Solve : Removing virus now I am stuck. Logs included? – InterviewSolution

InterviewSolution

1.	Solve : Removing virus now I am stuck. Logs included?
Answer» A friend asked me to clean their infected notebook. I tried to install avast first but I got an alert telling me to contact the system administrator. I was able to install maleware bytes, and it found several files, but was not able to delete them. I tried to install hijackthis and it wouldn't allow it. renaming the install to hello didn't help either. Attempting the above in safe mode returned the same results. So I removed the drive and set it up as an external usb drive, and used avast on another PC to clean it. After I REINSTALLED it I got a bsod error SESSION3_INITIALIZATION_FAILED with a code of 0x0000006F (0xC000000E, 0x00000000, 0x00000000, 0x00000000). The drive is still good. I ran a chkdsk on it and it passed. So I figure the registry is pointing to a non existant file, or an important file has been removed from the registry I then created a windows bootdisk with pe-builder and installed otlpe. Thank you for any help you can give me Log file _____ OTL logfile created on: 9/19/2010 8:05:54 PM - Run OTLPE by OldTimer - Version 3.1.40.0 Folder = D:\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 503.00 Mb Total Physical Memory \| 364.00 Mb Available Physical Memory \| 72.00% Memory free 471.00 Mb Paging File \| 400.00 Mb Available in Paging File \| 85.00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 71.11 Gb Total Space \| 60.42 Gb Free Space \| 84.97% Space Free \| Partition Type: NTFS Drive D: \| 980.72 Mb Total Space \| 978.61 Mb Free Space \| 99.78% Space Free \| Partition Type: FAT E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive X: \| 178.79 Mb Total Space \| 0.00 Mb Free Space \| 0.00% Space Free \| Partition Type: CDFS Computer Name: BARTPE-21130 Current User Name: SYSTEM Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard Using ControlSet: ControlSet001 ========== Win32 Services (All) ========== SRV - File not found [Disabled] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - File not found [On_Demand] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt) SRV - [2010/09/07 15:11:59 \| 000,040,384 \| ---- \| M] (AVAST Software) [On_Demand] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner) SRV - [2010/09/07 15:11:59 \| 000,040,384 \| ---- \| M] (AVAST Software) [On_Demand] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner) SRV - [2010/09/07 15:11:59 \| 000,040,384 \| ---- \| M] (AVAST Software) [Auto] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus) SRV - [2009/10/27 21:49:34 \| 000,319,488 \| ---- \| M] (Alcatel-Lucent) [Auto] -- C:\Program Files\Common Files\Motive\McciCMService.exe -- (McciCMService) SRV - [2009/06/10 06:14:49 \| 000,132,096 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\wkssvc.dll -- (lanmanworkstation) SRV - [2009/02/09 12:10:48 \| 000,401,408 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\rpcss.dll -- (RpcSs) Remote Procedure Call (RPC) SRV - [2009/02/09 12:10:48 \| 000,401,408 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\rpcss.dll -- (DcomLaunch) SRV - [2009/02/06 11:11:05 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\services.exe -- (PlugPlay) SRV - [2009/02/06 11:11:05 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\services.exe -- (Eventlog) SRV - [2008/12/19 18:51:55 \| 000,152,984 \| ---- \| M] (Sun Microsystems, Inc.) [Auto] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2008/10/06 23:52:23 \| 000,611,664 \| ---- \| M] (Lavasoft) [Auto] -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice) SRV - [2008/07/07 20:26:58 \| 000,253,952 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\es.dll -- (EventSystem) SRV - [2008/06/20 17:46:57 \| 000,245,248 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\mswsock.dll -- (Nla) Network Location Awareness (NLA) SRV - [2008/04/14 00:12:40 \| 000,126,464 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\wbem\wmiapsrv.exe -- (WmiApSrv) SRV - [2008/04/14 00:12:38 \| 000,289,792 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\vssvc.exe -- (VSS) SRV - [2008/04/14 00:12:38 \| 000,018,432 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\ups.exe -- (UPS) SRV - [2008/04/14 00:12:36 \| 000,057,856 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\spoolsv.exe -- (SPOOLER) SRV - [2008/04/14 00:12:35 \| 000,089,600 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\smlogsvc.exe -- (SysmonLog) SRV - [2008/04/14 00:12:34 \| 000,141,312 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\sessmgr.exe -- (RDSessMgr) SRV - [2008/04/14 00:12:33 \| 000,095,744 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\scardsvr.exe -- (SCardSvr) SRV - [2008/04/14 00:12:29 \| 000,111,104 \| ---- \| M] (Microsoft Corporation) [Disabled] -- C:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm) SRV - [2008/04/14 00:12:29 \| 000,111,104 \| ---- \| M] (Microsoft Corporation) [Disabled] -- C:\WINDOWS\system32\netdde.exe -- (NetDDE) SRV - [2008/04/14 00:12:28 \| 000,078,848 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\System32\msiexec.exe -- (MSIServer) SRV - [2008/04/14 00:12:27 \| 000,006,144 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\msdtc.exe -- (MSDTC) SRV - [2008/04/14 00:12:25 \| 000,032,768 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\mnmsrvc.exe -- (mnmsrvc) SRV - [2008/04/14 00:12:24 \| 000,075,264 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\locator.exe -- (RpcLocator) Remote Procedure Call (RPC) SRV - [2008/04/14 00:12:24 \| 000,013,312 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\lsass.exe -- (SamSs) SRV - [2008/04/14 00:12:24 \| 000,013,312 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\lsass.exe -- (ProtectedStorage) SRV - [2008/04/14 00:12:24 \| 000,013,312 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\lsass.exe -- (PolicyAgent) SRV - [2008/04/14 00:12:24 \| 000,013,312 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\lsass.exe -- (NtLmSsp) SRV - [2008/04/14 00:12:24 \| 000,013,312 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\lsass.exe -- (Netlogon) SRV - [2008/04/14 00:12:22 \| 000,150,528 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\imapi.exe -- (ImapiService) SRV - [2008/04/14 00:12:21 \| 000,267,776 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\fxssvc.exe -- (Fax) SRV - [2008/04/14 00:12:17 \| 000,224,768 \| ---- \| M] (Microsoft Corp., Veritas Software) [On_Demand] -- C:\WINDOWS\System32\dmadmin.exe -- (dmadmin) SRV - [2008/04/14 00:12:17 \| 000,005,120 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\System32\dllhost.exe -- (SwPrv) SRV - [2008/04/14 00:12:17 \| 000,005,120 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\System32\dllhost.exe -- (COMSysApp) SRV - [2008/04/14 00:12:14 \| 000,033,280 \| ---- \| M] (Microsoft Corporation) [Disabled] -- C:\WINDOWS\system32\clipsrv.exe -- (ClipSrv) SRV - [2008/04/14 00:12:14 \| 000,005,632 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\cisvc.exe -- (CiSvc) SRV - [2008/04/14 00:12:12 \| 000,044,544 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\alg.exe -- (ALG) SRV - [2008/04/14 00:12:11 \| 000,483,840 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\wzcsvc.dll -- (WZCSVC) SRV - [2008/04/14 00:12:11 \| 000,129,024 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\xmlprov.dll -- (xmlprov) SRV - [2008/04/14 00:12:11 \| 000,006,656 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\wuauserv.dll -- (wuauserv) SRV - [2008/04/14 00:12:10 \| 000,080,896 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\wscsvc.dll -- (wscsvc) SRV - [2008/04/14 00:12:09 \| 000,144,896 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\wbem\wmisvc.dll -- (winmgmt) SRV - [2008/04/14 00:12:08 \| 000,333,824 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\wiaservc.dll -- (stisvc) Windows Image Acquisition (WIA) SRV - [2008/04/14 00:12:08 \| 000,185,856 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\upnphost.dll -- (upnphost) SRV - [2008/04/14 00:12:08 \| 000,175,104 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\w32time.dll -- (w32time) SRV - [2008/04/14 00:12:08 \| 000,068,096 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\webclnt.dll -- (WebClient) SRV - [2008/04/14 00:12:08 \| 000,015,872 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\w3ssl.dll -- (HTTPFilter) SRV - [2008/04/14 00:12:07 \| 000,295,424 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\termsrv.dll -- (TermService) SRV - [2008/04/14 00:12:07 \| 000,249,856 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\tapisrv.dll -- (TapiSrv) SRV - [2008/04/14 00:12:07 \| 000,171,008 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\srsvc.dll -- (srservice) SRV - [2008/04/14 00:12:07 \| 000,096,768 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\srvsvc.dll -- (lanmanserver) SRV - [2008/04/14 00:12:07 \| 000,090,112 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\trkwks.dll -- (TrkWks) SRV - [2008/04/14 00:12:07 \| 000,071,680 