Hi,
These are the 2 logs from OTL. The other scan log could not be saved or found.
Thanks.
JG
OTL logfile created on: 10/1/2011 4:08:40 PM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\rdiadmin\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.99 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 67.03% Memory free
3.84 Gb Paging File | 3.33 Gb Available in Paging File | 86.73% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.02 Gb Total Space | 93.20 Gb Free Space | 62.54% Space Free | Partition Type: NTFS
Computer Name: JAKE | User Name: Jake | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ========== PRC - C:\WINDOWS\837401196:2470778574.exe File not found
PRC - C:\Documents and Settings\rdiadmin\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe (American Power Conversion Corporation)
PRC - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
========== Modules (No Company Name) ========== MOD - C:\WINDOWS\SYSTEM32\mdhcp32.dll ()
MOD - C:\WINDOWS\SYSTEM32\dimsntfy32.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
MOD - \\?\globalroot\systemroot\system32\mswsock.dll ()
MOD - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe ()
========== Win32 Services (SafeList) ========== SRV - (Onyx-RAD Space-Management Server) -- File not found
SRV - (Onyx-RAD Image Server) -- File not found
SRV - (LMIGuardianSvc) -- File not found
SRV - (SENS) -- C:\Documents and Settings\All Users\Application Data\asotocomfo.dat (Qjam evfg hlmfa p)
SRV - (CarboniteService) -- C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe (Carbonite, Inc. (
www.carbonite.com))
SRV - (NMSAccessU) -- C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (AdobeActiveFileMonitor4.0) -- C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe ()
SRV - (APC UPS Service) -- C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
SRV - (NetSvc) -- C:\Program Files\Intel\NCS\Sync\NetSvc.exe (Intel(R) Corporation)
========== Driver Services (SafeList) ========== DRV - (LMIRfsClientNP) -- C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (Lbd) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (LMIRfsDriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (PalmUSBD) -- C:\WINDOWS\SYSTEM32\DRIVERS\PalmUSBD.sys (PalmSource, Inc.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) -- C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (Orex02) Orex Ver(2000)(M) -- C:\WINDOWS\SYSTEM32\DRIVERS\Orex02.sys (Compuware Corporation)
DRV - (OMCI) -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.dell.comIE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page =
http://www.dell.comIE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.dell.comIE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page =
http://www.dell.comIE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
https://cffc.peak.aecium.com/IE - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ========== FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://news.google.com"
FF - prefs.js..extensions.enabledItems:
jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {46868735-c3fa-47ce-8ce7-cce51a66aceb}:1.2
FF - prefs.js..extensions.enabledItems:
LogMeInClient@logmein.com:1.0.0.608
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D69C9FCF-9CA3-487D-86A3-37CCBCC8CC78}: C:\Documents and Settings\rdiadmin\Local Settings\Application Data\{D69C9FCF-9CA3-487D-86A3-37CCBCC8CC78}\ [2011/09/11 11:29:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/14 20:29:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/15 19:29:06 | 000,000,000 | ---D | M]
[2008/09/09 00:01:43 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rdiadmin\Application Data\Mozilla\Extensions
[2011/05/08 00:00:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rdiadmin\Application Data\Mozilla\Firefox\Profiles\ihzdbp9d.default\extensions
[2010/12/18 12:51:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\rdiadmin\Application Data\Mozilla\Firefox\Profiles\ihzdbp9d.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008/09/09 00:36:21 | 000,000,000 | ---D | M] (oldbar) -- C:\Documents and Settings\rdiadmin\Application Data\Mozilla\Firefox\Profiles\ihzdbp9d.default\extensions\{46868735-c3fa-47ce-8ce7-cce51a66aceb}
[2011/02/27 21:19:17 | 000,000,000 | ---D | M] (LogMeIn, Inc. Remote Access Plugin) -- C:\Documents and Settings\rdiadmin\Application Data\Mozilla\Firefox\Profiles\ihzdbp9d.default\extensions\LogMeInClient@logmein.com
[2009/11/11 22:40:25 | 000,002,164 | ---- | M] () -- C:\Documents and Settings\rdiadmin\Application Data\Mozilla\Firefox\Profiles\ihzdbp9d.default\searchplugins\bing.xml
[2011/05/08 00:00:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/09/11 11:29:43 | 000,000,000 | ---D | M] (XULRunner) -- C:\DOCUMENTS AND SETTINGS\RDIADMIN\LOCAL SETTINGS\APPLICATION DATA\{D69C9FCF-9CA3-487D-86A3-37CCBCC8CC78}
