Solved Infected With Alerion Virus.

JDorritie · 2010/07/01

I don't know why part 1 posted twice. The forum told me posting that the first time was within 30 seconds and that it didn't let me post. Sorry for the clutter.

broni · 2010/07/01

Don't worry about it

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

Spyware, Adware, Dialers, and other potentially dangerous programs
[*] Archives
[*] Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

JDorritie · 2010/07/02

Here is my Kaspersky Scan Report. The computer seems to be running much better. I think I'm definitely getting close!

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Friday, July 2, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, July 02, 2010 07:10:41
Records in database: 4260121
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 114896
Threats found: 3
Infected objects found: 7
Suspicious objects found: 0
Scan duration: 05:43:22

File name / Threat / Threats count
C:\Qoobox\Quarantine\C\Documents and Settings\James Dorritie\Application Data\97979797979797979797.exe.vir Infected: Trojan.Win32.VB.ahcz 1
C:\Qoobox\Quarantine\C\Documents and Settings\James Dorritie\Application Data\drv73825.exe.vir Infected: Trojan.Win32.Agent.eimu 1
C:\Qoobox\Quarantine\C\Documents and Settings\James Dorritie\Application Data\tempimage.exe.vir Infected: Trojan.Win32.Agent.eimu 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\tcpip.sys.vir_ Infected: Rootkit.Win32.TDSS.ap 1
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP1469\A0225319.exe Infected: Trojan.Win32.VB.ahcz 1
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP1469\A0225323.exe Infected: Trojan.Win32.Agent.eimu 1
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP1469\A0225326.exe Infected: Trojan.Win32.Agent.eimu 1

Selected area has been scanned.

broni · 2010/07/02

OTL Clean-Up
Clean up with OTL:

* Double-click OTL.exe to start the program.
* Close all other programs apart from OTL as this step will require a reboot
* On the OTL main screen, press the CLEANUP button
* Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

===========================================================

Your computer is clean

1. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore ".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

JDorritie · 2010/07/03

I did everything you said, and it seemed to be clean and running beautifully, and I changed my default address bar search back to google, but, unfortunately, the address bar is now using bing.zugo.com again. Everything seemed to be fine.

broni · 2010/07/03

but, unfortunately, the address bar is now using bing.zugo.com again
Click to expand...

Which browser are we talking about here?

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

JDorritie · 2010/07/04

I'm using what I assume is the latest version of Firefox. Will run that scan right now.

broni · 2010/07/04

Ok

JDorritie · 2010/07/04

OTL.txt (Part 1.)

OTL logfile created on: 7/4/2010 1:36:52 PM - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\James Dorritie\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): C:\pagefile.sys 1024 1024 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 49.64 Gb Total Space | 29.68 Gb Free Space | 59.80% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JIMMY
Current User Name: James Dorritie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/04 04:40:57 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James Dorritie\Desktop\OTL.exe
PRC - [2010/06/17 15:24:13 | 000,121,576 | ---- | M] (dotSyntax, LLC) -- C:\Program Files\Digsby\lib\digsby-app.exe
PRC - [2010/06/01 14:53:46 | 001,093,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010/04/22 17:16:46 | 000,128,296 | ---- | M] (Synaptics Incorporated) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2010/03/21 15:18:50 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009/12/24 09:55:22 | 001,732,960 | ---- | M] (Diskeeper Corporation) -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
PRC - [2009/07/29 10:43:34 | 000,163,840 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
PRC - [2009/07/29 10:42:32 | 000,221,184 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
PRC - [2009/07/29 10:42:28 | 000,098,304 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
PRC - [2009/07/29 10:40:40 | 000,425,984 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
PRC - [2009/07/24 16:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2009/07/08 20:28:42 | 000,365,872 | ---- | M] (Boingo Wireless, Inc.) -- C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
PRC - [2008/10/20 11:36:40 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- c:\Program Files\Lenovo\System Update\SUService.exe
PRC - [2008/09/25 01:47:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe
PRC - [2008/08/08 15:37:04 | 000,041,248 | ---- | M] (Lenovo) -- C:\WINDOWS\system32\ibmpmsvc.exe
PRC - [2008/07/11 10:48:00 | 000,260,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
PRC - [2008/06/13 17:42:54 | 000,779,576 | ---- | M] (Lenovo) -- C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
PRC - [2008/06/13 17:29:44 | 000,746,808 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
PRC - [2008/05/14 16:42:30 | 001,155,072 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
PRC - [2008/05/14 16:32:28 | 000,950,272 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
PRC - [2008/05/14 16:25:12 | 000,520,192 | ---- | M] () -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
PRC - [2008/05/14 16:21:16 | 000,037,416 | ---- | M] (Lenovo.) -- C:\WINDOWS\system32\TPHDEXLG.exe
PRC - [2008/05/14 16:09:34 | 000,022,016 | ---- | M] () -- C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
PRC - [2008/04/25 16:38:34 | 000,128,368 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\ZOOM\TpScrex.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/24 14:41:22 | 000,067,432 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2008/03/24 10:15:04 | 000,068,464 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2008/03/11 16:13:08 | 000,788,332 | ---- | M] () -- C:\Program Files\Digsby\lib\aspell\bin\aspell.exe
PRC - [2007/11/19 16:00:38 | 000,794,624 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2007/11/19 15:40:08 | 001,183,744 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2007/11/19 15:35:46 | 000,483,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2007/09/25 04:10:50 | 002,007,088 | ---- | M] (FlashGet.com) -- C:\Program Files\FlashGet\flashget.exe
PRC - [2007/01/30 13:05:02 | 000,108,080 | ---- | M] (Lenovo Group Limited) -- C:\WINDOWS\system32\IPSSVC.EXE
PRC - [2006/11/01 22:15:50 | 000,537,480 | ---- | M] ( ) -- C:\WINDOWS\system32\dlcfcoms.exe
PRC - [2006/06/29 22:57:50 | 000,032,768 | ---- | M] () -- C:\WINDOWS\system32\TpKmpSvc.exe
PRC - [2006/03/03 21:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2005/11/01 19:04:02 | 000,258,103 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

========== Modules (SafeList) ==========

MOD - [2010/07/04 04:40:57 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James Dorritie\Desktop\OTL.exe
MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
MOD - [2008/03/13 18:46:24 | 000,079,224 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\HKVOLKEY.dll
MOD - [2007/05/18 12:13:08 | 000,053,329 | ---- | M] (www.flashget.com) -- C:\Program Files\FlashGet\fgmgr.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV - [2009/12/24 09:55:22 | 001,732,960 | ---- | M] (Diskeeper Corporation) [Auto | Running] -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe -- (Diskeeper)
SRV - [2009/07/29 10:42:32 | 000,221,184 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe -- (AcSvc)
SRV - [2009/07/29 10:42:28 | 000,098,304 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)
SRV - [2009/07/24 16:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2008/10/20 11:36:40 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- c:\Program Files\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2008/09/25 01:47:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
SRV - [2008/08/08 15:37:04 | 000,041,248 | ---- | M] (Lenovo) [Auto | Running] -- C:\WINDOWS\system32\ibmpmsvc.exe -- (IBMPMSVC)
SRV - [2008/07/11 10:48:00 | 000,260,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe -- (TVT_UpdateMonitor)
SRV - [2008/06/13 17:42:54 | 000,779,576 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe -- (TSSCoreService)
SRV - [2008/06/13 17:29:44 | 000,746,808 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service)
SRV - [2008/05/14 16:42:30 | 001,155,072 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe -- (TVT Scheduler)
SRV - [2008/05/14 16:32:28 | 000,950,272 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe -- (TVT Backup Service)
SRV - [2008/05/14 16:25:12 | 000,520,192 | ---- | M] () [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe -- (TVT Backup Protection Service)
SRV - [2008/05/14 16:21:16 | 000,037,416 | ---- | M] (Lenovo.) [Auto | Running] -- C:\WINDOWS\system32\TPHDEXLG.exe -- (TPHDEXLGSVC)
SRV - [2007/11/19 16:00:38 | 000,794,624 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng) Intel(R)
SRV - [2007/11/19 15:40:08 | 001,183,744 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor) Intel(R)
SRV - [2007/11/19 15:35:46 | 000,483,328 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc) Intel(R)
SRV - [2007/01/30 13:05:02 | 000,108,080 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\WINDOWS\system32\IPSSVC.EXE -- (IPSSVC)
SRV - [2006/11/01 22:15:50 | 000,537,480 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\dlcfcoms.exe -- (dlcf_device)
SRV - [2006/06/29 22:57:50 | 000,032,768 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\TpKmpSvc.exe -- (TpKmpSVC)
SRV - [2006/03/03 21:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2005/11/01 19:04:02 | 000,258,103 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe -- (btwdins)