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\ssdpsrv.dll -- (SSDPSRV) SRV - [2008/04/14 00:12:05 \| 000,192,512 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\schedsvc.dll -- (Schedule) SRV - [2008/04/14 00:12:05 \| 000,135,168 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\shsvcs.dll -- (Themes) SRV - [2008/04/14 00:12:05 \| 000,135,168 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\shsvcs.dll -- (ShellHWDetection) SRV - [2008/04/14 00:12:05 \| 000,135,168 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\shsvcs.dll -- (FastUserSwitchingCompatibility) SRV - [2008/04/14 00:12:05 \| 000,039,424 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\sens.dll -- (SENS) SRV - [2008/04/14 00:12:05 \| 000,018,944 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\seclogon.dll -- (seclogon) SRV - [2008/04/14 00:12:03 \| 000,409,088 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\qmgr.dll -- (BITS) SRV - [2008/04/14 00:12:03 \| 000,291,328 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\qagentrt.dll -- (napagent) SRV - [2008/04/14 00:12:03 \| 000,186,368 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\rasmans.dll -- (RasMan) SRV - [2008/04/14 00:12:03 \| 000,088,576 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\rasauto.dll -- (RasAuto) SRV - [2008/04/14 00:12:02 \| 000,435,200 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\ntmssvc.dll -- (NtmsSvc) SRV - [2008/04/14 00:12:02 \| 000,038,400 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll -- (helpsvc) SRV - [2008/04/14 00:12:01 \| 000,198,144 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\netman.dll -- (Netman) SRV - [2008/04/14 00:11:59 \| 000,033,792 \| ---- \| M] (Microsoft Corporation) [Disabled] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger) SRV - [2008/04/14 00:11:57 \| 000,053,248 \| ---- \| M] (Microsoft Corporation) [Disabled] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess) SRV - [2008/04/14 00:11:56 \| 000,061,440 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\kmsvc.dll -- (hkmsvc) SRV - [2008/04/14 00:11:56 \| 000,013,824 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\lmhsvc.dll -- (LmHosts) SRV - [2008/04/14 00:11:55 \| 000,331,264 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\ipnathlp.dll -- (SharedAccess) Windows Firewall/Internet Connection Sharing (ICS) SRV - [2008/04/14 00:11:53 \| 000,023,040 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\ersvc.dll -- (ERSvc) SRV - [2008/04/14 00:11:52 \| 000,132,096 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\dot3svc.dll -- (Dot3svc) SRV - [2008/04/14 00:11:52 \| 000,045,568 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\dnsrslvr.dll -- (Dnscache) SRV - [2008/04/14 00:11:52 \| 000,033,792 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\eapsvc.dll -- (EapHost) SRV - [2008/04/14 00:11:52 \| 000,023,552 \| ---- \| M] (Microsoft Corp.) [On_Demand] -- C:\WINDOWS\system32\dmserver.dll -- (dmserver) SRV - [2008/04/14 00:11:51 \| 000,126,976 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\dhcpcsvc.dll -- (Dhcp) SRV - [2008/04/14 00:11:51 \| 000,062,464 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\cryptsvc.dll -- (CryptSvc) SRV - [2008/04/14 00:11:50 \| 000,077,824 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\browser.dll -- (Browser) SRV - [2008/04/14 00:11:50 \| 000,042,496 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\audiosrv.dll -- (AudioSrv) SRV - [2008/04/14 00:11:49 \| 000,017,408 \| ---- \| M] (Microsoft Corporation) [Disabled] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter) SRV - [2007/03/07 20:47:46 \| 000,076,848 \| ---- \| M] () [On_Demand] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService) SRV - [2006/10/19 04:47:16 \| 000,027,136 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\mspmsnsv.dll -- (WmdmPmSN) SRV - [2006/10/19 03:05:24 \| 000,913,408 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc) SRV - [2006/09/29 01:56:14 \| 000,055,808 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\WudfSvc.dll -- (WudfSvc) SRV - [2005/06/22 00:19:38 \| 000,491,520 \| ---- \| M] () [On_Demand] -- C:\WINDOWS\System32\lxcdcoms.exe -- (lxcd_device) SRV - [2005/04/25 22:34:12 \| 000,466,944 \| ---- \| M] (Dell) [On_Demand] -- C:\WINDOWS\System32\dlbucoms.exe -- (dlbu_device) SRV - [2005/03/04 04:29:02 \| 000,356,352 \| ---- \| M] (Dell Inc.) [Auto] -- C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe -- (NICCONFIGSVC) SRV - [2004/09/07 21:12:32 \| 000,225,353 \| ---- \| M] (Intel® Corporation) [Auto] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) SRV - [2004/09/07 21:05:10 \| 000,360,521 \| ---- \| M] (Intel Corporation ) [Auto] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor) SRV - [2004/09/07 21:02:40 \| 000,086,016 \| ---- \| M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng) SRV - [2004/09/07 21:02:04 \| 000,139,264 \| ---- \| M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc) SRV - [2004/08/04 10:00:00 \| 000,132,608 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\system32\rsvp.exe -- (RSVP) SRV - [2004/07/15 06:49:26 \| 000,032,768 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -- (aspnet_state) SRV - [2003/06/20 04:25:00 \| 000,322,120 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (All) ========== DRV - File not found [KERNEL \| Boot] -- C:\WINDOWS\System32\drivers\gyvgr.sys -- (xldplikd) DRV - File not found [Kernel \| On_Demand] -- -- (WDICA) DRV - File not found [Kernel \| On_Demand] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW) DRV - File not found [Kernel \| Boot] -- C:\WINDOWS\System32\drivers\kbsxbxcc.sys -- (udhrqesh) DRV - File not found [Kernel \| Disabled] -- -- (Simbad) DRV - File not found [Kernel \| On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel \| On_Demand] -- -- (PDRELI) DRV - File not found [Kernel \| On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel \| On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel \| System] -- -- (PCIDump) DRV - File not found [Kernel \| System] -- -- (lbrtfdc) DRV - File not found [Kernel \| Boot] -- C:\WINDOWS\System32\DRIVERS\ftdisk.sys -- (Ftdisk) DRV - File not found [Kernel \| System] -- -- (Changer) DRV - File not found [Kernel \| On_Demand] -- -- (bvrp_pci) DRV - File not found [Kernel \| Disabled] -- -- (Atdisk) DRV - File not found [Kernel \| Disabled] -- -- (Abiosdsk) DRV - [2010/09/07 14:52:25 \| 000,046,672 \| ---- \| M] (AVAST Software) [Kernel \| System] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2010/09/07 14:52:03 \| 000,165,584 \| ---- \| M] (AVAST Software) [Kernel \| System] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2010/09/07 14:47:46 \| 000,023,376 \| ---- \| M] (AVAST Software) [Kernel \| On_Demand] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2010/09/07 14:47:19 \| 000,100,176 \| ---- \| M] (AVAST Software) [File_System \| Auto] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2010/09/07 14:47:07 \| 000,017,744 \| ---- \| M] (AVAST Software) [File_System \| Auto] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2010/09/07 14:46:51 \| 000,028,880 \| ---- \| M] (AVAST Software) [Kernel \| System] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2010/06/21 15:27:11 \| 000,354,304 \| ---- \| M] (Microsoft Corporation) [File_System \| On_Demand] -- C:\WINDOWS\system32\drivers\srv.sys -- (Srv) DRV - [2010/05/10 18:41:30 \| 000,067,656 \| ---- \| M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel \| System] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2010/02/24 13:11:07 \| 000,455,680 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\mrxsmb.sys -- (MRxSmb) DRV - [2010/02/17 18:25:48 \| 000,012,872 \| ---- \| M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel \| System] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2009/10/20 16:20:16 \| 000,265,728 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\http.sys -- (HTTP) DRV - [2009/06/24 11:18:41 \| 000,092,928 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\System32\drivers\ksecdd.sys -- (KSecDD) DRV - [2008/08/14 10:04:36 \| 000,138,496 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\afd.sys -- (AFD) DRV - [2008/06/20 11:51:12 \| 000,361,600 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\tcpip.sys -- (Tcpip) DRV - [2008/04/29 16:20:00 \| 000,015,648 \| ---- \| M] (Lavasoft AB) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\NSDriver.sys -- (Ad-Watch Connect Filter) DRV - [2008/04/14 00:13:22 \| 000,139,656 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\drivers\rdpwd.sys -- (RDPWD) DRV - [2008/04/14 00:13:21 \| 000,021,896 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\drivers\tdtcp.sys -- (TDTCP) DRV - [2008/04/14 00:13:20 \| 000,040,840 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\termdd.sys -- (TermDD) DRV - [2008/04/14 00:13:20 \| 000,012,040 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\drivers\tdpipe.sys -- (TDPIPE) DRV - [2008/04/13 19:28:39 \| 000,175,744 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\rdbss.sys -- (Rdbss) DRV - [2008/04/13 19:21:00 \| 000,162,816 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\netbt.sys -- (NetBT) DRV - [2008/04/13 19:20:42 \| 000,091,520 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndiswan.sys -- (NdisWan) DRV - [2008/04/13 19:20:37 \| 000,182,656 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\System32\drivers\ndis.sys -- (NDIS) DRV - [2008/04/13 19:19:48 \| 000,048,384 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\raspptp.sys -- (PptpMiniport) WAN Miniport (PPTP) DRV - [2008/04/13 19:19:43 \| 000,051,328 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rasl2tp.sys -- (Rasl2tp) WAN Miniport (L2TP) DRV - [2008/04/13 19:19:42 \| 000,075,264 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\ipsec.sys -- (IPSec) DRV - [2008/04/13 19:18:00 \| 000,052,480 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\i8042prt.sys -- (i8042prt) DRV - [2008/04/13 19:17:18 \| 000,083,072 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wdmaud.sys -- (wdmaud) DRV - [2008/04/13 19:17:05 \| 000,105,344 \| ---- \| M] (Microsoft Corporation) [File_System \| Boot] -- C:\WINDOWS\System32\drivers\mup.sys -- (Mup) DRV - [2008/04/13 19:15:55 \| 000,060,800 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\sysaudio.sys -- (sysaudio) DRV - [2008/04/13 19:15:53 \| 000,574,976 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\System32\drivers\ntfs.sys -- (Ntfs) DRV - [2008/04/13 19:15:45 \| 000,064,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\serial.sys -- (Serial) DRV - [2008/04/13 19:14:29 \| 000,143,744 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\System32\drivers\fastfat.sys -- (Fastfat) DRV - [2008/04/13 19:14:21 \| 000,063,744 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\System32\drivers\cdfs.sys -- (Cdfs) DRV - [2008/04/13 19:00:19 \| 000,030,080 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\drivers\modem.sys -- (Modem) DRV - [2008/04/13 18:57:32 \| 000,041,472 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\raspppoe.sys -- (RasPppoe) DRV - [2008/04/13 18:57:29 \| 000,040,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\drivers\ndproxy.sys -- (NDProxy) DRV - [2008/04/13 18:57:27 \| 000,014,336 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\asyncmac.sys -- (AsyncMac) DRV - [2008/04/13 18:57:27 \| 000,010,112 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndistapi.sys -- (NdisTapi) DRV - [2008/04/13 18:57:21 \| 000,034,560 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wanarp.sys -- (Wanarp) DRV - [2008/04/13 18:57:15 \| 000,152,832 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ipnat.sys -- (IpNat) DRV - [2008/04/13 18:57:07 \| 000,020,864 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ipinip.sys -- (IpInIp) DRV - [2008/04/13 18:56:38 \| 000,069,120 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\psched.sys -- (PSched) DRV - [2008/04/13 18:56:32 \| 000,035,072 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\msgpc.sys -- (Gpc) DRV - [2008/04/13 18:56:02 \| 000,034,688 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\netbios.sys -- (NetBIOS) DRV - [2008/04/13 18:55:58 \| 000,014,592 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndisuio.sys -- (Ndisuio) DRV - [2008/04/13 18:54:28 \| 000,011,264 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\irenum.sys -- (IRENUM) DRV - [2008/04/13 18:53:34 \| 000,036,608 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ip6fw.sys -- (Ip6Fw) DRV - [2008/04/13 18:51:25 \| 000,061,824 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nic1394.sys -- (NIC1394) DRV - [2008/04/13 18:51:25 \| 000,060,800 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\arp1394.sys -- (Arp1394) DRV - [2008/04/13 18:51:25 \| 000,059,904 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\atmarpc.sys -- (Atmarpc) DRV - [2008/04/13 18:47:37 \| 000,025,856 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbprint.sys -- (usbprint) DRV - [2008/04/13 18:46:18 \| 000,061,696 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\ohci1394.sys -- (ohci1394) DRV - [2008/04/13 18:45:39 \| 000,032,128 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbccgp.sys -- (usbccgp) DRV - [2008/04/13 18:45:38 \| 000,026,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbstor.sys -- (USBSTOR) DRV - [2008/04/13 18:45:37 \| 000,059,520 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbhub.sys -- (usbhub) DRV - [2008/04/13 18:45:35 \| 000,030,208 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbehci.sys -- (usbehci) DRV - [2008/04/13 18:45:35 \| 000,020,608 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbuhci.sys -- (usbuhci) DRV - [2008/04/13 18:45:34 \| 000,015,104 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbscan.sys -- (usbscan) DRV - [2008/04/13 18:45:27 \| 000,010,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\hidusb.sys -- (HidUsb) DRV - [2008/04/13 18:45:13 \| 000,002,944 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\drmkaud.sys -- (drmkaud) DRV - [2008/04/13 18:45:09 \| 000,172,416 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\kmixer.sys -- (kmixer) DRV - [2008/04/13 18:45:09 \| 000,056,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\swmidi.sys -- (swmidi) DRV - [2008/04/13 18:45:07 \| 000,006,272 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\splitter.sys -- (splitter) DRV - [2008/04/13 18:45:01 \| 000,052,864 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\dmusic.sys -- (DMusic) DRV - [2008/04/13 18:44:48 \| 000,799,744 \| ---- \| M] (Microsoft Corp., Veritas Software) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot) DRV - [2008/04/13 18:44:46 \| 000,153,344 \| ---- \| M] (Microsoft Corp., Veritas Software) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\dmio.sys -- (dmio) DRV - [2008/04/13 18:44:40 \| 000,020,992 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\vga.sys -- (VgaSave) DRV - [2008/04/13 18:41:22 \| 000,018,560 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\i2omp.sys -- (i2omp) DRV - [2008/04/13 18:41:22 \| 000,008,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\i2omgmt.sys -- (i2omgmt) DRV - [2008/04/13 18:41:01 \| 000,052,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\System32\drivers\volsnap.sys -- (VolSnap) DRV - [2008/04/13 18:40:58 \| 000,042,112 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\imapi.sys -- (Imapi) DRV - [2008/04/13 18:40:49 \| 000,019,712 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\System32\drivers\partmgr.sys -- (PartMgr) DRV - [2008/04/13 18:40:48 \| 000,011,392 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\sfloppy.sys -- (Sfloppy) DRV - [2008/04/13 18:40:47 \| 000,036,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\disk.sys -- (Disk) DRV - [2008/04/13 18:40:47 \| 000,011,904 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\sffdisk.sys -- (sffdisk) DRV - [2008/04/13 18:40:47 \| 000,011,008 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\sffp_sd.sys -- (sffp_sd) DRV - [2008/04/13 18:40:46 \| 000,062,976 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\cdrom.sys -- (Cdrom) DRV - [2008/04/13 18:40:31 \| 000,005,376 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\viaide.sys -- (ViaIde) DRV - [2008/04/13 18:40:30 \| 000,096,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\atapi.sys -- (atapi) DRV - [2008/04/13 18:40:29 \| 000,005,504 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\intelide.sys -- (IntelIde) DRV - [2008/04/13 18:40:27 \| 000,057,600 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\redbook.sys -- (redbook) DRV - [2008/04/13 18:40:25 \| 000,027,392 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\fdc.sys -- (Fdc) DRV - [2008/04/13 18:40:25 \| 000,020,480 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\flpydisk.sys -- (Flpydisk) DRV - [2008/04/13 18:40:12 \| 000,015,744 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\serenum.sys -- (serenum) DRV - [2008/04/13 18:40:10 \| 000,080,128 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\parport.sys -- (Parport) DRV - [2008/04/13 18:39:53 \| 000,004,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\swenum.sys -- (swenum) DRV - [2008/04/13 18:39:52 \| 000,007,552 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mskssrv.sys -- (MSKSSRV) DRV - [2008/04/13 18:39:51 \| 000,004,992 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mspqm.sys -- (MSPQM) DRV - [2008/04/13 18:39:50 \| 000,005,376 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mspclock.sys -- (MSPCLOCK) DRV - [2008/04/13 18:39:47 \| 000,024,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\kbdclass.sys -- (Kbdclass) DRV - [2008/04/13 18:39:47 \| 000,023,040 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\mouclass.sys -- (Mouclass) DRV - [2008/04/13 18:39:46 \| 000,384,768 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\update.sys -- (Update) DRV - [2008/04/13 18:39:46 \| 000,042,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\System32\drivers\mountmgr.sys -- (MountMgr) DRV - [2008/04/13 18:36:52 \| 000,073,472 \| ---- \| M] (Microsoft Corporation) [File_System \| Boot] -- C:\WINDOWS\system32\drivers\sr.sys -- (sr) DRV - [2008/04/13 18:36:46 \| 000,015,488 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mssmbios.sys -- (mssmbios) DRV - [2008/04/13 18:36:44 \| 000,079,232 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\sdbus.sys -- (sdbus) DRV - [2008/04/13 18:36:44 \| 000,068,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pci.sys -- (PCI) DRV - [2008/04/13 18:36:43 \| 000,120,192 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pcmcia.sys -- (Pcmcia) DRV - [2008/04/13 18:36:41 \| 000,037,248 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\isapnp.sys -- (isapnp) DRV - [2008/04/13 18:36:40 \| 000,042,240 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\viaagp.sys -- (viaagp) DRV - [2008/04/13 18:36:39 \| 000,044,928 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\agpCPQ.sys -- (agpCPQ) DRV - [2008/04/13 18:36:39 \| 000,043,008 \| ---- \| M] (Advanced Micro Devices, Inc.) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp) DRV - [2008/04/13 18:36:39 \| 000,040,960 \| ---- \| M] (Silicon Integrated Systems Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp) DRV - [2008/04/13 18:36:38 \| 000,042,752 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\alim1541.sys -- (alim1541) DRV - [2008/04/13 18:36:38 \| 000,042,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\agp440.sys -- (agp440) DRV - [2008/04/13 18:36:37 \| 000,013,952 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\cmbatt.sys -- (CmBatt) DRV - [2008/04/13 18:36:37 \| 000,010,240 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\compbatt.sys -- (Compbatt) DRV - [2008/04/13 18:36:35 \| 000,187,776 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\acpi.sys -- (ACPI) DRV - [2008/04/13 18:33:28 \| 000,044,544 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\fips.sys -- (Fips) DRV - [2008/04/13 18:32:59 \| 000,129,792 \| ---- \| M] (Microsoft Corporation) [File_System \| Boot] -- C:\WINDOWS\system32\drivers\fltmgr.sys -- (FltMgr) DRV - [2008/04/13 18:32:51 \| 000,196,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rdpdr.sys -- (rdpdr) DRV - [2008/04/13 18:32:44 \| 000,180,608 \| ---- \| M] (Microsoft Corporation) [File_System \| On_Demand] -- C:\WINDOWS\system32\drivers\mrxdav.sys -- (MRxDAV) DRV - [2008/04/13 18:32:39 \| 000,030,848 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\System32\drivers\npfs.sys -- (Npfs) DRV - [2008/04/13 18:32:39 \| 000,019,072 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\System32\drivers\msfs.sys -- (Msfs) DRV - [2008/04/13 18:32:36 \| 000,066,048 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs) DRV - [2008/04/13 18:31:32 \| 000,036,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\intelppm.sys -- (intelppm) DRV - [2008/04/13 16:39:23 \| 000,142,592 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\AEC.sys -- (aec) DRV - [2008/04/13 16:39:15 \| 000,020,480 \| ---- \| M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2007/02/25 17:10:48 \| 000,005,376 \| --S- \| M] (Gteko Ltd.) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv) DRV - [2006/10/05 21:07:28 \| 000,004,736 \| ---- \| M] (Gteko Ltd.) [Kernel \| On_Demand] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct) DRV - [2006/09/29 02:00:34 \| 000,082,944 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\WudfRd.sys -- (WudfRd) DRV - [2006/09/29 01:55:50 \| 000,077,568 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\WudfPf.sys -- (WudfPf) DRV - [2005/09/01 20:12:06 \| 000,008,552 \| ---- \| M] (Windows (R) 2000 DDK provider) [Kernel \| Auto] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM) DRV - [2005/09/01 19:55:11 \| 000,017,056 \| ---- \| M] (Meetinghouse Data Communications) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\AegisP.sys -- (AegisP) AEGIS Protocol (IEEE 802.1x) DRV - [2005/03/11 03:56:06 \| 000,273,168 \| ---- \| M] (SigmaTel, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97) DRV - [2005/02/15 20:02:58 \| 000,804,317 \| ---- \| M] (Intel Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ialmnt5.sys -- (ialm) DRV - [2005/01/26 07:03:00 \| 000,020,576 \| ---- \| M] (Sonic Solutions) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pxhelp20.sys -- (PxHelp20) DRV - [2004/12/06 06:05:00 \| 000,100,603 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\dla\tfsnudfa.sys -- (tfsnudfa) DRV - [2004/12/06 06:05:00 \| 000,098,714 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\dla\tfsnudf.sys -- (tfsnudf) DRV - [2004/12/06 06:05:00 \| 000,086,586 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\dla\tfsnifs.sys -- (tfsnifs) DRV - [2004/12/06 06:05:00 \| 000,034,843 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\dla\tfsncofs.sys -- (tfsncofs) DRV - [2004/12/06 06:05:00 \| 000,025,883 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\dla\tfsnboio.sys -- (tfsnboio) DRV - [2004/12/06 06:05:00 \| 000,015,227 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\dla\tfsnopio.sys -- (tfsnopio) DRV - [2004/12/06 06:05:00 \| 000,006,363 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\dla\tfsnpool.sys -- (tfsnpool) DRV - [2004/12/06 06:05:00 \| 000,004,123 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\dla\tfsndrct.sys -- (tfsndrct) DRV - [2004/12/06 06:05:00 \| 000,002,239 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\dla\tfsndres.sys -- (tfsndres) DRV - [2004/12/01 08:22:00 \| 000,087,488 \| ---- \| M] (Sonic Solutions) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\drvmcdb.sys -- (drvmcdb) DRV - [2004/11/23 07:56:00 \| 000,040,480 \| ---- \| M] (Sonic Solutions) [File_System \| Auto] -- C:\WINDOWS\system32\drivers\drvnddm.sys -- (drvnddm) DRV - [2004/11/16 21:03:52 \| 000,108,791 \| ---- \| M] (Alps Electric Co., Ltd.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService) DRV - [2004/10/22 01:56:04 \| 003,210,496 \| ---- \| M] (Intel® Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R) DRV - [2004/08/31 13:53:04 \| 000,011,354 \| ---- \| M] (Intel Corporation) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans) DRV - [2004/08/18 19:53:54 \| 000,016,128 \| ---- \| M] (Dell Inc) [Kernel \| System] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV) DRV - [2004/08/12 13:44:04 \| 000,234,496 \| ---- \| M] (Intel Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\iwca.sys -- (IWCA) DRV - [2004/08/04 10:00:00 \| 000,032,896 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ipfltdrv.sys -- (IpFilterDriver) DRV - [2004/08/04 10:00:00 \| 000,032,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nwlnkfwd.sys -- (NwlnkFwd) DRV - [2004/08/04 10:00:00 \| 000,018,688 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\cdaudio.sys -- (Cdaudio) DRV - [2004/08/04 10:00:00 \| 000,017,792 \| ---- \| M] (Parallel Technologies, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2004/08/04 10:00:00 \| 000,016,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\raspti.sys -- (Raspti) DRV - [2004/08/04 10:00:00 \| 000,012,416 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nwlnkflt.sys -- (NwlnkFlt) DRV - [2004/08/04 10:00:00 \| 000,011,648 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\System32\drivers\acpiec.sys -- (ACPIEC) DRV - [2004/08/04 10:00:00 \| 000,008,832 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\rasacd.sys -- (RasAcd) DRV - [2004/08/04 10:00:00 \| 000,007,936 \| ---- \| M] (Microsoft Corporation) [Recognizer \| System] -- C:\WINDOWS\System32\drivers\fs_rec.sys -- (Fs_Rec) DRV - [2004/08/04 10:00:00 \| 000,006,784 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\System32\drivers\parvdm.sys -- (ParVdm) DRV - [2004/08/04 10:00:00 \| 000,005,888 \| ---- \| M] (Microsoft Corp., Veritas Software.) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\dmload.sys -- (dmload) DRV - [2004/08/04 10:00:00 \| 000,004,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\rdpcdd.sys -- (RDPCDD) DRV - [2004/08/04 10:00:00 \| 000,004,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\mnmdd.sys -- (mnmdd) DRV - [2004/08/04 10:00:00 \| 000,004,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\beep.sys -- (Beep) DRV - [2004/08/04 10:00:00 \| 000,002,944 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\null.sys -- (Null) DRV - [2004/08/04 10:00:00 \| 000,002,864 \| ---- \| M] (Microsoft Corporation) [Adapter \| On_Demand] -- C:\WINDOWS\System32\winsock.dll -- (Winsock) DRV - [2004/08/04 03:29:56 \| 001,897,408 \| ---- \| M] (NVIDIA Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2004/07/14 16:29:04 \| 000,005,627 \| ---- \| M] (Sonic Solutions) [File_System \| System] -- C:\WINDOWS\system32\drivers\sscdbhk5.sys -- (sscdbhk5) DRV - [2004/07/14 16:28:50 \| 000,023,545 \| ---- \| M] (Sonic Solutions) [File_System \| System] -- C:\WINDOWS\system32\drivers\ssrtln.sys -- (ssrtln) DRV - [2004/06/18 01:57:02 \| 000,200,064 \| ---- \| M] (Conexant Systems, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH) DRV - [2004/06/18 01:55:38 \| 000,685,056 \| ---- \| M] (Conexant Systems, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf) DRV - [2004/06/18 01:55:04 \| 001,041,536 \| ---- \| M] (Conexant Systems, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP) DRV - [2004/05/27 01:18:18 \| 000,044,928 \| ---- \| M] (Broadcom Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp) DRV - [2004/03/17 23:04:14 \| 000,013,059 \| ---- \| M] (Conexant) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\mdmxsdk.sys -- (mdmxsdk) DRV - [2004/02/13 21:46:00 \| 000,017,153 \| ---- \| M] (Dell Inc) [Kernel \| System] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci) DRV - [2001/08/17 19:07:44 \| 000,025,952 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\hpn.sys -- (hpn) DRV - [2001/08/17 19:07:44 \| 000,020,192 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\dpti2o.sys -- (dpti2o) DRV - [2001/08/17 19:07:44 \| 000,019,072 \| ---- \| M] (Adaptec, Inc.) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow) DRV - [2001/08/17 19:07:42 \| 000,030,688 \| ---- \| M] (LSI Logic) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3) DRV - [2001/08/17 19:07:42 \| 000,005,504 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\perc2hib.sys -- (perc2hib) DRV - [2001/08/17 19:07:40 \| 000,028,384 \| ---- \| M] (LSI Logic) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi) DRV - [2001/08/17 19:07:40 \| 000,027,296 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\perc2.sys -- (perc2) DRV - [2001/08/17 19:07:38 \| 000,056,960 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\aic78xx.sys -- (aic78xx) DRV - [2001/08/17 19:07:36 \| 000,055,168 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\aic78u2.sys -- (aic78u2) DRV - [2001/08/17 19:07:36 \| 000,032,640 \| ---- \| M] (LSI Logic) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx) DRV - [2001/08/17 19:07:34 \| 000,016,256 \| ---- \| M] (Symbios Logic Inc.) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810) DRV - [2001/08/17 19:07:32 \| 000,101,888 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\adpu160m.sys -- (adpu160m) DRV - [2001/08/17 18:59:44 \| 000,003,072 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\audstub.sys -- (audstub) DRV - [2001/08/17 18:52:22 \| 000,036,736 \| ---- \| M] (Promise Technology, Inc.) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra) DRV - [2001/08/17 18:52:20 \| 000,045,312 \| ---- \| M] (QLogic Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160) DRV - [2001/08/17 18:52:20 \| 000,040,320 \| ---- \| M] (QLogic Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080) DRV - [2001/08/17 18:52:18 \| 000,049,024 \| ---- \| M] (QLogic Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280) DRV - [2001/08/17 18:52:16 \| 000,179,584 \| ---- \| M] (Mylex Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k) DRV - [2001/08/17 18:52:16 \| 000,040,448 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\ql1240.sys -- (ql1240) DRV - [2001/08/17 18:52:16 \| 000,033,152 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\ql10wnt.sys -- (Ql10wnt) DRV - [2001/08/17 18:52:16 \| 000,014,720 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\dac960nt.sys -- (dac960nt) DRV - [2001/08/17 18:52:12 \| 000,017,280 \| ---- \| M] (American Megatrends Inc.) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x) DRV - [2001/08/17 18:52:08 \| 000,016,000 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\ini910u.sys -- (ini910u) DRV - [2001/08/17 18:52:08 \| 000,013,952 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k) DRV - [2001/08/17 18:52:08 \| 000,013,952 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\cbidf2k.sys -- (cbidf) DRV - [2001/08/17 18:52:06 \| 000,014,976 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\cpqarray.sys -- (Cpqarray) DRV - [2001/08/17 18:52:06 \| 000,007,680 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys -- (cd20xrnt) DRV - [2001/08/17 18:52:04 \| 000,022,400 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\asc3350p.sys -- (asc3350p) DRV - [2001/08/17 18:52:04 \| 000,012,032 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\amsint.sys -- (amsint) DRV - [2001/08/17 18:52:02 \| 000,012,800 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\aha154x.sys -- (Aha154x) DRV - [2001/08/17 18:52:00 \| 000,026,496 \| ---- \| M] (Advanced System Products, Inc.) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc) DRV - [2001/08/17 18:52:00 \| 000,023,552 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS -- (abp480n5) DRV - [2001/08/17 18:51:58 \| 000,014,848 \| ---- \| M] (Advanced System Products, Inc.) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550) DRV - [2001/08/17 18:51:56 \| 000,005,248 \| ---- \| M] (Acer Laboratories Inc.) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde) DRV - [2001/08/17 18:51:56 \| 000,004,992 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\toside.sys -- (TosIde) DRV - [2001/08/17 18:51:54 \| 000,006,656 \| ---- \| M] (CMD Technology, Inc.) [Kernel \| Disabled] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde) DRV - [2001/08/17 18:51:52 \| 000,003,328 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pciide.sys -- (PCIIde) DRV - [2001/08/17 17:12:10 \| 000,117,760 \| ---- \| M] (Intel Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\e100b325.sys -- (E100B) Intel(R) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway IE - HKU\Administrator_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Carol_Clark_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://att.net IE - HKU\Carol_Clark_ON_C\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKU\Carol_Clark_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKU\Carol_Clark_ON_C\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\Carol_Clark_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.net IE - HKU\Carol_Clark_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Carol_Clark_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\Carol_Clark_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = IE - HKU\Carol_Clark_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6092 FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2008/12/19 18:51:56 \| 000,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\extensions\\{21C89119-F9AC-4DA7-B6EE-C1506EF30468}: C:\Documents and Settings\Carol Clark\Local Settings\Application Data\{21C89119-F9AC-4DA7-B6EE-C1506EF30468} [2010/09/11 06:13:25 \| 000,000,000 \| ---D \| M] O1 HOSTS File: ([2004/08/04 10:00:00 \| 000,000,734 \| ---- \| M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found. O3 - HKU\Carol_Clark_ON_C\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKU\Carol_Clark_ON_C\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe (Lavasoft AB) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [Bteqidupayazad] C:\WINDOWS\urufodiz.DLL File not found O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe () O4 - HKLM..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe (Sonic Solutions) O4 - HKLM..\Run: [DVDLauncher] C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe (CyberLink Corp.) O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 6300 Series\ezprint.exe (Lexmark International Inc.) O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation) O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [LXCDCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCDtime.DLL () O4 - HKLM..\Run: [lxcdmon.exe] C:\Program Files\Lexmark 6300 Series\lxcdmon.exe (Lexmark International, Inc.) O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mmtask] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe (Musicmatch Inc.) O4 - HKLM..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.) O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\Media Experience\PCMService.exe (CyberLink Corp.) O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.) O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKU\Administrator_ON_C..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\Administrator_ON_C..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.) O4 - HKU\Administrator_ON_C..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKU\Carol_Clark_ON_C..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\Carol_Clark_ON_C..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.) O4 - HKU\Carol_Clark_ON_C..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - HKU\Carol_Clark_ON_C..\Run: [qfrumbrr] C:\Documents and Settings\Carol Clark\Local Settings\Application Data\sqraclovp\uwhypujuqiw.exe File not found O4 - HKU\Carol_Clark_ON_C..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.) O4 - HKU\Carol_Clark_ON_C..