Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Recurring problems with service124.exe and csrss.exe


  • This topic is locked This topic is locked
8 replies to this topic

#1 habeascorpse

habeascorpse

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:52 AM

Posted 19 April 2011 - 11:48 AM

These two infections keep jumping from my USB drives to my hard disk and back again, and I can't seem to ever fully remove them. I have tried using Avast and Symantec Antivirus. I downloaded GMER and DDS, but for some reason the DDS program isn't running or creating a log as indicated in the instructions. Please let me know what I might need to do to correct that, and I will attach the log. In the mean time, I have attached the GMER log. Thank you in advance for your help!

BC AdBot (Login to Remove)

 


#2 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:52 AM

Posted 29 April 2011 - 06:41 PM

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.
  • Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.

  • Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

  • Please reply to this post so I know you are there.
The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

----------------------------------------------

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Posted Image
m0le is a proud member of UNITE

#3 habeascorpse

habeascorpse
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:52 AM

Posted 02 May 2011 - 01:54 PM

Howdy -- just checking in. Thanks for helping me out! I will follow your instructions later this evening and report back.

#4 habeascorpse

habeascorpse
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:52 AM

Posted 02 May 2011 - 06:03 PM

Here are the OTL logs:

OTL.txt

OTL logfile created on: 5/2/2011 6:53:57 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,007.00 Mb Total Physical Memory | 527.00 Mb Available Physical Memory | 52.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): C:\pagefile.sys 744 1488 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 13.35 Gb Free Space | 17.91% Space Free | Partition Type: NTFS
Drive D: | 74.47 Gb Total Space | 22.73 Gb Free Space | 30.52% Space Free | Partition Type: NTFS

Computer Name: S0032044999 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\1.3.21.53\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
PRC - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe ()
PRC - C:\WINNT\system32\NLSSRV32.EXE (Nalpeiron Ltd.)
PRC - C:\WINNT\explorer.exe (Microsoft Corporation)
PRC - C:\WINNT\system32\dldocoms.exe ( )
PRC - C:\Program Files\Dell 968 AIO Printer\memcard.exe ()
PRC - C:\Program Files\Dell 968 AIO Printer\dldomon.exe ()
PRC - C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (wuauserv) -- File not found
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (PassThru Service) -- C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe ()
SRV - (nlsX86cc) -- C:\WINNT\system32\NLSSRV32.EXE (Nalpeiron Ltd.)
SRV - (dldoCATSCustConnectService) -- C:\WINNT\System32\spool\DRIVERS\W32X86\3\\dldoserv.exe ()
SRV - (dldo_device) -- C:\WINNT\System32\dldocoms.exe ( )
SRV - (SavRoam) -- C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (Symantec AntiVirus) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (SNDSrvc) -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccPwdSvc) -- C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (NetSvc) -- C:\Program Files\Intel\NCS\Sync\NetSvc.exe (Intel® Corporation)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) -- C:\WINNT\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\WINNT\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) -- C:\WINNT\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) -- C:\WINNT\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) -- C:\WINNT\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) -- C:\WINNT\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\WINNT\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (htcnprot) -- C:\WINNT\system32\drivers\htcnprot.sys (Windows ® Win 7 DDK provider)
DRV - (BVRPMPR5) -- C:\WINNT\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100207.006\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100207.006\NAVENG.SYS (Symantec Corporation)
DRV - (HTCAND32) -- C:\WINNT\system32\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV - (PalmUSBD) -- C:\WINNT\system32\drivers\PalmUSBD.sys (PalmSource, Inc.)
DRV - (SYMTDI) -- C:\WINNT\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) -- C:\WINNT\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SymEvent) -- C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SAVRT) -- C:\Program Files\Symantec AntiVirus\savrt.sys (Symantec Corporation)
DRV - (SAVRTPEL) -- C:\Program Files\Symantec AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (VNUSB) -- C:\WINNT\system32\drivers\VNUSB.sys (OLYMPUS OPTICAL CO.,LTD.)
DRV - (IntelC53) -- C:\WINNT\system32\drivers\IntelC53.sys (Intel Corporation)
DRV - (IntelC51) -- C:\WINNT\system32\drivers\IntelC51.sys (Intel Corporation)
DRV - (IntelC52) -- C:\WINNT\system32\drivers\IntelC52.sys (Intel Corporation)
DRV - (mohfilt) -- C:\WINNT\system32\drivers\mohfilt.sys (Intel Corporation)
DRV - (dvd_2K) -- C:\WINNT\System32\drivers\Dvd_2k.sys (Roxio)
DRV - (mmc_2K) -- C:\WINNT\System32\drivers\Mmc_2k.sys (Roxio)
DRV - (pwd_2k) -- C:\WINNT\System32\drivers\pwd_2K.sys (Roxio)
DRV - (UdfReadr_xp) -- C:\WINNT\System32\drivers\udfreadr_xp.sys (Roxio)
DRV - (cdudf_xp) -- C:\WINNT\System32\drivers\cdudf_xp.sys (Roxio)
DRV - (Cdr4_xp) -- C:\WINNT\System32\drivers\cdr4_xp.sys (Roxio)
DRV - (Cdralw2k) -- C:\WINNT\System32\drivers\cdralw2k.sys (Roxio)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.skedula.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINNT\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://gmail.com/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.0.2
FF - prefs.js..extensions.enabledItems: {fce8417d-ef18-11dd-845c-000c6e211f50}:1.29
FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.10
FF - prefs.js..extensions.enabledItems: {77b819fa-95ad-4f2c-ac7c-486b356188a9}:1.5.20090525
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.19


FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/12/06 18:55:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2010/04/19 21:26:37 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINNT\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2011/04/19 13:17:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/27 15:48:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/23 08:21:42 | 000,000,000 | ---D | M]