[2009/11/20 21:52:43 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/09/14 20:29:40 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/08 00:40:12 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
O1 HOSTS File: ([2011/09/21 11:51:29 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SpeechExec Startup] C:\Program Files\Common Files\Philips Speech Shared\Components\PSP.SpeechExec.StartupApp.exe (Philips Austria GmbH - Speech Processing)
O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\SYSTEM32\tscupgrd.exe (Microsoft Corporation)
O4 - HKU\S-1-5-18..\RunOnce: [tscuninstall] C:\WINDOWS\SYSTEM32\tscupgrd.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10w_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\APC UPS Status.lnk = C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe (American Power Conversion Corporation)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\c072916da.dat ()
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\dxdiag.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O15 - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\..Trusted Domains: aecium.com ([cffc.peak] https in Trusted sites)
O15 - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\..Trusted Domains: localhost ([]* in Local intranet)
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D}
http://www.trendsecure.com/framework/co ... mHcmsX.CAB (TmHcmsX Control)
O16 - DPF: {2A59CE46-2E9E-4B00-BC9B-A183638E8D4E}
https://cffc.peak.aecium.com/Green/live ... werApp.CAB (CimDocImageViewerApp.CimDocImageViewer)
O16 - DPF: {300FE705-8D95-41F4-93C0-621F927379D0}
https://cffc.peak.aecium.com/Green/live ... dPrint.CAB (FTPSecureAndPrint.clsFileSystemObject)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
http://v5.windowsupdate.microsoft.com/v ... 2434139265 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
http://update.microsoft.com/microsoftup ... 2655706359 (MUWebControl Class)
O16 - DPF: {88DD90B6-C770-4CFF-B7A4-3AFD16BB8824}
https://cffc.peak.aecium.com/aspnet_cli ... ontrol.cab (Crystal Reports Print Control 12.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {C8FE369D-3517-490E-8EB5-256CA6C73236}
https://cffc.peak.aecium.com/Green/live ... corder.CAB (VoiceRecorder.Recorder)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}
http://java.sun.com/products/plugin/aut ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E6C4B65B-FD06-46F8-A031-34237B31B299}
https://cffc.peak.aecium.com/Green/live ... aching.CAB (ClinicianCaching.CIMCaching)
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667}
http://pccheckup.dellfix.com/rel/41/ins ... downde.cab (Dell PC Checkup Installer Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6A47E9CA-BAB3-4A84-B05E-B13B5B1F3A8A}: DhcpNameServer = 209.18.47.61 209.18.47.62
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy32: DllName - (dimsntfy32.dll) - C:\WINDOWS\System32\dimsntfy32.dll ()
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O20 - Winlogon\Notify\mdhcp32: DllName - (mdhcp32.dll) - C:\WINDOWS\System32\mdhcp32.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\rdiadmin\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\rdiadmin\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 17:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-4274134260-3623583512-2864591513-1005\...exe [@ = exefile] -- Reg Error: Key error. File not found
========== Files/Folders - Created Within 30 Days ========== File not found -- C:\WINDOWS\System32\
[2011/09/29 21:59:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2011/09/29 20:50:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rdiadmin\My Documents\Fax
[2011/09/27 21:40:56 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/09/26 19:03:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rdiadmin\Desktop\Logs
[2011/09/24 17:53:31 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2011/09/21 20:57:27 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/09/21 20:20:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rdiadmin\Local Settings\Application Data\ApplicationHistory
[2011/09/21 11:30:58 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/09/21 10:40:35 | 000,000,000 | ---D | C] -- C:\3ac22b318350a892bf5c77
[2011/09/18 08:18:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2011/09/17 10:35:55 | 000,479,232 | ---- | C] (WatanabeBudweiser Talmud Castro MalaysiaBurchDanbury Wilhelmina EdnaSocrates) -- C:\WINDOWS\System32\ihzp.exe
[2011/09/16 21:00:33 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2011/09/14 20:38:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2011/09/14 19:26:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/09/11 11:29:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rdiadmin\Local Settings\Application Data\{D69C9FCF-9CA3-487D-86A3-37CCBCC8CC78}