========== Driver Services (SafeList) ==========

DRV - [2010/06/07 13:15:12 | 000,013,696 | ---- | M] (Skyhook Wireless) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\wpsnuio.sys -- (Wpsnuio)
DRV - [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/04/22 17:17:40 | 000,244,784 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2010/03/25 21:30:22 | 000,151,216 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MpFilter.sys -- (MpFilter)
DRV - [2009/12/10 15:48:40 | 000,041,504 | ---- | M] (Diskeeper Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\DKRtWrt.sys -- (DKRtWrt)
DRV - [2009/07/24 16:05:24 | 000,030,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2009/07/21 21:45:30 | 000,011,520 | ---- | M] (IBM Corp.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ANC.sys -- (ANC)
DRV - [2009/07/21 21:45:30 | 000,004,224 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\IBMBLDID.sys -- (IBMTPCHK)
DRV - [2008/10/23 18:39:33 | 000,033,536 | ---- | M] (Lenovo) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tvtfilter.sys -- (tvtfilter)
DRV - [2008/10/23 18:38:55 | 000,030,144 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\psadd.sys -- (psadd)
DRV - [2008/10/01 22:51:23 | 000,716,272 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008/09/25 01:47:00 | 000,004,442 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TPPWRIF.SYS -- (TPPWRIF)
DRV - [2008/08/08 15:36:26 | 000,023,720 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ibmpmdrv.sys -- (IBMPMDRV)
DRV - [2008/07/31 04:01:00 | 000,004,608 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TSMAPIP.SYS -- (TSMAPIP)
DRV - [2008/07/22 15:33:02 | 000,319,000 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2008/05/14 16:21:16 | 000,114,728 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\Apsx86.sys -- (Shockprf)
DRV - [2008/05/14 16:21:16 | 000,019,496 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ApsHM86.sys -- (TPDIGIMN)
DRV - [2008/05/12 22:14:16 | 000,017,844 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TPHKDRV.sys -- (TPHKDRV)
DRV - [2008/05/09 05:50:48 | 000,046,144 | ---- | M] (Lenovo) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tvtumon.sys -- (tvtumon)
DRV - [2008/04/24 09:56:22 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PCASp50.sys -- (PCASp50)
DRV - [2008/04/13 15:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 14:54:36 | 000,028,672 | ---- | M] (National Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nscirda.sys -- (NSCIRDA)
DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008/04/13 14:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 14:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/02/22 16:54:40 | 000,037,312 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tvti2c.sys -- (TVTI2C)
DRV - [2008/02/15 13:12:06 | 005,854,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2007/11/27 00:37:00 | 002,236,544 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel(R)
DRV - [2007/11/20 17:39:56 | 000,012,288 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2007/11/01 17:26:36 | 000,989,696 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2007/11/01 17:25:32 | 000,211,456 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2007/11/01 17:25:22 | 000,731,520 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2007/10/12 17:30:46 | 000,252,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1e5132.sys -- (e1express) Intel(R)
DRV - [2007/09/03 22:44:20 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mcstrm.sys -- (MCSTRM)
DRV - [2007/08/14 16:46:36 | 000,010,896 | ---- | M] (UPEK Inc.) [Kernel | Auto | Running] -- C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys -- (smihlp2) SMI Helper Driver (smihlp2)
DRV - [2007/08/14 16:25:52 | 000,047,376 | ---- | M] (UPEK Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tcusb.sys -- (TcUsb)
DRV - [2006/11/06 18:24:56 | 000,012,080 | ---- | M] (Lenovo Group Limited) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PROCDD.SYS -- (PROCDD)
DRV - [2006/10/02 02:55:00 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SMAPINT.SYS -- (Smapint)
DRV - [2006/10/02 02:55:00 | 000,009,343 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TDSMAPI.SYS -- (TDSMAPI)
DRV - [2006/06/20 12:56:48 | 000,178,688 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV - [2005/12/06 15:20:48 | 000,192,512 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hsxhwazl.sys -- (HSXHWAZL)
DRV - [2005/12/05 04:55:30 | 001,428,096 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel(R)
DRV - [2005/11/01 18:55:22 | 000,401,664 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2005/11/01 18:53:14 | 001,342,122 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2005/11/01 18:51:34 | 000,030,363 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2005/11/01 18:51:06 | 000,056,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2005/11/01 18:48:00 | 000,148,040 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2005/05/17 11:20:08 | 000,015,872 | ---- | M] (Atmel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atmeltpm.sys -- (atmeltpm)
DRV - [2004/08/04 09:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [2004/08/04 02:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2003/07/29 10:00:00 | 000,007,140 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\cvintdrv.sys -- (cvintdrv)
DRV - [2001/12/19 11:45:00 | 000,008,576 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\VCdRom.sys -- (vcdrom)
DRV - [2001/08/17 18:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 18:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 18:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 18:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 18:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 17:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 17:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 17:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 17:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 17:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 17:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 17:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 17:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 17:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 17:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 16:20:04 | 000,096,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Intel(r) 82801 Audio Driver Install Service (WDM)
DRV - [2001/08/17 14:48:14 | 000,011,520 | ---- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TwoTrack.sys -- (TwoTrack)
DRV - [2000/06/01 16:29:54 | 000,007,012 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PMEMNT.SYS -- (PMEM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore =
IE - HKCU\..\URLSearchHook: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://my.yahoo.com/ "
FF - prefs.js..extensions.enabledItems: aboutme@test.mozilla.com:0.4.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.8
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.27
FF - prefs.js..extensions.enabledItems: grwatcher@ajnasz.hu:1.2.2
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.%(version)s
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.1
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..keyword.URL: "http://bing.zugo.com/s/?src=FF-Address&site=Bing&cfg=2-79-0-1qruk&q= "

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/21 15:19:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/27 22:57:13 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/01 17:37:42 | 000,000,000 | ---D | M]

[2008/03/03 16:44:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Extensions
[2010/07/04 04:01:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions
[2010/07/04 04:00:47 | 000,000,000 | ---D | M] (FlashGot) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/06/20 19:45:31 | 000,000,000 | ---D | M] (Zynga Toolbar) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2010/07/03 01:45:41 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/06/28 19:23:53 | 000,000,000 | ---D | M] (Password Exporter) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}
[2010/05/14 00:32:18 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/05/14 00:32:17 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/05/31 01:15:59 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010/05/14 00:32:10 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009/09/14 21:40:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\aboutme@test.mozilla.com
[2009/11/11 16:06:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\firefox@tvunetworks.com
[2010/06/04 19:42:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\grwatcher@ajnasz.hu
[2009/01/15 01:46:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\translator@dontfollowme(2).net
[2010/05/03 22:59:22 | 000,002,571 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\amazon-search-suggestions.xml
[2010/05/08 14:06:02 | 000,000,445 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\b-ref-search.xml
[2010/06/23 07:14:49 | 000,002,267 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\bing-zugo.xml
[2008/06/24 12:08:28 | 000,000,908 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\imdb.xml
[2008/06/23 01:39:40 | 000,001,959 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\lastfm.xml
[2007/10/24 16:48:03 | 000,002,006 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\urban-dictionary.xml
[2008/06/23 11:28:28 | 000,001,108 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\wikipedia-en.xml
[2007/05/28 23:35:13 | 000,002,105 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\youtube-video-search.xml
[2010/07/04 03:20:36 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/01 17:37:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/01 17:37:27 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/05/11 17:41:00 | 000,200,704 | ---- | M] (Ancestry.com) -- C:\Program Files\Mozilla Firefox\plugins\npImgCtl.dll
[2005/12/05 23:31:00 | 000,114,688 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npmozax.dll
[2008/02/26 18:27:46 | 001,212,416 | ---- | M] (cedelia) -- C:\Program Files\Mozilla Firefox\plugins\NPStreamPlug.dll

O1 HOSTS File: ([2010/07/01 17:54:22 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (www.flashget.com)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)
O2 - BHO: (IePasswordManagerHelper Class) - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (www.flashget.com)
O2 - BHO: (TBSB05974 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Search Toolbar\tbcore3.dll File not found
O3 - HKLM\..\Toolbar: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Zynga Toolbar) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)
O4 - HKLM..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo )
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [Boingo Wi-Fi] C:\Program Files\Boingo\Boingo Wi-Fi\Boingo.lnk ()
O4 - HKLM..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\imekrmig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TP4EX] C:\WINDOWS\System32\TP4EX.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digsby.lnk = C:\Program Files\Digsby\digsby.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\JC_ALL.HTM ()
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\JC_LINK.HTM ()
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : Lenovo Password Manager... - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O15 - HKCU\..Trusted Domains: kuaiche.com ([software] http in Trusted sites)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.crucial.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 68.237.161.12
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\WINDOWS\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\psfus: DllName - C:\WINDOWS\system32\psqlpwd.dll - C:\WINDOWS\system32\psqlpwd.dll (UPEK Inc.)
O20 - Winlogon\Notify\tpfnf2: DllName - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll ()
O20 - Winlogon\Notify\tphotkey: DllName - C:\Program Files\Lenovo\HOTKEY\tphklock.dll - C:\Program Files\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited)
O24 - Desktop WallPaper: C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/12/22 06:50:02 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2004/08/09 14:40:04 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.divxa32 - C:\WINDOWS\System32\DivXa32.acm (Kristal StudioDFileDescription)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

JDorritie · 2010/07/04

OTL.txt (Part 2)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17183584330711040)

========== Files/Folders - Created Within 90 Days ==========

[2010/07/04 04:40:29 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\James Dorritie\Desktop\OTL.exe
[2010/07/03 02:28:05 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2010/07/03 02:27:30 | 000,165,160 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynTPAPI.dll
[2010/07/03 02:27:27 | 000,120,104 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynTPCo4.dll
[2010/07/03 02:27:26 | 000,244,784 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\drivers\SynTP.sys
[2010/07/03 02:27:26 | 000,173,352 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynCOM.dll
[2010/07/03 02:27:22 | 000,210,216 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynCtrl.dll
[2010/07/03 02:00:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Zynga
[2010/07/01 17:54:22 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/07/01 17:38:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/06/28 22:47:29 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/28 22:47:26 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/28 22:47:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/28 19:14:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\GoodSync
[2010/06/28 19:14:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Application Data\GoodSync
[2010/06/28 18:04:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\RoboForm
[2010/06/28 18:04:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\My Documents\My RoboForm Data
[2010/06/28 04:08:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\PCHealth
[2010/06/28 03:44:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Conduit
[2010/06/28 03:44:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga
[2010/06/28 02:40:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/06/28 02:40:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/06/27 20:45:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Apple Computer
[2010/06/24 18:45:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\cache
[2010/06/24 18:44:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\FullTiltPoker
[2010/06/24 11:01:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Adobe
[2010/06/23 23:23:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Conduit
[2010/06/23 23:23:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Mozilla
[2010/06/23 00:07:10 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/06/22 23:20:18 | 000,000,000 | ---D | C] -- C:\Program Files\CrazyPixels
[2010/06/22 23:08:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Application Data\ManyCam
[2010/06/20 19:35:21 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2010/06/20 19:35:13 | 000,000,000 | ---D | C] -- C:\Program Files\Zynga
[2010/06/07 13:15:12 | 000,013,696 | ---- | C] (Skyhook Wireless) -- C:\WINDOWS\System32\drivers\wpsnuio.sys
[2010/06/07 13:15:12 | 000,000,000 | ---D | C] -- C:\Program Files\Skyhook Wireless
[2010/06/07 13:15:07 | 000,000,000 | ---D | C] -- C:\Program Files\Boingo
[2010/06/07 13:15:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\GoBoingo
[2010/05/31 00:50:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Application Data\vlc
[2010/05/04 02:16:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Medieval Software
[2010/05/04 02:15:55 | 000,000,000 | ---D | C] -- C:\Program Files\Medieval Software
[2010/05/04 02:15:31 | 000,217,088 | ---- | C] (Medieval Software) -- C:\WINDOWS\System32\BlueCiucc.dll
[2010/04/18 22:23:26 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
[2006/10/11 18:01:40 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfpmui.dll
[2006/10/11 17:59:56 | 001,224,704 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfserv.dll
[2006/10/11 17:54:10 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfcomm.dll
[2006/10/11 17:52:34 | 000,585,728 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcflmpm.dll
[2006/10/11 17:51:16 | 000,397,312 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfiesc.dll
[2006/10/11 17:48:58 | 000,094,208 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfpplc.dll
[2006/10/11 17:48:14 | 000,684,032 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfcomc.dll
[2006/10/11 17:47:42 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfprox.dll
[2006/10/11 17:41:42 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfinpa.dll
[2006/10/11 17:41:04 | 000,991,232 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfusb1.dll
[2006/10/11 17:37:14 | 000,696,320 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfhbn3.dll