[2010/03/27 10:09:47 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2008/08/29 17:48:48 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2010/03/27 10:09:47 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2011/03/23 10:59:10 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tqttd4rk.default\extensions
[2009/04/20 20:17:23 | 000,000,000 | ---D | M] (Flashblock) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tqttd4rk.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2009/06/18 08:16:10 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tqttd4rk.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2009/04/20 20:17:24 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tqttd4rk.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011/03/27 15:51:32 | 000,001,687 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tqttd4rk.default\searchplugins\nutritiondata.xml
[2011/03/27 15:48:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/03/27 15:48:02 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011/01/26 22:58:16 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2008/09/25 18:38:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2009/07/26 20:16:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/26 20:41:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009/11/03 20:31:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2010/04/19 21:27:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/02 12:46:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/21 10:17:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/03/26 11:09:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) --
[2010/04/19 21:26:37 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/03/18 13:53:24 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/02/02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2005/12/05 22:31:00 | 000,114,688 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npmozax.dll
[2011/01/30 11:45:12 | 000,135,568 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
[2008/12/06 18:55:10 | 000,144,960 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
[2011/02/20 13:11:07 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
[2011/02/20 13:11:07 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
[2011/02/20 13:11:07 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
[2011/02/20 13:11:07 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
[2011/02/20 13:11:07 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
[2011/02/20 13:11:08 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
[2011/02/20 13:11:08 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
[2008/12/06 18:55:19 | 000,008,192 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
[2008/12/06 18:55:06 | 000,094,208 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
[2010/01/01 04:00:00 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,001,131 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
[2010/01/01 04:00:00 | 000,002,364 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2010/01/01 04:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml
[2010/01/01 04:00:00 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: ([2011/04/19 09:13:50 | 000,000,027 | ---- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: () - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINNT\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINNT\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINNT\system32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Dell 968 AIO Printer Fax Server] C:\Program Files\Dell 968 AIO Printer\fm3032.exe ()
O4 - HKLM..\Run: [dldomon.exe] C:\Program Files\Dell 968 AIO Printer\dldomon.exe ()
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [MemoryCardManager] C:\Program Files\Dell 968 AIO Printer\memcard.exe ()
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINNT\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINNT\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINNT\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINNT\system32\mswsock.dll (Microsoft Corporation)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} http://a1408.g.akamai.net/7/1408/9955/20031016/akamai.info.apple.com/iTunes4/WW/win/061-0848.20031022.TtzS4/iTunesSetup.exe (Reg Error: Key error.)
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\InstallerControl.cab (F5 Networks Auto Update)
O16 - DPF: {6C275925-A1ED-4DD2-9CEE-9823F5FDAA10} https://rapps.ucg.com/vdesk/terminal/urTermProxy.cab#version=6020,2007,1001,2136 (F5 Networks SSLTunnel)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} https://rapps.ucg.com/vdesk/terminal/urxhost.cab#version=6020,2007,1001,2140 (F5 Networks Host Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINNT\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINNT\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.16.0.1
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINNT\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINNT\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINNT\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINNT\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINNT\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINNT\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINNT\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINNT\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINNT\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINNT\system32\shell32.