\System32\DRIVERS\e100b325.sys 147456 bytes (Intel Corporation, Intel® PRO/100 Adapter NDIS 5.1 driver)
0xF8448000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF84FA000 C:\WINDOWS\System32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xF8555000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 143360 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB52FA000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xB51BF000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 135168 bytes (Microsoft Corporation, IP Network Address Translator)
0x806EC000 ACPI_HAL 131968 bytes
0x806EC000 C:\WINDOWS\system32\hal.dll 131968 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF920F000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF9247000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xBF03F000 C:\WINDOWS\System32\ialmdev5.DLL 126976 bytes (Intel Corporation, Component GHAL Driver)
0xBF020000 C:\WINDOWS\System32\ialmdnt5.dll 126976 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0xB50A7000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 122880 bytes (Symantec Corporation, Symantec Eraser Utility Driver)
0xF90FC000 Mup.sys 110592 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xB4FC1000 C:\WINDOWS\system32\dla\tfsnudf.sys 102400 bytes (Sonic Solutions, Drive Letter Access Component)
0xB4FA8000 C:\WINDOWS\system32\dla\tfsnudfa.sys 102400 bytes (Sonic Solutions, Drive Letter Access Component)
0xF922F000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xB508F000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF90E4000 IPVNMon.sys 98304 bytes (Visual Networks, IPVNMon)
0xF91D1000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF8431000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xB5437000 C:\WINDOWS\System32\Drivers\SYMFW.SYS 90112 bytes (Symantec Corporation, Firewall Filter Driver)
0xF91E8000 drvmcdb.sys 86016 bytes (Sonic Solutions, Device Driver)
0xB4FDA000 C:\WINDOWS\system32\dla\tfsnifs.sys 86016 bytes (Sonic Solutions, Drive Letter Access Component)
0xB47FE000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF851D000 C:\WINDOWS\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xF8578000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xB5547000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xB47EB000 C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080122.037\NAVENG.SYS 77824 bytes (Symantec Corporation, AV Engine)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF91FD000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF9266000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF8420000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xB5829000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF93B6000 C:\WINDOWS\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xF93F6000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF93E6000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xB49B5000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF8643000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xBF012000 C:\WINDOWS\System32\ialmrnt5.dll 57344 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0xF93D6000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 53248 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF9306000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF9396000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF9406000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF92E6000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF86B3000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF9326000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)
0xF93C6000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF92D6000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF86C3000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xEFEBD000 C:\WINDOWS\system32\drivers\drvnddm.sys 40960 bytes (Sonic Solutions, Device Driver Manager)
0xF8683000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xB69CD000 C:\WINDOWS\System32\Drivers\SRTSPX.SYS 40960 bytes (Symantec Corporation, Symantec AutoProtect)
0xF8693000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF92F6000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xB5889000 C:\WINDOWS\System32\Drivers\Fips.SYS 36864 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xB5839000 C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF9386000 C:\WINDOWS\System32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF92C6000 isapnp.sys 36864 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF86A3000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xB69FD000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xB4985000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF9316000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xEFEAD000 C:\WINDOWS\system32\dla\tfsncofs.sys 36864 bytes (Sonic Solutions, Drive Letter Access Component)
0xB69BD000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xB7442000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xB7432000 C:\WINDOWS\System32\Drivers\SYMIDS.SYS 32768 bytes (Symantec Corporation, IDS Filter Driver)
0xB743A000 C:\WINDOWS\System32\Drivers\SYMNDIS.SYS 32768 bytes (Symantec Corporation, NDIS Filter Driver)
0xB59DF000 C:\WINDOWS\System32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xF968E000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xB59D7000 C:\WINDOWS\System32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF9546000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF96C6000 C:\WINDOWS\system32\DRIVERS\SymIM.sys 28672 bytes (Symantec Corporation, NDIS Intermediate Driver)
0xB5465000 C:\WINDOWS\system32\dla\tfsnboio.sys 28672 bytes (Sonic Solutions, Drive Letter Access Component)
0xF9686000 C:\WINDOWS\System32\DRIVERS\usbehci.sys 28672 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF95CE000 C:\WINDOWS\System32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
0xF969E000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0xF9696000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF96BE000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF95EE000 C:\WINDOWS\system32\drivers\ssrtln.sys 24576 bytes (Sonic Solutions, Shared Driver Component)
0xB7452000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xB744A000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF96CE000 C:\WINDOWS\System32\DRIVERS\omci.sys 20480 bytes (Dell Computer Corporation, OMCI Device Driver)
0xF954E000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF96AE000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF96B6000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xF96A6000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF967E000 C:\WINDOWS\System32\DRIVERS\usbuhci.sys 20480 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xB548D000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF976A000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xF8E57000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF8E4B000 C:\WINDOWS\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF0122000 C:\WINDOWS\System32\Drivers\SYMREDRV.SYS 16384 bytes (Symantec Corporation, Redirector Filter Driver)
0xB5047000 C:\WINDOWS\system32\dla\tfsnopio.sys 16384 bytes (Sonic Solutions, Drive Letter Access Component)
0xB73BB000 C:\WINDOWS\System32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver)
0xF96D6000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF909F000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF97BE000 C:\WINDOWS\System32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xB73B3000 C:\WINDOWS\System32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF8E47000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF0126000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF981C000 C:\WINDOWS\system32\drivers\aeaudio.sys 8192 bytes (Andrea Electronics Corporation, Andrea Audio Stub Driver)
0xF97E6000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF980C000 C:\WINDOWS\System32\DRIVERS\dsunidrv.sys 8192 bytes (Gteko Ltd., GUniDriver)
0xF9800000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF97E4000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF9854000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 8192 bytes (Microsoft Corporation, I2O Utility Filter)
0xF97C6000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF97E8000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF97D0000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xF97EA000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF981A000 C:\WINDOWS\system32\drivers\sscdbhk5.sys 8192 bytes (Sonic Solutions, Shared Driver Component)
0xF981E000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF97EC000 C:\WINDOWS\System32\Drivers\SYMDNS.SYS 8192 bytes (Symantec Corporation, DNS Filter Driver)
0xF988C000 C:\WINDOWS\system32\dla\tfsnpool.sys 8192 bytes (Sonic Solutions, Drive Letter Access Component)
0xF9822000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF97C8000 C:\WINDOWS\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF9895000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF98BD000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xB6B3B000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF988E000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0xF99C2000 C:\WINDOWS\system32\dla\tfsndrct.sys 4096 bytes (Sonic Solutions, Drive Letter Access Component)
0xF99C5000 C:\WINDOWS\system32\dla\tfsndres.sys 4096 bytes (Sonic Solutions, Drive Letter Access Component)
==============================================
>Stealth
==============================================
0x81A74A9B Unknown page with executable code, 1381 bytes
0x81A7786A Unknown page with executable code, 1942 bytes
0x81A79794 Unknown page with executable code, 2156 bytes
0x81A7778B Unknown page with executable code, 2165 bytes
0x81A7962D Unknown page with executable code, 2515 bytes
0x81A73288 Unknown page with executable code, 3448 bytes
0x81A7519B Unknown page with executable code, 3685 bytes
0xF92E6000 WARNING: Virus alike driver modification [VolSnap.sys], 53248 bytes
0x81A77E84 Unknown thread object [ ETHREAD 0x81A71DA8 ] TID: 120, 600 bytes
0x81A7A084 Unknown thread object [ ETHREAD 0x81AF2020 ] TID: 124, 600 bytes
0x81A7915A Unknown thread object [ ETHREAD 0x81B0FDA8 ] , 600 bytes
0x81A77B4F Unknown thread object [ ETHREAD 0x81B0FB30 ] , 600 bytes
0x81A79D58 Unknown page with executable code, 680 bytes

#6 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:01:09 AM

Posted 06 April 2011 - 04:32 PM

Hi,

you have been infected by a nasty rootkit. It is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.


If you decide to clean, then please run TDSSKiller and post the log in your next reply:

  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
  • Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

    "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt

  • If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
  • When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#7 hydrodumps

hydrodumps
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 06 April 2011 - 05:20 PM

I wanted to try and clean it first but when I copy and past what you suggested it says "cannot find this file" and it is saved to the desktop, please help!