[2011/09/11 09:09:11 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/09/11 09:09:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/09/11 09:09:04 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/09/11 09:09:04 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/09/10 01:25:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2011/09/10 01:20:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/09/10 01:20:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/09/10 00:48:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/09/10 00:47:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/09/10 00:47:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/09/03 05:17:37 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll
[2011/06/23 13:36:30 | 001,136,337 | -H-- | C] (Qjam evfg hlmfa p) -- C:\Documents and Settings\All Users\Application Data\asotocomfo.dat
[2009/12/02 14:10:00 | 000,495,616 | ---- | C] ( ) -- C:\WINDOWS\System32\TOCRRService.exe
[2009/12/02 14:10:00 | 000,086,016 | ---- | C] ( ) -- C:\WINDOWS\System32\TOCRRdll.dll
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ========== File not found -- C:\WINDOWS\System32\
[2011/10/01 16:11:33 | 076,004,920 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\ofmocotosa.dat
[2011/10/01 16:11:09 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/10/01 16:06:10 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/10/01 16:03:00 | 000,013,668 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2011/10/01 16:02:58 | 000,000,878 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/10/01 16:01:50 | 000,000,016 | ---- | M] () -- C:\WINDOWS\System32\crt.dat
[2011/10/01 16:01:50 | 000,000,000 | ---- | M] () -- C:\WINDOWS\837401196
[2011/10/01 16:01:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/10/01 16:01:47 | 2138,099,712 | -HS- | M] () -- C:\hiberfil.sys
[2011/09/30 21:48:54 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\rdiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2003 (2).lnk
[2011/09/30 16:58:45 | 018,166,784 | ---- | M] () -- C:\Documents and Settings\rdiadmin\My Documents\Business Cards.cdb
[2011/09/29 22:15:04 | 000,002,557 | ---- | M] () -- C:\Documents and Settings\rdiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\Dragon Medical 10.1.lnk
[2011/09/29 21:59:51 | 2138,128,384 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2011/09/29 08:45:39 | 000,002,234 | ---- | M] () -- C:\Documents and Settings\rdiadmin\Application Data\SAS7_000.DAT
[2011/09/27 21:41:21 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2011/09/26 19:12:07 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\rdiadmin\Desktop\Microsoft Office Word 2003.lnk
[2011/09/26 19:03:25 | 000,296,374 | ---- | M] () -- C:\WINDOWS\System32\shimg.dll
[2011/09/25 14:47:48 | 000,002,539 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Dragon Medical 10.1.lnk
[2011/09/24 17:16:47 | 000,002,443 | ---- | M] () -- C:\Documents and Settings\rdiadmin\Desktop\Microsoft Office Publisher 2003.lnk
[2011/09/23 21:51:31 | 004,238,357 | R--- | M] () -- C:\Documents and Settings\rdiadmin\Desktop\ComboFix.exe
[2011/09/21 20:51:09 | 000,000,000 | -HS- | M] () -- C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
[2011/09/21 20:47:45 | 000,049,152 | ---- | M] () -- C:\WINDOWS\System32\sname
[2011/09/21 20:46:53 | 000,013,248 | ---- | M] () -- C:\WINDOWS\System32\0.045629815589275036.exe
[2011/09/21 20:34:45 | 000,000,077 | ---- | M] () -- C:\WINDOWS\System32\dimsntfy.ocx
[2011/09/21 20:32:08 | 000,049,152 | ---- | M] () -- C:\WINDOWS\System32\mdhcp32.dll
[2011/09/21 20:31:55 | 000,135,680 | ---- | M] () -- C:\WINDOWS\System32\dimsntfy32.dll
[2011/09/21 20:31:29 | 000,013,248 | ---- | M] () -- C:\WINDOWS\System32\0.8686894774185765.exe
[2011/09/21 11:51:29 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
[2011/09/21 11:31:10 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/09/17 10:37:43 | 000,000,992 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/09/17 10:36:00 | 000,479,232 | ---- | M] (WatanabeBudweiser Talmud Castro MalaysiaBurchDanbury Wilhelmina EdnaSocrates) -- C:\WINDOWS\System32\ihzp.exe
[2011/09/14 20:26:16 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/09/14 18:26:34 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat
[2011/09/14 18:26:34 | 000,000,044 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat
[2011/09/14 18:18:30 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Pvakucow.dat
[2011/09/14 18:18:30 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Plitevul.bin
[2011/09/11 09:09:12 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/07 08:01:35 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/09/07 07:37:35 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/09/03 05:17:37 | 000,599,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ========== [2011/09/23 21:51:28 | 004,238,357 | R--- | C] () -- C:\Documents and Settings\rdiadmin\Desktop\ComboFix.exe