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\WINNT\system32\acaptuser32.dll) - C:\WINNT\system32\acaptuser32.dll (Adobe Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINNT\system32\userinit.exe) - C:\WINNT\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINNT\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINNT\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINNT\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINNT\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINNT\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINNT\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINNT\system32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINNT\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINNT\System32\NavLogon.dll - C:\WINNT\system32\NavLogon.dll (Symantec Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINNT\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINNT\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINNT\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINNT\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINNT\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINNT\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINNT\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINNT\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINNT\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINNT\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINNT\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINNT\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINNT\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINNT\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINNT\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINNT\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINNT\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINNT\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINNT\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINNT\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINNT\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINNT\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINNT\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (aswBoot.exe /M:ad8e08473146) - C:\WINNT\System32\aswBoot.exe (AVAST Software)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/30 15:32:54 | 000,049,904 | R--- | C] (Avanquest Software) -- C:\WINNT\System32\drivers\BVRPMPR5.SYS
[2011/04/30 15:31:36 | 000,000,000 | ---D | C] -- C:\Netgear
[2011/04/30 10:06:01 | 000,000,000 | ---D | C] -- C:\Music
[2011/04/27 21:42:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Of Mice and Men
[2011/04/26 14:49:24 | 000,000,000 | ---D | C] -- C:\WINNT\Minidump
[2011/04/23 08:25:32 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/04/22 09:07:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Metropolitan Pavilion_files
[2011/04/19 12:53:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\My Photos
[2011/04/19 12:53:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\My Documents
[2011/04/19 12:52:20 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\spmsgXP_2k3.dll
[2011/04/19 12:51:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2011/04/19 12:50:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\HTC
[2011/04/19 12:50:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\HTC Sync
[2011/04/19 12:48:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\HTC
[2011/04/19 12:48:07 | 001,122,664 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\WdfCoInstaller01007.dll
[2011/04/19 12:48:07 | 000,024,576 | ---- | C] (HTC, Corporation) -- C:\WINNT\System32\drivers\ANDROIDUSB.sys
[2011/04/19 12:47:54 | 000,000,000 | ---D | C] -- C:\Program Files\Spirent Communications
[2011/04/19 12:47:02 | 000,000,000 | ---D | C] -- C:\Program Files\HTC
[2011/04/19 08:46:23 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/04/19 08:42:37 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINNT\SWXCACLS.exe
[2011/04/19 08:42:37 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINNT\SWREG.exe
[2011/04/19 08:42:37 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINNT\SWSC.exe
[2011/04/19 08:42:37 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINNT\NIRCMD.exe
[2011/04/19 08:41:14 | 000,000,000 | ---D | C] -- C:\WINNT\ERDNT
[2011/04/19 08:38:56 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/04/19 06:34:02 | 000,000,000 | ---D | C] -- C:\WINNT\System32\XPSViewer
[2011/04/19 06:33:56 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild
[2011/04/19 06:33:44 | 000,000,000 | ---D | C] -- C:\Program Files\Reference Assemblies
[2011/04/19 06:32:34 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\printfilterpipelinesvc.exe
[2011/04/19 06:32:34 | 000,575,488 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\xpsshhdr.dll
[2011/04/19 06:32:34 | 000,117,760 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\prntvpt.dll
[2011/04/19 06:32:34 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\filterpipelineprintproc.dll
[2011/04/19 06:32:33 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\xpssvcs.dll
[2011/04/19 06:32:33 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\xpssvcs.dll
[2011/04/18 13:23:36 | 000,000,000 | ---D | C] -- C:\WINNT\ie8updates
[2011/04/18 09:45:34 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\mfc40u.dll
[2011/04/18 09:44:53 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\comctl32.dll
[2011/04/18 09:44:14 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\aclayers.dll
[2011/04/18 09:43:12 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\helpsvc.exe
[2011/04/18 09:42:42 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\ndproxy.sys
[2011/04/18 09:41:54 | 000,119,808 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\t2embed.dll
[2011/04/18 09:41:54 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\fontsub.dll
[2011/04/18 09:37:56 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\msfeeds.dll
[2011/04/18 09:37:55 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\msfeedsbs.dll
[2011/04/18 09:37:47 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\iedvtool.dll
[2011/04/18 09:37:46 | 001,991,680 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\iertutil.dll
[2011/04/18 09:37:36 | 011,080,704 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\ieframe.dll