\Run: [Ymicodokakejupec] C:\WINDOWS\drwpslts.DLL File not found O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit, Inc.) O4 - Startup: C:\Documents and Settings\Carol Clark\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Carol_Clark_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) O9 - Extra Button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - File not found O9 - Extra 'Tools' menuitem : xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} http://www.musicnotes.com/download/mnviewer.cab (Musicnotes Viewer) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/pThis is the extras log ----- OTL Extras logfile created on: 9/19/2010 8:05:54 PM - Run OTLPE by OldTimer - Version 3.1.40.0 Folder = D:\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 503.00 Mb Total Physical Memory \| 364.00 Mb Available Physical Memory \| 72.00% Memory free 471.00 Mb Paging File \| 400.00 Mb Available in Paging File \| 85.00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 71.11 Gb Total Space \| 60.42 Gb Free Space \| 84.97% Space Free \| Partition Type: NTFS Drive D: \| 980.72 Mb Total Space \| 978.61 Mb Free Space \| 99.78% Space Free \| Partition Type: FAT E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive X: \| 178.79 Mb Total Space \| 0.00 Mb Free Space \| 0.00% Space Free \| Partition Type: CDFS Computer Name: BARTPE-21130 Current User Name: SYSTEM Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard Using ControlSet: ControlSet001 ========== Extra Registry (All) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\] .chm [ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation) .cpl [ = cplfile] -- C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) .hlp [ = hlpfile] -- C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation) .hta [ = htafile] -- C:\WINDOWS\System32\mshta.exe (Microsoft Corporation) .html [ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) .inf [ = inffile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation) .ini [ = inifile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation) .url [ = InternetShortcut] -- C:\WINDOWS\system32\ieframe.DLL (Microsoft Corporation) .js [ = JSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .jse [ = JSEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .reg [ = regfile] -- C:\WINDOWS\regedit.exe (Microsoft Corporation) .txt [ = txtfile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation) .vbe [ = VBEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .vbs [ = VBSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .wsf [ = WSFFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .wsh [ = WSHFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command] batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation) batfile [open] -- "%1" %* batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation) chm.file [open] -- "C:\WINDOWS\hh.exe" %1 (Microsoft Corporation) cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation) cmdfile [open] -- "%1" %* cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation) comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- winhlp32.exe %1 (Microsoft Corporation) hlpfile [open] -- %SystemRoot%\System32\winhlp32.exe %1 (Microsoft Corporation) htafile [open] -- C:\WINDOWS\system32\mshta.exe "%1" %* (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) htmlfile [print] -- "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation) inffile [open] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation) inffile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation) inifile [open] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation) inifile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation) InternetShortcut [open] -- "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) jsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation) jsfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation) jsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation) jsefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation) jsefile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation) jsefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation) piffile [open] -- "%1" %* regfile [edit] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation) regfile [open] -- regedit.exe "%1" (Microsoft Corporation) regfile [merge] -- Reg Error: Key error. regfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation) scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation) txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation) txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation) vbefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation) vbefile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation) vbefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation) vbsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation) vbsfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation) vbsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation) wsffile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation) wsffile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation) wsffile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation) wshfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation) Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe::enabled:xpsp2res.dll,-22019 -- (Microsoft Corporation) "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe::Enabled:AOL -- File not found "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe::Enabled:AOL -- File not found "C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe::Enabled:AOL -- File not found "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe::Enabled:xpsp3res.dll,-20000 -- (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe::Disabled:AOL -- File not found "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe::Disabled:AOL -- File not found "C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe::Disabled:AOL -- File not found "C:\WINDOWS\system32\sessmgr.exe" = C:\WINDOWS\system32\sessmgr.exe::Disabled:xpsp2res.dll,-22019 -- (Microsoft Corporation) "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe::Enabled:xpsp3res.dll,-20000 -- (Microsoft Corporation) "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe::enabled:xpsp2res.dll,-22019 -- (Microsoft Corporation) "C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe::Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation) "C:\WINDOWS\system32\rundll32.exe" = C:\WINDOWS\system32\rundll32.exe::Enabled:Run a DLL as an App -- (Microsoft Corporation) "C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe::Enabled:Skype -- (Skype Technologies S.A.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player "{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}" = mSSO "{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data "{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView "{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA "{14374619-0900-4056-BA06-C87C900AF9E6}" = QuickBooks Simple Start Special Edition "{1F528948-0E80-4C96-B455-DE4167CB1DF7}" = Internal Network Card Power Management "{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD LE "{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe "{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Dell Media Experience "{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java(TM) 6 Update 10 "{2CD2C0DB-81C3-416B-9FA6-589B9235359B}" = OpenOffice.org 2.4 "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager "{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4 "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10 "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZeroInstallers "{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page "{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting "{4192EAC0-6B36-4723-B216-D0E86E7757AC}" = Jasc Paint Shop Photo Album 5 "{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}" = mHlpDell "{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features "{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool "{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon "{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Management Programs 2 "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5 "{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A}" = mCore "{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer "{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626}" = mIWCA "{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03 "{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore "{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver for Mobile "{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr "{8EF1122E-E90C-4EE9-AB0C-7FDE2BA42C26}" = Musicmatch® Jukebox "{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz "{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig "{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML "{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver "{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio "{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0 "{AF06CAE4-C134-44B1-B699-14FBDB63BD37}" = Dell Picture Studio v3.0 "{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy "{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet "{CA9BAADB-C262-4E05-B2E2-CEE8CE9809EC}" = mToolkit "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1 "{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware "{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect "{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player "{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse "{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi "{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "ATT-RC" = ATT-RC Self Support Tool "avast5" = avast! Free Antivirus "CCleaner" = CCleaner "CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1" = Conexant D110 MDC V.9x Modem "Dell Photo AIO Printer 942" = Dell Photo AIO Printer 942 "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "InstallShield_{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Management Programs 2 "Lexmark 6300 Series" = Lexmark 6300 Series "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "ProInst" = Intel(R) PROSet/Wireless Software "QuickTime" = QuickTime "RealPlayer 6.0" = RealPlayer Basic "StreetPlugin" = Learn2 Player (Uninstall Only) "ViewpointMediaPlayer" = Viewpoint Media Player "WebCyberCoach_wtrb" = WebCyberCoach 3.2 Dell "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "Windows XP Service Pack" = Windows XP Service Pack 3 "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 < End of report > Just saw part of the first log was cut off O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_03) O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10) O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com) O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation) O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation) O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation) O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O20 - Winlogon\Notify\IntelWireless: DllName - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation) O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O24 - Desktop Components:0 (My Current Home Page) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation) O30 - LSA: AUTHENTICATION Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004/08/10 18:04:08 \| 000,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2004/11/02 22:04:58 \| 000,000,046 \| R--- \| M] () - X:\autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk ) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe () O35 - HKLM\..comfile [open] -- "%1" % O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [ = comfile] -- "%1" %* O37 - HKLM\...exe [ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/09/18 04:38:42 \| 000,000,000 \| ---D \| C] -- C:\hello [2010/09/15 05:04:37 \| 000,000,000 \| RH-D \| C] -- C:\Documents and Settings\Administrator\Recent [2010/09/14 21:25:45 \| 000,165,584 \| ---- \| C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys [2010/09/14 21:25:45 \| 000,017,744 \| ---- \| C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys [2010/09/14 21:25:43 \| 000,023,376 \| ---- \| C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys [2010/09/14 21:25:42 \| 000,046,672 \| ---- \| C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys [2010/09/14 21:25:40 \| 000,100,176 \| ---- \| C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys [2010/09/14 21:25:40 \| 000,094,544 \| ---- \| C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys [2010/09/14 21:25:40 \| 000,028,880 \| ---- \| C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys [2010/09/14 21:25:27 \| 000,038,848 \| ---- \| C] (AVAST Software) -- C:\WINDOWS\avastSS.scr [2010/09/14 21:25:25 \| 000,167,592 \| ---- \| C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe [2010/09/14 21:22:12 \| 000,000,000 \| -H-D \| C] -- C:\WINDOWS\PIF [2010/09/14 19:42:05 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com [2010/09/14 19:41:32 \| 000,000,000 \| ---D \| C] -- C:\Program Files\SUPERAntiSpyware [2010/09/14 19:40:43 \| 000,000,000 \| ---D \| C] -- C:\Program Files\CCleaner [2010/09/14 19:39:59 \| 003,427,248 \| ---- \| C] (Piriform Ltd) -- C:\Documents and Settings\Administrator\Desktop\Jcc.exe [2010/09/14 19:38:45 \| 006,078,120 \| ---- \| C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Administrator\Desktop\Johnmb.exe [2010/09/14 19:34:28 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Alwil Software [2010/09/12 02:45:52 \| 000,000,000 \| ---D \| C] -- C:\WINDOWS\pss [2010/09/12 01:26:17 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Carol Clark\Application Data\Malwarebytes [2010/09/11 23:30:43 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes [2010/09/11 23:30:34 \| 000,038,224 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/09/11 23:30:25 \| 000,020,952 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/09/11 23:30:25 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/09/11 22:06:14 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Application Data\Macromedia [2010/09/11 22:06:12 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Application Data\Adobe [2010/09/11 21:58:14 \| 000,000,000 \| -HSD \| C] -- C:\Documents and Settings\Administrator\PrivacIE [2010/09/11 21:57:43 \| 000,000,000 \| -HSD \| C] -- C:\Documents and Settings\Administrator\IETldCache [2010/09/11 21:46:17 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Application Data\Intel [2010/09/11 21:46:17 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Application Data\Identities [2010/09/11 21:46:16 \| 000,000,000 \| --SD \| C] -- C:\Documents and Settings\Administrator\Application Data\Microsoft [2010/09/11 21:46:16 \| 000,000,000 \| RH-D \| C] -- C:\Documents and Settings\Administrator\Application Data [2010/09/11 21:46:16 \| 000,000,000 \| R--D \| C] -- C:\Documents and Settings\Administrator\Favorites [2010/09/11 21:46:16 \| 000,000,000 \| -HSD \| C] -- C:\Documents and Settings\Administrator\Cookies [2010/09/11 21:46:16 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Application Data\Sun [2010/09/11 21:46:16 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Desktop [2010/09/11 21:46:15 \| 000,000,000 \| -H-D \| C] -- C:\Documents and Settings\Administrator\Local Settings [2010/09/11 21:46:15 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft [2010/09/11 21:46:15 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\BVRP Software [2010/09/11 21:46:15 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\ApplicationHistory [2010/09/11 21:46:15 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030} [2010/09/11 21:46:14 \| 000,000,000 \| RH-D \| C] -- C:\Documents and Settings\Administrator\SendTo [2010/09/11 21:46:14 \| 000,000,000 \| R--D \| C] -- C:\Documents and Settings\Administrator\Start Menu [2010/09/11 21:46:14 \| 000,000,000 \| R--D \| C] -- C:\Documents and Settings\Administrator\My Documents\My Videos [2010/09/11 21:46:14 \| 000,000,000 \| R--D \| C] -- C:\Documents and Settings\Administrator\My Documents\My Pictures [2010/09/11 21:46:14 \| 000,000,000 \| R--D \| C] -- C:\Documents and Settings\Administrator\My Documents\My Music [2010/09/11 21:46:14 \| 000,000,000 \| R--D \| C] -- C:\Documents and Settings\Administrator\My Documents [2010/09/11 21:46:14 \| 000,000,000 \| -H-D \| C] -- C:\Documents and Settings\Administrator\Templates [2010/09/11 21:46:14 \| 000,000,000 \| -H-D \| C] -- C:\Documents and Settings\Administrator\PrintHood [2010/09/11 21:46:14 \| 000,000,000 \| -H-D \| C] -- C:\Documents and Settings\Administrator\NetHood [2010/09/11 06:16:11 \| 000,000,000 \| -HSD \| C] -- C:\Documents and Settings\NetworkService\IETldCache [2010/09/11 06:13:25 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Carol Clark\Local Settings\Application Data\{21C89119-F9AC-4DA7-B6EE-C1506EF30468} [2010/09/11 06:11:53 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Carol Clark\Local Settings\Application Data\sqraclovp [2010/09/11 06:11:00 \| 000,000,000 \| ---D \| C] -- C:\WINDOWS\Sun [2 C:\WINDOWS\System32\.tmp files -> C:\WINDOWS\System32\.tmp -> ] [2 C:\WINDOWS\.tmp files -> C:\WINDOWS\.