[2011/09/21 20:51:09 | 000,000,000 | -HS- | C] () -- C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
[2011/09/21 20:49:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\837401196
[2011/09/21 20:47:45 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\sname
[2011/09/21 20:46:52 | 000,013,248 | ---- | C] () -- C:\WINDOWS\System32\0.045629815589275036.exe
[2011/09/21 20:34:45 | 000,000,077 | ---- | C] () -- C:\WINDOWS\System32\dimsntfy.ocx
[2011/09/21 20:32:12 | 000,000,016 | ---- | C] () -- C:\WINDOWS\System32\crt.dat
[2011/09/21 20:32:11 | 000,296,374 | ---- | C] () -- C:\WINDOWS\System32\shimg.dll
[2011/09/21 20:32:08 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\mdhcp32.dll
[2011/09/21 20:31:55 | 000,135,680 | ---- | C] () -- C:\WINDOWS\System32\dimsntfy32.dll
[2011/09/21 20:31:29 | 000,013,248 | ---- | C] () -- C:\WINDOWS\System32\0.8686894774185765.exe
[2011/09/21 12:17:03 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/09/17 10:26:13 | 000,000,992 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/09/16 19:01:58 | 2138,099,712 | -HS- | C] () -- C:\hiberfil.sys
[2011/09/11 11:29:44 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Pvakucow.dat
[2011/09/11 11:29:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Plitevul.bin
[2011/09/11 09:09:12 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/23 13:36:30 | 076,004,920 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\ofmocotosa.dat
[2011/05/29 10:32:38 | 000,000,254 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2011/03/20 22:32:35 | 000,391,462 | ---- | C] () -- C:\Documents and Settings\rdiadmin\Application Data\fontlst2.opf
[2011/03/03 06:59:19 | 000,000,094 | ---- | C] () -- C:\WINDOWS\family.ini
[2010/08/01 09:49:54 | 000,041,684 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/05/16 21:08:53 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2010/04/07 21:16:34 | 000,000,067 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2009/12/02 14:10:00 | 003,253,758 | ---- | C] () -- C:\WINDOWS\System32\UsaIDs.bin
[2009/12/02 14:10:00 | 000,000,128 | ---- | C] () -- C:\WINDOWS\System32\TOCRR.ini
[2009/12/02 14:09:50 | 000,708,608 | ---- | C] () -- C:\WINDOWS\System32\OCR_PreProc.dll
[2009/12/02 14:09:50 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\STBXPCOM.exe
[2009/12/02 14:09:50 | 000,036,352 | ---- | C] () -- C:\WINDOWS\System32\SX32W.DLL
[2009/12/02 14:09:50 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\Parser.dll
[2009/12/02 14:09:08 | 001,798,144 | ---- | C] () -- C:\WINDOWS\System32\ltmm_n.dll
[2009/12/02 14:08:46 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\LMOggSpl.dll
[2009/12/02 14:08:44 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\LMOggMux.dll
[2009/12/02 14:08:44 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\LMJ2K.dll
[2009/12/02 14:08:38 | 001,273,856 | ---- | C] () -- C:\WINDOWS\System32\LEncVorbis.dll
[2009/12/02 14:08:38 | 000,299,008 | ---- | C] () -- C:\WINDOWS\System32\LDecVorbis.dll
[2009/12/02 14:08:38 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\LCODCJ2K.dll
[2009/12/02 14:08:28 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrtRTECG.dll
[2009/12/02 14:08:26 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\BarCode.dll
[2009/11/12 23:43:10 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2009/11/12 01:09:16 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2009/11/12 01:09:16 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2009/11/12 00:32:34 | 000,001,152 | ---- | C] () -- C:\WINDOWS\System32\windrv.sys
[2009/02/21 15:23:09 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\Inst2892.dll
[2009/01/15 22:15:39 | 000,000,600 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/10/16 07:47:22 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\rdiadmin\Local Settings\Application Data\fusioncache.dat
[2008/10/11 21:27:55 | 000,197,120 | ---- | C] () -- C:\Documents and Settings\rdiadmin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/09/10 20:34:22 | 000,000,664 | ---- | C] () -- C:\Documents and Settings\rdiadmin\Local Settings\Application Data\FASTWiz.html
[2008/09/10 11:03:16 | 000,001,299 | ---- | C] () -- C:\WINDOWS\checkip.dat
[2008/09/10 08:44:16 | 000,002,234 | ---- | C] () -- C:\Documents and Settings\rdiadmin\Application Data\SAS7_000.DAT
[2008/09/10 08:07:48 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/09/09 00:01:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008/09/08 23:44:20 | 000,001,100 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2007/11/16 11:37:14 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