#8 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:01:09 AM

Posted 06 April 2011 - 05:46 PM

Hi,

can you please double-click the file and follow the prompts.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#9 hydrodumps

hydrodumps
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 06 April 2011 - 05:59 PM

I was able to type that in and then it asked me if I wanted to Run it, so I did however when I check the C drive there is no "TDSSKiller.txt" file? Am I doing something wrong?

#10 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:01:09 AM

Posted 06 April 2011 - 06:06 PM

Hi,

do you by chance remember if it found anything from the run?

If TDSSKiller isn't working out, please try running ComboFix:

Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Temporarily disable isable your AntiVirus and AntiSpyware applications. They may otherwise interfere with our tools
    Usually this can be done via a right click on the System Tray icon, check this tutorial for disabling the most common security programs: Link

  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper


If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

regards myrti

Edited by myrti, 06 April 2011 - 06:28 PM.

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#11 hydrodumps

hydrodumps
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 06 April 2011 - 06:30 PM

Maybe I should re-instal my OS with the Disk I have.... Should I save all my Documents, Photos and other pereferal items and then disconnect from the internet to use the Reinstallation CD? What process do you reccomend to properly re-install?

#12 hydrodumps

hydrodumps
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 06 April 2011 - 06:31 PM

oops im gonna try the combo fix you just put up... Sorry

#13 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:01:09 AM

Posted 06 April 2011 - 06:45 PM

Hi,

if you want to reinstall you don't need to run ComboFix first.

Reformatting a hard disk deletes all data. You can back up all your important documents, personal data files, photos to a CD or DVD drive, not a flash drive or external hard drive as they may become compromised in the process. The safest practice is not to backup any executable files (*.exe), screensavers (*.scr), autorun (.ini) or script files (.php, .asp, and .html) files because they may be infected by malware. Avoid backing up compressed files (.zip, .cab, .rar) that have executable files inside them as some types of malware can penetrate and infect .exe files within compressed files too. Other types of malware may even disguise itself by adding and hiding its extension to the existing extension of file(s) so be sure you look closely at the full file name. After reformatting, scan the backed up data with your anti-virus prior to to copying it back to your hard drive.

If you're not sure how to reformat or need help with reformatting, please review:These links include step-by-step instructions with screenshots:Don't forget you will have to go to Microsoft Update and apply all Windows security patches after reformatting.
Also see How to keep your Windows XP activation after clean install.

Note: If you're using an IBM, Sony, HP, Compaq or Dell machine, you may not have an original XP CD Disk. By policy Microsoft no longer allows OEM manufactures to include the original Windows XP CD-ROM on computers sold with Windows pre-installed. Instead, most computers manufactured and sold by OEM vendors come with a vendor-specific Recovery Disk or Recovery Partition for performing a clean "factory restore" that will reformat your hard drive, remove all data and restore the computer to the state it was in when you first purchased it. See Technology Advisory Recovery Media.

If you need additional assistance with reformatting or have questions about multiple hard drives, you can start a new topic in the Windows XP Home and Professional forum. If you don't get a reply, please send me a PM and I will get someone to take a look.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#14 hydrodumps

hydrodumps
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 07 April 2011 - 10:30 AM

Here is the combofix report, thanks for the help!!