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/09/19 20:04:51 \| 000,786,432 \| -H-- \| M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT [2010/09/15 05:02:07 \| 000,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2010/09/15 05:00:46 \| 000,262,144 \| -H-- \| M] () -- C:\Documents and Settings\NetworkService\NTUSER.DAT [2010/09/15 05:00:39 \| 000,000,178 \| -HS- \| M] () -- C:\Documents and Settings\Administrator\ntuser.ini [2010/09/15 05:00:34 \| 003,712,656 \| -H-- \| M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db [2010/09/14 21:25:40 \| 000,002,626 \| ---- \| M] () -- C:\WINDOWS\System32\CONFIG.NT [2010/09/14 19:40:43 \| 000,000,682 \| ---- \| M] () -- C:\Documents and Settings\Administrator\Desktop\CCleaner.lnk [2010/09/14 19:22:33 \| 029,468,568 \| ---- \| M] () -- C:\Documents and Settings\Administrator\Desktop\john1tmp.exe [2010/09/14 19:13:18 \| 006,078,120 \| ---- \| M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Administrator\Desktop\Johnmb.exe [2010/09/14 17:35:35 \| 001,402,880 \| ---- \| M] () -- C:\Documents and Settings\Administrator\Desktop\hiJohn.msi [2010/09/14 17:32:53 \| 003,427,248 \| ---- \| M] (Piriform Ltd) -- C:\Documents and Settings\Administrator\Desktop\Jcc.exe [2010/09/14 17:03:57 \| 000,262,144 \| -H-- \| M] () -- C:\Documents and Settings\LocalService\NTUSER.DAT [2010/09/14 17:03:53 \| 000,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2010/09/14 17:03:52 \| 003,145,728 \| -H-- \| M] () -- C:\Documents and Settings\Carol Clark\NTUSER.DAT [2010/09/14 17:03:52 \| 000,000,178 \| -HS- \| M] () -- C:\Documents and Settings\Carol Clark\ntuser.ini [2010/09/14 16:58:15 \| 000,000,000 \| ---- \| M] () -- C:\WINDOWS\Vfepucivireban.bin [2010/09/14 16:51:32 \| 000,000,211 \| RHS- \| M] () -- C:\boot.ini [2010/09/14 16:51:31 \| 000,000,491 \| ---- \| M] () -- C:\WINDOWS\win.ini [2010/09/14 16:51:31 \| 000,000,227 \| ---- \| M] () -- C:\WINDOWS\system.ini [2010/09/14 16:49:45 \| 000,002,206 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2010/09/12 02:43:07 \| 000,034,840 \| ---- \| M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT [2010/09/12 01:53:32 \| 000,000,178 \| -HS- \| M] () -- C:\Documents and Settings\LocalService\ntuser.ini [2010/09/11 06:13:26 \| 000,000,120 \| ---- \| M] () -- C:\WINDOWS\Uyebinireyiluy.dat [2010/09/08 17:53:49 \| 000,019,996 \| ---- \| M] () -- C:\Documents and Settings\Carol Clark\My Documents\J&J.odt [2010/09/07 15:12:17 \| 000,038,848 \| ---- \| M] (AVAST Software) -- C:\WINDOWS\avastSS.scr [2010/09/07 15:11:54 \| 000,167,592 \| ---- \| M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe [2010/09/07 14:52:25 \| 000,046,672 \| ---- \| M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys [2010/09/07 14:52:03 \| 000,165,584 \| ---- \| M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys [2010/09/07 14:47:46 \| 000,023,376 \| ---- \| M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys [2010/09/07 14:47:19 \| 000,100,176 \| ---- \| M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys [2010/09/07 14:47:16 \| 000,094,544 \| ---- \| M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys [2010/09/07 14:47:07 \| 000,017,744 \| ---- \| M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys [2010/09/07 14:46:51 \| 000,028,880 \| ---- \| M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys [2010/09/03 19:09:43 \| 000,017,867 \| ---- \| M] () -- C:\Documents and Settings\Carol Clark\My Documents\Kindred Hearts and Friends.odt [2010/09/03 15:13:23 \| 000,015,077 \| ---- \| M] () -- C:\Documents and Settings\Carol Clark\My Documents\It Will Get Better.rtf [2010/09/03 14:06:12 \| 000,054,156 \| -H-- \| M] () -- C:\WINDOWS\QTFont.qfn [2010/09/03 14:06:12 \| 000,001,409 \| ---- \| M] () -- C:\WINDOWS\QTFont.for [2010/09/02 21:27:10 \| 000,162,763 \| ---- \| M] () -- C:\Documents and Settings\Carol Clark\Desktop\Dear Jordan.docx [2010/08/31 02:05:29 \| 000,073,728 \| ---- \| M] () -- C:\Documents and Settings\Carol Clark\Desktop\Carol payment calc.xls [2 C:\WINDOWS\System32\.tmp files -> C:\WINDOWS\System32\.tmp -> ] [2 C:\WINDOWS\.tmp files -> C:\WINDOWS\.tmp -> ] ========== Files Created - No Company Name ========== [2010/09/14 21:31:05 \| 001,402,880 \| ---- \| C] () -- C:\Documents and Settings\Administrator\Desktop\hiJohn.msi [2010/09/14 19:40:43 \| 000,000,682 \| ---- \| C] () -- C:\Documents and Settings\Administrator\Desktop\CCleaner.lnk [2010/09/14 19:36:57 \| 029,468,568 \| ---- \| C] () -- C:\Documents and Settings\Administrator\Desktop\john1tmp.exe [2010/09/11 21:47:16 \| 000,000,669 \| ---- \| C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\America Online 9.0.lnk [2010/09/11 21:47:15 \| 000,001,769 \| ---- \| C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Musicmatch Jukebox.lnk [2010/09/11 21:47:15 \| 000,000,742 \| ---- \| C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk [2010/09/11 21:47:15 \| 000,000,683 \| ---- \| C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [2010/09/11 21:47:15 \| 000,000,079 \| ---- \| C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf [2010/09/11 21:46:14 \| 000,020,480 \| -H-- \| C] () -- C:\Documents and Settings\Administrator\ntuser.dat.LOG [2010/09/11 21:46:14 \| 000,000,178 \| -HS- \| C] () -- C:\Documents and Settings\Administrator\ntuser.ini [2010/09/11 21:46:13 \| 000,786,432 \| -H-- \| C] () -- C:\Documents and Settings\Administrator\NTUSER.DAT [2010/09/11 06:13:27 \| 000,000,000 \| ---- \| C] () -- C:\WINDOWS\Vfepucivireban.bin [2010/09/11 06:13:26 \| 000,000,120 \| ---- \| C] () -- C:\WINDOWS\Uyebinireyiluy.dat [2010/09/03 14:06:12 \| 000,054,156 \| -H-- \| C] () -- C:\WINDOWS\QTFont.qfn [2010/09/03 14:06:12 \| 000,001,409 \| ---- \| C] () -- C:\WINDOWS\QTFont.for [2010/09/02 21:27:10 \| 000,162,763 \| ---- \| C] () -- C:\Documents and Settings\Carol Clark\Desktop\Dear Jordan.docx [2009/12/21 07:54:31 \| 000,638,976 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdpmui.dll [2009/12/21 07:54:30 \| 001,183,744 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdserv.dll [2009/12/21 07:54:30 \| 001,134,592 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdusb1.dll [2009/12/21 07:54:30 \| 000,770,048 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdhbn3.dll [2009/12/21 07:54:30 \| 000,704,512 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdcomc.dll [2009/12/21 07:54:30 \| 000,483,328 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdlmpm.dll [2009/12/21 07:54:30 \| 000,413,696 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdcomm.dll [2009/12/21 07:54:30 \| 000,155,648 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdprox.dll [2009/12/21 07:54:30 \| 000,114,688 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdpplc.dll [2009/12/21 07:54:30 \| 000,040,960 \| ---- \| C] () -- C:\WINDOWS\System32\lxcdvs.dll [2008/10/08 22:39:10 \| 000,005,632 \| ---- \| C] () -- C:\Documents and Settings\Carol Clark\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/10/05 06:34:46 \| 000,000,583 \| ---- \| C] () -- C:\WINDOWS\dellstat.ini [2008/10/05 06:32:32 \| 000,176,128 \| ---- \| C] () -- C:\WINDOWS\System32\dlbuinsb.dll [2008/10/05 06:32:32 \| 000,077,824 \| ---- \| C] () -- C:\WINDOWS\System32\dlbucub.dll [2008/10/05 06:32:31 \| 000,139,264 \| ---- \| C] () -- C:\WINDOWS\System32\dlbuins.dll [2008/10/05 06:32:31 \| 000,098,304 \| ---- \| C] () -- C:\WINDOWS\System32\dlbuinsr.dll [2008/10/05 06:32:31 \| 000,040,960 \| ---- \| C] () -- C:\WINDOWS\System32\dlbuvs.dll [2008/10/05 06:32:30 \| 000,069,632 \| ---- \| C] () -- C:\WINDOWS\System32\dlbucu.dll [2008/10/05 06:32:30 \| 000,032,768 \| ---- \| C] () -- C:\WINDOWS\System32\dlbucur.dll [2008/10/05 06:32:29 \| 000,135,168 \| ---- \| C] () -- C:\WINDOWS\System32\dlbujswr.dll [2008/10/05 06:32:25 \| 000,397,312 \| ---- \| C] () -- C:\WINDOWS\System32\dlbuutil.dll [2008/10/04 17:14:47 \| 000,000,002 \| ---- \| C] () -- C:\WINDOWS\msoffice.ini [2008/10/04 17:02:42 \| 003,145,728 \| -H-- \| C] () -- C:\Documents and Settings\Carol Clark\NTUSER.DAT [2008/10/04 17:02:42 \| 000,008,192 \| -H-- \| C] () -- C:\Documents and Settings\Carol Clark\ntuser.dat.LOG [2008/10/04 17:02:42 \| 000,000,178 \| -HS- \| C] () -- C:\Documents and Settings\Carol Clark\ntuser.ini [2007/01/22 12:19:00 \| 000,069,632 \| ---- \| C] () -- C:\WINDOWS\System32\dlbucfg.dll [2005/09/01 20:22:04 \| 000,000,061 \| ---- \| C] () -- C:\WINDOWS\smscfg.ini [2005/09/01 20:16:05 \| 000,000,138 \| ---- \| C] () -- C:\WINDOWS\wininit.ini [2005/09/01 20:03:35 \| 000,000,376 \| ---- \| C] () -- C:\WINDOWS\ODBC.INI [2005/09/01 19:38:21 \| 000,262,144 \| ---- \| C] () -- C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT [2005/09/01 19:38:21 \| 000,008,192 \| -H-- \| C] () -- C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG [2005/09/01 19:33:24 \| 000,192,512 \| ---- \| C] () -- C:\WINDOWS\System32\stac97co.dll [2005/09/01 19:32:18 \| 000,000,372 \| ---- \| C] () -- C:\WINDOWS\System32\OEMINFO.INI [2005/05/25 18:07:26 \| 000,061,440 \| ---- \| C] () -- C:\WINDOWS\System32\dlbucnv4.dll [2005/04/09 22:04:54 \| 000,000,000 \| ---- \| C] () -- C:\WINDOWS\System32\px.ini [2004/08/12 13:44:10 \| 000,016,384 \| ---- \| C] () -- C:\WINDOWS\System32\iwca.dll [2004/08/11 01:08:13 \| 000,262,144 \| -H-- \| C] () -- C:\Documents and Settings\NetworkService\NTUSER.DAT [2004/08/11 01:08:13 \| 000,262,144 \| -H-- \| C] () -- C:\Documents and Settings\LocalService\NTUSER.DAT [2004/08/10 18:12:05 \| 000,000,780 \| ---- \| C] () -- C:\WINDOWS\orun32.ini [2004/08/10 18:08:14 \| 000,008,192 \| -H-- \| C] () -- C:\Documents and Settings\LocalService\ntuser.dat.LOG [2004/08/10 18:08:14 \| 000,000,178 \| -HS- \| C] () -- C:\Documents and Settings\LocalService\ntuser.ini [2004/08/10 18:08:13 \| 000,008,192 \| -H-- \| C] () -- C:\Documents and Settings\NetworkService\ntuser.dat.LOG [2004/08/10 18:08:13 \| 000,000,020 \| -HS- \| C] () -- C:\Documents and Settings\NetworkService\ntuser.ini [2004/08/10 18:01:18 \| 000,001,793 \| ---- \| C] () -- C:\WINDOWS\System32\fxsperf.ini < End of report > I fixed it. from my boot cd I replaced Windows\System32\smss.exe, Windows\System32\ntdll.dll, and Windows\System32\ntoskrnl.exe Then I reloaded all the drivers in Windows\System32\drivers. The system boots again.

Discussion

No Comment Found

Related InterviewSolutions