[2011/04/18 09:36:22 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\msxml3.dll
[2011/04/18 09:34:56 | 000,455,936 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\mrxsmb.sys
[2011/04/18 09:34:30 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\moviemk.exe
[2011/04/18 09:31:00 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\netapi32.dll
[2011/04/18 09:28:40 | 002,148,864 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\ntkrnlmp.exe
[2011/04/18 09:28:39 | 002,192,768 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\ntoskrnl.exe
[2011/04/18 09:28:37 | 002,027,008 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\ntkrpamp.exe
[2011/04/18 09:28:36 | 002,069,376 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\ntkrnlpa.exe
[2011/04/18 09:24:47 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\wab.exe
[2011/04/18 09:23:58 | 000,590,848 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\rpcrt4.dll
[2011/04/06 20:49:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\photo dump
[2011/04/03 18:34:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Hope Street
[2008/08/20 15:40:43 | 001,069,056 | ---- | C] ( ) -- C:\WINNT\System32\dldoserv.dll
[2008/08/20 15:40:43 | 000,954,368 | ---- | C] ( ) -- C:\WINNT\System32\dldousb1.dll
[2008/08/20 15:40:43 | 000,851,968 | ---- | C] ( ) -- C:\WINNT\System32\dldocomc.dll
[2008/08/20 15:40:43 | 000,663,552 | ---- | C] ( ) -- C:\WINNT\System32\dldohbn3.dll
[2008/08/20 15:40:43 | 000,643,072 | ---- | C] ( ) -- C:\WINNT\System32\dldopmui.dll
[2008/08/20 15:40:43 | 000,595,184 | ---- | C] ( ) -- C:\WINNT\System32\dldocoms.exe
[2008/08/20 15:40:43 | 000,569,344 | ---- | C] ( ) -- C:\WINNT\System32\dldolmpm.dll
[2008/08/20 15:40:43 | 000,438,272 | ---- | C] ( ) -- C:\WINNT\System32\dldohcp.dll
[2008/08/20 15:40:43 | 000,365,808 | ---- | C] ( ) -- C:\WINNT\System32\dldocfg.exe
[2008/08/20 15:40:43 | 000,364,544 | ---- | C] ( ) -- C:\WINNT\System32\dldocomm.dll
[2008/08/20 15:40:43 | 000,360,448 | ---- | C] ( ) -- C:\WINNT\System32\dldoinpa.dll
[2008/08/20 15:40:43 | 000,339,968 | ---- | C] ( ) -- C:\WINNT\System32\dldoiesc.dll
[2008/08/20 15:40:43 | 000,320,752 | ---- | C] ( ) -- C:\WINNT\System32\dldoih.exe
[2008/08/20 15:40:43 | 000,053,248 | ---- | C] ( ) -- C:\WINNT\System32\dldoprox.dll
[2 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/02 18:51:10 | 000,001,158 | ---- | M] () -- C:\WINNT\System32\wpa.dbl
[2011/05/02 18:49:51 | 000,002,048 | --S- | M] () -- C:\WINNT\bootstat.dat
[2011/05/02 18:49:47 | 1055,707,136 | -HS- | M] () -- C:\hiberfil.sys
[2011/05/01 22:12:01 | 000,001,010 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskUserS-1-5-21-1664665948-122051574-1339580857-500UA.job
[2011/04/30 19:12:05 | 000,000,958 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskUserS-1-5-21-1664665948-122051574-1339580857-500Core.job
[2011/04/30 09:08:04 | 000,002,344 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Google Chrome.lnk
[2011/04/30 09:08:04 | 000,002,322 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/04/27 21:28:17 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word (2).lnk
[2011/04/25 15:00:04 | 000,000,424 | ---- | M] () -- C:\WINNT\tasks\Norton Security Scan for Administrator.job
[2011/04/24 08:55:28 | 000,009,302 | ---- | M] () -- C:\WINNT\cdplayer.ini
[2011/04/22 10:57:50 | 000,001,730 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/04/22 09:07:31 | 000,014,340 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Metropolitan Pavilion.htm
[2011/04/19 15:41:26 | 000,432,796 | ---- | M] () -- C:\WINNT\System32\perfh009.dat
[2011/04/19 15:41:25 | 000,067,370 | ---- | M] () -- C:\WINNT\System32\perfc009.dat
[2011/04/19 13:25:05 | 000,001,374 | ---- | M] () -- C:\WINNT\imsins.BAK
[2011/04/19 12:52:34 | 000,000,000 | -H-- | M] () -- C:\WINNT\System32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf
[2011/04/19 12:52:32 | 000,000,000 | -H-- | M] () -- C:\WINNT\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2011/04/19 12:50:37 | 000,000,825 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\HTC Sync.lnk
[2011/04/19 12:50:37 | 000,000,807 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HTC Sync.lnk
[2011/04/19 09:36:07 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Administrator\defogger_reenable
[2011/04/19 09:13:50 | 000,000,027 | ---- | M] () -- C:\WINNT\System32\drivers\etc\hosts
[2011/04/19 08:46:30 | 000,000,323 | RHS- | M] () -- C:\boot.ini
[2011/04/19 06:52:58 | 000,247,104 | ---- | M] () -- C:\WINNT\System32\FNTCACHE.DAT
[2011/04/18 14:23:02 | 002,005,455 | ---- | M] () -- C:\WINNT\iis6.BAK
[2011/04/18 14:18:54 | 000,000,118 | ---- | M] () -- C:\WINNT\System32\MRT.INI
[2011/04/18 09:43:40 | 000,000,207 | ---- | M] () -- C:\Boot.bak
[2011/04/18 09:14:24 | 000,033,792 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/22 10:57:50 | 000,001,730 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/04/22 10:57:49 | 000,001,800 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/04/22 09:07:28 | 000,014,340 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Metropolitan Pavilion.htm
[2011/04/19 12:52:34 | 000,000,000 | -H-- | C] () -- C:\WINNT\System32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf
[2011/04/19 12:52:32 | 000,000,000 | -H-- | C] () -- C:\WINNT\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2011/04/19 12:50:37 | 000,000,825 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\HTC Sync.lnk
[2011/04/19 12:50:37 | 000,000,807 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HTC Sync.lnk
[2011/04/19 09:36:07 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Administrator\defogger_reenable
[2011/04/19 08:46:30 | 000,000,207 | ---- | C] () -- C:\Boot.bak
[2011/04/19 08:46:29 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/04/19 08:42:37 | 000,256,512 | ---- | C] () -- C:\WINNT\PEV.exe
[2011/04/19 08:42:37 | 000,098,816 | ---- | C] () -- C:\WINNT\sed.exe