========== Files - Modified Within 90 Days ==========

[2010/07/04 13:40:11 | 000,000,318 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job
[2010/07/04 13:35:58 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3599169923-3658683049-1803797758-1005.job
[2010/07/04 13:35:58 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3599169923-3658683049-1803797758-1005.job
[2010/07/04 04:40:57 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James Dorritie\Desktop\OTL.exe
[2010/07/04 01:39:04 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/07/03 02:34:58 | 000,025,269 | ---- | M] () -- C:\WINDOWS\System32\PROCDB.INI
[2010/07/03 02:33:37 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/03 02:33:18 | 000,000,380 | ---- | M] () -- C:\WINDOWS\System32\IPSCtrl.INI
[2010/07/03 02:33:18 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/03 02:33:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/03 02:33:04 | 1600,573,440 | -HS- | M] () -- C:\hiberfil.sys
[2010/07/03 02:31:44 | 011,796,480 | ---- | M] () -- C:\Documents and Settings\James Dorritie\ntuser.dat
[2010/07/03 02:31:35 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\James Dorritie\ntuser.ini
[2010/07/03 02:29:10 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_SynTP_01009.Wdf
[2010/07/03 02:29:05 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/07/03 00:45:43 | 000,090,744 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/07/03 00:44:57 | 000,336,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/07/01 17:54:22 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2010/06/30 23:07:16 | 000,000,260 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/06/30 12:33:08 | 001,809,896 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\Photo0645.jpg
[2010/06/30 12:33:08 | 001,603,064 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\Photo0644.jpg
[2010/06/28 20:16:39 | 000,002,548 | ---- | M] () -- C:\config.xml
[2010/06/28 20:16:38 | 000,054,022 | ---- | M] () -- C:\WINDOWS\System32\RW_AppData.dat
[2010/06/28 20:16:38 | 000,014,032 | ---- | M] () -- C:\WINDOWS\System32\RW_FileType.dat
[2010/06/28 20:16:38 | 000,000,348 | ---- | M] () -- C:\WINDOWS\System32\RW_FileFlag.dat
[2010/06/28 20:16:38 | 000,000,056 | ---- | M] () -- C:\WINDOWS\System32\RW_{44214736-91A9-11DB-A2E8-806D6172696F}.dat
[2010/06/27 22:12:43 | 000,006,144 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/24 21:45:40 | 000,095,224 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\0624001057.jpg
[2010/06/24 21:45:40 | 000,064,415 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\0624001045.jpg
[2010/06/24 00:09:34 | 004,871,478 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\Video 2.wmv
[2010/06/24 00:09:24 | 003,862,782 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\Video 3.wmv
[2010/06/23 03:04:01 | 000,507,514 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/23 03:04:01 | 000,445,472 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/23 03:04:01 | 000,072,824 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/06/22 01:42:35 | 000,000,050 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\twittertmpwin.jpx
[2010/06/22 01:42:01 | 000,000,005 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\myspacetmpwin.jpx
[2010/06/15 18:00:37 | 091,129,818 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\67760.flv
[2010/06/09 03:26:34 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/06/09 03:24:50 | 000,000,708 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/06/07 13:15:12 | 000,013,696 | ---- | M] (Skyhook Wireless) -- C:\WINDOWS\System32\drivers\wpsnuio.sys
[2010/06/06 18:30:12 | 000,041,984 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\James Dorritie Resume.doc
[2010/05/31 21:58:23 | 000,025,088 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\James Dorritie Cover Letter.doc
[2010/05/29 20:10:33 | 000,025,088 | ---- | M] () -- C:\Documents and Settings\James Dorritie\My Documents\example coverletter.doc
[2010/05/16 13:47:38 | 015,613,701 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\LOST_616_audio_podcast_86afa0aa-338f-4c33-b030-8c83e06af538_2963901.mp3
[2010/05/04 02:15:31 | 000,217,088 | ---- | M] (Medieval Software) -- C:\WINDOWS\System32\BlueCiucc.dll
[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010/04/26 01:34:21 | 000,000,154 | ---- | M] () -- C:\WINDOWS\matlab.ini
[2010/04/22 17:17:40 | 000,244,784 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\drivers\SynTP.sys
[2010/04/22 17:16:14 | 000,120,104 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynTPCo4.dll
[2010/04/22 17:16:12 | 000,165,160 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynTPAPI.dll
[2010/04/22 17:16:10 | 000,210,216 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynCtrl.dll
[2010/04/22 17:16:08 | 000,173,352 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynCOM.dll
[2010/04/16 15:38:11 | 000,074,364 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/04/13 18:48:08 | 000,042,971 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\TaxReturn.pdf

========== Files Created - No Company Name ==========

[2010/07/03 02:29:10 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_SynTP_01009.Wdf
[2010/07/03 02:29:05 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/06/30 15:56:54 | 1600,573,440 | -HS- | C] () -- C:\hiberfil.sys
[2010/06/30 15:33:44 | 001,809,896 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\Photo0645.jpg
[2010/06/30 15:33:44 | 001,603,064 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\Photo0644.jpg
[2010/06/30 15:27:53 | 000,000,296 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3599169923-3658683049-1803797758-1005.job
[2010/06/28 22:49:16 | 000,000,408 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/06/28 20:16:39 | 000,002,548 | ---- | C] () -- C:\config.xml
[2010/06/28 20:16:38 | 000,054,022 | ---- | C] () -- C:\WINDOWS\System32\RW_AppData.dat
[2010/06/28 20:16:38 | 000,014,032 | ---- | C] () -- C:\WINDOWS\System32\RW_FileType.dat
[2010/06/28 20:16:38 | 000,000,348 | ---- | C] () -- C:\WINDOWS\System32\RW_FileFlag.dat
[2010/06/28 20:16:38 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\RW_{44214736-91A9-11DB-A2E8-806D6172696F}.dat
[2010/06/27 22:05:01 | 000,006,144 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/24 21:45:39 | 000,064,415 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\0624001045.jpg
[2010/06/24 21:45:31 | 000,095,224 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\0624001057.jpg
[2010/06/24 00:09:27 | 004,871,478 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\Video 2.wmv
[2010/06/24 00:09:16 | 003,862,782 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\Video 3.wmv
[2010/06/23 03:21:24 | 000,894,464 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/06/22 01:42:01 | 000,000,005 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Application Data\myspacetmpwin.jpx
[2010/06/22 01:41:53 | 000,000,050 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Application Data\twittertmpwin.jpx
[2010/06/15 18:00:37 | 091,129,818 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\67760.flv
[2010/05/29 20:18:27 | 000,025,088 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\James Dorritie Cover Letter.doc
[2010/05/29 19:48:29 | 000,025,088 | ---- | C] () -- C:\Documents and Settings\James Dorritie\My Documents\example coverletter.doc
[2010/05/22 18:53:03 | 000,041,984 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\James Dorritie Resume.doc
[2010/05/16 13:47:15 | 015,613,701 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\LOST_616_audio_podcast_86afa0aa-338f-4c33-b030-8c83e06af538_2963901.mp3
[2010/04/13 18:48:05 | 000,042,971 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\TaxReturn.pdf
[2010/02/09 12:19:35 | 000,000,025 | ---- | C] () -- C:\WINDOWS\libem.INI
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/03/17 22:21:26 | 000,006,850 | R--- | C] () -- C:\WINDOWS\Disktool.INI
[2009/03/17 22:21:26 | 000,005,633 | R--- | C] () -- C:\WINDOWS\fwupgrade.ini
[2009/03/17 22:21:26 | 000,003,677 | R--- | C] () -- C:\WINDOWS\PlaySnd.INI
[2009/01/18 01:18:18 | 000,000,050 | ---- | C] () -- C:\WINDOWS\MegaManager.INI
[2008/08/23 23:51:54 | 000,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.sys
[2008/04/28 03:31:33 | 000,408,576 | ---- | C] () -- C:\WINDOWS\System32\Smab.dll
[2008/04/28 03:31:32 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2008/04/28 00:59:29 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\AVERM.dll
[2008/04/27 12:19:08 | 000,000,067 | ---- | C] () -- C:\WINDOWS\My Video Converter.INI
[2008/04/13 06:02:50 | 000,000,815 | ---- | C] () -- C:\WINDOWS\entpack.ini
[2008/04/06 23:22:10 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2008/02/06 23:02:09 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSMAPIP.SYS
[2008/02/06 22:52:17 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4860.dll
[2008/01/04 15:13:58 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\DEVMAN.DLL
[2007/12/08 01:45:30 | 000,139,008 | ---- | C] () -- C:\WINDOWS\System32\guard32.dll
[2007/09/01 17:58:15 | 000,000,038 | ---- | C] () -- C:\WINDOWS\System32\winitn.dll
[2007/08/06 00:50:12 | 000,000,709 | ---- | C] () -- C:\WINDOWS\mp3rmconverter.ini
[2007/07/26 04:10:26 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2007/06/22 00:01:22 | 000,006,365 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/05/21 01:17:36 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2007/05/21 01:17:36 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2007/05/21 01:17:36 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2007/05/21 01:17:36 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2007/05/07 05:42:45 | 000,532,480 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll
[2007/02/09 22:33:24 | 000,716,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2007/01/30 18:21:25 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Graphing Calculator Viewer.INI
[2007/01/29 12:36:32 | 000,025,269 | ---- | C] () -- C:\WINDOWS\System32\PROCDB.INI
[2007/01/11 17:50:07 | 000,000,154 | ---- | C] () -- C:\WINDOWS\matlab.ini
[2006/12/27 15:27:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2006/12/25 20:17:04 | 000,000,629 | ---- | C] () -- C:\WINDOWS\RMAC.ini
[2006/12/23 09:29:44 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/12/22 07:03:24 | 000,002,481 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/12/22 07:00:35 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\notifyf2.dll
[2006/12/22 07:00:35 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\tphklock.dll
[2006/12/22 06:58:22 | 000,000,380 | ---- | C] () -- C:\WINDOWS\System32\IPSCtrl.INI
[2006/12/22 06:56:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2006/12/22 06:39:33 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/12/22 06:39:09 | 000,004,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2006/12/22 06:29:47 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys
[2006/12/22 06:29:21 | 000,000,722 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/12/22 06:17:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\FPCALL.dll
[2006/12/22 06:17:20 | 000,009,343 | ---- | C] () -- C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2006/12/22 06:04:20 | 000,000,488 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/10/28 10:31:44 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\dlcfcoin.dll
[2006/10/20 13:42:24 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dlcfinsr.dll
[2006/10/20 13:42:18 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dlcfcur.dll
[2006/10/20 13:41:46 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\dlcfjswr.dll
[2006/10/20 13:37:22 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\dlcfinsb.dll
[2006/10/20 13:37:16 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dlcfcub.dll
[2006/10/20 13:37:00 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\dlcfcu.dll
[2006/10/20 13:36:54 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\dlcfins.dll
[2006/10/20 13:35:36 | 000,434,176 | ---- | C] () -- C:\WINDOWS\System32\dlcfutil.dll
[2006/09/06 05:27:08 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\dlcfcfg.dll
[2006/05/16 02:25:43 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2005/11/16 10:15:04 | 000,164,112 | ---- | C] () -- C:\WINDOWS\System32\awmpi.dll
[2005/11/01 18:59:16 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2005/08/18 06:26:46 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlcfvs.dll
[2005/06/29 04:58:02 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/02/17 07:31:58 | 000,679,936 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2005/02/17 07:31:58 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2005/02/17 07:31:58 | 000,155,136 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2004/08/09 15:03:43 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2003/11/13 14:28:02 | 000,012,570 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2003/11/13 14:28:02 | 000,012,570 | ---- | C] () -- C:\WINDOWS\ADFUUD.SYS
[2003/07/29 10:00:00 | 000,007,140 | ---- | C] () -- C:\WINDOWS\System32\drivers\cvintdrv.sys
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/10/06 14:42:57 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2002/10/04 19:04:25 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2002/10/04 19:04:24 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2002/10/04 19:04:17 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2002/05/16 02:29:04 | 000,000,607 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2001/11/23 21:18:00 | 000,000,597 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001/11/14 16:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2010/02/09 20:31:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation
[2008/10/01 17:41:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\farstone
[2010/06/07 13:15:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GoBoingo
[2010/06/28 19:14:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GoodSync
[2008/08/27 05:27:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
[2008/05/18 21:39:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lenovo
[2008/05/06 12:06:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MediaMonkey
[2010/05/04 02:16:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Medieval Software
[2008/01/29 22:12:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/11/11 02:18:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2008/02/06 23:59:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC-Doctor
[2007/11/30 07:31:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\River Past G5
[2010/06/28 18:04:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RoboForm
[2010/06/22 23:59:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2008/02/07 00:02:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UIB
[2008/03/24 20:44:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\.gaim
[2009/12/30 00:38:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\.purple
[2008/08/10 04:03:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\.Tribler
[2007/01/18 21:47:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\acccore
[2007/01/18 21:56:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Aim
[2008/08/24 04:36:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Avaya
[2007/04/10 15:35:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\BitTorrent
[2008/07/11 00:06:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\BWMeterPro
[2007/09/02 16:00:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\COWON
[2010/02/09 20:17:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\FlashGet
[2009/10/02 16:40:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\FreeFLVConverter
[2010/02/09 10:42:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\FrostWire
[2007/06/29 15:49:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\GetRightToGo
[2010/07/03 02:00:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\GoodSync
[2008/10/08 19:31:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\GrabPro
[2009/09/22 00:15:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\gtk-2.0
[2006/12/22 06:27:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\IBM
[2007/10/13 10:23:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Image Zone Express
[2006/12/24 03:40:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\InterVideo
[2007/01/20 23:58:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Leadertech
[2008/01/18 02:11:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\LEAPS
[2008/08/23 23:43:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Lenovo
[2010/06/22 23:12:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\ManyCam
[2010/02/09 10:44:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Pamela
[2008/01/18 02:08:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Pegasys Inc
[2010/02/09 10:39:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Trillian
[2008/04/06 23:11:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\True Sword
[2009/09/18 01:05:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
[2009/11/13 14:47:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010/02/08 17:10:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\UDRuler
[2008/10/23 17:37:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Uniblue
[2010/06/27 22:35:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\uTorrent
[2006/12/31 17:46:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\WebRenderer
[2007/02/09 22:42:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\WhenU
[2010/07/04 01:39:04 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/07/04 13:40:11 | 000,000,318 | ---- | M] () -- C:\WINDOWS\Tasks\PMTask.job