ComboFix 11-04-06.01 - Hydro Heaven 04/06/2011 17:37:17.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.119 [GMT -7:00]
Running from: c:\documents and settings\Hydro Heaven\Desktop\ComboFix.exe
FW: Norton AntiVirus *Enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Hydro Heaven\System
c:\documents and settings\Hydro Heaven\System\win_qs8.jqx
c:\documents and settings\Hydro Heaven\WINDOWS
c:\documents and settings\Patty\Application Data\alot
C:\techload.dll
c:\temp\0b9
c:\temp\0b9\tmpTF.log
c:\temp\aZ001.exe
c:\temp\iee
c:\temp\iee\tmpZTF.log
c:\temp\tn3
c:\windows\patch.exe
c:\windows\SCAN.DLL
c:\windows\socks.dll
.
Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
Restored copy from - Kitty had a snack :P
.
((((((((((((((((((((((((( Files Created from 2011-03-07 to 2011-04-07 )))))))))))))))))))))))))))))))
.
.
2011-04-07 11:21 . 2011-04-07 12:24 -------- d-----w- c:\windows\system32\CatRoot_bak
2011-04-07 10:47 . 2011-04-07 10:47 -------- d-----w- c:\windows\LastGood
2011-04-07 10:07 . 2011-04-07 10:07 -------- d-----w- c:\windows\system32\XPSViewer
2011-04-07 10:07 . 2011-04-07 10:07 -------- d-----w- c:\program files\MSBuild
2011-04-07 10:07 . 2011-04-07 10:07 -------- d-----w- c:\program files\Reference Assemblies
2011-04-07 10:07 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-04-07 10:06 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-04-07 10:06 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-04-07 10:06 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2011-04-07 10:06 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2011-04-07 10:06 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-04-07 10:06 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-04-07 10:06 . 2011-04-07 10:07 -------- d-----w- C:\6cb58848e71dc598171f16637b
2011-04-07 10:06 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2011-04-07 10:06 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2011-04-07 10:01 . 2011-04-07 10:01 -------- d-----w- c:\program files\MSXML 6.0
2011-04-07 00:13 . 2011-04-07 00:13 -------- d-----w- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
2011-04-06 10:01 . 2011-04-06 22:39 -------- d-----w- C:\21979999e6d87ae953b2
2011-04-06 10:00 . 2011-04-06 10:01 -------- d-----w- C:\97caf4734c16104c31e3b0a35a0daacc
2011-04-04 19:44 . 2011-04-06 22:40 -------- d-----w- C:\3552f69b16fcf3183e0a55465790
2011-04-04 19:43 . 2011-04-04 19:44 -------- d-----w- C:\e7398452facfa2dbcb445e6d080ba53d
2011-04-04 19:24 . 2011-04-06 22:39 -------- d-----w- C:\9d3668a048fbe5a335e49b7fbee7
2011-04-04 19:24 . 2011-04-04 19:24 -------- d-----w- C:\141d18b248f4ce98d61f88eaa5
2011-04-04 17:25 . 2011-04-04 17:25 -------- d-----w- c:\program files\iPod
2011-04-04 17:24 . 2011-04-04 17:26 -------- d-----w- c:\program files\iTunes
2011-04-04 16:53 . 2011-04-04 16:53 -------- d-----w- c:\program files\Bonjour
2011-04-04 10:01 . 2011-04-06 22:38 -------- d-----w- C:\f863f3b11fb74681f4
2011-04-04 10:01 . 2011-04-04 10:01 -------- d-----w- C:\38b23c5a8b718f7297
2011-04-03 10:01 . 2011-04-06 22:38 -------- d-----w- C:\d8c96c8ab58be0675e
2011-04-03 10:01 . 2011-04-03 10:01 -------- d-----w- C:\6909b529d2fe84911368
2011-04-02 10:01 . 2011-04-06 22:39 -------- d-----w- C:\afa1e6ce7bff4e6849526076246b28b0
2011-04-02 10:00 . 2011-04-02 10:01 -------- d-----w- C:\c8180544575f6128ca
2011-04-01 10:01 . 2011-04-06 22:39 -------- d-----w- C:\eda2a69f6d636a2666e114d777e4
2011-04-01 10:00 . 2011-04-01 10:01 -------- d-----w- C:\beb7f2035a9a66472063497a2d185f
2011-03-29 10:00 . 2011-04-06 22:39 -------- d-----w- C:\41335d4b0a13f8cd0c3f
2011-03-29 10:00 . 2011-03-29 10:00 -------- d-----w- C:\91a12a64a7ccf3f6b279
2011-03-28 23:13 . 2011-03-28 23:13 388096 ----a-r- c:\documents and settings\Hydro Heaven\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-03-28 23:13 . 2011-03-28 23:13 -------- d-----w- c:\program files\Trend Micro
2011-03-28 10:01 . 2011-04-06 22:40 -------- d-----w- C:\4c5e93caa50228997b5555ea43
2011-03-28 10:00 . 2011-03-29 02:00 -------- d-----w- C:\c8121c1a634212c372
2011-03-27 10:01 . 2011-04-06 22:39 -------- d-----w- C:\c1b05e70d7da2e8fca31
2011-03-27 10:00 . 2011-03-28 02:00 -------- d-----w- C:\4e76a21cf962b5a5ea233f8f812674
2011-03-25 23:01 . 2011-04-06 22:39 -------- d-----w- C:\b84d12ad8cc36ee704
2011-03-25 23:01 . 2011-03-25 23:01 -------- d-----w- C:\e4d72cf4ab4b89bd2d51b94b51
2011-03-25 22:47 . 2011-04-06 22:39 -------- d-----w- C:\0189f62ef5ca56e75c72
2011-03-25 22:47 . 2011-03-25 22:47 -------- d-----w- C:\4ced9128e613121bd5b7ee7406
2011-03-25 20:58 . 2011-03-25 20:58 -------- d-----w- c:\documents and settings\Hydro Heaven\Application Data\Malwarebytes
2011-03-25 20:57 . 2010-12-21 01:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-25 20:57 . 2011-03-25 20:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-03-25 20:57 . 2011-03-25 20:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-03-25 11:51 . 2011-04-06 22:39 -------- d-----w- C:\43ea85f74ca6298408c125cb
2011-03-25 11:51 . 2011-03-25 11:51 -------- d-----w- C:\d2e95bb56671a5e35839f1
2011-03-25 10:01 . 2011-04-06 22:39 -------- d-----w- C:\ba8bb58ba05a15235d3fca
2011-03-25 10:00 . 2011-03-25 10:01 -------- d-----w- C:\e07b5f78abbcda20dc
2011-03-24 22:16 . 2011-03-24 23:26 -------- d-----w- C:\7faf097f7f0b72ae90734a1b4b2087a9
2011-03-24 22:16 . 2011-03-24 22:16 -------- d-----w- C:\fe1fa432e229bb8bb1e26bb490a571
2011-03-23 21:15 . 2011-03-24 21:40 -------- d-----w- c:\program files\FileASSASSIN
2011-03-23 17:09 . 2011-03-24 23:27 -------- d-----w- C:\78c68814a4dc8ec6c0
2011-03-23 17:08 . 2011-03-24 21:40 -------- d-----w- C:\a97906d189099487805a
2011-03-23 17:01 . 2011-03-23 17:01 -------- d-----w- c:\windows\system32\wbem\Repository
2011-03-22 16:49 . 2011-03-24 23:26 -------- d-----w- C:\6d82027c440cd9ceea668bfd47b2