[2011/04/19 08:42:37 | 000,089,088 | ---- | C] () -- C:\WINNT\MBR.exe
[2011/04/19 08:42:37 | 000,080,412 | ---- | C] () -- C:\WINNT\grep.exe
[2011/04/19 08:42:37 | 000,068,096 | ---- | C] () -- C:\WINNT\zip.exe
[2011/04/18 14:18:54 | 000,000,118 | ---- | C] () -- C:\WINNT\System32\MRT.INI
[2011/04/18 09:18:27 | 1055,707,136 | -HS- | C] () -- C:\hiberfil.sys
[2011/01/26 23:01:46 | 000,000,056 | -H-- | C] () -- C:\WINNT\System32\ezsidmv.dat
[2010/10/18 18:35:30 | 000,015,872 | ---- | C] () -- C:\WINNT\winxss.dll
[2010/06/02 22:07:09 | 000,010,240 | ---- | C] () -- C:\WINNT\System32\virport.dll
[2010/02/21 16:19:03 | 000,000,050 | ---- | C] () -- C:\WINNT\qwimp.ini
[2009/09/16 17:27:58 | 000,508,224 | ---- | C] () -- C:\WINNT\System32\ICCProfiles.dll
[2009/06/30 11:29:58 | 000,000,094 | ---- | C] () -- C:\WINNT\family.ini
[2009/06/18 08:37:05 | 000,110,592 | ---- | C] () -- C:\WINNT\System32\OdiOlDVR.dll
[2009/06/18 08:37:04 | 000,053,248 | ---- | C] () -- C:\WINNT\System32\OdiAPI.dll
[2009/06/04 22:24:25 | 000,002,828 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2009/06/04 22:24:25 | 000,000,088 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\DAB4AEA37B.sys
[2008/09/30 08:57:39 | 000,149,504 | ---- | C] () -- C:\WINNT\UNWISE.EXE
[2008/08/20 15:42:19 | 000,040,960 | ---- | C] () -- C:\WINNT\System32\dldovs.dll
[2008/08/20 15:42:18 | 000,348,160 | ---- | C] () -- C:\WINNT\System32\dldocoin.dll
[2008/08/20 15:42:08 | 000,692,224 | ---- | C] () -- C:\WINNT\System32\dldodrs.dll
[2008/08/20 15:42:08 | 000,069,632 | ---- | C] () -- C:\WINNT\System32\dldocnv4.dll
[2008/08/20 15:42:08 | 000,065,536 | ---- | C] () -- C:\WINNT\System32\dldocaps.dll
[2008/08/20 15:41:41 | 000,049,152 | ---- | C] () -- C:\WINNT\System32\dldooem.dll
[2008/08/20 15:41:41 | 000,045,056 | ---- | C] () -- C:\WINNT\System32\DLDOPMON.DLL
[2008/08/20 15:41:41 | 000,032,768 | ---- | C] () -- C:\WINNT\System32\DLDOFXPU.DLL
[2008/08/20 15:41:41 | 000,012,288 | ---- | C] () -- C:\WINNT\System32\DLDOPMRC.DLL
[2008/08/20 15:40:43 | 000,503,808 | ---- | C] () -- C:\WINNT\System32\dldoutil.dll
[2008/08/20 15:40:43 | 000,348,160 | ---- | C] () -- C:\WINNT\System32\dldoinst.dll
[2008/08/20 15:40:43 | 000,208,896 | ---- | C] () -- C:\WINNT\System32\dldogrd.dll
[2008/08/20 15:40:43 | 000,176,128 | ---- | C] () -- C:\WINNT\System32\dldoinsb.dll
[2008/08/20 15:40:43 | 000,176,128 | ---- | C] () -- C:\WINNT\System32\dldoins.dll
[2008/08/20 15:40:43 | 000,143,360 | ---- | C] () -- C:\WINNT\System32\dldojswr.dll
[2008/08/20 15:40:43 | 000,106,496 | ---- | C] () -- C:\WINNT\System32\dldoinsr.dll
[2008/08/20 15:40:43 | 000,086,016 | ---- | C] () -- C:\WINNT\System32\dldocub.dll
[2008/08/20 15:40:43 | 000,077,906 | ---- | C] () -- C:\WINNT\System32\dldocfg.dll
[2008/08/20 15:40:43 | 000,077,824 | ---- | C] () -- C:\WINNT\System32\dldocu.dll
[2008/08/20 15:40:43 | 000,036,864 | ---- | C] () -- C:\WINNT\System32\dldocur.dll
[2008/06/07 11:12:56 | 000,001,895 | ---- | C] () -- C:\WINNT\mozver.dat
[2007/11/14 13:42:27 | 000,237,568 | ---- | C] () -- C:\WINNT\System32\lame_enc.dll
[2007/11/09 07:01:59 | 000,000,164 | ---- | C] () -- C:\WINNT\System32\psyswin32.dll
[2005/01/30 02:10:23 | 000,009,302 | ---- | C] () -- C:\WINNT\cdplayer.ini
[2004/10/13 16:22:27 | 000,000,000 | ---- | C] () -- C:\WINNT\VPC32.INI
[2004/10/09 02:14:20 | 000,004,569 | ---- | C] () -- C:\WINNT\System32\secupd.dat
[2004/09/18 18:54:54 | 000,000,051 | ---- | C] () -- C:\WINNT\iTouch.ini
[2004/04/11 03:48:47 | 000,000,000 | ---- | C] () -- C:\WINNT\iPlayer.INI
[2004/03/17 01:50:36 | 000,033,792 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/02/22 03:01:11 | 000,006,550 | ---- | C] () -- C:\WINNT\jautoexp.dat
[2003/09/17 16:14:56 | 000,000,024 | ---- | C] () -- C:\WINNT\wininit.ini
[2003/09/17 16:14:50 | 000,000,002 | ---- | C] () -- C:\WINNT\msoffice.ini
[2003/09/17 16:11:20 | 000,000,000 | ---- | C] () -- C:\WINNT\AutoRun.INI
[2003/09/17 14:56:50 | 000,001,132 | ---- | C] () -- C:\WINNT\LEXSTAT.INI
[2003/09/04 08:17:37 | 000,000,061 | ---- | C] () -- C:\WINNT\smscfg.ini
[2003/09/03 16:07:51 | 000,000,708 | ---- | C] () -- C:\WINNT\QUICKEN.INI
[2003/09/03 16:07:51 | 000,000,052 | ---- | C] () -- C:\WINNT\intuprof.ini
[2003/09/03 16:07:09 | 000,000,370 | ---- | C] () -- C:\WINNT\ODBC.INI
[2003/09/03 16:03:51 | 000,000,335 | ---- | C] () -- C:\WINNT\nsreg.dat
[2003/09/03 16:02:31 | 000,000,701 | ---- | C] () -- C:\WINNT\System32\OEMINFO.INI
[2003/05/12 10:57:34 | 000,000,781 | ---- | C] () -- C:\WINNT\orun32.ini
[2003/05/12 10:47:26 | 000,363,520 | ---- | C] () -- C:\WINNT\System32\psisdecd.dll
[2003/05/12 10:37:33 | 000,002,048 | --S- | C] () -- C:\WINNT\bootstat.dat
[2003/05/12 10:28:21 | 000,021,640 | ---- | C] () -- C:\WINNT\System32\emptyregdb.dat
[2003/05/12 10:22:08 | 000,004,073 | ---- | C] () -- C:\WINNT\ODBCINST.INI
[2003/05/12 10:20:57 | 000,247,104 | ---- | C] () -- C:\WINNT\System32\FNTCACHE.DAT
[1980/01/01 00:00:00 | 013,107,200 | ---- | C] () -- C:\WINNT\System32\oembios.bin
[1980/01/01 00:00:00 | 000,673,088 | ---- | C] () -- C:\WINNT\System32\mlang.dat
[1980/01/01 00:00:00 | 000,432,796 | ---- | C] () -- C:\WINNT\System32\perfh009.dat
[1980/01/01 00:00:00 | 000,272,128 | ---- | C] () -- C:\WINNT\System32\perfi009.dat
[1980/01/01 00:00:00 | 000,218,003 | ---- | C] () -- C:\WINNT\System32\dssec.dat
[1980/01/01 00:00:00 | 000,067,370 | ---- | C] () -- C:\WINNT\System32\perfc009.dat
[1980/01/01 00:00:00 | 000,046,258 | ---- | C] () -- C:\WINNT\System32\mib.bin
[1980/01/01 00:00:00 | 000,028,626 | ---- | C] () -- C:\WINNT\System32\perfd009.dat
[1980/01/01 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINNT\System32\e100bmsg.dll
[1980/01/01 00:00:00 | 000,005,114 | ---- | C] () -- C:\WINNT\System32\oembios.dat
[1980/01/01 00:00:00 | 000,001,804 | ---- | C] () -- C:\WINNT\System32\dcache.bin
[1980/01/01 00:00:00 | 000,000,741 | ---- | C] () -- C:\WINNT\System32\noise.dat