========== Purity Check ==========

========== Custom Scans ==========

< >

< %SYSTEMDRIVE%\*.* >
[2008/03/15 18:05:09 | 000,001,024 | ---- | M] () -- C:\.rnd
[2006/12/22 06:50:02 | 000,000,000 | -H-- | M] () -- C:\AUTOEXEC.BAT
[2007/05/21 01:27:55 | 000,002,240 | ---- | M] () -- C:\avi_log.txt
[2007/09/22 15:51:32 | 000,000,194 | ---- | M] () -- C:\Boot.bak
[2010/02/09 01:53:38 | 000,000,264 | RHS- | M] () -- C:\BOOT.INI
[2006/12/22 06:35:22 | 000,000,000 | -H-- | M] () -- C:\BOOTLOG.PRV
[2006/12/22 06:40:24 | 000,000,000 | -H-- | M] () -- C:\BOOTLOG.TXT
[2004/08/09 14:35:38 | 000,000,512 | -HS- | M] () -- C:\BOOTSECT.DOS
[2004/08/04 00:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2006/12/22 06:50:02 | 000,000,000 | -H-- | M] () -- C:\CONFIG.SYS
[2010/06/28 20:16:39 | 000,002,548 | ---- | M] () -- C:\config.xml
[2007/03/25 20:12:35 | 000,000,069 | ---- | M] () -- C:\dlcfpswx.log
[2006/12/22 06:30:12 | 000,002,416 | ---- | M] () -- C:\drivez.log
[2008/08/28 00:59:53 | 000,000,120 | ---- | M] () -- C:\drmHeader.bin
[2010/07/03 02:33:04 | 1600,573,440 | -HS- | M] () -- C:\hiberfil.sys
[2006/12/22 06:33:26 | 003,892,152 | ---- | M] () -- C:\install.log
[2006/12/31 17:34:42 | 000,026,023 | ---- | M] () -- C:\installer_debug.txt
[2008/10/01 17:03:21 | 000,000,261 | ---- | M] () -- C:\inVHDDrvLog.dat
[2006/12/22 06:50:03 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2007/01/18 21:47:13 | 000,002,074 | -H-- | M] () -- C:\IPH.PH
[2010/07/04 00:00:38 | 000,022,964 | ---- | M] () -- C:\Log.txt
[2008/04/06 23:12:29 | 000,000,000 | ---- | M] () -- C:\log1.txt
[2008/04/06 23:12:29 | 000,000,000 | ---- | M] () -- C:\log2.txt
[2009/03/10 00:10:11 | 000,000,277 | ---- | M] () -- C:\m.txt
[2010/02/12 00:50:19 | 000,030,902 | ---- | M] () -- C:\MP4debug.log
[2006/12/23 09:46:57 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 09:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/08/30 23:43:41 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2008/10/26 01:25:29 | 000,008,192 | ---- | M] () -- C:\ntuser.dat
[2010/06/23 03:21:31 | 000,001,024 | -H-- | M] () -- C:\ntuser.dat.LOG
[2010/07/03 02:33:03 | 1073,741,824 | -HS- | M] () -- C:\pagefile.sys
[2010/06/27 22:38:39 | 000,000,387 | ---- | M] () -- C:\rkill.log
[2010/02/09 11:05:47 | 000,008,192 | ---- | M] () -- C:\s-1-5-21-3599169923-3658683049-1803797758-1006.rrr
[2008/10/26 01:25:54 | 000,000,000 | -H-- | M] () -- C:\S-1-5-21-3599169923-3658683049-1803797758-1006.rrr.LOG
[2008/04/30 02:50:49 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2008/04/30 02:53:22 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2008/04/30 02:50:49 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2008/04/30 02:53:22 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2010/07/04 00:00:39 | 012,501,807 | ---- | M] () -- C:\sysiclog.txt
[2006/12/22 06:27:16 | 000,001,505 | ---- | M] () -- C:\SYSLEVEL.IBM
[2006/12/22 07:02:20 | 000,000,044 | ---- | M] () -- C:\TCPACHIP.LOG
[2008/03/23 16:04:10 | 000,000,156 | ---- | M] () -- C:\TPHKLOCK.TXT
[2006/06/19 17:08:17 | 000,000,054 | ---- | M] () -- C:\ut.bat
[2006/06/21 23:03:22 | 000,000,056 | ---- | M] () -- C:\ut9x.bat

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2006/10/20 04:39:34 | 000,118,272 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\dlcfPP5C.DLL
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/06/03 22:29:06 | 000,076,288 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp4pi.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2004/08/09 14:45:10 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/09 14:45:10 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/09 14:45:10 | 000,876,544 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/13 20:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/13 20:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/13 20:12:10 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