[2007/02/05 12:16:18 | 000,000,033 | ---- | C] () -- C:\WINDOWS\System32\speechexeclic.dat
[2007/02/05 12:14:38 | 000,000,226 | ---- | C] () -- C:\WINDOWS\System32\speechexeclic.ini
[2007/02/05 11:14:38 | 000,000,231 | ---- | C] () -- C:\WINDOWS\System32\SpeechExecSpcapi.ini
[2005/01/19 15:03:54 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\Pspwma.ini
[2004/12/16 16:26:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2004/12/15 14:43:15 | 000,006,656 | ---- | C] () -- C:\WINDOWS\System32\CNMVS5c.DLL
[2004/12/06 15:43:35 | 000,000,012 | ---- | C] () -- C:\WINDOWS\cd_dent.ini
[2004/12/06 15:35:07 | 002,777,088 | ---- | C] () -- C:\WINDOWS\System32\qt222.dll
[2004/10/27 23:13:03 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/10/27 23:03:02 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2004/10/27 23:02:18 | 000,447,852 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2004/10/27 23:02:18 | 000,074,464 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2004/10/27 22:52:54 | 000,000,516 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/09/23 14:31:10 | 000,000,219 | ---- | C] () -- C:\WINDOWS\System32\Pspmp3.ini
[2004/08/11 17:25:56 | 000,000,791 | ---- | C] () -- C:\WINDOWS\ORUN32.INI
[2004/08/11 17:20:10 | 000,244,720 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/11 17:14:38 | 000,004,318 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/11 17:12:16 | 000,023,428 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/04 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 07:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 07:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/04 07:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 05:00:00 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\FXSPERF.INI
[2004/08/04 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2004/07/19 16:01:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\SETPWRCG.EXE
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/05/03 09:03:58 | 000,000,219 | R--- | C] () -- C:\WINDOWS\System32\pspgru.ini
[2001/05/03 08:04:00 | 000,000,220 | ---- | C] () -- C:\WINDOWS\System32\smlpcbb.ini
[2001/05/03 08:03:58 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\smcelp32.ini
[2001/05/03 08:03:58 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\psptrusp.ini
[2000/11/10 14:57:04 | 000,005,025 | ---- | C] () -- C:\WINDOWS\System32\patterns.dat
[1999/11/05 09:42:36 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspusbct.ini
[1999/10/08 13:58:24 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspusblb.ini
[1998/12/11 11:55:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspsbext.ini
[1998/08/10 14:04:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspfidrv.ini
[1998/08/10 14:04:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspaudrv.ini
[1998/08/10 14:03:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspapdrv.ini
[1998/08/10 14:03:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\mcipspwa.ini
[1998/08/10 14:03:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\mcipspct.ini
[1998/08/10 14:02:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspfbase.ini
[1998/08/10 14:02:00 | 000,000,220 | ---- | C] () -- C:\WINDOWS\System32\pspwave.ini
[1998/08/10 14:02:00 | 000,000,219 | ---- | C] () -- C:\WINDOWS\System32\PSPDSS.INI
[1998/08/10 14:02:00 | 000,000,219 | ---- | C] () -- C:\WINDOWS\System32\pspddi.ini
[1980/01/01 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
========== Alternate Data Streams ========== @Alternate Data Stream - 816 bytes -> C:\WINDOWS\837401196:2470778574.exe
@Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A24211BA
@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:63238B95
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >
OTL Extras logfile created on: 10/1/2011 4:08:40 PM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\rdiadmin\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.99 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 67.03% Memory free
3.84 Gb Paging File | 3.33 Gb Available in Paging File | 86.73% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.02 Gb Total Space | 93.20 Gb Free Space | 62.54% Space Free | Partition Type: NTFS
Computer Name: JAKE | User Name: Jake | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_USERS\S-1-5-21-4274134260-3623583512-2864591513-1005\SOFTWARE\Classes\<extension>]
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Disabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe" = C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Disabled:Google Earth -- (Google)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer -- (Microsoft Corporation)
"C:\Program Files\Corex\CardScan\cs.exe" = C:\Program Files\Corex\CardScan\cs.exe:*:Disabled:CardScan Program -- (CardScan, Inc.)
"C:\Documents and Settings\rdiadmin\My Documents\Downloads\tdsskiller.exe" = C:\Documents and Settings\rdiadmin\My Documents\Downloads\tdsskiller.exe:*:Enabled:TDSS rootkit removing tool -- (Kaspersky Lab ZAO)
========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}" = WD Diagnostics
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1B260954-B5F8-435A-A628-0B0CA6BF1C2A}" = SpeechExec Pro Dictate
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{468190DA-FB4C-45BA-8E40-4B165FF1A939}" = BACS
"{4A5A427F-BA39-4BF0-9A47-9999FBE60C9F}" = Visual C++ Runtime for Dragon NaturallySpeaking
"{5A0C892E-FD1C-4203-941E-0956AED20A6A}" = APC PowerChute Personal Edition
"{629B8602-DCDC-40F7-A5CE-E3A13E25691F}" = Melloware PlacesBar Editor
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{891280E0-7794-4FCA-8525-09BE96D264F1}" = Eclipsys PeakPractice Client Tools for 1095
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{8FFC924C-ED06-44CB-8867-3CA778ECE903}" = Adobe Help Center 2.0
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A790BEB1-BCCF-4EC6-807B-5708B36E8A79}" = Intel(R) PROSet
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.6
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1BD700E-92C1-4F3E-B934-0140440B336A}" = CardScan 7.0.5
"{E4C1DBF1-67D9-4973-9DEC-677E695E7CE0}" = AxCrypt 1.7.2126.0
"{E7712E53-7A7F-46EB-AA13-70D5987D30F2}" = Dragon NaturallySpeaking 10
"{EBB7C1C1-D439-4D9B-9FDC-954C10F266B0}" = Adobe Photoshop Elements 4.0
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F445476A-42DE-11D4-80D0-00C04F2750A6}" = Epocrates Essentials
"{F5372C96-5224-40E5-90A5-D1F6D88F21E6}" = DiMAGE Scan Elite5400 2 ver.1.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 4" = Adobe Photoshop Elements 4.0
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.7 (Unicode)
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"Carbonite Backup" = Carbonite
"ie8" = Windows Internet Explorer 8
"InstallShield_{468190DA-FB4C-45BA-8E40-4B165FF1A939}" = Broadcom Advanced Control Suite
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 6.0.2 (x86 en-US)" = Mozilla Firefox 6.0.2 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"ODIR_is1" = ODIR
"PROSet" = Intel(R) PRO Network Adapters and Drivers
"RealPlayer 6.0" = RealPlayer
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
========== Last 10 Event Log Errors ========== [ Application Events ]
Error - 9/21/2011 9:49:49 PM | Computer Name = JAKE | Source = Microsoft Security Client | ID = 5000
Description =
Error - 9/21/2011 9:51:24 PM | Computer Name = JAKE | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module mshtml.dll, version 8.0.6001.19120, fault address 0x00067b98.
Error - 9/24/2011 6:44:27 PM | Computer Name = JAKE | Source = Microsoft Office 11 | ID = 1000
Description = Faulting application outlook.exe, version 11.0.8217.0, stamp 480f95d9,
faulting module outllib.dll, version 11.0.8217.0, stamp 480f94f8, debug? 0, fault
address 0x0025ec6e.
Error - 9/24/2011 6:44:37 PM | Computer Name = JAKE | Source = Microsoft Office 11 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.
Error - 9/25/2011 11:21:08 AM | Computer Name = JAKE | Source = Application Hang | ID = 1002
Description = Hanging application natspeak.exe, version 10.10.0.272, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
Error - 9/25/2011 3:48:30 PM | Computer Name = JAKE | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
Error - 9/25/2011 6:58:17 PM | Computer Name = JAKE | Source = Application Hang | ID = 1002
Description = Hanging application natspeak.exe, version 10.10.0.272, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
Error - 9/25/2011 11:15:45 PM | Computer Name = JAKE | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module mshtml.dll, version 8.0.6001.19120, fault address 0x00067b98.
Error - 9/27/2011 10:33:47 PM | Computer Name = JAKE | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.
Error - 9/27/2011 10:33:57 PM | Computer Name = JAKE | Source = Application Error | ID = 1000
Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.
< End of report >