========== LOP Check ==========

[2010/09/19 10:36:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\.minecraft
[2008/09/30 16:14:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\.Torrent Swapper
[2008/08/21 16:06:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\968 Series
[2008/11/12 20:43:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Aim
[2010/04/05 22:17:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/06/22 20:23:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Downloaded Installations
[2009/06/30 16:53:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\HotSync
[2011/04/19 12:50:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\HTC
[2011/04/19 12:51:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2003/09/03 16:04:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\InterTrust
[2004/04/04 01:05:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\InterVideo
[2010/06/22 20:27:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Nitro PDF
[2011/04/02 14:45:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Octoshape
[2010/06/08 17:03:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\StreamTorrent
[2011/03/16 20:46:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\uTorrent
[2008/08/20 15:41:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\968 Series
[2010/03/20 21:21:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/06/30 11:33:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Borland
[2009/06/30 16:57:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HotSync
[2010/06/22 20:26:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nitro PDF
[2005/01/16 17:47:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OLYMPUS
[2006/02/18 13:52:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/02/19 10:44:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2003/09/06 17:39:00 | 000,000,254 | ---- | M] () -- C:\WINNT\Tasks\ISP signup reminder 1.job
[2003/09/06 17:39:01 | 000,000,254 | ---- | M] () -- C:\WINNT\Tasks\ISP signup reminder 2.job
[2003/09/22 00:45:00 | 000,000,254 | ---- | M] () -- C:\WINNT\Tasks\ISP signup reminder 3.job

========== Purity Check ==========



< End of report >



Extras.txt

OTL Extras logfile created on: 5/2/2011 6:53:57 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,007.00 Mb Total Physical Memory | 527.00 Mb Available Physical Memory | 52.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): C:\pagefile.sys 744 1488 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 13.35 Gb Free Space | 17.91% Space Free | Partition Type: NTFS
Drive D: | 74.47 Gb Total Space | 22.73 Gb Free Space | 30.52% Space Free | Partition Type: NTFS