JDorritie · 2010/07/04

Extras.txt

OTL Extras logfile created on: 7/4/2010 1:36:52 PM - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\James Dorritie\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): C:\pagefile.sys 1024 1024 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 49.64 Gb Total Space | 29.68 Gb Free Space | 59.80% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JIMMY
Current User Name: James Dorritie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*:Enabledxpsp2res.dll,-22009
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe" = C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Documents and Settings\James Dorritie\My Documents\utorrent.exe" = C:\Documents and Settings\James Dorritie\My Documents\utorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\WINDOWS\system32\java.exe" = C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\MATLAB_SV71\bin\win32\MATLAB.exe" = C:\Program Files\MATLAB_SV71\bin\win32\MATLAB.exe:*:Enabled:MATLAB -- (The MathWorks Inc.)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll" = C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin -- (Google)
"C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)
"C:\Program Files\Digsby\lib\digsby-app.exe" = C:\Program Files\Digsby\lib\digsby-app.exe:*:Enabledigsby IM -- (dotSyntax, LLC)
"C:\Program Files\Microsoft LifeCam\LifeCam.exe" = C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe -- (Microsoft Corporation)
"C:\Program Files\Microsoft LifeCam\LifeEnC2.exe" = C:\Program Files\Microsoft LifeCam\LifeEnC2.exe:*:Enabled:LifeEnC2.exe -- (Microsoft Corporation)
"C:\Program Files\Microsoft LifeCam\LifeExp.exe" = C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe -- (Microsoft Corporation)
"C:\Program Files\Microsoft LifeCam\LifeTray.exe" = C:\Program Files\Microsoft LifeCam\LifeTray.exe:*:Enabled:LifeTray.exe -- (Microsoft Corporation)
"C:\Program Files\FlashGet\flashget.exe" = C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget -- (FlashGet.com)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0AD84416-63A4-4CF3-BDDF-8FA866711FB0}" = Civilization III
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1297C681-92D7-40EF-93BF-03F66EC5105C}" = ThinkPad EasyEject Utility
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{17CBC505-D1AE-459D-B445-3D2000A85842}" = ThinkPad UltraNav Utility
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{2111B23F-7FDA-4A41-8309-E5A1663CA296}" = ThinkPad Keyboard Customizer Utility
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{235C31BC-BBAE-4932-9F17-15395C65907B}" = Boingo Wi-Fi
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36C97B5B-5593-45B8-B50E-DAD87036BD9D}" = Microsoft LifeCam
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = ThinkPad Bluetooth with Enhanced Data Rate Software
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{44E9D4C2-946C-4378-9354-558803C47A68}" = Client Security - Password Manager
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage Active Protection System
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5299C5E1-70F9-3D1D-A1FA-BDECA4EC8015}" = Google Talk Plugin
"{5BBFB0E4-2250-49C3-A8A3-65BE2197D13B}" = MP3 Player Utilities
"{65706020-7B6F-41F2-8047-FC69579E386A}" = Presentation Director
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7EB114D8-207F-45AE-BABD-1669715F2630}" = ThinkVantage Access Connections
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{82512BC9-BD5D-4C50-BE4D-B98E7DF78687}" = ThinkPad UltraNav Wizard
"{83E5FE05-31F4-FA91-BB29-3D987008BA49}" = TweetDeck
"{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update
"{868F24EB-5CA7-4285-B39B-3617CF37462A}" = D2300_Help
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{981FAFFC-35E9-42E0-9C58-9AADE646F92A}" = Diskeeper 2010
"{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center
"{A0E64EBA-8BF0-49FB-90C0-BB3D781A2016}" = ThinkPad Power Manager
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2289997-10A3-48F2-AA03-99180D761661}" = ThinkVantage Fingerprint Software 5.6
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B19F9155-9337-4807-B5EF-ED471DDB2CCE}" = hph_software_req
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C54ED2B6-1AF2-416F-BBA8-5E2B8CDCB5C4}" = XP Themes
"{C6FA39A7-26B1-480A-BC74-6D17531AC222}" = Access Help
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF5737AF-8550-4546-A69B-0EA9EF5A9B55}" = ThinkVantage Productivity Center
"{CFADE4AF-C0CF-4A04-A776-741318F1658F}" = Content Transfer
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1AE6D4D-C37A-487d-83D8-C333125B2459}" = HP Photosmart and Deskjet 7.0 Software
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D728E945-256D-4477-B377-6BBA693714AC}" = Productivity Center Supplement for ThinkPad
"{D75BB2DA-5078-4922-81CD-17736A2D888B}" = Bluetooth OBEX File Transfer
"{E33956B7-301C-429D-9E6C-2C12EACB8A62}" = NWZ-E340 WALKMAN Guide
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}" = Message Center
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{E922961C-6DB6-41DE-9FEA-426DF3E9F81C}" = IBM 32-bit Runtime Environment for Java 2, v1.4.2
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{EA664480-3844-11D5-8C25-444553540000}" = TrackPoint Accessibility Features
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F151F2B3-0C32-44D3-90E2-E639B8024622}" = Rescue and Recovery
"{F386C340-DF4B-4BBA-9503-420FB7EDB395}" = Wallpapers
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F564454D-DEBE-0CCE-93C3-FD8DEB975100}" = MyFonts Order M1870694
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F705E3E1-A471-426B-9A09-73429F3418EE}" = System Migration Assistant
"{FC081D4D-DF1B-4CF1-B530-027E4118D846}" = ThinkPad Configuration
"{FC5495CB-CDA5-4DCE-99DF-D1567DAF5A86}" = TMPGEnc 4.0 XPress
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"AC3Filter" = AC3Filter (remove only)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Audacity_is1" = Audacity 1.2.6
"AwayTask" = Maintenance Manager
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10140588" = ThinkPad Modem
"Cool's_Codec_pack_4.12" = Codec Pack - All In 1 6.0.2.7
"DefilerPak" = DefilerPak 1.19 (Remove Only)
"Digsby" = Digsby
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"filehippo.com" = FileHippo.com Update Checker
"FlashGet" = FlashGet 1.9.6.1073
"FlashGet(JetCar)" = FlashGet(JetCar)
"Free FLV Converter_is1" = Free FLV Converter V 6.7
"GTK 2.0" = GTK+ Runtime 2.14.7 rev a (remove only)
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{E922961C-6DB6-41DE-9FEA-426DF3E9F81C}" = IBM 32-bit Runtime Environment for Java 2, v1.4.2
"LastFM_is1" = Last.fm 1.5.2.38918
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MatlabR14SP3" = MATLAB Student 7.1
"MediaMonkey_is1" = MediaMonkey 3.2
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Essentials" = Microsoft Security Essentials
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OnScreenDisplay" = On Screen Display
"PC-Doctor 5 for Windows" = PC-Doctor 5 for Windows
"PCMCIAPW" = ThinkPad PC Card Power Policy
"PeerGuardian_is1" = PeerGuardian 2.0
"Power Management Driver" = ThinkPad Power Management Driver
"ProInst" = Intel(R) PROSet/Wireless Software
"PROSet" = Intel(R) PRO Network Connections Drivers
"qt7lite_is1" = QT Lite 2.7.0
"RealPlayer 12.0" = RealPlayer
"Registry Mechanic_is1" = Registry Mechanic 8.0
"Revo Uninstaller" = Revo Uninstaller 1.85
"Skyhook Wireless Wi-Fi Service" = Skyhook Wireless Wi-Fi Service
"Speed Reader - X" = Speed Reader - X 5.0.20
"SynTPDeinstKey" = ThinkPad UltraNav Driver
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1" = TweetDeck
"TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1" = TweetDeck
"Unlocker" = Unlocker 1.8.8
"Video Convert Master_is1" = Video Convert Master v6.0
"VLC media player" = VLC media player 1.0.5
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yuvutu Video Downloader_is1" = Yuvutu Video Downloader 3.16
"Zynga Toolbar" = Zynga Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FlashMute" = FlashMute
"Google Chrome" = Google Chrome
"Move Media Player" = Move Media Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/1/2010 5:50:16 PM | Computer Name = JIMMY | Source = Application Error | ID = 1000
Description = Faulting application AcSvc.exe, version 5.3.3.41, faulting module
PfMgrApi.dll, version 11.5.0.2, fault address 0x0009abe4.

Error - 7/1/2010 6:10:42 PM | Computer Name = JIMMY | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 7/3/2010 12:57:11 AM | Computer Name = JIMMY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 2.1.6805.0, P3 timeout, P4 1.1.5902.0, P5 local, P6 unspecified, P7 unspecified,
P8 NIL, P9 NIL, P10 NIL.

Error - 7/3/2010 12:57:16 AM | Computer Name = JIMMY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 2152759331, P2 unspecified, P3 scanfile,
P4 2.1.6805.0, P5 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

Error - 7/4/2010 1:44:57 AM | Computer Name = JIMMY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 2.1.6805.0, P3 timeout, P4 1.1.5902.0, P5 local, P6 unspecified, P7 unspecified,
P8 NIL, P9 NIL, P10 NIL.

Error - 7/4/2010 1:45:04 AM | Computer Name = JIMMY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 2.1.6805.0, P3 timeout, P4 1.1.5902.0, P5 local, P6 unspecified, P7 unspecified,
P8 NIL, P9 NIL, P10 NIL.

Error - 7/4/2010 1:45:07 AM | Computer Name = JIMMY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 2.1.6805.0, P3 timeout, P4 1.1.5902.0, P5 local, P6 unspecified, P7 unspecified,
P8 NIL, P9 NIL, P10 NIL.

Error - 7/4/2010 1:45:10 AM | Computer Name = JIMMY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 2.1.6805.0, P3 timeout, P4 1.1.5902.0, P5 local, P6 unspecified, P7 unspecified,
P8 NIL, P9 NIL, P10 NIL.

Error - 7/4/2010 1:45:12 AM | Computer Name = JIMMY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 2.1.6805.0, P3 passthrough, P4 1.1.5902.0, P5 local, P6 unspecified, P7 unspecified,
P8 NIL, P9 NIL, P10 NIL.

Error - 7/4/2010 1:45:13 AM | Computer Name = JIMMY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 2152759331, P2 unspecified, P3 scanfile,
P4 2.1.6805.0, P5 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

[ System Events ]
Error - 7/3/2010 4:18:25 AM | Computer Name = JIMMY | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 120 minutes. NtpClient has no source of accurate
time.

Error - 7/3/2010 6:18:26 AM | Computer Name = JIMMY | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer ',0x1'. NtpClient will try the DNS lookup again in 240 minutes.
The
error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error - 7/3/2010 6:18:26 AM | Computer Name = JIMMY | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 240 minutes. NtpClient has no source of accurate
time.

Error - 7/3/2010 10:18:26 AM | Computer Name = JIMMY | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer ',0x1'. NtpClient will try the DNS lookup again in 480 minutes.
The
error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error - 7/3/2010 10:18:26 AM | Computer Name = JIMMY | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 480 minutes. NtpClient has no source of accurate
time.

Error - 7/3/2010 6:18:26 PM | Computer Name = JIMMY | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer ',0x1'. NtpClient will try the DNS lookup again in 960 minutes.
The
error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error - 7/3/2010 6:18:26 PM | Computer Name = JIMMY | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 960 minutes. NtpClient has no source of accurate
time.

Error - 7/4/2010 1:42:51 AM | Computer Name = JIMMY | Source = Microsoft Antimalware | ID = 3002
Description = %%861 Real-Time Protection feature has encountered an error and failed.

Feature:
%%834 Error Code: 0x80004005 Error description: Unspecified error Reason: %%838

Error - 7/4/2010 10:18:28 AM | Computer Name = JIMMY | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer ',0x1'. NtpClient will try the DNS lookup again in 960 minutes.
The
error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error - 7/4/2010 10:18:28 AM | Computer Name = JIMMY | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 960 minutes. NtpClient has no source of accurate
time.

< End of report >

broni · 2010/07/04

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
FF - prefs.js..keyword.URL:  "http://bing.zugo.com/s/?src=FF-Address&site=Bing&cfg=2-79-0-1qruk&q= "

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.

Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

JDorritie · 2010/07/04

Results of the fix:

All processes killed
========== OTL ==========
Prefs.js: "http://bing.zugo.com/s/?src=FF-Address&site=Bing&cfg=2-79-0-1qruk&q=" removed from keyword.URL
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: James Dorritie
->Temp folder emptied: 109671083 bytes
->Temporary Internet Files folder emptied: 1200631 bytes
->Java cache emptied: 128094 bytes
->FireFox cache emptied: 121193512 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 119155 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33614 bytes

User: NetworkService
->Temp folder emptied: 27202 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 64530 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 271823835 bytes

Total Files Cleaned = 481.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: James Dorritie
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.7.0 log created on 07042010_143901

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

broni · 2010/07/04

Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Click to expand...

.....