2011-03-22 16:48 . 2011-03-23 16:51 -------- d-----w- C:\619e2eb2f189a5afddc5
2011-03-21 10:01 . 2011-03-24 23:27 -------- d-----w- C:\ebf49712726611c4b3d62aeb
2011-03-21 10:00 . 2011-03-23 16:52 -------- d-----w- C:\a60396851ea72ac777e8b6f1cf1a5a
2011-03-20 10:00 . 2011-03-24 23:26 -------- d-----w- C:\cb4ad89582905337832dbde7
2011-03-20 10:00 . 2011-03-23 16:52 -------- d-----w- C:\9a5254d4f90b9a1c32f949
2011-03-19 10:00 . 2011-03-24 23:26 -------- d-----w- C:\d61800eba5eaa0abda111b7cf73e50
2011-03-19 10:00 . 2011-03-23 16:52 -------- d-----w- C:\0390e136c34628855a906328
2011-03-18 16:45 . 2011-03-24 23:25 -------- d-----w- C:\9cefc04c5d5f7618bb090cdb06
2011-03-18 16:45 . 2011-03-23 16:52 -------- d-----w- C:\1823b6418a54d99915
2011-03-17 10:01 . 2011-03-24 23:27 -------- d-----w- C:\a20740977e64b4fd239342
2011-03-17 10:00 . 2011-03-23 16:52 -------- d-----w- C:\7600e7e077d7af71810602e6e9aa2f
2011-03-16 10:01 . 2011-03-24 23:25 -------- d-----w- C:\15fac2618c4736111f9c97e66f15
2011-03-16 10:00 . 2011-03-23 16:52 -------- d-----w- C:\457a0e790144130dc7e8a7dafc13
2011-03-15 10:00 . 2011-03-24 23:27 -------- d-----w- C:\3063cfb827455ff71c
2011-03-15 10:00 . 2011-03-23 16:52 -------- d-----w- C:\07fddc78c114d16b4c8473f6f661991e
2011-03-14 10:01 . 2011-03-24 23:27 -------- d-----w- C:\362bb3ba65772e1b1b84885b804138
2011-03-14 10:00 . 2011-03-23 16:53 -------- d-----w- C:\747ec74a5fb236372f76998bdf
2011-03-13 11:01 . 2011-03-24 23:26 -------- d-----w- C:\457675a6e6e9a11349b1e65fb87d
2011-03-13 11:01 . 2011-03-23 16:53 -------- d-----w- C:\3903347445a07e14c412
2011-03-12 11:01 . 2011-03-24 23:26 -------- d-----w- C:\e20db771e3fc18fea42188
2011-03-12 11:01 . 2011-03-23 16:56 -------- d-----w- C:\179ebbc409e4d6620f984f09c23e4982
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-01-20 17:34 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-06-25 294998]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-11 368706]
"YBrowser"="c:\program files\Yahoo!\browser\ybrwicon.exe" [2003-07-11 57344]
"IPInSightLAN 02"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 380928]
"IPInSightMonitor 02"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 122880]
"MMTray"="c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2004-07-01 131072]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-15 202256]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-30 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Hydro Heaven^Start Menu^Programs^Startup^Connection Manager.lnk]
path=c:\documents and settings\Hydro Heaven\Start Menu\Programs\Startup\Connection Manager.lnk
backup=c:\windows\pss\Connection Manager.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
2002-09-11 05:26 368706 ----a-w- c:\program files\BroadJump\Client Foundation\CFD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 07:56 15360 ----a-w- c:\windows\SYSTEM32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell AIO Printer A940]
2003-06-25 15:29 294998 ------w- c:\program files\Dell AIO Printer A940\dlbabmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-03-15 06:04 122933 ----a-w- c:\windows\SYSTEM32\dla\tfswctrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2004-02-10 16:51 118784 ----a-w- c:\windows\SYSTEM32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2004-02-10 16:55 155648 ----a-w- c:\windows\SYSTEM32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPInSightLAN 02]
2003-06-11 09:52 380928 ----a-w- c:\program files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPInSightMonitor 02]
2003-06-11 09:52 122880 ----a-w- c:\program files\Visual Networks\Visual IP InSight\SBC\ipmon32.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2001-08-23 21:52 331830 ----a-w- c:\program files\Microsoft Works\wkssb.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2001-08-17 04:41 28738 ----a-w- c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2004-07-01 20:15 131072 ----a-w- c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2004-04-12 01:15 290816 ----a-w- c:\program files\Dell\Media Experience\PCMService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-30 01:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2003-11-19 22:48 32881 ----a-w- c:\program files\Java\j2re1.4.2_03\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-04-15 18:28 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 06:01 110592 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2001-10-06 00:34 24576 ----a-w- c:\program files\Microsoft Works\wkfud.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
2003-07-11 22:51 57344 ----a-w- c:\program files\Yahoo!\browser\ybrwicon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YPCService"=3 (0x3)
"SymWSC"=2 (0x2)
"SNDSrvc"=2 (0x2)
"SBService"=2 (0x2)
"SAVScan"=3 (0x3)
"NetSvc"=3 (0x3)
"navapsvc"=2 (0x2)
"MDM"=2 (0x2)
"LexBceS"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccProxy"=2 (0x2)
"ccEvtMgr"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\progra~1\\yahoo!\\browser\\ybrowser.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"28952:TCP"= 28952:TCP:BND
"19330:TCP"= 19330:TCP:BND
"5033:TCP"= 5033:TCP:BND
"31645:TCP"= 31645:TCP:BND
"18984:TCP"= 18984:TCP:BND
"16906:TCP"= 16906:TCP:BND
"15085:TCP"= 15085:TCP:BND
"30224:TCP"= 30224:TCP:BND
"5617:TCP"= 5617:TCP:BND
"6620:TCP"= 6620:TCP:BND
"32077:TCP"= 32077:TCP:BND
"10447:TCP"= 10447:TCP:BND
"30333:TCP"= 30333:TCP:BND
"21014:TCP"= 21014:TCP:BND
"21658:TCP"= 21658:TCP:BND
"16497:TCP"= 16497:TCP:BND
"28838:TCP"= 28838:TCP:BND
"21673:TCP"= 21673:TCP:BND
"26791:TCP"= 26791:TCP:BND
"22728:TCP"= 22728:TCP:BND
"21601:TCP"= 21601:TCP:BND
"17259:TCP"= 17259:TCP:BND
"30294:TCP"= 30294:TCP:BND
"9176:TCP"= 9176:TCP:BND
"25137:TCP"= 25137:TCP:BND
"14701:TCP"= 14701:TCP:BND