Computer Name: S0032044999 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf426984InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf426984InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf059890InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf059890InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf029515InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf029515InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf199890InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf199890InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf938312InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf938312InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf762750InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf762750InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf983218InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf983218InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf267750InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf267750InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf898843InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf898843InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf331750InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf331750InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf982062InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf982062InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf125546InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf125546InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf337921InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf337921InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf044859InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf044859InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf760625InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf760625InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf365375InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf365375InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf807343InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf807343InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf416296InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf416296InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf643125InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf643125InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf085765InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf085765InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf552656InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf552656InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf816796InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf816796InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf320484InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf320484InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf286671InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf286671InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf202234InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf202234InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf885265InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf885265InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf208671InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf208671InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf033859InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf033859InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf068546InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf068546InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf532671InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf532671InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf409437InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf409437InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf826031InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf826031InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf110625InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf110625InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf956109InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf956109InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf765859InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf765859InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf822015InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf822015InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf673578InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf673578InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf081828InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf081828InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf278046InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf278046InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf157625InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf157625InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf023984InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf023984InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf392640InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf392640InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf794640InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf794640InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf230281InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf230281InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf650343InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf650343InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf811062InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf811062InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf041015InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf041015InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf229000InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf229000InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf252375InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf252375InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf069421InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf069421InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf090375InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf090375InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf681468InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf681468InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf180531InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf180531InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf304312InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf304312InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf351171InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf351171InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf020859InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf020859InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf221859InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf221859InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf508687InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf508687InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf288406InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf288406InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf784046InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf784046InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf352750InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf352750InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf575468InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf575468InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf913437InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf913437InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf319078InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf319078InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf237484InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf237484InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf686781InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf686781InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf669953InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf669953InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf195156InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf195156InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf869140InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf869140InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf716609InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf716609InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf205234InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf205234InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf398875InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf398875InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf314390InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf314390InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf676296InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf676296InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf022453InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf022453InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf079031InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf079031InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf390968InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf390968InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf960234InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf960234InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf997828InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf997828InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf533000InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf533000InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf922421InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf922421InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf127421InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf127421InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf618046InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf618046InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf325296InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf325296InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf652515InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf652515InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf397031InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf397031InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf757093InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf757093InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf848843InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf848843InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf864000InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf864000InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf988906InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf988906InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf441859InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf441859InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf572828InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf572828InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf208937InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf208937InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf544421InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf544421InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf544859InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf544859InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf071625InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf071625InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf410625InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf410625InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf640312InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf640312InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf964421InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf964421InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf242781InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf242781InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf186531InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf186531InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf746875InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf746875InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf301171InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf301171InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf118359InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf118359InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf868734InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf868734InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf542140InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf542140InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf219437InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf219437InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf064375InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf064375InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf828156InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf828156InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf160062InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf160062InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf337640InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf337640InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf961562InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf961562InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf305921InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf305921InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf356437InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf356437InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf965343InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf965343InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf973656InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf973656InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf398203InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf398203InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf965859InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf965859InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf904765InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf904765InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf281062InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf281062InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf533593InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf533593InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf316765InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf316765InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf897656InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf897656InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf469453InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf469453InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf967250InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf967250InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf386484InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf386484InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf813093InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf813093InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf664625InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf664625InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf893453InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf893453InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf444515InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf444515InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf361234InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf361234InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf686265InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf686265InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf975734InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf975734InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf123234InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf123234InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf049484InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf049484InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf766062InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf766062InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf602640InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf602640InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf631578InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf631578InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf174343InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf174343InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf784281InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf784281InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf019390InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf019390InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf338828InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf338828InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf615609InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf615609InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf316593InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf316593InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf946406InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf946406InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf782046InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf782046InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf564125InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf564125InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf626843InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf626843InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf052750InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf052750InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf403031InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf403031InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf793453InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf793453InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf082593InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf082593InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf988156InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf988156InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf095953InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf095953InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf123796InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf123796InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf870515InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf870515InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf135109InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf135109InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf567484InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf567484InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf952203InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf952203InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf330453InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf330453InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf924656InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf924656InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf045046InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf045046InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf612750InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf612750InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf082250InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf082250InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf770656InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf770656InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf074625InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf074625InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf971437InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf971437InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf379656InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf379656InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf761203InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf761203InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf209531InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf209531InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf914812InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf914812InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf194843InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf194843InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf758484InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf758484InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf152343InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf152343InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf183750InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf183750InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf650937InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf650937InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf317953InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf317953InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf239468InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf239468InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf057531InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf057531InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf299375InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf299375InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf919281InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf919281InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf520031InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf520031InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf946453InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf946453InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf117625InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf117625InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf447671InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf447671InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf434046InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf434046InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf672421InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf672421InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf502453InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf502453InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf524703InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf524703InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf015046InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf015046InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf333734InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf333734InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf785937InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf785937InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf925109InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf925109InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf749296InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf749296InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf365250InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf365250InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf710156InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf710156InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf502203InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf502203InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf642390InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf642390InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf831281InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf831281InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf161312InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf161312InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf107125InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf107125InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf704906InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf704906InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf891546InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf891546InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf520109InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf520109InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\vf972234InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\vf972234InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\InStream20060202\InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\InStream20060202\InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"C:\Documents and Settings\Administrator\Local Settings\Temp\InStream20060913\InStream.app\InStream.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\InStream20060913\InStream.app\InStream.exe:*:Enabled:InStream.app/InStream
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\WINNT\system32\dldocoms.exe" = C:\WINNT\system32\dldocoms.exe:*:Enabled:Dell Communications System -- ( )
"C:\Program Files\Dell 968 AIO Printer\dldomon.exe" = C:\Program Files\Dell 968 AIO Printer\dldomon.exe:*:Enabled:Printer Device Monitor -- ()
"C:\WINNT\system32\spool\drivers\w32x86\3\dldopswx.exe" = C:\WINNT\system32\spool\drivers\w32x86\3\dldopswx.exe:*:Enabled:Printer Status Window Interface -- ()
"C:\WINNT\system32\spool\drivers\w32x86\3\dldotime.exe" = C:\WINNT\system32\spool\drivers\w32x86\3\dldotime.exe:*:Enabled:Time Executable -- ()
"C:\Program Files\Dell 968 AIO Printer\dldoaiox.exe" = C:\Program Files\Dell 968 AIO Printer\dldoaiox.exe:*:Enabled:AIOC exe -- ()
"C:\WINNT\system32\spool\drivers\w32x86\3\dldojswx.exe" = C:\WINNT\system32\spool\drivers\w32x86\3\dldojswx.exe:*:Enabled:Job Status Window Interface -- ()
"C:\Program Files\Dell 968 AIO Printer\dldoafcn.exe" = C:\Program Files\Dell 968 AIO Printer\dldoafcn.exe:*:Enabled: -- ()
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"D:\Program Files\LimeWire\LimeWire.exe" = D:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"D:\Program Files\AIM\aim.exe" = D:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"C:\Program Files\StreamTorrent 1.0\StreamTorrent.exe" = C:\Program Files\StreamTorrent 1.0\StreamTorrent.exe:*:Enabled:StreamTorrent Media Player -- (StreamTorrent)
"C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome -- (Google Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- (Skype Technologies)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service -- (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Documents and Settings\Administrator\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" = C:\Documents and Settings\Administrator\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe:*:Enabled:Main program for Octoshape client -- (Octoshape ApS)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000000-3976-4267-9F39-1DC4745090B7}" = Microsoft Learning and Research Plus Support Files
"{03410014-3975-4267-9F39-1DC4745090B7}" = Microsoft Encarta Encyclopedia Standard 2003
"{12BDDF23-B1DB-49C8-92D3-3E6841CCED61}" = Microsoft Streets and Trips 2002
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 24
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{30BB4D60-81DB-11D5-BB77-00400536ABAC}" = OLYMPUS CAMEDIA Master 4.2
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{369B36BE-3D64-4641-9AEA-808D436FE132}" = Microsoft Picture It! Photo 7.0
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5645FB61-898F-4F59-AF80-52FEF3D63A64}" = HTC Sync
"{5701EFCA-EFA0-4109-BB33-BB461F63088A}" = ShowInfo
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{609F7AC8-C510-11D4-A788-009027ABA5D0}" = Easy CD Creator 5 Basic
"{63CFD835-FF50-4F8B-91CD-5662A8C640F8}" = Photo Transport
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{70B45586-B51E-4947-A258-A895596C5CED}" = Photo Loader 3.0E
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7E819CE5-2C41-4C8D-BAF0-B49CC65C5562}" = Norton Security Scan
"{7EE9DE0D-9228-4C33-B80E-FDD1773600DF}" = Microsoft Works Suite Add-in for Microsoft Word
"{848AC794-8B81-440A-81AE-6474337DB527}" = Symantec AntiVirus
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90300409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Media Content
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{913D0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Standard for Students and Teachers
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = DVD
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A790BEB1-BCCF-4EC6-807B-5708B36E8A79}" = Intel® PROSet
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{ABEB838C-A1A7-4C5D-B7E1-8B4314B00527}" = MSN Messenger 5.0
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{B43357AA-3A6D-4D94-B56E-43C44D09E548}" = Microsoft .NET Framework (English)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFADE4AF-C0CF-4A04-A776-741318F1658F}" = Content Transfer
"{D64DCF1C-7A95-49A4-BAFA-C42B5CF6B8B6}" = Works Suite OS Pack
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F10082FE-BACB-4E58-A423-DAD6BFC8B3A2}" = Gateway Ink Monitor
"{FB91E774-867B-4567-ACE7-8144EF036068}" = Olympus Digital Wave Player
"{FD6034A3-655C-49F0-B496-D4CBFD74D7A7}" = Palm Desktop by ACCESS
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"avast" = avast! Free Antivirus
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Comical_is1" = Comical 0.8
"Dell 968 AIO Printer" = Dell 968 AIO Printer
"Foxit PDF Editor" = Foxit PDF Editor
"ie8" = Windows Internet Explorer 8
"Intel® 537EP Data Fax Modem" = Intel® 537EP Data Fax Modem
"InterActual Player" = InterActual Player
"Lexmark Z600 Series" = Lexmark Z600 Series
"LimeWire" = LimeWire 5.5.16
"linksadoor_is1" = linksadoor 1.29
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 2.0 (Symantec Corporation)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework Full v1.0.3705 (1033)" = Microsoft .NET Framework (English) v1.0.3705
"Mozilla Firefox 4.0 (x86 en-US)" = Mozilla Firefox 4.0 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNMS" = MSN Internet Software
"NSSSetup.{7E819CE5-2C41-4C8D-BAF0-B49CC65C5562}" = Norton Security Scan (Symantec Corporation)
"PROSet" = Intel® PRO Network Adapters and Drivers
"RealPlayer 6.0" = RealPlayer
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.3
"StreamTorrent 1.0" = StreamTorrent 1.0
"uTorrent" = µTorrent
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 0.9.4
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Works2003Setup" = Microsoft Works 2003 Setup Launcher
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Octoshape Streaming Services" = Octoshape Streaming Services

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/24/2011 8:45:56 PM | Computer Name = S0032044999 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/24/2011 8:46:05 PM | Computer Name = S0032044999 | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 3/24/2011 8:53:37 PM | Computer Name = S0032044999 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/26/2011 11:08:47 AM | Computer Name = S0032044999 | Source = MsiInstaller | ID = 11500
Description = Product: Java™ 6 Update 24 -- Error 1500.Another installation is
in progress. You must complete that installation before continuing this one.

Error - 3/27/2011 3:29:18 PM | Computer Name = S0032044999 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 3/27/2011 3:29:18 PM | Computer Name = S0032044999 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 3/27/2011 3:29:18 PM | Computer Name = S0032044999 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 3/27/2011 3:29:18 PM | Computer Name = S0032044999 | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 4/18/2011 10:03:11 PM | Computer Name = S0032044999 | Source = MPSampleSubmission | ID = 5000
Description =

Error - 4/19/2011 8:51:37 AM | Computer Name = S0032044999 | Source = Application Error | ID = 1000
Description = Faulting application PEV.cfxxe, version 0.0.0.0, faulting module PEV.cfxxe,
version 0.0.0.0, fault address 0x00082899.

[ System Events ]
Error - 4/30/2011 4:43:25 PM | Computer Name = S0032044999 | Source = Dhcp | ID = 1002
Description = The IP address lease 208.120.207.27 for the Network Card with network
address 0007E946C4CF has been denied by the DHCP server 172.16.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 5/1/2011 8:20:46 AM | Computer Name = S0032044999 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the dldoCATSCustConnectService
service to connect.

Error - 5/1/2011 8:20:46 AM | Computer Name = S0032044999 | Source = Service Control Manager | ID = 7000
Description = The dldoCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 5/1/2011 8:20:46 AM | Computer Name = S0032044999 | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126

Error - 5/1/2011 8:50:33 PM | Computer Name = S0032044999 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the dldoCATSCustConnectService
service to connect.

Error - 5/1/2011 8:50:33 PM | Computer Name = S0032044999 | Source = Service Control Manager | ID = 7000
Description = The dldoCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 5/1/2011 8:50:33 PM | Computer Name = S0032044999 | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126

Error - 5/2/2011 6:50:44 PM | Computer Name = S0032044999 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the dldoCATSCustConnectService
service to connect.

Error - 5/2/2011 6:50:44 PM | Computer Name = S0032044999 | Source = Service Control Manager | ID = 7000
Description = The dldoCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 5/2/2011 6:50:44 PM | Computer Name = S0032044999 | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%126


< End of report >

#5 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:52 AM

Posted 02 May 2011 - 06:41 PM

There's nothing in the log to indicate an infection so let's switch to looking for something else. I note that you didn't attach the Gmer log so could you post that next please.
Posted Image
m0le is a proud member of UNITE

#6 habeascorpse

habeascorpse
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:52 AM

Posted 02 May 2011 - 09:48 PM

GMER log is attached.

Attached Files

  • Attached File  gmer.log   173.44KB   1 downloads


#7 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:52 AM

Posted 03 May 2011 - 02:21 PM

Gmer looks fine too. Please run both MBAM and SAS.

Please download Posted Image Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application or, if you are using Vista, right-click and select Run As Administrator on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
    If MBAM won't update then download and update MBAM on a clean computer then save the rules.ref folder to a memory stick. This file is found here: 'C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware' then transfer it across to the infected computer.
  • On the Scanner tab:
    • Make sure the "Perform Full Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.


And

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.

Posted Image
m0le is a proud member of UNITE

#8 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:52 AM

Posted 05 May 2011 - 08:26 PM

Hi,

I have not had a reply from you for 3 days. Can you please tell me if you still need help with your computer as I am unable to help other members with their problems while I have your topic still open. The time taken between posts can also change the situation with your PC making it more difficult to help you.

If you like you can PM me.

Thanks,


m0le
Posted Image
m0le is a proud member of UNITE

#9 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:52 AM

Posted 07 May 2011 - 11:40 AM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.
Posted Image
m0le is a proud member of UNITE




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users