JDorritie · 2010/07/04

OTL.txt Part 1/2

OTL logfile created on: 7/4/2010 2:48:12 PM - Run 2
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\James Dorritie\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 1024 1024 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 49.64 Gb Total Space | 30.10 Gb Free Space | 60.65% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JIMMY
Current User Name: James Dorritie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/04 04:40:57 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James Dorritie\Desktop\OTL.exe
PRC - [2010/06/27 22:57:01 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/06/01 14:53:46 | 001,093,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010/04/29 15:39:32 | 000,437,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2010/04/22 17:16:46 | 000,128,296 | ---- | M] (Synaptics Incorporated) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2010/03/21 15:18:50 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009/12/24 09:55:22 | 001,732,960 | ---- | M] (Diskeeper Corporation) -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
PRC - [2009/07/29 10:43:34 | 000,163,840 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
PRC - [2009/07/29 10:42:32 | 000,221,184 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
PRC - [2009/07/29 10:42:28 | 000,098,304 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
PRC - [2009/07/29 10:40:40 | 000,425,984 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
PRC - [2009/07/24 16:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2009/07/08 20:28:42 | 000,365,872 | ---- | M] (Boingo Wireless, Inc.) -- C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
PRC - [2008/10/20 11:36:40 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- c:\Program Files\Lenovo\System Update\SUService.exe
PRC - [2008/09/25 01:47:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe
PRC - [2008/08/08 15:37:04 | 000,041,248 | ---- | M] (Lenovo) -- C:\WINDOWS\system32\ibmpmsvc.exe
PRC - [2008/07/11 10:48:00 | 000,260,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
PRC - [2008/06/13 17:42:54 | 000,779,576 | ---- | M] (Lenovo) -- C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
PRC - [2008/06/13 17:29:44 | 000,746,808 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
PRC - [2008/05/14 16:42:30 | 001,155,072 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
PRC - [2008/05/14 16:32:28 | 000,950,272 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
PRC - [2008/05/14 16:25:12 | 000,520,192 | ---- | M] () -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
PRC - [2008/05/14 16:21:16 | 000,037,416 | ---- | M] (Lenovo.) -- C:\WINDOWS\system32\TPHDEXLG.exe
PRC - [2008/05/14 16:09:34 | 000,022,016 | ---- | M] () -- C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
PRC - [2008/04/25 16:38:34 | 000,128,368 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\ZOOM\TpScrex.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/24 14:41:22 | 000,067,432 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2008/03/24 10:15:04 | 000,068,464 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2007/11/19 16:00:38 | 000,794,624 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2007/11/19 15:40:08 | 001,183,744 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2007/11/19 15:35:46 | 000,483,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2007/01/30 13:05:02 | 000,108,080 | ---- | M] (Lenovo Group Limited) -- C:\WINDOWS\system32\IPSSVC.EXE
PRC - [2006/11/01 22:15:50 | 000,537,480 | ---- | M] ( ) -- C:\WINDOWS\system32\dlcfcoms.exe
PRC - [2006/07/04 04:05:00 | 000,225,280 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.exe
PRC - [2006/06/29 22:57:50 | 000,032,768 | ---- | M] () -- C:\WINDOWS\system32\TpKmpSvc.exe
PRC - [2006/03/03 21:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2005/11/01 19:04:02 | 000,258,103 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

========== Modules (SafeList) ==========

MOD - [2010/07/04 04:40:57 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James Dorritie\Desktop\OTL.exe
MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV - [2009/12/24 09:55:22 | 001,732,960 | ---- | M] (Diskeeper Corporation) [Auto | Running] -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe -- (Diskeeper)
SRV - [2009/07/29 10:42:32 | 000,221,184 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe -- (AcSvc)
SRV - [2009/07/29 10:42:28 | 000,098,304 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)
SRV - [2009/07/24 16:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2008/10/20 11:36:40 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- c:\Program Files\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2008/09/25 01:47:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
SRV - [2008/08/08 15:37:04 | 000,041,248 | ---- | M] (Lenovo) [Auto | Running] -- C:\WINDOWS\system32\ibmpmsvc.exe -- (IBMPMSVC)
SRV - [2008/07/11 10:48:00 | 000,260,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe -- (TVT_UpdateMonitor)
SRV - [2008/06/13 17:42:54 | 000,779,576 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe -- (TSSCoreService)
SRV - [2008/06/13 17:29:44 | 000,746,808 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service)
SRV - [2008/05/14 16:42:30 | 001,155,072 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe -- (TVT Scheduler)
SRV - [2008/05/14 16:32:28 | 000,950,272 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe -- (TVT Backup Service)
SRV - [2008/05/14 16:25:12 | 000,520,192 | ---- | M] () [Auto | Running] -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe -- (TVT Backup Protection Service)
SRV - [2008/05/14 16:21:16 | 000,037,416 | ---- | M] (Lenovo.) [Auto | Running] -- C:\WINDOWS\system32\TPHDEXLG.exe -- (TPHDEXLGSVC)
SRV - [2007/11/19 16:00:38 | 000,794,624 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng) Intel(R)
SRV - [2007/11/19 15:40:08 | 001,183,744 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor) Intel(R)
SRV - [2007/11/19 15:35:46 | 000,483,328 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc) Intel(R)
SRV - [2007/01/30 13:05:02 | 000,108,080 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\WINDOWS\system32\IPSSVC.EXE -- (IPSSVC)
SRV - [2006/11/01 22:15:50 | 000,537,480 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\dlcfcoms.exe -- (dlcf_device)
SRV - [2006/06/29 22:57:50 | 000,032,768 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\TpKmpSvc.exe -- (TpKmpSVC)
SRV - [2006/03/03 21:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2005/11/01 19:04:02 | 000,258,103 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe -- (btwdins)

========== Driver Services (SafeList) ==========

DRV - [2010/06/07 13:15:12 | 000,013,696 | ---- | M] (Skyhook Wireless) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\wpsnuio.sys -- (Wpsnuio)
DRV - [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/04/22 17:17:40 | 000,244,784 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2010/03/25 21:30:22 | 000,151,216 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MpFilter.sys -- (MpFilter)
DRV - [2009/12/10 15:48:40 | 000,041,504 | ---- | M] (Diskeeper Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\DKRtWrt.sys -- (DKRtWrt)
DRV - [2009/07/24 16:05:24 | 000,030,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2009/07/21 21:45:30 | 000,011,520 | ---- | M] (IBM Corp.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ANC.sys -- (ANC)
DRV - [2009/07/21 21:45:30 | 000,004,224 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\IBMBLDID.sys -- (IBMTPCHK)
DRV - [2008/10/23 18:39:33 | 000,033,536 | ---- | M] (Lenovo) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tvtfilter.sys -- (tvtfilter)
DRV - [2008/10/23 18:38:55 | 000,030,144 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\psadd.sys -- (psadd)
DRV - [2008/10/01 22:51:23 | 000,716,272 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008/09/25 01:47:00 | 000,004,442 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TPPWRIF.SYS -- (TPPWRIF)
DRV - [2008/08/08 15:36:26 | 000,023,720 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ibmpmdrv.sys -- (IBMPMDRV)
DRV - [2008/07/31 04:01:00 | 000,004,608 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TSMAPIP.SYS -- (TSMAPIP)
DRV - [2008/07/22 15:33:02 | 000,319,000 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2008/05/14 16:21:16 | 000,114,728 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\Apsx86.sys -- (Shockprf)
DRV - [2008/05/14 16:21:16 | 000,019,496 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ApsHM86.sys -- (TPDIGIMN)
DRV - [2008/05/12 22:14:16 | 000,017,844 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TPHKDRV.sys -- (TPHKDRV)
DRV - [2008/05/09 05:50:48 | 000,046,144 | ---- | M] (Lenovo) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tvtumon.sys -- (tvtumon)
DRV - [2008/04/24 09:56:22 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PCASp50.sys -- (PCASp50)
DRV - [2008/04/13 15:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 14:54:36 | 000,028,672 | ---- | M] (National Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nscirda.sys -- (NSCIRDA)
DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008/04/13 14:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 14:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/02/22 16:54:40 | 000,037,312 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tvti2c.sys -- (TVTI2C)
DRV - [2008/02/15 13:12:06 | 005,854,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2007/11/27 00:37:00 | 002,236,544 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel(R)
DRV - [2007/11/20 17:39:56 | 000,012,288 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2007/11/01 17:26:36 | 000,989,696 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2007/11/01 17:25:32 | 000,211,456 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2007/11/01 17:25:22 | 000,731,520 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2007/10/12 17:30:46 | 000,252,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1e5132.sys -- (e1express) Intel(R)
DRV - [2007/09/03 22:44:20 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mcstrm.sys -- (MCSTRM)
DRV - [2007/08/14 16:46:36 | 000,010,896 | ---- | M] (UPEK Inc.) [Kernel | Auto | Running] -- C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys -- (smihlp2) SMI Helper Driver (smihlp2)
DRV - [2007/08/14 16:25:52 | 000,047,376 | ---- | M] (UPEK Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tcusb.sys -- (TcUsb)
DRV - [2006/11/06 18:24:56 | 000,012,080 | ---- | M] (Lenovo Group Limited) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PROCDD.SYS -- (PROCDD)
DRV - [2006/10/02 02:55:00 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SMAPINT.SYS -- (Smapint)
DRV - [2006/10/02 02:55:00 | 000,009,343 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TDSMAPI.SYS -- (TDSMAPI)
DRV - [2006/06/20 12:56:48 | 000,178,688 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV - [2005/12/06 15:20:48 | 000,192,512 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hsxhwazl.sys -- (HSXHWAZL)
DRV - [2005/12/05 04:55:30 | 001,428,096 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel(R)
DRV - [2005/11/01 18:55:22 | 000,401,664 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2005/11/01 18:53:14 | 001,342,122 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2005/11/01 18:51:34 | 000,030,363 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2005/11/01 18:51:06 | 000,056,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2005/11/01 18:48:00 | 000,148,040 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2005/05/17 11:20:08 | 000,015,872 | ---- | M] (Atmel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atmeltpm.sys -- (atmeltpm)
DRV - [2004/08/04 09:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [2004/08/04 02:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2003/07/29 10:00:00 | 000,007,140 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\cvintdrv.sys -- (cvintdrv)
DRV - [2001/12/19 11:45:00 | 000,008,576 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\VCdRom.sys -- (vcdrom)
DRV - [2001/08/17 18:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 18:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 18:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 18:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 18:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 17:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 17:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 17:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 17:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 17:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 17:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 17:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 17:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 17:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 17:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 16:20:04 | 000,096,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Intel(r) 82801 Audio Driver Install Service (WDM)
DRV - [2001/08/17 14:48:14 | 000,011,520 | ---- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TwoTrack.sys -- (TwoTrack)
DRV - [2000/06/01 16:29:54 | 000,007,012 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PMEMNT.SYS -- (PMEM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore =
IE - HKCU\..\URLSearchHook: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://my.yahoo.com/ "
FF - prefs.js..extensions.enabledItems: aboutme@test.mozilla.com:0.4.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.8
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.27
FF - prefs.js..extensions.enabledItems: grwatcher@ajnasz.hu:1.2.2
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.%(version)s
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.1
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/21 15:19:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/27 22:57:13 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/01 17:37:42 | 000,000,000 | ---D | M]