"2528:TCP"= 2528:TCP:BND
"15940:TCP"= 15940:TCP:BND
"10992:TCP"= 10992:TCP:BND
"5780:TCP"= 5780:TCP:BND
"25661:TCP"= 25661:TCP:BND
"14106:TCP"= 14106:TCP:BND
"18175:TCP"= 18175:TCP:BND
"31003:TCP"= 31003:TCP:BND
"2702:TCP"= 2702:TCP:BND
"26052:TCP"= 26052:TCP:BND
"10838:TCP"= 10838:TCP:BND
"22195:TCP"= 22195:TCP:BND
"5455:TCP"= 5455:TCP:BND
"21311:TCP"= 21311:TCP:BND
"23689:TCP"= 23689:TCP:BND
"5146:TCP"= 5146:TCP:BND
"3783:TCP"= 3783:TCP:BND
"21373:TCP"= 21373:TCP:BND
"14755:TCP"= 14755:TCP:BND
"8562:TCP"= 8562:TCP:BND
"1999:TCP"= 1999:TCP:BND
"14209:TCP"= 14209:TCP:BND
"7591:TCP"= 7591:TCP:BND
"24664:TCP"= 24664:TCP:BND
"18049:TCP"= 18049:TCP:BND
"14826:TCP"= 14826:TCP:BND
"26517:TCP"= 26517:TCP:BND
"31560:TCP"= 31560:TCP:BND
"3835:TCP"= 3835:TCP:BND
"6374:TCP"= 6374:TCP:BND
"8910:TCP"= 8910:TCP:BND
"11447:TCP"= 11447:TCP:BND
"13989:TCP"= 13989:TCP:BND
"26553:TCP"= 26553:TCP:BND
"11355:TCP"= 11355:TCP:BND
"29218:TCP"= 29218:TCP:BND
"6355:TCP"= 6355:TCP:BND
"25385:TCP"= 25385:TCP:BND
"23679:TCP"= 23679:TCP:BND
"9244:TCP"= 9244:TCP:BND
"11790:TCP"= 11790:TCP:BND
"14340:TCP"= 14340:TCP:BND
"19494:TCP"= 19494:TCP:BND
"10284:TCP"= 10284:TCP:BND
"31423:TCP"= 31423:TCP:BND
"1194:TCP"= 1194:TCP:BND
"3730:TCP"= 3730:TCP:BND
"6270:TCP"= 6270:TCP:BND
"13816:TCP"= 13816:TCP:BND
"16362:TCP"= 16362:TCP:BND
"18901:TCP"= 18901:TCP:BND
"21438:TCP"= 21438:TCP:BND
"23974:TCP"= 23974:TCP:BND
"26513:TCP"= 26513:TCP:BND
"29049:TCP"= 29049:TCP:BND
"31592:TCP"= 31592:TCP:BND
"1364:TCP"= 1364:TCP:BND
"3919:TCP"= 3919:TCP:BND
"30707:TCP"= 30707:TCP:BND
"28428:TCP"= 28428:TCP:BND
"5180:TCP"= 5180:TCP:BND
"7517:TCP"= 7517:TCP:BND
"10053:TCP"= 10053:TCP:BND
"12593:TCP"= 12593:TCP:BND
"15129:TCP"= 15129:TCP:BND
"17668:TCP"= 17668:TCP:BND
"20205:TCP"= 20205:TCP:BND
"22741:TCP"= 22741:TCP:BND
"25280:TCP"= 25280:TCP:BND
"27820:TCP"= 27820:TCP:BND
"18600:TCP"= 18600:TCP:BND
"21175:TCP"= 21175:TCP:BND
"23711:TCP"= 23711:TCP:BND
"26251:TCP"= 26251:TCP:BND
"28787:TCP"= 28787:TCP:BND
"31323:TCP"= 31323:TCP:BND
"1095:TCP"= 1095:TCP:BND
"3634:TCP"= 3634:TCP:BND
"6180:TCP"= 6180:TCP:BND
"8719:TCP"= 8719:TCP:BND
"11256:TCP"= 11256:TCP:BND
"31244:TCP"= 31244:TCP:BND
"1019:TCP"= 1019:TCP:BND
"6062:TCP"= 6062:TCP:BND
"8601:TCP"= 8601:TCP:BND
"32149:TCP"= 32149:TCP:BND
"4457:TCP"= 4457:TCP:BND
"6993:TCP"= 6993:TCP:BND
"14543:TCP"= 14543:TCP:BND
"19586:TCP"= 19586:TCP:BND
"1113:TCP"= 1113:TCP:BND
"24662:TCP"= 24662:TCP:BND
"27198:TCP"= 27198:TCP:BND
"29737:TCP"= 29737:TCP:BND
"7205:TCP"= 7205:TCP:BND
"12425:TCP"= 12425:TCP:BND
"15016:TCP"= 15016:TCP:BND
"22566:TCP"= 22566:TCP:BND
"25106:TCP"= 25106:TCP:BND
"27645:TCP"= 27645:TCP:BND
"27495:TCP"= 27495:TCP:BND
"30067:TCP"= 30067:TCP:BND
"32607:TCP"= 32607:TCP:BND
"2375:TCP"= 2375:TCP:BND
"4917:TCP"= 4917:TCP:BND
"7454:TCP"= 7454:TCP:BND
"20136:TCP"= 20136:TCP:BND
"24928:TCP"= 24928:TCP:BND
"27496:TCP"= 27496:TCP:BND
"30039:TCP"= 30039:TCP:BND
"11567:TCP"= 11567:TCP:BND
"2154:TCP"= 2154:TCP:BND
"28462:TCP"= 28462:TCP:BND
"24449:TCP"= 24449:TCP:BND
"20412:TCP"= 20412:TCP:BND
"11192:TCP"= 11192:TCP:BND
"16366:TCP"= 16366:TCP:BND
"18935:TCP"= 18935:TCP:BND
"24043:TCP"= 24043:TCP:BND
"26579:TCP"= 26579:TCP:BND
"1426:TCP"= 1426:TCP:BND
"24978:TCP"= 24978:TCP:BND
"12489:TCP"= 12489:TCP:BND
"23796:TCP"= 23796:TCP:BND
"14573:TCP"= 14573:TCP:BND
"28950:TCP"= 28950:TCP:BND
"31487:TCP"= 31487:TCP:BND
"18305:TCP"= 18305:TCP:BND
"9085:TCP"= 9085:TCP:BND
"32633:TCP"= 32633:TCP:BND
"33530:TCP"= 33530:TCP:BND
"5942:TCP"= 5942:TCP:BND
"29494:TCP"= 29494:TCP:BND
"11057:TCP"= 11057:TCP:BND
"1837:TCP"= 1837:TCP:BND
"16162:TCP"= 16162:TCP:BND
"10223:TCP"= 10223:TCP:BND
"24519:TCP"= 24519:TCP:BND
"13208:TCP"= 13208:TCP:BND
"15744:TCP"= 15744:TCP:BND
"12902:TCP"= 12902:TCP:BND
"3692:TCP"= 3692:TCP:BND
"29845:TCP"= 29845:TCP:BND
"20625:TCP"= 20625:TCP:BND
"23194:TCP"= 23194:TCP:BND
"13974:TCP"= 13974:TCP:BND
"9934:TCP"= 9934:TCP:BND
"33482:TCP"= 33482:TCP:BND
"15082:TCP"= 15082:TCP:BND
"17621:TCP"= 17621:TCP:BND
"8401:TCP"= 8401:TCP:BND
"10937:TCP"= 10937:TCP:BND
"27740:TCP"= 27740:TCP:BND
"9297:TCP"= 9297:TCP:BND
"23595:TCP"= 23595:TCP:BND
"26164:TCP"= 26164:TCP:BND
"1779:TCP"= 1779:TCP:BND
"10798:TCP"= 10798:TCP:BND
"13370:TCP"= 13370:TCP:BND
"4150:TCP"= 4150:TCP:BND
"11925:TCP"= 11925:TCP:BND
"28766:TCP"= 28766:TCP:BND
"15306:TCP"= 15306:TCP:BND
"23320:TCP"= 23320:TCP:BND
"28516:TCP"= 28516:TCP:BND
"20949:TCP"= 20949:TCP:BND
"24559:TCP"= 24559:TCP:BND
"20565:TCP"= 20565:TCP:BND
"23144:TCP"= 23144:TCP:BND
"4736:TCP"= 4736:TCP:BND
"29092:TCP"= 29092:TCP:BND
"24344:TCP"= 24344:TCP:BND
"27522:TCP"= 27522:TCP:BND
"30035:TCP"= 30035:TCP:BND
"23355:TCP"= 23355:TCP:BND
"25891:TCP"= 25891:TCP:BND
"16674:TCP"= 16674:TCP:BND
"19214:TCP"= 19214:TCP:BND
"9994:TCP"= 9994:TCP:BND
"24322:TCP"= 24322:TCP:BND
"8386:TCP"= 8386:TCP:BND
"10954:TCP"= 10954:TCP:BND
"4241:TCP"= 4241:TCP:BND
"27789:TCP"= 27789:TCP:BND
"9382:TCP"= 9382:TCP:BND
"23740:TCP"= 23740:TCP:BND
"14520:TCP"= 14520:TCP:BND
"28815:TCP"= 28815:TCP:BND
"10415:TCP"= 10415:TCP:BND
"1205:TCP"= 1205:TCP:BND
"15503:TCP"= 15503:TCP:BND
"20622:TCP"= 20622:TCP:BND
"11398:TCP"= 11398:TCP:BND
"25759:TCP"= 25759:TCP:BND
"7319:TCP"= 7319:TCP:BND
"14142:TCP"= 14142:TCP:BND
"4939:TCP"= 4939:TCP:BND
"28824:TCP"= 28824:TCP:BND
"10417:TCP"= 10417:TCP:BND
"12985:TCP"= 12985:TCP:BND
"3765:TCP"= 3765:TCP:BND
"16326:TCP"= 16326:TCP:BND
"19309:TCP"= 19309:TCP:BND
"8112:TCP"= 8112:TCP:BND
"22469:TCP"= 22469:TCP:BND
"25395:TCP"= 25395:TCP:BND
"15722:TCP"= 15722:TCP:BND
"30050:TCP"= 30050:TCP:BND
"20831:TCP"= 20831:TCP:BND
"2391:TCP"= 2391:TCP:BND
"28511:TCP"= 28511:TCP:BND
"31060:TCP"= 31060:TCP:BND
"15307:TCP"= 15307:TCP:BND
"29788:TCP"= 29788:TCP:BND
"22999:TCP"= 22999:TCP:BND
"19649:TCP"= 19649:TCP:BND
"24722:TCP"= 24722:TCP:BND
"30631:TCP"= 30631:TCP:BND
"28626:TCP"= 28626:TCP:BND
"12788:TCP"= 12788:TCP:BND
"15357:TCP"= 15357:TCP:BND
"20573:TCP"= 20573:TCP:BND
"23109:TCP"= 23109:TCP:BND
"13889:TCP"= 13889:TCP:BND
"16428:TCP"= 16428:TCP:BND
"30724:TCP"= 30724:TCP:BND
"33293:TCP"= 33293:TCP:BND
"15624:TCP"= 15624:TCP:BND
"24762:TCP"= 24762:TCP:BND
"13817:TCP"= 13817:TCP:BND
"5285:TCP"= 5285:TCP:BND
"19626:TCP"= 19626:TCP:BND
"12956:TCP"= 12956:TCP:BND
"29853:TCP"= 29853:TCP:BND
"20633:TCP"= 20633:TCP:BND
"23172:TCP"= 23172:TCP:BND
"4700:TCP"= 4700:TCP:BND
"3251:TCP"= 3251:TCP:BND
"20050:TCP"= 20050:TCP:BND
"1610:TCP"= 1610:TCP:BND
"4146:TCP"= 4146:TCP:BND
"6695:TCP"= 6695:TCP:BND
"21059:TCP"= 21059:TCP:BND
"23628:TCP"= 23628:TCP:BND
"14412:TCP"= 14412:TCP:BND
"19549:TCP"= 19549:TCP:BND
"10329:TCP"= 10329:TCP:BND
"18372:TCP"= 18372:TCP:BND
"28195:TCP"= 28195:TCP:BND
"18975:TCP"= 18975:TCP:BND
"12356:TCP"= 12356:TCP:BND
"26717:TCP"= 26717:TCP:BND
"17501:TCP"= 17501:TCP:BND
"20073:TCP"= 20073:TCP:BND
"10856:TCP"= 10856:TCP:BND
"27818:TCP"= 27818:TCP:BND
"30387:TCP"= 30387:TCP:BND
"32959:TCP"= 32959:TCP:BND
"14552:TCP"= 14552:TCP:BND
"17092:TCP"= 17092:TCP:BND
"31397:TCP"= 31397:TCP:BND
"33092:TCP"= 33092:TCP:BND
"22467:TCP"= 22467:TCP:BND
"24342:TCP"= 24342:TCP:BND
"28977:TCP"= 28977:TCP:BND
"25257:TCP"= 25257:TCP:BND
"16152:TCP"= 16152:TCP:BND
"7157:TCP"= 7157:TCP:BND
"19204:TCP"= 19204:TCP:BND
"10421:TCP"= 10421:TCP:BND
"13166:TCP"= 13166:TCP:BND
"27756:TCP"= 27756:TCP:BND
"18833:TCP"= 18833:TCP:BND
"13275:TCP"= 13275:TCP:BND
"21961:TCP"= 21961:TCP:BND
"18434:TCP"= 18434:TCP:BND
"12074:TCP"= 12074:TCP:BND
"19592:TCP"= 19592:TCP:BND
"18813:TCP"= 18813:TCP:BND
"18012:TCP"= 18012:TCP:BND
"30189:TCP"= 30189:TCP:BND
"32898:TCP"= 32898:TCP:BND
"26502:TCP"= 26502:TCP:BND
"17752:TCP"= 17752:TCP:BND
"11392:TCP"= 11392:TCP:BND
"16454:TCP"= 16454:TCP:BND
"31890:TCP"= 31890:TCP:BND
"25565:TCP"= 25565:TCP:BND
"19169:TCP"= 19169:TCP:BND
"10471:TCP"= 10471:TCP:BND
"13213:TCP"= 13213:TCP:BND
"14478:TCP"= 14478:TCP:BND
"2809:TCP"= 2809:TCP:BND
"19430:TCP"= 19430:TCP:BND
"23028:TCP"= 23028:TCP:BND
"23933:TCP"= 23933:TCP:BND
"23138:TCP"= 23138:TCP:BND
"4824:TCP"= 4824:TCP:BND
"31280:TCP"= 31280:TCP:BND
"23625:TCP"= 23625:TCP:BND
"16925:TCP"= 16925:TCP:BND
"9395:TCP"= 9395:TCP:BND
"23756:TCP"= 23756:TCP:BND
"31305:TCP"= 31305:TCP:BND
"1923:TCP"= 1923:TCP:BND
"30514:TCP"= 30514:TCP:BND
"16760:TCP"= 16760:TCP:BND
"28318:TCP"= 28318:TCP:BND
"5851:TCP"= 5851:TCP:BND
"29733:TCP"= 29733:TCP:BND
"16474:TCP"= 16474:TCP:BND
"3188:TCP"= 3188:TCP:BND
"1753:TCP"= 1753:TCP:BND
"7609:TCP"= 7609:TCP:BND
"26919:TCP"= 26919:TCP:BND
"10959:TCP"= 10959:TCP:BND
"16859:TCP"= 16859:TCP:BND
"8878:TCP"= 8878:TCP:BND
"3366:TCP"= 3366:TCP:BND
"13553:TCP"= 13553:TCP:BND
"7107:TCP"= 7107:TCP:BND
"1570:TCP"= 1570:TCP:BND
"5929:TCP"= 5929:TCP:BND
"1850:TCP"= 1850:TCP:BND
"17576:TCP"= 17576:TCP:BND
"29594:TCP"= 29594:TCP:BND
"7177:TCP"= 7177:TCP:BND
"26639:TCP"= 26639:TCP:BND
"30637:TCP"= 30637:TCP:BND
"8045:TCP"= 8045:TCP:BND
"16291:TCP"= 16291:TCP:BND
"21334:TCP"= 21334:TCP:BND
"21742:TCP"= 21742:TCP:BND
"17601:TCP"= 17601:TCP:BND
"32285:TCP"= 32285:TCP:BND
"2086:TCP"= 2086:TCP:BND
"7165:TCP"= 7165:TCP:BND
"3089:TCP"= 3089:TCP:BND
"16200:TCP"= 16200:TCP:BND
"33198:TCP"= 33198:TCP:BND
"29123:TCP"= 29123:TCP:BND
"14415:TCP"= 14415:TCP:BND
"6257:TCP"= 6257:TCP:BND
"8794:TCP"= 8794:TCP:BND
"2110:TCP"= 2110:TCP:BND
"4649:TCP"= 4649:TCP:BND
"28635:TCP"= 28635:TCP:BND
"3612:TCP"= 3612:TCP:BND
"27160:TCP"= 27160:TCP:BND
"24791:TCP"= 24791:TCP:BND
"6352:TCP"= 6352:TCP:BND
"7162:TCP"= 7162:TCP:BND
"26595:TCP"= 26595:TCP:BND
"22526:TCP"= 22526:TCP:BND
"2797:TCP"= 2797:TCP:BND
"19730:TCP"= 19730:TCP:BND
"19836:TCP"= 19836:TCP:BND
"22408:TCP"= 22408:TCP:BND
"20833:TCP"= 20833:TCP:BND
"33632:TCP"= 33632:TCP:BND
"21017:TCP"= 21017:TCP:BND
"19411:TCP"= 19411:TCP:BND
"18038:TCP"= 18038:TCP:BND
"4706:TCP"= 4706:TCP:BND
"12390:TCP"= 12390:TCP:BND
"31823:TCP"= 31823:TCP:BND
"3386:TCP"= 3386:TCP:BND
"1987:TCP"= 1987:TCP:BND
"3811:TCP"= 3811:TCP:BND
"29941:TCP"= 29941:TCP:BND
"28567:TCP"= 28567:TCP:BND
"15269:TCP"= 15269:TCP:BND
"13339:TCP"= 13339:TCP:BND
"30269:TCP"= 30269:TCP:BND
"28481:TCP"= 28481:TCP:BND
"17895:TCP"= 17895:TCP:BND
"4566:TCP"= 4566:TCP:BND
"21502:TCP"= 21502:TCP:BND
"29183:TCP"= 29183:TCP:BND
"15855:TCP"= 15855:TCP:BND
"11779:TCP"= 11779:TCP:BND
"19459:TCP"= 19459:TCP:BND
"32979:TCP"= 32979:TCP:BND
"17141:TCP"= 17141:TCP:BND
"3809:TCP"= 3809:TCP:BND
"32505:TCP"= 32505:TCP:BND
"28560:TCP"= 28560:TCP:BND
"29742:TCP"= 29742:TCP:BND
"25670:TCP"= 25670:TCP:BND
"20212:TCP"= 20212:TCP:BND
"24983:TCP"= 24983:TCP:BND
"23473:TCP"= 23473:TCP:BND
"30355:TCP"= 30355:TCP:BND
"27672:TCP"= 27672:TCP:BND
"6321:TCP"= 6321:TCP:BND
"12939:TCP"= 12939:TCP:BND
"29712:TCP"= 29712:TCP:BND
"20456:TCP"= 20456:TCP:BND
"1049:TCP"= 1049:TCP:BND
"13397:TCP"= 13397:TCP:BND
"4206:TCP"= 4206:TCP:BND
"15054:TCP"= 15054:TCP:BND
"11576:TCP"= 11576:TCP:BND
"13920:TCP"= 13920:TCP:BND
"7024:TCP"= 7024:TCP:BND
"31448:TCP"= 31448:TCP:BND
"3536:TCP"= 3536:TCP:BND
"7811:TCP"= 7811:TCP:BND
"32150:TCP"= 32150:TCP:BND
"4393:TCP"= 4393:TCP:BND
"16943:TCP"= 16943:TCP:BND
"10592:TCP"= 10592:TCP:BND
"27362:TCP"= 27362:TCP:BND
"27067:TCP"= 27067:TCP:BND
"20533:TCP"= 20533:TCP:BND
"25554:TCP"= 25554:TCP:BND
"19605:TCP"= 19605:TCP:BND
"10353:TCP"= 10353:TCP:BND
"6110:TCP"= 6110:TCP:BND
"8617:TCP"= 8617:TCP:BND
"22883:TCP"= 22883:TCP:BND
"4139:TCP"= 4139:TCP:BND
"17362:TCP"= 17362:TCP:BND
"2217:TCP"= 2217:TCP:BND
"5302:TCP"= 5302:TCP:BND
"7922:TCP"= 7922:TCP:BND
"7183:TCP"= 7183:TCP:BND
"7036:TCP"= 7036:TCP:BND
"28665:TCP"= 28665:TCP:BND
"21740:TCP"= 21740:TCP:BND
"13720:TCP"= 13720:TCP:BND
"16269:TCP"= 16269:TCP:BND
"18772:TCP"= 18772:TCP:BND
"1065:TCP"= 1065:TCP:BND
"3568:TCP"= 3568:TCP:BND
"13644:TCP"= 13644:TCP:BND
"2656:TCP"= 2656:TCP:BND
"18931:TCP"= 18931:TCP:BND
"9711:TCP"= 9711:TCP:BND
"24752:TCP"= 24752:TCP:BND
"6367:TCP"= 6367:TCP:BND
"21053:TCP"= 21053:TCP:BND
"13303:TCP"= 13303:TCP:BND
"3868:TCP"= 3868:TCP:BND
"2136:TCP"= 2136:TCP:BND
"29694:TCP"= 29694:TCP:BND
"32201:TCP"= 32201:TCP:BND
"16322:TCP"= 16322:TCP:BND
"28885:TCP"= 28885:TCP:BND
"6938:TCP"= 6938:TCP:BND
"10210:TCP"= 10210:TCP:BND
"24473:TCP"= 24473:TCP:BND
"21054:TCP"= 21054:TCP:BND
"6835:TCP"= 6835:TCP:BND
"32933:TCP"= 32933:TCP:BND
"9514:TCP"= 9514:TCP:BND
"6157:TCP"= 6157:TCP:BND
"21211:TCP"= 21211:TCP:BND
"23718:TCP"= 23718:TCP:BND
"17819:TCP"= 17819:TCP:BND
"21910:TCP"= 21910:TCP:BND
"21786:TCP"= 21786:TCP:BND
"18994:TCP"= 18994:TCP:BND
"13895:TCP"= 13895:TCP:BND
"8718:TCP"= 8718:TCP:BND
"4593:TCP"= 4593:TCP:BND
"17124:TCP"= 17124:TCP:BND
"23827:TCP"= 23827:TCP:BND
"26334:TCP"= 26334:TCP:BND
"29214:TCP"= 29214:TCP:BND
"22321:TCP"= 22321:TCP:BND
"6565:TCP"= 6565:TCP:BND
"19257:TCP"= 19257:TCP:BND
"15278:TCP"= 15278:TCP:BND
"17898:TCP"= 17898:TCP:BND
"26186:TCP"= 26186:TCP:BND
"24458:TCP"= 24458:TCP:BND
"7577:TCP"= 7577:TCP:BND
"3800:TCP"= 3800:TCP:BND
"22161:TCP"= 22161:TCP:BND
"3736:TCP"= 3736:TCP:BND
"5572:TCP"= 5572:TCP:BND
"29087:TCP"= 29087:TCP:BND
"18155:TCP"= 18155:TCP:BND
"23178:TCP"= 23178:TCP:BND
"7180:TCP"= 7180:TCP:BND
"3738:TCP"= 3738:TCP:BND
"2882:TCP"= 2882:TCP:BND
"20420:TCP"= 20420:TCP:BND
"17001:TCP"= 17001:TCP:BND
"29483:TCP"= 29483:TCP:BND
"23493:TCP"= 23493:TCP:BND
"28565:TCP"= 28565:TCP:BND
"15845:TCP"= 15845:TCP:BND
"16616:TCP"= 16616:TCP:BND
"24156:TCP"= 24156:TCP:BND
"32457:TCP"= 32457:TCP:BND
"23205:TCP"= 23205:TCP:BND
"12230:TCP"= 12230:TCP:BND
"29039:TCP"= 29039:TCP:BND
"29937:TCP"= 29937:TCP:BND
"7213:TCP"= 7213:TCP:BND
"10670:TCP"= 10670:TCP:BND
"31346:TCP"= 31346:TCP:BND
"12841:TCP"= 12841:TCP:BND
"27104:TCP"= 27104:TCP:BND
"17851:TCP"= 17851:TCP:BND
"9391:TCP"= 9391:TCP:BND
"11898:TCP"= 11898:TCP:BND
"28668:TCP"= 28668:TCP:BND
"24432:TCP"= 24432:TCP:BND
"20190:TCP"= 20190:TCP:BND
"26011:TCP"= 26011:TCP:BND
"31021:TCP"= 31021:TCP:BND
"17559:TCP"= 17559:TCP:BND
"27932:TCP"= 27932:TCP:BND
"24608:TCP"= 24608:TCP:BND
"7659:TCP"= 7659:TCP:BND
"25719:TCP"= 25719:TCP:BND
"2592:TCP"= 2592:TCP:BND
"16881:TCP"= 16881:TCP:BND
"7629:TCP"= 7629:TCP:BND
"24470:TCP"= 24470:TCP:BND
"29715:TCP"= 29715:TCP:BND
"27702:TCP"= 27702:TCP:BND
"9197:TCP"= 9197:TCP:BND
"14259:TCP"= 14259:TCP:BND
"26800:TCP"= 26800:TCP:BND
"20051:TCP"= 20051:TCP:BND
"11595:TCP"= 11595:TCP:BND
"27600:TCP"= 27600:TCP:BND
"18348:TCP"= 18348:TCP:BND
"20851:TCP"= 20851:TCP:BND
"30953:TCP"= 30953:TCP:BND
"12448:TCP"= 12448:TCP:BND
"30081:TCP"= 30081:TCP:BND
"20828:TCP"= 20828:TCP:BND
"10977:TCP"= 10977:TCP:BND
"16107:TCP"= 16107:TCP:BND
"6855:TCP"= 6855:TCP:BND
"31452:TCP"= 31452:TCP:BND
"15463:TCP"= 15463:TCP:BND
"7974:TCP"= 7974:TCP:BND
"11265:TCP"= 11265:TCP:BND
"4516:TCP"= 4516:TCP:BND
"4629:TCP"= 4629:TCP:BND
"19650:TCP"= 19650:TCP:BND
"12973:TCP"= 12973:TCP:BND
"3724:TCP"= 3724:TCP:BND
"29743:TCP"= 29743:TCP:BND
"9610:TCP"= 9610:TCP:BND
"14690:TCP"= 14690:TCP:BND
"25168:TCP"= 25168:TCP:BND
"9179:TCP"= 9179:TCP:BND
"33469:TCP"= 33469:TCP:BND
"17578:TCP"= 17578:TCP:BND
"14964:TCP"= 14964:TCP:BND
"15872:TCP"= 15872:TCP:BND
"5005:TCP"= 5005:TCP:BND
"28520:TCP"= 28520:TCP:BND
"31037:TCP"= 31037:TCP:BND
"15983:TCP"= 15983:TCP:BND
"24317:TCP"= 24317:TCP:BND
"28718:TCP"= 28718:TCP:BND
"11300:TCP"= 11300:TCP:BND
"13804:TCP"= 13804:TCP:BND
"15359:TCP"= 15359:TCP:BND
"9411:TCP"= 9411:TCP:BND
"23674:TCP"= 23674:TCP:BND
"14421:TCP"= 14421:TCP:BND
"7676:TCP"= 7676:TCP:BND
"24416:TCP"= 24416:TCP:BND
"17670:TCP"= 17670:TCP:BND
"30204:TCP"= 30204:TCP:BND
"2547:TCP"= 2547:TCP:BND
"31073:TCP"= 31073:TCP:BND
"22615:TCP"= 22615:TCP:BND
"9992:TCP"= 9992:TCP:BND
"3247:TCP"= 3247:TCP:BND
"26624:TCP"= 26624:TCP:BND
"10580:TCP"= 10580:TCP:BND
"33151:TCP"= 33151:TCP:BND
"2886:TCP"= 2886:TCP:BND
"20099:TCP"= 20099:TCP:BND
"17474:TCP"= 17474:TCP:BND
"27511:TCP"= 27511:TCP:BND
"11519:TCP"= 11519:TCP:BND
"3763:TCP"= 3763:TCP:BND
"1862:TCP"= 1862:TCP:BND
"31277:TCP"= 31277:TCP:BND
"18635:TCP"= 18635:TCP:BND
"11886:TCP"= 11886:TCP:BND
"10026:TCP"= 10026:TCP:BND
"31845:TCP"= 31845:TCP:BND
"4130:TCP"= 4130:TCP:BND
"12500:TCP"= 12500:TCP:BND
"20860:TCP"= 20860:TCP:BND
"2355:TCP"= 2355:TCP:BND
"28403:TCP"= 28403:TCP:BND
"8576:TCP"= 8576:TCP:BND
"11105:TCP"= 11105:TCP:BND
"13736:TCP"= 13736:TCP:BND
"6990:TCP"= 6990:TCP:BND
"29620:TCP"= 29620:TCP:BND
"29231:TCP"= 29231:TCP:BND
"25354:TCP"= 25354:TCP:BND
"30423:TCP"= 30423:TCP:BND
"32953:TCP"= 32953:TCP:BND
"10418:TCP"= 10418:TCP:BND
"20582:TCP"= 20582:TCP:BND
"18993:TCP"= 18993:TCP:BND
"3073:TCP"= 3073:TCP:BND
"26608:TCP"= 26608:TCP:BND
"8201:TCP"= 8201:TCP:BND
"2864:TCP"= 2864:TCP:BND
"19699:TCP"= 19699:TCP:BND
"3769:TCP"= 3769:TCP:BND
"4684:TCP"= 4684:TCP:BND
"21669:TCP"= 21669:TCP:BND
"15979:TCP"= 15979:TCP:BND
"11805:TCP"= 11805:TCP:BND
"28644:TCP"= 28644:TCP:BND
"27065:TCP"= 27065:TCP:BND
"6978:TCP"= 6978:TCP:BND
"12096:TCP"= 12096:TCP:BND
"5402:TCP"= 5402:TCP:BND
"18070:TCP"= 18070:TCP:BND
"2783:TCP"= 2783:TCP:BND
"29129:TCP"= 29129:TCP:BND
"33436:TCP"= 33436:TCP:BND
"1567:TCP"= 1567:TCP:BND
"2482:TCP"= 2482:TCP:BND
"7890:TCP"= 7890:TCP:BND
"28438:TCP"= 28438:TCP:BND
"19218:TCP"= 19218:TCP:BND
"3327:TCP"= 3327:TCP:BND
"14060:TCP"= 14060:TCP:BND
"30895:TCP"= 30895:TCP:BND
"21731:TCP"= 21731:TCP:BND
"20792:TCP"= 20792:TCP:BND
"12729:TCP"= 12729:TCP:BND
"3519:TCP"= 3519:TCP:BND
"13143:TCP"= 13143:TCP:BND
"27445:TCP"= 27445:TCP:BND
"8979:TCP"= 8979:TCP:BND
"32906:TCP"= 32906:TCP:BND
"5201:TCP"= 5201:TCP:BND
"22452:TCP"= 22452:TCP:BND
"3370:TCP"= 3370:TCP:BND
"29442:TCP"= 29442:TCP:BND
"22745:TCP"= 22745:TCP:BND
"13868:TCP"= 13868:TCP:BND
"31500:TCP"= 31500:TCP:BND
"23005:TCP"= 23005:TCP:BND
"30633:TCP"= 30633:TCP:BND
"31545:TCP"= 31545:TCP:BND
"10960:TCP"= 10960:TCP:BND
"1721:TCP"= 1721:TCP:BND
"16016:TCP"= 16016:TCP:BND
"21409:TCP"= 21409:TCP:BND
"14725:TCP"= 14725:TCP:BND
"29364:TCP"= 29364:TCP:BND
"24330:TCP"= 24330:TCP:BND
"15097:TCP"= 15097:TCP:BND
"20169:TCP"= 20169:TCP:BND
"13822:TCP"= 13822:TCP:BND
"12945:TCP"= 12945:TCP:BND
"25622:TCP"= 25622:TCP:BND
"27155:TCP"= 27155:TCP:BND
"25521:TCP"= 25521:TCP:BND
"5457:TCP"= 5457:TCP:BND
"11301:TCP"= 11301:TCP:BND
"13860:TCP"= 13860:TCP:BND
"3559:TCP"= 3559:TCP:BND
"12817:TCP"= 12817:TCP:BND
"1481:TCP"= 1481:TCP:BND
"6546:TCP"= 6546:TCP:BND
"10764:TCP"= 10764:TCP:BND
"30207:TCP"= 30207:TCP:BND
"19340:TCP"= 19340:TCP:BND
"6306:TCP"= 6306:TCP:BND
"18422:TCP"= 18422:TCP:BND
"31362:TCP"= 31362:TCP:BND
"30982:TCP"= 30982:TCP:BND
"32730:TCP"= 32730:TCP:BND
"5028:TCP"= 5028:TCP:BND
"20021:TCP"= 20021:TCP:BND
"13438:TCP"= 13438:TCP:BND
"27737:TCP"= 27737:TCP:BND
"17245:TCP"= 17245:TCP:BND
"31547:TCP"= 31547:TCP:BND
"25034:TCP"= 25034:TCP:BND
"7051:TCP"= 7051:TCP:BND
"20649:TCP"= 20649:TCP:BND
"19740:TCP"= 19740:TCP:BND
"13088:TCP"= 13088:TCP:BND
"15657:TCP"= 15657:TCP:BND
"32783:TCP"= 32783:TCP:BND
"4266:TCP"= 4266:TCP:BND
"6799:TCP"= 6799:TCP:BND
"32890:TCP"= 32890:TCP:BND
"22353:TCP"= 22353:TCP:BND
"28712:TCP"= 28712:TCP:BND
"8609:TCP"= 8609:TCP:BND
"32141:TCP"= 32141:TCP:BND
"23270:TCP"= 23270:TCP:BND
"4164:TCP"= 4164:TCP:BND
"5870:TCP"= 5870:TCP:BND
"12329:TCP"= 12329:TCP:BND
"3135:TCP"= 3135:TCP:BND
"8207:TCP"= 8207:TCP:BND
"9442:TCP"= 9442:TCP:BND
"7870:TCP"= 7870:TCP:BND
"31408:TCP"= 31408:TCP:BND
"12887:TCP"= 12887:TCP:BND
"29513:TCP"= 29513:TCP:BND
"16672:TCP"= 16672:TCP:BND
"18649:TCP"= 18649:TCP:BND
"33010:TCP"= 33010:TCP:BND
"27898:TCP"= 27898:TCP:BND
"32107:TCP"= 32107:TCP:BND
"30498:TCP"= 30498:TCP:BND
"17477:TCP"= 17477:TCP:BND
"8244:TCP"= 8244:TCP:BND
"22543:TCP"= 22543:TCP:BND
"25429:TCP"= 25429:TCP:BND
"6963:TCP"= 6963:TCP:BND
"12051:TCP"= 12051:TCP:BND
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - IPVNMon
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 12:32 128512 ----a-w- c:\windows\SYSTEM32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
2011-04-07 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3359005984-3577352339-825049218-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-04-07 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3359005984-3577352339-825049218-1010.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-04-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3359005984-3577352339-825049218-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-04-02 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3359005984-3577352339-825049218-1010.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-04-07 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-01-20 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/search/ie.html
uInternet Connection Wizard,ShellNext = hxxp://rd.yahoo.com/customize/sbcydsl/defaults/*http://yahoo.sbc.com/dsl
uInternet Settings,ProxyOverride = *.local
uSearchAssistant =
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: Yahoo! Pool 2 - hxxp://origin.games.yahoo.net/games/clients/y/poti_x.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
HKCU-Run-Legacy VGA Drivers V1.0 - c:\windows\certproc32.exe
HKCU-Run-AcerVGA Drivers V1.2 - c:\windows\initview32.exe
HKCU-Run-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
HKCU-Run-Sony DVDRam Version 1.8B - c:\windows\uiengine32.exe
HKCU-Run-Prauge DVDRam Version 2.3A - c:\windows\system32\spfx\hypinit32.exe
HKU-Default-Run-Yahoo! Pager - c:\progra~1\Yahoo!\MESSEN~1\ypager.exe
HKU-Default-Run-Prauge DVDRam Version 2.3A - c:\windows\system32\spfx\hypinit32.exe
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-mmtask - c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe
MSConfigStartUp-Sonic RecordNow! - c:\progra~1\SYMNET~1\SNDMon.exe
MSConfigStartUp-Symantec NetDriver Monitor - c:\progra~1\SYMNET~1\SNDMon.exe
MSConfigStartUp-tgcmdprovidersbc - c:\program files\support.com\bin\tgcmd.exe
MSConfigStartUp-URLLSTCK - c:\program files\Norton Internet Security\UrlLstCk.exe
HKLM_ActiveSetup-AcerVGA Drivers V1.2 - c:\windows\initview32.exe
HKLM_ActiveSetup-AcerVGA Engine Drivers V1.2 - c:\windows\iuengine32.exe
HKLM_ActiveSetup-Creative Audio Studio V2.8 - c:\windows\unimontr.exe
HKLM_ActiveSetup-IntelliMouse Explorer V2.3 - c:\windows\netpefr32.exe
HKLM_ActiveSetup-Legacy VGA Drivers V1.0 - c:\windows\certproc32.exe
HKLM_ActiveSetup-Prauge DVDRam Version 2.3A - c:\windows\system32\spfx\hypinit32.exe
HKLM_ActiveSetup-Sony DVDRam Version 1.8B - c:\windows\uiengine32.exe
AddRemove-SBC Yahoo! Dial Connection Manager - c:\windows\..\Program Files\SBC Yahoo!\Connection Manager\uninst.exe
AddRemove-SBC Yahoo! DSL Extras - c:\progra~1\Yahoo!\Common\unwise.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-07 08:06
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(516)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\wscntfy.exe
c:\program files\Dell AIO Printer A940\dlbabmon.exe
c:\progra~1\Yahoo!\browser\ycommon.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Java\jre1.6.0_07\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2011-04-07 08:18:59 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-07 15:18
.
Pre-Run: 33,724,403,712 bytes free
Post-Run: 33,627,238,400 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 3A12B2323761410DD067785EA82BF53B

#15 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:01:09 AM

Posted 07 April 2011 - 10:36 AM

Hi,

there's a number of issues we still need to fix, but I'd like to confirm that the redirects have stopped first.

There's a large number of open ports on your system, did you open them or should we remove them from the list?

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users