[2008/03/03 16:44:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Extensions
[2010/07/04 04:01:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions
[2010/07/04 04:00:47 | 000,000,000 | ---D | M] (FlashGot) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/06/20 19:45:31 | 000,000,000 | ---D | M] (Zynga Toolbar) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2010/07/03 01:45:41 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/06/28 19:23:53 | 000,000,000 | ---D | M] (Password Exporter) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}
[2010/05/14 00:32:18 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/05/14 00:32:17 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/05/31 01:15:59 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010/05/14 00:32:10 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009/09/14 21:40:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\aboutme@test.mozilla.com
[2009/11/11 16:06:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\firefox@tvunetworks.com
[2010/06/04 19:42:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\grwatcher@ajnasz.hu
[2009/01/15 01:46:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\extensions\translator@dontfollowme(2).net
[2010/05/03 22:59:22 | 000,002,571 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\amazon-search-suggestions.xml
[2010/05/08 14:06:02 | 000,000,445 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\b-ref-search.xml
[2010/06/23 07:14:49 | 000,002,267 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\bing-zugo.xml
[2008/06/24 12:08:28 | 000,000,908 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\imdb.xml
[2008/06/23 01:39:40 | 000,001,959 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\lastfm.xml
[2007/10/24 16:48:03 | 000,002,006 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\urban-dictionary.xml
[2008/06/23 11:28:28 | 000,001,108 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\wikipedia-en.xml
[2007/05/28 23:35:13 | 000,002,105 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\Mozilla\Firefox\Profiles\dqp8cqt8.default\searchplugins\youtube-video-search.xml
[2010/07/04 04:01:03 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/01 17:37:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/01 17:37:27 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/05/11 17:41:00 | 000,200,704 | ---- | M] (Ancestry.com) -- C:\Program Files\Mozilla Firefox\plugins\npImgCtl.dll
[2005/12/05 23:31:00 | 000,114,688 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npmozax.dll
[2008/02/26 18:27:46 | 001,212,416 | ---- | M] (cedelia) -- C:\Program Files\Mozilla Firefox\plugins\NPStreamPlug.dll

O1 HOSTS File: ([2010/07/04 14:39:57 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (www.flashget.com)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)
O2 - BHO: (IePasswordManagerHelper Class) - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (www.flashget.com)
O2 - BHO: (TBSB05974 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Search Toolbar\tbcore3.dll File not found
O3 - HKLM\..\Toolbar: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Zynga Toolbar) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)
O4 - HKLM..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo )
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [Boingo Wi-Fi] C:\Program Files\Boingo\Boingo Wi-Fi\Boingo.lnk ()
O4 - HKLM..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\imekrmig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TP4EX] C:\WINDOWS\System32\TP4EX.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digsby.lnk = C:\Program Files\Digsby\digsby.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\JC_ALL.HTM ()
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\JC_LINK.HTM ()
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : Lenovo Password Manager... - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O15 - HKCU\..Trusted Domains: kuaiche.com ([software] http in Trusted sites)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.crucial.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 68.237.161.12
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\WINDOWS\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\psfus: DllName - C:\WINDOWS\system32\psqlpwd.dll - C:\WINDOWS\system32\psqlpwd.dll (UPEK Inc.)
O20 - Winlogon\Notify\tpfnf2: DllName - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll ()
O20 - Winlogon\Notify\tphotkey: DllName - C:\Program Files\Lenovo\HOTKEY\tphklock.dll - C:\Program Files\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited)
O24 - Desktop WallPaper: C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/12/22 06:50:02 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

JDorritie · 2010/07/04

OTL.txt Part 2/2

========== Files/Folders - Created Within 90 Days ==========

[2010/07/04 14:39:02 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/07/04 04:40:29 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\James Dorritie\Desktop\OTL.exe
[2010/07/03 02:28:05 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2010/07/03 02:27:30 | 000,165,160 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynTPAPI.dll
[2010/07/03 02:27:27 | 000,120,104 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynTPCo4.dll
[2010/07/03 02:27:26 | 000,244,784 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\drivers\SynTP.sys
[2010/07/03 02:27:26 | 000,173,352 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynCOM.dll
[2010/07/03 02:27:22 | 000,210,216 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynCtrl.dll
[2010/07/03 02:00:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Zynga
[2010/07/01 17:54:22 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/07/01 17:38:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/06/28 22:47:29 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/28 22:47:26 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/28 22:47:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/28 19:14:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\GoodSync
[2010/06/28 19:14:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Application Data\GoodSync
[2010/06/28 18:04:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\RoboForm
[2010/06/28 18:04:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\My Documents\My RoboForm Data
[2010/06/28 04:08:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\PCHealth
[2010/06/28 03:44:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Conduit
[2010/06/28 03:44:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga
[2010/06/28 02:40:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/06/28 02:40:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/06/27 20:45:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Apple Computer
[2010/06/24 18:45:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\cache
[2010/06/24 18:44:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\FullTiltPoker
[2010/06/24 11:01:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Adobe
[2010/06/23 23:23:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Conduit
[2010/06/23 23:23:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\Mozilla
[2010/06/23 00:07:10 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/06/22 23:20:18 | 000,000,000 | ---D | C] -- C:\Program Files\CrazyPixels
[2010/06/22 23:08:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Application Data\ManyCam
[2010/06/20 19:35:21 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2010/06/20 19:35:13 | 000,000,000 | ---D | C] -- C:\Program Files\Zynga
[2010/06/07 13:15:12 | 000,013,696 | ---- | C] (Skyhook Wireless) -- C:\WINDOWS\System32\drivers\wpsnuio.sys
[2010/06/07 13:15:12 | 000,000,000 | ---D | C] -- C:\Program Files\Skyhook Wireless
[2010/06/07 13:15:07 | 000,000,000 | ---D | C] -- C:\Program Files\Boingo
[2010/06/07 13:15:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\GoBoingo
[2010/05/31 00:50:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James Dorritie\Application Data\vlc
[2010/05/04 02:16:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Medieval Software
[2010/05/04 02:15:55 | 000,000,000 | ---D | C] -- C:\Program Files\Medieval Software
[2010/05/04 02:15:31 | 000,217,088 | ---- | C] (Medieval Software) -- C:\WINDOWS\System32\BlueCiucc.dll
[2010/04/18 22:23:26 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
[2006/10/11 18:01:40 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfpmui.dll
[2006/10/11 17:59:56 | 001,224,704 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfserv.dll
[2006/10/11 17:54:10 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfcomm.dll
[2006/10/11 17:52:34 | 000,585,728 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcflmpm.dll
[2006/10/11 17:51:16 | 000,397,312 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfiesc.dll
[2006/10/11 17:48:58 | 000,094,208 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfpplc.dll
[2006/10/11 17:48:14 | 000,684,032 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfcomc.dll
[2006/10/11 17:47:42 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfprox.dll
[2006/10/11 17:41:42 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfinpa.dll
[2006/10/11 17:41:04 | 000,991,232 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfusb1.dll
[2006/10/11 17:37:14 | 000,696,320 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfhbn3.dll

========== Files - Modified Within 90 Days ==========

[2010/07/04 15:01:38 | 000,000,318 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job
[2010/07/04 14:47:03 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/07/04 14:43:23 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3599169923-3658683049-1803797758-1005.job
[2010/07/04 14:43:09 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3599169923-3658683049-1803797758-1005.job
[2010/07/04 14:43:00 | 000,025,269 | ---- | M] () -- C:\WINDOWS\System32\PROCDB.INI
[2010/07/04 14:41:35 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/04 14:41:14 | 000,000,380 | ---- | M] () -- C:\WINDOWS\System32\IPSCtrl.INI
[2010/07/04 14:41:14 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/04 14:41:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/04 14:41:09 | 1600,573,440 | -HS- | M] () -- C:\hiberfil.sys
[2010/07/04 14:40:11 | 011,796,480 | ---- | M] () -- C:\Documents and Settings\James Dorritie\ntuser.dat
[2010/07/04 14:40:11 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\James Dorritie\ntuser.ini
[2010/07/04 14:39:57 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2010/07/04 04:40:57 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James Dorritie\Desktop\OTL.exe
[2010/07/03 02:29:10 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_SynTP_01009.Wdf
[2010/07/03 02:29:05 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/07/03 00:45:43 | 000,090,744 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/07/03 00:44:57 | 000,336,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/30 23:07:16 | 000,000,260 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/06/30 12:33:08 | 001,809,896 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\Photo0645.jpg
[2010/06/30 12:33:08 | 001,603,064 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\Photo0644.jpg
[2010/06/28 20:16:39 | 000,002,548 | ---- | M] () -- C:\config.xml
[2010/06/28 20:16:38 | 000,054,022 | ---- | M] () -- C:\WINDOWS\System32\RW_AppData.dat
[2010/06/28 20:16:38 | 000,014,032 | ---- | M] () -- C:\WINDOWS\System32\RW_FileType.dat
[2010/06/28 20:16:38 | 000,000,348 | ---- | M] () -- C:\WINDOWS\System32\RW_FileFlag.dat
[2010/06/28 20:16:38 | 000,000,056 | ---- | M] () -- C:\WINDOWS\System32\RW_{44214736-91A9-11DB-A2E8-806D6172696F}.dat
[2010/06/27 22:12:43 | 000,006,144 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/24 21:45:40 | 000,095,224 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\0624001057.jpg
[2010/06/24 21:45:40 | 000,064,415 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\0624001045.jpg
[2010/06/24 00:09:34 | 004,871,478 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\Video 2.wmv
[2010/06/24 00:09:24 | 003,862,782 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\Video 3.wmv
[2010/06/23 03:04:01 | 000,507,514 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/23 03:04:01 | 000,445,472 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/23 03:04:01 | 000,072,824 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/06/22 01:42:35 | 000,000,050 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\twittertmpwin.jpx
[2010/06/22 01:42:01 | 000,000,005 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Application Data\myspacetmpwin.jpx
[2010/06/15 18:00:37 | 091,129,818 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\67760.flv
[2010/06/09 03:26:34 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/06/09 03:24:50 | 000,000,708 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/06/07 13:15:12 | 000,013,696 | ---- | M] (Skyhook Wireless) -- C:\WINDOWS\System32\drivers\wpsnuio.sys
[2010/06/06 18:30:12 | 000,041,984 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\James Dorritie Resume.doc
[2010/05/31 21:58:23 | 000,025,088 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\James Dorritie Cover Letter.doc
[2010/05/29 20:10:33 | 000,025,088 | ---- | M] () -- C:\Documents and Settings\James Dorritie\My Documents\example coverletter.doc
[2010/05/16 13:47:38 | 015,613,701 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\LOST_616_audio_podcast_86afa0aa-338f-4c33-b030-8c83e06af538_2963901.mp3
[2010/05/04 02:15:31 | 000,217,088 | ---- | M] (Medieval Software) -- C:\WINDOWS\System32\BlueCiucc.dll
[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010/04/26 01:34:21 | 000,000,154 | ---- | M] () -- C:\WINDOWS\matlab.ini
[2010/04/22 17:17:40 | 000,244,784 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\drivers\SynTP.sys
[2010/04/22 17:16:14 | 000,120,104 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynTPCo4.dll
[2010/04/22 17:16:12 | 000,165,160 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynTPAPI.dll
[2010/04/22 17:16:10 | 000,210,216 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynCtrl.dll
[2010/04/22 17:16:08 | 000,173,352 | ---- | M] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynCOM.dll
[2010/04/16 15:38:11 | 000,074,364 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/04/13 18:48:08 | 000,042,971 | ---- | M] () -- C:\Documents and Settings\James Dorritie\Desktop\TaxReturn.pdf

========== Files Created - No Company Name ==========

[2010/07/03 02:29:10 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_SynTP_01009.Wdf
[2010/07/03 02:29:05 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/06/30 15:56:54 | 1600,573,440 | -HS- | C] () -- C:\hiberfil.sys
[2010/06/30 15:33:44 | 001,809,896 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\Photo0645.jpg
[2010/06/30 15:33:44 | 001,603,064 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\Photo0644.jpg
[2010/06/30 15:27:53 | 000,000,296 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3599169923-3658683049-1803797758-1005.job
[2010/06/28 22:49:16 | 000,000,408 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/06/28 20:16:39 | 000,002,548 | ---- | C] () -- C:\config.xml
[2010/06/28 20:16:38 | 000,054,022 | ---- | C] () -- C:\WINDOWS\System32\RW_AppData.dat
[2010/06/28 20:16:38 | 000,014,032 | ---- | C] () -- C:\WINDOWS\System32\RW_FileType.dat
[2010/06/28 20:16:38 | 000,000,348 | ---- | C] () -- C:\WINDOWS\System32\RW_FileFlag.dat
[2010/06/28 20:16:38 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\RW_{44214736-91A9-11DB-A2E8-806D6172696F}.dat
[2010/06/27 22:05:01 | 000,006,144 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/24 21:45:39 | 000,064,415 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\0624001045.jpg
[2010/06/24 21:45:31 | 000,095,224 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\0624001057.jpg
[2010/06/24 00:09:27 | 004,871,478 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\Video 2.wmv
[2010/06/24 00:09:16 | 003,862,782 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\Video 3.wmv
[2010/06/23 03:21:24 | 000,894,464 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/06/22 01:42:01 | 000,000,005 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Application Data\myspacetmpwin.jpx
[2010/06/22 01:41:53 | 000,000,050 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Application Data\twittertmpwin.jpx
[2010/06/15 18:00:37 | 091,129,818 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\67760.flv
[2010/05/29 20:18:27 | 000,025,088 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\James Dorritie Cover Letter.doc
[2010/05/29 19:48:29 | 000,025,088 | ---- | C] () -- C:\Documents and Settings\James Dorritie\My Documents\example coverletter.doc
[2010/05/22 18:53:03 | 000,041,984 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\James Dorritie Resume.doc
[2010/05/16 13:47:15 | 015,613,701 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\LOST_616_audio_podcast_86afa0aa-338f-4c33-b030-8c83e06af538_2963901.mp3
[2010/04/13 18:48:05 | 000,042,971 | ---- | C] () -- C:\Documents and Settings\James Dorritie\Desktop\TaxReturn.pdf
[2010/02/09 12:19:35 | 000,000,025 | ---- | C] () -- C:\WINDOWS\libem.INI
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/03/17 22:21:26 | 000,006,850 | R--- | C] () -- C:\WINDOWS\Disktool.INI
[2009/03/17 22:21:26 | 000,005,633 | R--- | C] () -- C:\WINDOWS\fwupgrade.ini
[2009/03/17 22:21:26 | 000,003,677 | R--- | C] () -- C:\WINDOWS\PlaySnd.INI
[2009/01/18 01:18:18 | 000,000,050 | ---- | C] () -- C:\WINDOWS\MegaManager.INI
[2008/08/23 23:51:54 | 000,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.sys
[2008/04/28 03:31:33 | 000,408,576 | ---- | C] () -- C:\WINDOWS\System32\Smab.dll
[2008/04/28 03:31:32 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2008/04/28 00:59:29 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\AVERM.dll
[2008/04/27 12:19:08 | 000,000,067 | ---- | C] () -- C:\WINDOWS\My Video Converter.INI
[2008/04/13 06:02:50 | 000,000,815 | ---- | C] () -- C:\WINDOWS\entpack.ini
[2008/04/06 23:22:10 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2008/02/06 23:02:09 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSMAPIP.SYS
[2008/02/06 22:52:17 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4860.dll
[2008/01/04 15:13:58 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\DEVMAN.DLL
[2007/12/08 01:45:30 | 000,139,008 | ---- | C] () -- C:\WINDOWS\System32\guard32.dll
[2007/09/01 17:58:15 | 000,000,038 | ---- | C] () -- C:\WINDOWS\System32\winitn.dll
[2007/08/06 00:50:12 | 000,000,709 | ---- | C] () -- C:\WINDOWS\mp3rmconverter.ini
[2007/07/26 04:10:26 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2007/06/22 00:01:22 | 000,006,365 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/05/21 01:17:36 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2007/05/21 01:17:36 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2007/05/21 01:17:36 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2007/05/21 01:17:36 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2007/05/07 05:42:45 | 000,532,480 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll
[2007/02/09 22:33:24 | 000,716,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2007/01/30 18:21:25 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Graphing Calculator Viewer.INI
[2007/01/29 12:36:32 | 000,025,269 | ---- | C] () -- C:\WINDOWS\System32\PROCDB.INI
[2007/01/11 17:50:07 | 000,000,154 | ---- | C] () -- C:\WINDOWS\matlab.ini
[2006/12/27 15:27:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2006/12/25 20:17:04 | 000,000,629 | ---- | C] () -- C:\WINDOWS\RMAC.ini
[2006/12/23 09:29:44 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/12/22 07:03:24 | 000,002,481 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/12/22 07:00:35 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\notifyf2.dll
[2006/12/22 07:00:35 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\tphklock.dll
[2006/12/22 06:58:22 | 000,000,380 | ---- | C] () -- C:\WINDOWS\System32\IPSCtrl.INI
[2006/12/22 06:56:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2006/12/22 06:39:33 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/12/22 06:39:09 | 000,004,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2006/12/22 06:29:47 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys
[2006/12/22 06:29:21 | 000,000,722 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/12/22 06:17:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\FPCALL.dll
[2006/12/22 06:17:20 | 000,009,343 | ---- | C] () -- C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2006/12/22 06:04:20 | 000,000,488 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/10/28 10:31:44 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\dlcfcoin.dll
[2006/10/20 13:42:24 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dlcfinsr.dll
[2006/10/20 13:42:18 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dlcfcur.dll
[2006/10/20 13:41:46 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\dlcfjswr.dll
[2006/10/20 13:37:22 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\dlcfinsb.dll
[2006/10/20 13:37:16 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dlcfcub.dll
[2006/10/20 13:37:00 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\dlcfcu.dll
[2006/10/20 13:36:54 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\dlcfins.dll
[2006/10/20 13:35:36 | 000,434,176 | ---- | C] () -- C:\WINDOWS\System32\dlcfutil.dll
[2006/09/06 05:27:08 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\dlcfcfg.dll
[2006/05/16 02:25:43 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2005/11/16 10:15:04 | 000,164,112 | ---- | C] () -- C:\WINDOWS\System32\awmpi.dll
[2005/11/01 18:59:16 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2005/08/18 06:26:46 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlcfvs.dll
[2005/06/29 04:58:02 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/02/17 07:31:58 | 000,679,936 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2005/02/17 07:31:58 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2005/02/17 07:31:58 | 000,155,136 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2004/08/09 15:03:43 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2003/11/13 14:28:02 | 000,012,570 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2003/11/13 14:28:02 | 000,012,570 | ---- | C] () -- C:\WINDOWS\ADFUUD.SYS
[2003/07/29 10:00:00 | 000,007,140 | ---- | C] () -- C:\WINDOWS\System32\drivers\cvintdrv.sys
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/10/06 14:42:57 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2002/10/04 19:04:25 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2002/10/04 19:04:24 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2002/10/04 19:04:17 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2002/05/16 02:29:04 | 000,000,607 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2001/11/23 21:18:00 | 000,000,597 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001/11/14 16:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2010/02/09 20:31:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation
[2008/10/01 17:41:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\farstone
[2010/06/07 13:15:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GoBoingo
[2010/06/28 19:14:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GoodSync
[2008/08/27 05:27:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
[2008/05/18 21:39:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lenovo
[2008/05/06 12:06:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MediaMonkey
[2010/05/04 02:16:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Medieval Software
[2008/01/29 22:12:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/11/11 02:18:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2008/02/06 23:59:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC-Doctor
[2007/11/30 07:31:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\River Past G5
[2010/06/28 18:04:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RoboForm
[2010/06/22 23:59:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2008/02/07 00:02:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UIB
[2008/03/24 20:44:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\.gaim
[2009/12/30 00:38:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\.purple
[2008/08/10 04:03:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\.Tribler
[2007/01/18 21:47:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\acccore
[2007/01/18 21:56:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Aim
[2008/08/24 04:36:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Avaya
[2007/04/10 15:35:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\BitTorrent
[2008/07/11 00:06:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\BWMeterPro
[2007/09/02 16:00:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\COWON
[2010/02/09 20:17:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\FlashGet
[2009/10/02 16:40:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\FreeFLVConverter
[2010/02/09 10:42:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\FrostWire
[2007/06/29 15:49:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\GetRightToGo
[2010/07/03 02:00:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\GoodSync
[2008/10/08 19:31:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\GrabPro
[2009/09/22 00:15:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\gtk-2.0
[2006/12/22 06:27:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\IBM
[2007/10/13 10:23:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Image Zone Express
[2006/12/24 03:40:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\InterVideo
[2007/01/20 23:58:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Leadertech
[2008/01/18 02:11:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\LEAPS
[2008/08/23 23:43:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Lenovo
[2010/06/22 23:12:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\ManyCam
[2010/02/09 10:44:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Pamela
[2008/01/18 02:08:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Pegasys Inc
[2010/02/09 10:39:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Trillian
[2008/04/06 23:11:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\True Sword
[2009/09/18 01:05:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
[2009/11/13 14:47:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010/02/08 17:10:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\UDRuler
[2008/10/23 17:37:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\Uniblue
[2010/06/27 22:35:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\uTorrent
[2006/12/31 17:46:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\WebRenderer
[2007/02/09 22:42:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Dorritie\Application Data\WhenU
[2010/07/04 14:47:03 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/07/04 15:01:38 | 000,000,318 | ---- | M] () -- C:\WINDOWS\Tasks\PMTask.job

========== Purity Check ==========

< End of report >

broni · 2010/07/04

It looks, like bing.zugo was successfully removed.
How is Firefox doing?

JDorritie · 2010/07/04

It was, firefox was searching with Google, but then I restarted Firefox and tried again and it was back to searching with Bing.zugo.com

JDorritie · 2010/07/04

I may have made a mistake and left firefox running, on accident, during that last scan, do you want me to do another one with firefox closed?

broni · 2010/07/04

Please do.

Log in or Sign up

Solved Infected With Alerion Virus.

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

JDorritie Inactive Thread Starter

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Infected With Alerion Virus.

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

JDorritie Inactive Thread Starter

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

JDorritie Inactive Thread Starter

JDorritie Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches