Malware Removal Forums

Background program keeps de-selecting my current application

81 min read

Bold

April 2, 2010, 4:26 AM UTC

Dell Vostro 2150
Windows XP SP3

Symptom: At random times I will be writing in an application or on a forum and something causes it to be 'de-selected.' That is, my application will stop registering my typing - as if I had clicked on the Windows Toolbar. Occasionally I'll be able to catch the program/process' icon if I alt-tab (see attached), which calls itself Registrar. This happens intermittently and I've found no timing/pattern to it yet. Once, the process appeared to open IE and send out some automated spam through a hotmail account. I have only seen this behavior once, but clearly it's malicious.

My HiJack this log file:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:51:13 PM, on 4/1/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\DRIVERS\o2flash.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\Dell Support Center\bin\sprtsvc.exe

C:\WINDOWS\Explorer.EXE

C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\MICROS~1\esentutl.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\OEM13Mon.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\WINDOWS\Logi_MwX.Exe

C:\WINDOWS\system32\atwtusb.exe

C:\WINDOWS\system32\RunDLL32.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Dell Support Center\bin\sprtcmd.exe

C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\DOCUME~1\BOLD\LOCALS~1\Temp\~temp\hmml45\csrss.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USSMB/1

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USSMB/1

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.com/USSMB/1

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

F3 - REG:win.ini: load=C:\WINDOWS\sessmgr.exe

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: IE Developer Toolbar BHO - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [OEM13Mon.exe] C:\WINDOWS\OEM13Mon.exe

O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [atwtusb] atwtusb.exe

O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start

O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe

O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter

O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"

O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"

O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [AdobeBridge] //~

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare\AWC.exe" /startup

O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe

O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare\Sup_SmartRAM.exe" /m

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKLM\..\Policies\Explorer\Run: [Spool] C:\WINDOWS\System32\drivers\spoolsv.exe /waitservice

O4 - HKLM\..\Policies\Explorer\Run: [ClipSrv] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\clipsrv.exe /waitservice

O4 - HKLM\..\Policies\Explorer\Run: [Cisvc] C:\DOCUME~1\BOLD\LOCALS~1\Temp\cisvc.exe /waitservice

O4 - HKLM\..\Policies\Explorer\Run: [Esent Utl] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\MICROS~1\esentutl.exe /waitservice

O4 - HKLM\..\Policies\Explorer\Run: [DllHst] C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe /waitservice

O4 - HKLM\..\Policies\Explorer\Run: [CmSTP] C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\cmstp.exe /waitservice

O4 - HKLM\..\Policies\Explorer\Run: [Logman] C:\DOCUME~1\BOLD\APPLIC~1\logman.exe /waitservice

O4 - HKLM\..\Policies\Explorer\Run: [Mstsc] C:\WINDOWS\System\mstsc.exe /waitservice

O4 - HKCU\..\Policies\Explorer\Run: [ComRepl] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\MICROS~1\comrepl.exe /waitservice

O4 - HKCU\..\Policies\Explorer\Run: [Logman] C:\DOCUME~1\BOLD\LOCALS~1\Temp\logman.exe /waitservice

O4 - HKCU\..\Policies\Explorer\Run: [Spool] C:\WINDOWS\System32\drivers\spoolsv.exe /waitservice

O4 - HKCU\..\Policies\Explorer\Run: [rsvp] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\rsvp.exe /waitservice

O4 - HKCU\..\Policies\Explorer\Run: [ClipSrv] C:\WINDOWS\System32\drivers\clipsrv.exe /waitservice

O4 - HKCU\..\Policies\Explorer\Run: [Cisvc] C:\DOCUME~1\BOLD\LOCALS~1\Temp\cisvc.exe /waitservice

O4 - HKCU\..\Policies\Explorer\Run: [CmSTP] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\MICROS~1\cmstp.exe /waitservice

O4 - HKCU\..\Policies\Explorer\Run: [Esent Utl] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\MICROS~1\esentutl.exe /waitservice

O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [IEudinit] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\ieudinit.exe /waitservice (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [IEudinit] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\ieudinit.exe /waitservice (User 'Default user')

O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258389455359

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate1c9f9baeab53ff0) (gupdate1c9f9baeab53ff0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O2FLASH - O2Micro International - C:\WINDOWS\system32\DRIVERS\o2flash.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE



--

End of file - 13084 bytes

The Uninstall list:

AC3Filter 1.61b

Acrobat.com

Acrobat.com

Active Desktop Calendar 7.75

Adobe Acrobat 9 Pro - English, Français, Deutsch

Adobe After Effects CS4

Adobe After Effects CS4

Adobe After Effects CS4 Presets

Adobe After Effects CS4 Third Party Content

Adobe AIR

Adobe AIR

Adobe Anchor Service CS4

Adobe Asset Services CS4

Adobe Bridge CS4

Adobe CMaps CS4

Adobe Color - Photoshop Specific CS4

Adobe Color EU Extra Settings CS4

Adobe Color JA Extra Settings CS4

Adobe Color NA Recommended Settings CS4

Adobe Color Video Profiles AE CS4

Adobe Color Video Profiles CS CS4

Adobe Contribute CS4

Adobe Creative Suite 4 Design Premium

Adobe Creative Suite 4 Design Premium

Adobe Creative Suite 4 Master Collection

Adobe Creative Suite 4 Master Collection

Adobe CS4 American English Speech Analysis Models

Adobe CSI CS4

Adobe Default Language CS4

Adobe Device Central CS4

Adobe Dreamweaver CS4

Adobe Drive CS4

Adobe Dynamiclink Support

Adobe Encore CS4

Adobe Encore CS4 Codecs

Adobe ExtendScript Toolkit CS4

Adobe Extension Manager CS4

Adobe Fireworks CS4

Adobe Flash CS4

Adobe Flash CS4 Extension - Flash Lite STI en

Adobe Flash CS4 STI-en

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Fonts All

Adobe Illustrator CS4

Adobe InDesign CS4

Adobe InDesign CS4 Application Feature Set Files (Roman)

Adobe InDesign CS4 Common Base Files

Adobe InDesign CS4 Icon Handler

Adobe Linguistics CS4

Adobe Media Encoder CS4

Adobe Media Encoder CS4 Additional Exporter

Adobe Media Encoder CS4 Dolby

Adobe Media Encoder CS4 Exporter

Adobe Media Encoder CS4 Importer

Adobe Media Player

Adobe MotionPicture Color Files CS4

Adobe OnLocation CS4

Adobe Output Module

Adobe PDF Library Files CS4

Adobe Photoshop CS4

Adobe Photoshop CS4 Support

Adobe Premiere Pro CS4

Adobe Premiere Pro CS4 Functional Content

Adobe Premiere Pro CS4 Third Party Content

Adobe Reader 9.3.1

Adobe Search for Help

Adobe Service Manager Extension

Adobe Setup

Adobe Setup

Adobe Setup

Adobe SGM CS4

Adobe Shockwave Player 11.5

Adobe SING CS4

Adobe Soundbooth CS4

Adobe Soundbooth CS4 Codecs

Adobe Type Support CS4

Adobe Update Manager CS4

Adobe Version Cue CS4 Server

Adobe WinSoft Linguistics Plugin

Adobe XMP Panels CS4

AdobeColorCommonSetCMYK

AdobeColorCommonSetRGB

Advanced Audio FX Engine

Advanced SystemCare 3

Advanced Video FX Engine

Age of Empires III

Age of Empires III - The Asian Dynasties

Age of Empires III - The WarChiefs

Age of Mythology Gold

Aliens vs. Predator 2

Aliens vs. Predator 2 Tools

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ArcSoft PhotoImpression 6

Audacity 1.3.9 (Unicode)

Autodesk DirectConnect 2009

Battlecraft 1942

Battlefield 1942

Battlefield 1942: Secret Weapons of WWII

Battlefield 1942: The Road To Rome

Beyond Good & Evil

BioShock

BitDefender Antivirus 2009

Bonjour

Brother HL-4070CDW

Brother MFL-Pro Suite

Celtx (2.7)

Choice Guard

CmdHere Powertoy For Windows XP

Col. Cruachan's RFA Explorer

Compatibility Pack for the 2007 Office system

Connect

Critical Update for Windows Media Player 11 (KB959772)

Dell Support Center (Support Software)

Dell Touchpad

Dell Webcam Center

Dell Webcam Manager

Dell Wireless WLAN Card Utility

Diablo II

DivX Converter

DivX Player

DivX Plus DirectShow Filters

DivX Web Player

Dragon UnPACKer 5

Dungeon Siege 2

Dungeon Siege II Tool Kit 1.1

DVD Decrypter (Remove Only)

Easy CD-DA Extractor 12

Empires Dawn of the Modern World

eMule

EphPod

FFmpeg for Audacity on Windows

FileZilla Client 3.3.2.1

Final Draft

Font Xplorer 1.2.2 

Freeplane

Game Maker 8.0

Google Earth

Google SketchUp Pro 7

Google Update Helper

Google Updater

Grand Theft Auto IV

GTAIII

Half-Life 2: Lost Coast

Half-Life(R) 2

HijackThis 2.0.2

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB915800-v4)

Hotfix for Windows XP (KB938759)

Hotfix for Windows XP (KB954708)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Internet Explorer Developer Toolbar

iTunes

Java(TM) 6 Update 15

Junk Mail filter update

Karaoke CD+G Creator

K-Lite Mega Codec Pack 5.1.0

kuler

LAME v3.98.2 for Audacity

Laptop Integrated Webcam Driver (1.01.01.0529)  

Live! Cam Avatar v1.0

Logitech MouseWare 9.79.1 

Maya 2009

Maya 2009 Documentation (en_US)

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB953297)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 3.5 SP1

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Games for Windows - LIVE

Microsoft Games for Windows - LIVE Redistributable

Microsoft Halo

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft Kernel-Mode Driver Framework Feature Pack 1.7

Microsoft Kernel-Mode Driver Framework Feature Pack 1.9

Microsoft National Language Support Downlevel APIs

Microsoft Office Professional Edition 2003

Microsoft Office Project Professional 2003

Microsoft Office Visio Professional 2003

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Sync Framework Runtime Native v1.0 (x86)

Microsoft Sync Framework Services Native v1.0 (x86)

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox (3.5.7)

MSVCRT

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

MSXML 6.0 Parser (KB927977)

MSXML4 Parser

nCleaner second 2.3.4.0

Nero 7 Ultra Edition

neroxml

Neverwinter Nights 2

New AoE3 Editor 2

Notepad++

NVIDIA Drivers

NVIDIA nView Desktop Manager

NVIDIA Photoshop Plug-ins

NVIDIA PhysX

OpenAL

Opera 10.10

OVT Scanner

PaperPort Image Printer

PDF Settings CS4

Photoshop Camera Raw

Pixel Bender Toolkit

PowerDVD

Psychonauts

PunkBuster Services

QuickSet

QuickTime

RAD Video Tools

Realtek High Definition Audio Driver

REALTEK RTL8187 Wireless LAN Driver and Utility

Renamer 1.1

Rockstar Games Social Club

Roxio Activation Module

Roxio Creator Audio

Roxio Creator BDAV Plugin

Roxio Creator Copy

Roxio Creator Data

Roxio Creator DE

Roxio Creator Tools

Roxio Drag-to-Disc

Roxio Express Labeler 3

Roxio Update Manager

Safari

ScanSoft PaperPort 11

Screencaster Plug-in for FF

Security Update for Windows Internet Explorer 7 (KB938127-v2)

Security Update for Windows Internet Explorer 7 (KB963027)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB972260)

Security Update for Windows Internet Explorer 8 (KB974455)

Security Update for Windows Internet Explorer 8 (KB976325)

Security Update for Windows Internet Explorer 8 (KB978207)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB963027)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165-v2)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978706)

Segoe UI

Serious Sam 2

Skype web features

Skype™ 4.1

Smart Defrag

Sonic CinePlayer Decoder Pack

Source SDK

SourceGear DiffMerge

Spybot - Search & Destroy

SpywareBlaster 4.2

Steam(TM)

Suite Shared Configuration CS4

SuperNotecard for Scriptwriting 1.9

System Shock2

TagScanner 5.0 build 532

The Suffering: Ties That Bind

TmUnitedForever

Tomb Raider:

Tron 2.0

UE3Redist

UE3Redist

Unreal Tournament 3

Unreal Tournament G.O.T.Y. Edition

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 8 (KB969497)

Update for Windows Internet Explorer 8 (KB975364)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows Internet Explorer 8 (KB976749)

Update for Windows XP (KB898461)

Update for Windows XP (KB955759)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

USB Tablet Manager

VC80CRTRedist - 8.0.50727.762

VDMSound

VST Bridge 1.1

VUE 3.0

Warzone 2100

Windows Internet Explorer 8

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Essentials

Windows Live Mail

Windows Live Photo Gallery

Windows Live Toolbar

Windows Live Upload Tool

Windows Live Writer

Windows Media Format 11 runtime

Windows Media Format 11 runtime

Windows Media Player 11

Windows Media Player 11

Windows Media Player Firefox Plugin

Windows Presentation Foundation

WinRAR archiver

WinRez LT Studio

WinZip 12.0

Wolfenstein

Wolfenstein(TM) 1.11 Patch

X-Lite 3.0

These are reg entries which I believe to be part of the culprit:

Author : Local AppWizard-Generated Applications

Software : Registrar

Age : New



HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\Registrar\Recent File List

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\Registrar\Settings

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\Registrar

HKEY_CLASSES_ROOT\ATL.Registrar

HKEY_CLASSES_ROOT\EventRegistrar.EventRegistrar

HKEY_CLASSES_ROOT\EventRegistrar.EventRegistrar.1

As mentioned, attached is the Alt-Tab icon that appears when the process is interrupting my workflow. Any/all help is greatly appreciated!

Attachments:

mfc.jpg

MWR 3 day Mod

April 5, 2010, 9:55 PM UTC

[3days:1orpf4d1][/3days:1orpf4d1]

deltalima

April 6, 2010, 7:18 PM UTC

Hi Bold,

Welcome to the forum.

My nickname is deltalima and I will be helping you with your computer problems.

The logs can take some time to research, so please be patient with me.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Please note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
If after 3 days you have not responded to this topic, it will be closed, and you will need to start a new one.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

CKScanner

Please download CKScanner from here to your Desktop.

Make sure that CKScanner.exe is on the your Desktop before running the application!

Double-click on CKScanner.exe and click Search For Files.
After a very short time, when the cursor hourglass disappears, click Save List To File.
A message box will verify the file saved
Double-click on the CKFiles.txt icon on your Desktop and copy/paste the contents in your next reply.

Download and run OTL
Download OTL by Old Timer and save it to your Desktop.

Double click on OTL.exe to run it.
Under Output, ensure that Minimal Output is selected.
Under Extra Registry section, select Use SafeList.
Click the Scan All Users checkbox.
Click on Run Scan at the top left hand corner.
When done, two Notepad files will open.
- OTL.txt <-- Will be opened
- Extras.txt <-- Will be minimized
Please post the contents of these 2 Notepad files in your next reply.

Please paste direct into the reply, there is no need for a code box.

Bold

April 7, 2010, 5:04 AM UTC

Thanks for the reply!
The CKFiles.txt output file was empty.

The OTX file:

OTL logfile created on: 4/6/2010 9:55:37 PM - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Documents and Settings\BOLD\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 74.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.05 Gb Total Space | 111.92 Gb Free Space | 37.55% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BOLD_LAPTOP
Current User Name: BOLD
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\BOLD\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\BOLD\Local Settings\Temp\~temp\aiunml221\smss.exe (TODO: <Company name>)
PRC - C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Documents and Settings\BOLD\Local Settings\Application Data\clipsrv.exe ()
PRC - C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe (BitDefender S.R.L.)
PRC - C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe ()
PRC - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe (BitDefender SRL)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
PRC - C:\WINDOWS\system32\drivers\o2flash.exe (O2Micro International)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\WINDOWS\OEM13Mon.exe (Creative Technology Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\ATWTUSB.EXE ()
PRC - C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\BOLD\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (LIVESRV) -- C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe (BitDefender SRL)
SRV - (scan) -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\scan.dll (S.C. BitDefender S.R.L)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Arrakis3) -- C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe ()
SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
SRV - (O2FLASH) -- C:\WINDOWS\system32\drivers\o2flash.exe (O2Micro International)
SRV - (Adobe Version Cue CS4) -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)
SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (trufos) -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys (BitDefender S.R.L.)
DRV - (dfmirage) -- C:\WINDOWS\system32\drivers\dfmirage.sys (DemoForge, LLC)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (bdfsfltr) -- C:\WINDOWS\system32\drivers\bdfsfltr.sys (BitDefender S.R.L. Bucharest, ROMANIA)
DRV - (O2SDRDR) -- C:\WINDOWS\system32\drivers\o2sd.sys (O2Micro )
DRV - (O2MDRDR) -- C:\WINDOWS\system32\drivers\o2media.sys (O2Micro )
DRV - (bdfm) -- C:\WINDOWS\system32\drivers\bdfm.sys (BitDefender S.R.L. Bucharest, ROMANIA)
DRV - (profos) -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys ()
DRV - (adfs) -- C:\WINDOWS\system32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (OEM13Vid) -- C:\WINDOWS\system32\drivers\OEM13Vid.sys (Creative Technology Ltd.)
DRV - (OEM13Vfx) -- C:\WINDOWS\system32\drivers\OEM13Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (OEM13Afx) -- C:\WINDOWS\system32\drivers\OEM13Afx.sys (Creative Technology Ltd.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (iaStor) -- C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (DLADResM) -- C:\WINDOWS\system32\drivers\DLADResM.SYS (Roxio)
DRV - (DLABMFSM) -- C:\WINDOWS\system32\drivers\DLABMFSM.SYS (Roxio)
DRV - (DLAUDF_M) -- C:\WINDOWS\system32\drivers\DLAUDF_M.SYS (Roxio)
DRV - (DLAUDFAM) -- C:\WINDOWS\system32\drivers\DLAUDFAM.SYS (Roxio)
DRV - (DLAOPIOM) -- C:\WINDOWS\system32\drivers\DLAOPIOM.SYS (Roxio)
DRV - (DLABOIOM) -- C:\WINDOWS\system32\drivers\DLABOIOM.SYS (Roxio)
DRV - (DLAPoolM) -- C:\WINDOWS\system32\drivers\DLAPoolM.SYS (Roxio)
DRV - (DLAIFS_M) -- C:\WINDOWS\system32\drivers\DLAIFS_M.SYS (Roxio)
DRV - (DRVMCDB) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DLARTL_M) -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS (Roxio)
DRV - (DLACDBHM) -- C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Roxio)
DRV - (DRVNDDM) -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Roxio)
DRV - (RTLWUSB) -- C:\WINDOWS\system32\drivers\RTL8187.sys (Realtek Semiconductor Corporation )
DRV - (APL531) -- C:\WINDOWS\system32\drivers\ov550i.sys (Omnivision Technologies, Inc.)
DRV - (aiptektp) -- C:\WINDOWS\system32\drivers\aiptektp.sys (WALTOP International Corp.)
DRV - (APPDRV) -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfsync02.sys (Protection Technology)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)
DRV - (Afc) -- C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (LMouFlt2) -- C:\WINDOWS\system32\drivers\lmouflt2.sys (Logitech, Inc.)
DRV - (LHidFlt2) -- C:\WINDOWS\system32\drivers\LHIDFLT2.SYS (Logitech, Inc.)
DRV - (tandpl) -- C:\WINDOWS\system32\drivers\tandpl.sys ()
DRV - (enodpl) -- C:\WINDOWS\system32\drivers\enodpl.sys ()
DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USSMB/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.msn.com/sphome.aspx
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USSMB/1

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USSMB/1
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USSMB/1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USSMB/1
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USSMB/1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USSMB/1
IE - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com
IE - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.5.3
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2009\FFToolbar\ [2010/03/30 20:44:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/31 20:07:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/31 20:07:12 | 000,000,000 | ---D | M]

[2010/01/22 12:00:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Extensions
[2010/01/22 12:00:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Extensions\[removed]
[2010/04/06 15:41:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions
[2009/11/19 17:18:29 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009/07/31 16:50:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/18 15:13:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions\[removed]
[2010/03/18 15:13:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions\staged-xpis
[2010/04/06 15:41:46 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/11/12 09:14:47 | 000,065,536 | ---- | M] () -- C:\Program Files\Mozilla Firefox\components\FFComm.dll
[2008/09/03 17:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
[2009/09/22 14:14:24 | 000,176,128 | ---- | M] (Dimdim, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npDimdimControl.dll
[2006/08/09 03:16:08 | 000,030,408 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npWebLaunch.dll

O1 HOSTS File: ([2010/03/17 23:03:02 | 000,380,737 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 http://www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 http://www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 http://www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 http://www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 http://www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 http://www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 http://www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 http://www.100888290cs.com
O1 - Hosts: 127.0.0.1 http://www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 http://www.10sek.com
O1 - Hosts: 127.0.0.1 http://www.1-2005-search.com
O1 - Hosts: 13117 more lines...
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot S&D\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (IE Developer Toolbar BHO) - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll (Bitdefender)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [atwtusb] C:\WINDOWS\System32\ATWTUSB.EXE ()
O4 - HKLM..\Run: [BDAgent] C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe (BitDefender S.R.L.)
O4 - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe (BitDefender)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] File not found
O4 - HKLM..\Run: [OEM13Mon.exe] C:\WINDOWS\OEM13Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe (XemiComputers ltd.)
O4 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006..\Run: [Advanced SystemCare 3] C:\Program Files\IObit\Advanced SystemCare\AWC.exe (IObit)
O4 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006..\Run: [SmartRAM] C:\Program Files\IObit\Advanced SystemCare\Sup_SmartRAM.exe (IObit)
O4 - HKLM..\RunOnce: [WIAWizardMenu] C:\WINDOWS\System32\sti_ci.DLL (Microsoft Corporation)
F3 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006 WinNT: Load - (C:\WINDOWS\sessmgr.exe) - C:\WINDOWS\sessmgr.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Spool = C:\WINDOWS\System32\drivers\spoolsv.exe /waitservice ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ClipSrv = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\clipsrv.exe /waitservice ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Cisvc = C:\DOCUME~1\BOLD\LOCALS~1\Temp\cisvc.exe /waitservice File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Esent Utl = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\MICROS~1\esentutl.exe /waitservice ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: DllHst = C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe /waitservice ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: CmSTP = C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\cmstp.exe /waitservice ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Logman = C:\DOCUME~1\BOLD\APPLIC~1\logman.exe /waitservice ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Mstsc = C:\WINDOWS\System\mstsc.exe /waitservice ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: IEudinit = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\ieudinit.exe /waitservice ()
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: IEudinit = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\ieudinit.exe /waitservice ()
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ComRepl = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\MICROS~1\comrepl.exe /waitservice ()
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Logman = C:\DOCUME~1\BOLD\LOCALS~1\Temp\logman.exe /waitservice File not found
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Spool = C:\WINDOWS\System32\drivers\spoolsv.exe /waitservice ()
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: rsvp = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\rsvp.exe /waitservice ()
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ClipSrv = C:\WINDOWS\System32\drivers\clipsrv.exe /waitservice ()
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Cisvc = C:\DOCUME~1\BOLD\LOCALS~1\Temp\cisvc.exe /waitservice File not found
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: CmSTP = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\MICROS~1\cmstp.exe /waitservice ()
O7 - HKU\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Esent Utl = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\MICROS~1\esentutl.exe /waitservice ()
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot S&D\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258389455359 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\BOLD\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\BOLD\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 14:29:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/04/06 13:47:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010/04/06 13:31:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Local Settings\Application Data\RustemSoft
[2010/04/06 13:31:04 | 000,000,000 | ---D | C] -- C:\Program Files\RustemSoft
[2010/04/06 12:20:52 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\BOLD\Desktop\OTL.exe
[2010/04/05 15:55:36 | 000,000,000 | ---D | C] -- C:\Program Files\Notepad
[2010/04/05 07:38:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/04/05 07:38:43 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/04/05 07:38:42 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/05 07:38:42 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/05 07:38:42 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/03 09:56:19 | 000,000,000 | ---D | C] -- C:\Program Files\World Creator
[2010/04/03 09:51:16 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\BOLD\Recent
[2010/04/02 11:48:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Application Data\OpenOffice.org
[2010/04/02 11:39:43 | 000,000,000 | ---D | C] -- C:\Program Files\JRE
[2010/04/02 11:39:37 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2010/04/02 11:39:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/04/02 08:46:51 | 000,000,000 | ---D | C] -- C:\Program Files\CompareIt
[2010/03/31 23:23:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Application Data\BitDefender
[2010/03/29 23:43:36 | 000,000,000 | ---D | C] -- C:\Program Files\VDMSound
[2010/03/27 14:47:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Softwrap
[2010/03/27 14:47:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Fonts
[2010/03/27 14:47:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Config
[2010/03/24 14:39:26 | 000,000,000 | ---D | C] -- C:\Program Files\thriXXX
[2010/03/17 22:30:43 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/03/17 12:12:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Temp
[2010/03/16 11:25:09 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/03/11 23:05:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Local Settings\Application Data\none
[2010/03/11 08:52:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\IObit
[2009/06/30 13:02:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/06/30 12:42:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/05/14 07:09:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2009/05/11 09:09:35 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/05/11 09:09:35 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/05/11 09:09:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/05/11 09:09:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/04/06 21:41:00 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2639425400-4150335791-2106716870-1006UA.job
[2010/04/06 21:41:00 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2639425400-4150335791-2106716870-1006Core.job
[2010/04/06 21:31:22 | 000,000,466 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI
[2010/04/06 21:17:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/04/06 20:03:44 | 000,052,592 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001
[2010/04/06 15:31:47 | 000,052,592 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat
[2010/04/06 12:20:52 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\BOLD\Desktop\OTL.exe
[2010/04/06 12:20:45 | 000,451,584 | ---- | M] () -- C:\Documents and Settings\BOLD\Desktop\CKScanner.exe
[2010/04/06 12:17:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/04/06 11:55:10 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/04/05 23:29:49 | 014,417,920 | -H-- | M] () -- C:\Documents and Settings\BOLD\NTUSER.DAT
[2010/04/05 09:26:54 | 000,118,272 | ---- | M] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/05 07:38:28 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2010/04/05 07:38:28 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/05 07:38:28 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/05 07:38:28 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/05 07:38:28 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/04/05 07:16:23 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\AWC AutoSweep.job
[2010/04/05 07:16:21 | 000,528,020 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/04/05 07:16:21 | 000,445,938 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/04/05 07:16:21 | 000,072,978 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/04/05 07:15:15 | 000,000,718 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/04/05 07:15:12 | 000,272,291 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010/04/05 07:14:58 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/04/05 07:11:51 | 002,078,944 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/04/05 07:11:34 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/05 07:11:32 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/05 07:11:27 | 3219,574,784 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/05 00:47:55 | 014,939,306 | -H-- | M] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\IconCache.db
[2010/04/04 22:00:00 | 000,000,358 | ---- | M] () -- C:\WINDOWS\tasks\SmartDefrag.job
[2010/04/02 00:18:08 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\BOLD\ntuser.ini
[2010/04/01 21:08:45 | 000,002,570 | ---- | M] () -- C:\Documents and Settings\BOLD\My Documents\mfc.jpg
[2010/04/01 18:21:56 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/04/01 17:51:28 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\null
[2010/03/30 20:42:47 | 000,081,984 | ---- | M] () -- C:\WINDOWS\System32\bdod.bin
[2010/03/30 12:28:39 | 000,046,080 | ---- | M] () -- C:\Documents and Settings\BOLD\My Documents\Invoice - Chris Bold 3-24-10.doc
[2010/03/28 21:35:54 | 000,026,112 | ---- | M] () -- C:\Documents and Settings\BOLD\Desktop\todo.doc
[2010/03/27 14:50:05 | 000,002,645 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\Global.sw2
[2010/03/27 14:47:53 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\SwSys2.bmp
[2010/03/27 14:47:53 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\SwSys1.bmp
[2010/03/25 21:18:54 | 000,152,064 | ---- | M] () -- C:\Documents and Settings\BOLD\My Documents\A REPORT ON HELEN KELLER BY ROWAN LASKY.doc
[2010/03/23 01:58:25 | 000,001,656 | ---- | M] () -- C:\Documents and Settings\BOLD\My Documents\584109eb_Fudgonaut.sav
[2010/03/21 13:03:53 | 000,000,375 | ---- | M] () -- C:\WINDOWS\System32\BDUpdateV1.xml
[2010/03/17 23:03:02 | 000,380,737 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/17 22:35:14 | 000,000,118 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI
[2010/03/17 22:31:46 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/03/17 21:40:22 | 000,000,121 | ---- | M] () -- C:\WINDOWS\bdagent.INI
[2010/03/15 12:50:57 | 000,033,416 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/03/08 15:08:42 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/03/08 15:08:42 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2010/03/08 12:27:32 | 021,785,600 | ---- | M] () -- C:\Documents and Settings\BOLD\My Documents\Burning-Man-Pictures.doc
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/04/06 12:20:45 | 000,451,584 | ---- | C] () -- C:\Documents and Settings\BOLD\Desktop\CKScanner.exe
[2010/04/01 21:08:45 | 000,002,570 | ---- | C] () -- C:\Documents and Settings\BOLD\My Documents\mfc.jpg
[2010/03/30 12:28:39 | 000,046,080 | ---- | C] () -- C:\Documents and Settings\BOLD\My Documents\Invoice - Chris Bold 3-24-10.doc
[2010/03/28 21:33:17 | 000,095,744 | ---- | C] () -- C:\WINDOWS\sessmgr.exe
[2010/03/27 14:47:53 | 000,002,645 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\Global.sw2
[2010/03/27 14:47:53 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\SwSys2.bmp
[2010/03/27 14:47:53 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\SwSys1.bmp
[2010/03/25 21:15:08 | 000,152,064 | ---- | C] () -- C:\Documents and Settings\BOLD\My Documents\A REPORT ON HELEN KELLER BY ROWAN LASKY.doc
[2010/03/23 01:53:05 | 000,001,656 | ---- | C] () -- C:\Documents and Settings\BOLD\My Documents\584109eb_Fudgonaut.sav
[2010/03/17 22:31:09 | 000,001,024 | -H-- | C] () -- C:\Documents and Settings\All Users\ntuser.dat.LOG
[2010/03/09 09:20:53 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Application Data\spoolsv.exe
[2010/03/08 15:06:41 | 000,095,744 | ---- | C] () -- C:\WINDOWS\System\rsvp.exe
[2010/03/08 12:27:30 | 021,785,600 | ---- | C] () -- C:\Documents and Settings\BOLD\My Documents\Burning-Man-Pictures.doc
[2010/02/20 10:46:43 | 000,000,025 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\.811261211181235583101118113995
[2010/02/08 08:52:29 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Application Data\mstsc.exe
[2010/02/05 22:00:15 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\mstsc.exe
[2010/01/29 11:34:05 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\rsvp.exe
[2010/01/29 11:34:04 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Application Data\logman.exe
[2010/01/22 08:54:52 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Application Data\cisvc.exe
[2010/01/21 17:16:05 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\logman.exe
[2010/01/21 17:15:43 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Application Data\dllhst3g.exe
[2010/01/21 01:04:21 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\clipsrv.exe
[2010/01/20 08:44:21 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\ieudinit.exe
[2010/01/15 00:17:33 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/12/28 11:48:59 | 000,743,552 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/11/23 17:47:55 | 000,031,567 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2009/11/23 13:47:57 | 000,000,225 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2009/11/23 13:47:57 | 000,000,093 | ---- | C] () -- C:\WINDOWS\brpcfx.ini
[2009/11/23 13:47:12 | 000,000,086 | ---- | C] () -- C:\WINDOWS\Brfaxrx.ini
[2009/11/23 13:47:10 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll
[2009/11/16 10:30:17 | 000,005,511 | ---- | C] () -- C:\WINDOWS\aiptbl.ini
[2009/11/16 01:10:45 | 000,000,466 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009/11/16 01:10:45 | 000,000,026 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2009/11/15 23:28:15 | 000,000,148 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI
[2009/11/15 23:28:15 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Brownie.ini
[2009/11/15 23:28:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brmx2001.ini
[2009/11/15 23:28:14 | 000,020,605 | ---- | C] () -- C:\WINDOWS\HL-4070CDW.INI
[2009/11/15 23:27:54 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\BRTCPCON.DLL
[2009/11/15 23:27:54 | 000,000,114 | ---- | C] () -- C:\WINDOWS\System32\BRLMW03A.INI
[2009/11/15 22:35:25 | 000,007,552 | ---- | C] () -- C:\WINDOWS\System32\drivers\enodpl.sys
[2009/11/15 22:35:25 | 000,004,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\tandpl.sys
[2009/11/06 11:58:04 | 000,178,975 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2009/10/31 13:13:45 | 000,000,714 | ---- | C] () -- C:\WINDOWS\Edofma.INI
[2009/10/22 19:10:26 | 000,139,152 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/10/22 19:10:25 | 000,139,152 | ---- | C] () -- C:\Documents and Settings\BOLD\Application Data\PnkBstrK.sys
[2009/09/24 13:51:08 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\PUTTY.RND
[2009/09/21 16:48:25 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2009/09/21 16:48:25 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2009/09/21 16:48:25 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2009/09/21 16:48:25 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2009/09/21 16:48:25 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2009/09/21 16:48:25 | 000,000,021 | ---- | C] () -- C:\WINDOWS\SurCode.INI
[2009/09/16 17:51:23 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009/09/16 17:51:23 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2009/09/16 17:51:21 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009/09/16 17:51:21 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/09/16 17:51:21 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009/09/16 17:51:20 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/09/16 17:51:19 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009/06/22 00:07:20 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/05/14 19:24:03 | 000,000,121 | ---- | C] () -- C:\WINDOWS\bdagent.INI
[2009/05/04 21:36:53 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\nvRegDev.dll
[2009/04/26 21:42:47 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2009/04/26 08:06:25 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2009/04/25 13:33:17 | 000,118,272 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/25 10:25:01 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2009/04/25 10:25:01 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2009/04/25 10:25:01 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2009/04/24 15:19:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\w32apiw.dll
[2009/04/24 13:17:56 | 000,000,025 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\.119889580931711767808769176
[2009/04/24 13:15:43 | 000,000,021 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\.311018984119889580931149468956
[2009/04/24 12:18:47 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/04/24 10:40:04 | 014,417,920 | -H-- | C] () -- C:\Documents and Settings\BOLD\NTUSER.DAT
[2009/04/24 10:40:04 | 000,036,864 | -H-- | C] () -- C:\Documents and Settings\BOLD\ntuser.dat.LOG
[2009/04/24 10:40:04 | 000,000,278 | -HS- | C] () -- C:\Documents and Settings\BOLD\ntuser.ini
[2009/04/24 10:39:47 | 000,262,144 | ---- | C] () -- C:\Documents and Settings\All Users\NTUSER.DAT
[2009/04/17 04:30:57 | 000,001,153 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2009/04/17 01:52:46 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/04/17 01:44:37 | 000,000,279 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/04/17 01:42:04 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll
[2009/04/17 01:42:03 | 000,753,664 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2009/03/03 12:18:04 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2008/10/09 16:31:54 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\txmlutil.dll
[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/04/25 14:26:32 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2007/01/31 14:50:32 | 000,913,408 | ---- | C] () -- C:\WINDOWS\System32\xreglib.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >

The OTL extras file:

OTL Extras logfile created on: 4/6/2010 9:55:37 PM - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Documents and Settings\BOLD\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 74.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.05 Gb Total Space | 111.92 Gb Free Space | 37.55% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BOLD_LAPTOP
Current User Name: BOLD
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /k "cd %L" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"135:TCP" = 135:TCP:*:Enabled:TCP Port 135
"5000:TCP" = 5000:TCP:*:Enabled:TCP Port 5000
"5001:TCP" = 5001:TCP:*:Enabled:TCP Port 5001
"5002:TCP" = 5002:TCP:*:Enabled:TCP Port 5002
"5003:TCP" = 5003:TCP:*:Enabled:TCP Port 5003
"5004:TCP" = 5004:TCP:*:Enabled:TCP Port 5004
"5005:TCP" = 5005:TCP:*:Enabled:TCP Port 5005
"5006:TCP" = 5006:TCP:*:Enabled:TCP Port 5006
"5007:TCP" = 5007:TCP:*:Enabled:TCP Port 5007
"5008:TCP" = 5008:TCP:*:Enabled:TCP Port 5008
"5009:TCP" = 5009:TCP:*:Enabled:TCP Port 5009
"5010:TCP" = 5010:TCP:*:Enabled:TCP Port 5010
"5011:TCP" = 5011:TCP:*:Enabled:TCP Port 5011
"5012:TCP" = 5012:TCP:*:Enabled:TCP Port 5012
"5013:TCP" = 5013:TCP:*:Enabled:TCP Port 5013
"5014:TCP" = 5014:TCP:*:Enabled:TCP Port 5014
"5015:TCP" = 5015:TCP:*:Enabled:TCP Port 5015
"5016:TCP" = 5016:TCP:*:Enabled:TCP Port 5016
"5017:TCP" = 5017:TCP:*:Enabled:TCP Port 5017
"5018:TCP" = 5018:TCP:*:Enabled:TCP Port 5018
"5019:TCP" = 5019:TCP:*:Enabled:TCP Port 5019
"5020:TCP" = 5020:TCP:*:Enabled:TCP Port 5020
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4
"3703:TCP" = 3703:TCP:*:Enabled:Adobe Version Cue CS4 Server
"3704:TCP" = 3704:TCP:*:Enabled:Adobe Version Cue CS4 Server
"51000:TCP" = 51000:TCP:*:Enabled:Adobe Version Cue CS4 Server
"51001:TCP" = 51001:TCP:*:Enabled:Adobe Version Cue CS4 Server

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 -- (Adobe Systems Incorporated)
"C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe" = C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:*:Enabled:Adobe Version Cue CS4 Server -- (Adobe Systems Incorporated)
"C:\Games\UT3\Binaries\UT3.exe" = C:\Games\UT3\Binaries\UT3.exe:*:Enabled:Unreal Tournament 3 -- ()
"C:\Games\Dungeon Siege 2\DungeonSiege2.exe" = C:\Games\Dungeon Siege 2\DungeonSiege2.exe:*:Enabled:Dungeon Siege 2 Game Executable -- (Gas Powered Games)
"C:\Games\TmUnitedForever\TmForever.exe" = C:\Games\TmUnitedForever\TmForever.exe:*:Enabled:TmForever -- ()
"C:\Program Files\eMule\emule.exe" = C:\Program Files\eMule\emule.exe:*:Enabled:eMule -- (http://www.emule-project.net)
"C:\Games\AoE3\age3x.exe" = C:\Games\AoE3\age3x.exe:*:Enabled:Age of Empires III - The WarChiefs -- (Ensemble Studios)
"C:\Games\AoE3\age3y.exe" = C:\Games\AoE3\age3y.exe:*:Enabled:Age of Empires III - The Asian Dynasties -- (Microsoft Corporation)
"C:\Games\BF1942\BF1942.exe" = C:\Games\BF1942\BF1942.exe:*:Enabled:BF1942 -- ()
"C:\Games\UT3\Binaries\UnrealConsole.exe" = C:\Games\UT3\Binaries\UnrealConsole.exe:*:Enabled:UnrealConsole -- (Epic Games)
"C:\Games\UT\System\UnrealTournament.exe" = C:\Games\UT\System\UnrealTournament.exe:*:Enabled:UnrealTournament -- ()
"C:\Program Files\Google\Google SketchUp 7\SketchUp.exe" = C:\Program Files\Google\Google SketchUp 7\SketchUp.exe:*:Disabled:SketchUp Application -- (Google, Inc.)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Games\NWN2\nwn2main.exe" = C:\Games\NWN2\nwn2main.exe:*:Enabled:Neverwinter Nights 2 Main -- (Obsidian Entertainment, Inc.)
"C:\Games\NWN2\nwn2main_amdxp.exe" = C:\Games\NWN2\nwn2main_amdxp.exe:*:Enabled:Neverwinter Nights 2 AMD -- (Obsidian Entertainment, Inc.)
"C:\Games\NWN2\nwupdate.exe" = C:\Games\NWN2\nwupdate.exe:*:Enabled:Neverwinter Nights 2 Updater -- (Obsidian Entertainment, Inc.)
"C:\Games\NWN2\nwn2server.exe" = C:\Games\NWN2\nwn2server.exe:*:Enabled:Neverwinter Nights 2 Server -- (Obsidian Entertainment, Inc.)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Games\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" = C:\Games\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club -- (Take-Two Interactive Software, Inc.)
"C:\Games\GTA4\Grand Theft Auto IV\LaunchGTAIV.exe" = C:\Games\GTA4\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV -- ()
"C:\Games\GTA4\Grand Theft Auto IV\GTAIV.exe" = C:\Games\GTA4\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV -- (Take-Two Interactive Software, Inc.)
"C:\DOCUME~1\BOLD\LOCALS~1\Temp\~temp\mlp232\mdm.exe" = C:\DOCUME~1\BOLD\LOCALS~1\Temp\~temp\mlp232\mdm.exe:*:Enabled:UpdateWizzard -- ()
"C:\DOCUME~1\BOLD\LOCALS~1\Temp\~temp\mlp239\mdm.exe" = C:\DOCUME~1\BOLD\LOCALS~1\Temp\~temp\mlp239\mdm.exe:*:Enabled:UpdateWizzard -- ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call
"{0394CDC8-FABD-4ED8-B104-03393876DFDF}" = Roxio Creator Tools
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam(TM)
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{063E409E-3D7C-4A4A-95AB-2F124B9224B3}" = ArcSoft PhotoImpression 6
"{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0C8F5A16-1A6D-405B-A31E-C79B2C7CDA26}" = Screencaster Plug-in for FF
"{0D397393-9B50-4C52-84D5-77E344289F87}" = Roxio Creator Data
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{14F70205-1940-4000-88C7-BE799A6B2CAD}" = Adobe Soundbooth CS4
"{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}" = Adobe SGM CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A621A2F-98F6-4373-89A2-8ED16076990A}" = WinRez LT Studio
"{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server
"{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar v1.0
"{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}" = Adobe InDesign CS4
"{1E002EAE-2F9D-4071-B65B-E19ABB1C297A}" = Brother HL-4070CDW
"{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}" = Adobe InDesign CS4 Icon Handler
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23F79416-CAD1-41BF-99A3-040F6C814AAA}" = NVIDIA Photoshop Plug-ins
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 19
"{297190A1-4B0D-4CD6-8B9F-3907F15C3FD8}" = Adobe CS4 American English Speech Analysis Models
"{299CF645-48C7-4FA1-8BCD-5CE200CF180D}" = Microsoft Search Enhancement Pack
"{2B4C7E1E-E446-4740-ADB5-9842E742EE8A}" = Windows Live Toolbar
"{2BAF2B96-7560-48B4-87D4-10178DDBE217}" = Adobe InDesign CS4 Application Feature Set Files (Roman)
"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
"{2EAF7E61-068E-11DF-953C-005056806466}" = Google Earth
"{2F05CEAF-A575-41E5-B3D0-FE4CEF83CA0A}" = Maya 2009
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{2FB04107-7BC2-449C-915A-530B29B5E0FE}" = UE3Redist
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BA2BAF-FFD4-4B12-B42B-AA8CC902CD23}" = Autodesk DirectConnect 2009
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{362C6A81-4C88-4B26-8C79-B2EE0076F65F}" = Wolfenstein(TM) 1.11 Patch
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A6829EF-0791-4FDD-9382-C690DD0821B9}" = Adobe Flash Player 10 ActiveX
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3EF79591-BF16-4CF8-8FF0-D8AD968228B1}" = Aliens vs. Predator 2
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{411F3ABA-2AB5-4799-AA19-6ADF0A8F7424}" = Adobe Setup
"{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}" = Adobe Fireworks CS4
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{46E1B1F2-A279-4356-9B17-029F9CC72EAE}" = Brother MFL-Pro Suite
"{47D511E4-CF3F-45D4-90A0-B02E086A889C}" = Aliens vs. Predator 2 Tools
"{48E15C9C-E25C-40AD-A46B-AB270729B9B9}" = Google SketchUp Pro 7
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A52555C-032A-4083-BDD9-6A85ABFB39A8}" = Adobe SING CS4
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{52232EF4-CC12-4C21-ABCF-ADB79618302D}" = Adobe Soundbooth CS4 Codecs
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79.1
"{5EAD5443-7194-46CC-A055-428E6ABB1BAF}" = Adobe Encore CS4
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}" = Adobe Creative Suite 4 Master Collection
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6855CCDD-BDF9-48E4-B80A-80DFB96FE36C}" = CmdHere Powertoy For Windows XP
"{690BE098-6D0D-493D-B079-BD7E8F81A141}" = Opera 10.10
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2
"{6BF81CE7-3D5A-497F-8912-2A65A0253E1B}" = Beyond Good & Evil
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7406DF60-016D-476B-A2C7-55D997592047}" = Adobe OnLocation CS4
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{7A8FF745-BBC5-482B-88E4-18D3178249A9}" = ScanSoft PaperPort 11
"{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"{7C3C895B-AE02-4F30-8A6A-051D37A38DD0}" = Final Draft
"{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}" = Adobe InDesign CS4 Common Base Files
"{7E0F42A8-AC7D-4557-8D8F-49918C543ABF}" = BitDefender Antivirus 2009
"{7F34A21F-2DEB-4598-BB19-611D6BD24271}" = Managed DirectX (0900)
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{83FFCFC7-88C6-41C6-8752-958A45325C82}" = Roxio Creator Audio
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{847CAE64-4CD2-4B2D-AF00-978FF5431033}" = Nero 7 Ultra Edition
"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{903B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Project Professional 2003
"{90510409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{92B94569-6683-4617-8C54-EB27A1B51B30}" = GTAIII
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95264530-5A22-8E7E-FE9D-D63A927BCAEA}" = Adobe Media Player
"{97C4F970-C753-443F-B61C-525C739BBC3D}" = Maya 2009 Documentation (en_US)
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A128921B-D03F-4BFB-8141-C365AA48D660}" = Adobe Setup
"{A129D1F2-CAC4-4AD7-B26D-3C6411B87DCC}" = Psychonauts
"{A1C962E2-2426-49C6-A38B-9A07E40D607C}" = Microsoft Games for Windows - LIVE
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2881E09-38DB-4F79-9135-00FDA01768A7}" = Adobe Creative Suite 4 Design Premium
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A6EC82A0-1414-475D-8AFD-469089F3080D}" = Adobe Contribute CS4
"{A746CE98-A755-4AD7-B4B8-346DC74CDECD}" = OVT Scanner
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}_931" = Adobe Acrobat 9.3.1 - CPSID_50570
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.1
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = Adobe MotionPicture Color Files CS4
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = Adobe Color Video Profiles AE CS4
"{B169BC97-B8AA-4ACA-9CF2-9D0FF5BABDF7}" = Adobe Premiere Pro CS4 Functional Content
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B73B4A99-4173-4747-BBEC-0F05E966F9D2}" = Battlefield 1942: Secret Weapons of WWII
"{B9F4561A-924D-4510-A85A-BB0960C338CB}" = Adobe Asset Services CS4
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BBD40517-2A65-4683-A164-E1F1E5770BAB}" = Battlecraft 1942
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}" = Unreal Tournament 3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3AE9DA1-2E44-4F11-803E-20977F0FE6B9}" = Safari
"{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C938BE91-3BB5-4B84-9EF6-88F0505D0038}" = Adobe Premiere Pro CS4 Third Party Content
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}" = WinZip 12.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D057AA08-8CBF-42E3-9EAB-23B8FED1C279}" = Battlefield 1942: The Road To Rome
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes
"{D1DDE912-03B9-4C1C-A7EB-C60693820E18}" = REALTEK RTL8187 Wireless LAN Driver and Utility
"{D3941722-C4DD-4509-88C4-0E87F675A859}_is1" = Freeplane
"{D45EC259-4A19-4656-B588-C2C360DD18EA}" = Half-Life(R) 2
"{D499F8DE-3F31-4900-9157-61061613704B}" = Adobe Premiere Pro CS4
"{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{E280923D-C5D9-4728-8C79-AC9A0DC75875}" = BioShock
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E7081891-BC7F-43F9-9CE6-B5DD2F497156}" = Internet Explorer Developer Toolbar
"{E8EE9410-8AC4-4F43-A626-DDECA75C79F3}" = Adobe Setup
"{ED264BD6-724B-4300-9C5F-EC4F2F01F647}" = The Suffering: Ties That Bind
"{EE353798-E875-42E0-B58D-7E6696182EA8}" = Adobe Media Encoder CS4 Dolby
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F19082BE-3928-40B8-B985-C6E230010912}_is1" = Karaoke CD+G Creator
"{F20C1251-1D0A-4944-B2AE-678581B33B19}" = Neverwinter Nights 2
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery
"{f827bbee-510d-4dc4-bc62-83c8104285f5}" = Nero 9
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"{FB2A5FCC-B81B-48C2-A009-7804694D83E9}" = Adobe Encore CS4 Codecs
"{FC272B66-8372-49EF-A642-28CAD2B9EAC9}" = Tron 2.0
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"AC3Filter_is1" = AC3Filter 1.61b
"Active Desktop Calendar_is1" = Active Desktop Calendar 7.75
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_3dcb365ab9e01871fb8c6f27b0ea079" = Adobe After Effects CS4
"Adobe_55230b0b70661df0f212e88f0b655f7" = Adobe Creative Suite 4 Design Premium
"Adobe_b2d6abde968e6f277ddbfd501383e02" = Adobe Creative Suite 4 Master Collection
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"Advanced Video FX Engine" = Advanced Video FX Engine
"Age of Mythology Expansion Pack 1.0" = Age of Mythology Gold
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.9 (Unicode)
"Broadcom 802.11 Application" = Dell Wireless WLAN Card Utility
"Celtx (2.7)" = Celtx (2.7)
"Col. Cruachan's RFA Explorer" = Col. Cruachan's RFA Explorer
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Compare It!_is1" = Compare It!
"Creative OEM013" = Laptop Integrated Webcam Driver (1.01.01.0529)
"Dell Webcam Center" = Dell Webcam Center
"Dell Webcam Manager" = Dell Webcam Manager
"Diablo II" = Diablo II
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DragonUnPACKer5_is1" = Dragon UnPACKer 5
"Dungeon Siege II Tool Kit_is1" = Dungeon Siege II Tool Kit 1.1
"DungeonSiege2" = Dungeon Siege 2
"DVD Decrypter" = DVD Decrypter (Remove Only)
"Easy CD-DA Extractor 12" = Easy CD-DA Extractor 12
"Empires Dawn of the Modern World" = Empires Dawn of the Modern World
"eMule" = eMule
"EphPod" = EphPod
"FFmpeg for Audacity on Windows_is1" = FFmpeg for Audacity on Windows
"FileZilla Client" = FileZilla Client 3.3.2.1
"Font Xplorer" = Font Xplorer 1.2.2
"Game Maker 8.0" = Game Maker 8.0
"Google Updater" = Google Updater
"Halo" = Microsoft Halo
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"InstallShield_{2FB04107-7BC2-449C-915A-530B29B5E0FE}" = UE3Redist
"InstallShield_{362C6A81-4C88-4B26-8C79-B2EE0076F65F}" = Wolfenstein(TM) 1.11 Patch
"InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"InstallShield_{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 5.1.0
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"nCleaner" = nCleaner second 2.3.4.0
"New AoE3 Editor 2" = New AoE3 Editor 2
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Notepad++" = Notepad++
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"OpenAL" = OpenAL
"OVT Scanner" = Uninstall OVT Scanner
"PunkBusterSvc" = PunkBuster Services
"RADVideo" = RAD Video Tools
"Renamer_is1" = Renamer 1.1
"Rmtablet" = USB Tablet Manager
"SeriousSam2" = Serious Sam 2
"Smart Defrag_is1" = Smart Defrag
"SpywareBlaster_is1" = SpywareBlaster 4.2
"SShockDeinstallKey" = System Shock2
"Steam App 211" = Source SDK
"Steam App 340" = Half-Life 2: Lost Coast
"SuperNotecard for Scriptwriting" = SuperNotecard for Scriptwriting 1.9
"TagScanner_is1" = TagScanner 5.0 build 532
"TmUnitedForever_is1" = TmUnitedForever
"Tomb Raider: Legend" = Tomb Raider:ver
"UnrealTournament" = Unreal Tournament G.O.T.Y. Edition
"VDMSound" = VDMSound
"VST Bridge_is1" = VST Bridge 1.1
"VUE" = VUE 3.0
"Warzone 2100" = Warzone 2100
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"World Creator v1.5 Freeware" = World Creator v1.5 Freeware
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"X-Lite 1.5_is1" = X-Lite 3.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2639425400-4150335791-2106716870-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
"Google Chrome" = Google Chrome
"InstallShield_{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}" = Unreal Tournament 3
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/15/2010 1:27:43 PM | Computer Name = BOLD_LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application safari.exe, version 4.528.17.0, faulting module
corefoundation.dll, version 1.510.21.0, fault address 0x00054e62.

Error - 3/15/2010 3:34:16 PM | Computer Name = BOLD_LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application safari.exe, version 4.528.17.0, faulting module
pubsubdll.dll, version 1.65.6.3, fault address 0x0002f634.

Error - 3/18/2010 5:34:11 AM | Computer Name = BOLD_LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application csrss.exe, version 1.0.0.1, faulting module mshtml.dll,
version 8.0.6001.18876, fault address 0x000a2077.

Error - 3/19/2010 4:00:32 PM | Computer Name = BOLD_LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application csrss.exe, version 1.0.0.1, faulting module mshtml.dll,
version 8.0.6001.18876, fault address 0x000a2077.

Error - 3/21/2010 7:42:48 AM | Computer Name = BOLD_LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application csrss.exe, version 1.0.0.1, faulting module mshtml.dll,
version 8.0.6001.18876, fault address 0x000a2077.

Error - 3/23/2010 5:00:58 AM | Computer Name = BOLD_LAPTOP | Source = MsiInstaller | ID = 10005
Description = Product: Tinker -- Error 25580. Cannot connect to Windows Firewall.
(-2147023143 )

Error - 3/24/2010 10:20:58 AM | Computer Name = BOLD_LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application csrss.exe, version 1.0.0.1, faulting module mshtml.dll,
version 8.0.6001.18876, fault address 0x000a2077.

Error - 3/26/2010 3:39:54 AM | Computer Name = BOLD_LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application lsass.exe, version 1.0.0.1, faulting module mshtml.dll,
version 8.0.6001.18876, fault address 0x000a2077.

Error - 3/30/2010 11:44:44 PM | Computer Name = BOLD_LAPTOP | Source = MsiInstaller | ID = 11316
Description = Product: BitDefender Antivirus 2009 -- Error 1316. A network error
occurred while attempting to read from the file: C:\WINDOWS\Installer\bdav.msi

Error - 4/5/2010 12:53:25 PM | Computer Name = BOLD_LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application chrome.exe, version 0.0.0.0, faulting module
d3d9.dll, version 5.3.2600.5512, fault address 0x00103a6b.

[ System Events ]
Error - 4/2/2010 9:46:37 PM | Computer Name = BOLD_LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service upnphost with
arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

Error - 4/2/2010 10:13:53 PM | Computer Name = BOLD_LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service upnphost with
arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

Error - 4/3/2010 11:21:17 AM | Computer Name = BOLD_LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service upnphost with
arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

Error - 4/3/2010 2:25:43 PM | Computer Name = BOLD_LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service upnphost with
arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

Error - 4/3/2010 2:26:29 PM | Computer Name = BOLD_LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service upnphost with
arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

Error - 4/4/2010 3:05:52 PM | Computer Name = BOLD_LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service upnphost with
arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

Error - 4/4/2010 3:06:22 PM | Computer Name = BOLD_LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service upnphost with
arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

Error - 4/5/2010 10:11:49 AM | Computer Name = BOLD_LAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.102 for the Network Card with network
address 00242BC72E93 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 4/5/2010 12:26:59 PM | Computer Name = BOLD_LAPTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service upnphost with
arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

Error - 4/6/2010 1:24:08 PM | Computer Name = BOLD_LAPTOP | Source = Service Control Manager | ID = 7034
Description = The PnkBstrA service terminated unexpectedly. It has done this 1
time(s).

< End of report >

deltalima

April 7, 2010, 8:22 AM UTC

Hi Bold,

Remove P2P Programs

I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

BitTorrent
BitTorrent DNA
Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.
Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Click on start
Then Run
In the open text entry box please copy/paste appwiz.cpl Then click enter.
Press the "Remove" or "Change/Remove"...button to uninstall the programs listed above (in red) and any other P2P you have installed NOW.
Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.

Now please run CKScanner again and post the contents of CKFiles.txt, if the file is blank then please post the exact contents of the results window after the scan has completed.

Bold

April 7, 2010, 7:41 PM UTC

Thanks deltalima,

I removed the p2p programs and re-ran CKScanner, the .txt file still comes up empty. Could there be something else preventing the CKScanner output?

deltalima

April 7, 2010, 7:50 PM UTC

"Bold" wrote:Thanks deltalima,

I removed the p2p programs and re-ran CKScanner, the .txt file still comes up empty. Could there be something else preventing the CKScanner output?

What text is displayed in the white box to the right of the CKScanner window once the scan has completed ?

It should start with CKScanner - Additional Security Risks

Bold

April 8, 2010, 1:04 AM UTC

Apologies deltalima, it was user error. Here you go:

CKScanner - Additional Security Risks - These are not necessarily bad
c:\games\mame\roms\cracksht.zip
c:\program files\adobe\adobe premiere pro cs4\plug-ins\en_us\vstplugins\decrackler1.dll
c:\program files\adobe\adobe premiere pro cs4\plug-ins\en_us\vstplugins\decrackler2.dll
c:\program files\adobe\adobe premiere pro cs4\plug-ins\en_us\vstplugins\decrackler6.dll
c:\program files\autodesk\maya2009\brushes\fun\cracks.mel
c:\program files\autodesk\maya2009\brushes\fun\cracks.mel.icon
c:\program files\autodesk\maya2009\docs\maya2009\en_us\files\uv_texture_mapping_creating_a_cracker_box_model.htm
c:\program files\autodesk\maya2009\scripts\others\crackshatter.mel
c:\program files\autodesk\maya2009\scripts\others\crackshatter.res.mel
scanner sequence 3.ED.11
----- EOF -----

deltalima

April 8, 2010, 11:47 AM UTC

Hi Bold,

Please remove the program Spybot - Search & Destroy , it will interfere with our fixes and can be reinstalled later if still required.

Click Start, point to Settings, and then click Control Panel.
In Control Panel, double-click Add or Remove Programs.
In Add or Remove Programs,
highlight Spybot - Search & Destroy
click Remove
Close the Add or Remove Programs and the Control Panel windows.

Upload a File to Virustotal

Please go to Virustotal

Copy/paste this file and path into the white box at the top:

C:\WINDOWS\sessmgr.exe

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.

TFC

Please download TFC to your desktop,
Save any unsaved work. TFC will close all open application windows.
Double-click TFC.exe to run the program.
Click the Start button in the bottom left of TFC
If prompted, click "Yes" to reboot.

Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It should not take longer than a couple of minutes , and may only take a few seconds. Only if needed will you be prompted to reboot.

Rkill

Please download Rkill from one of the following links and save to your Desktop:

One, Two,Three or Four

Double click on Rkill.
A command window will open then disappear upon completion, this is normal.
A notepad windows will open, please post the contents in your next reply
This log can also be found at C:\rkill.log
Please leave Rkill on the Desktop until otherwise advised.

Note: If your security software warns about Rkill, please ignore and allow the download to continue.

Malwarebytes Anti-Malware

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and select then follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please post that log in your next reply.

The log can also be found here:

Launch Malwarebytes' Anti-Malware
Click on the Logs radio tab.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Now please run a new OTL scan and post just the OTL.txt log along with the RKill log, the Malwarebytes log and the results from the Virustotal scan.

Bold

April 9, 2010, 3:53 AM UTC

Thanks...I followed all the steps and here are the four logs.

OTL.txt
OTL logfile created on: 4/8/2010 1:46:55 PM - Run 2
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Documents and Settings\BOLD\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 84.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.05 Gb Total Space | 110.65 Gb Free Space | 37.12% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BOLD_LAPTOP
Current User Name: BOLD
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\BOLD\Local Settings\Temp\~temp\hmbst27\lsass.exe (TODO: <Company name>)
PRC - C:\Documents and Settings\BOLD\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\IObit\Advanced SystemCare\AWC.exe (IObit)
PRC - C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Documents and Settings\BOLD\Local Settings\Application Data\clipsrv.exe ()
PRC - C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe (BitDefender S.R.L.)
PRC - C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe ()
PRC - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe (BitDefender SRL)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe (XemiComputers ltd.)
PRC - C:\Program Files\IObit\Advanced SystemCare\Sup_SmartRAM.exe (IObit)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
PRC - C:\WINDOWS\system32\drivers\o2flash.exe (O2Micro International)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\WINDOWS\OEM13Mon.exe (Creative Technology Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\ATWTUSB.EXE ()
PRC - C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\BOLD\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\XemiComputers\Active Desktop Calendar\MouseHook.dll ()

========== Win32 Services (SafeList) ==========

SRV - (LIVESRV) -- C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe (BitDefender SRL)
SRV - (scan) -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\scan.dll (S.C. BitDefender S.R.L)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Arrakis3) -- C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe ()
SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
SRV - (O2FLASH) -- C:\WINDOWS\system32\drivers\o2flash.exe (O2Micro International)
SRV - (Adobe Version Cue CS4) -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)
SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (trufos) -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys (BitDefender S.R.L.)
DRV - (dfmirage) -- C:\WINDOWS\system32\drivers\dfmirage.sys (DemoForge, LLC)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (bdfsfltr) -- C:\WINDOWS\system32\drivers\bdfsfltr.sys (BitDefender S.R.L. Bucharest, ROMANIA)
DRV - (O2SDRDR) -- C:\WINDOWS\system32\drivers\o2sd.sys (O2Micro )
DRV - (O2MDRDR) -- C:\WINDOWS\system32\drivers\o2media.sys (O2Micro )
DRV - (bdfm) -- C:\WINDOWS\system32\drivers\bdfm.sys (BitDefender S.R.L. Bucharest, ROMANIA)
DRV - (profos) -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys ()
DRV - (adfs) -- C:\WINDOWS\system32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (OEM13Vid) -- C:\WINDOWS\system32\drivers\OEM13Vid.sys (Creative Technology Ltd.)
DRV - (OEM13Vfx) -- C:\WINDOWS\system32\drivers\OEM13Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (OEM13Afx) -- C:\WINDOWS\system32\drivers\OEM13Afx.sys (Creative Technology Ltd.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (iaStor) -- C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (DLADResM) -- C:\WINDOWS\system32\drivers\DLADResM.SYS (Roxio)
DRV - (DLABMFSM) -- C:\WINDOWS\system32\drivers\DLABMFSM.SYS (Roxio)
DRV - (DLAUDF_M) -- C:\WINDOWS\system32\drivers\DLAUDF_M.SYS (Roxio)
DRV - (DLAUDFAM) -- C:\WINDOWS\system32\drivers\DLAUDFAM.SYS (Roxio)
DRV - (DLAOPIOM) -- C:\WINDOWS\system32\drivers\DLAOPIOM.SYS (Roxio)
DRV - (DLABOIOM) -- C:\WINDOWS\system32\drivers\DLABOIOM.SYS (Roxio)
DRV - (DLAPoolM) -- C:\WINDOWS\system32\drivers\DLAPoolM.SYS (Roxio)
DRV - (DLAIFS_M) -- C:\WINDOWS\system32\drivers\DLAIFS_M.SYS (Roxio)
DRV - (DRVMCDB) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DLARTL_M) -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS (Roxio)
DRV - (DLACDBHM) -- C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Roxio)
DRV - (DRVNDDM) -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Roxio)
DRV - (RTLWUSB) -- C:\WINDOWS\system32\drivers\RTL8187.sys (Realtek Semiconductor Corporation )
DRV - (APL531) -- C:\WINDOWS\system32\drivers\ov550i.sys (Omnivision Technologies, Inc.)
DRV - (aiptektp) -- C:\WINDOWS\system32\drivers\aiptektp.sys (WALTOP International Corp.)
DRV - (APPDRV) -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfsync02.sys (Protection Technology)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)
DRV - (Afc) -- C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (LMouFlt2) -- C:\WINDOWS\system32\drivers\lmouflt2.sys (Logitech, Inc.)
DRV - (LHidFlt2) -- C:\WINDOWS\system32\drivers\LHIDFLT2.SYS (Logitech, Inc.)
DRV - (tandpl) -- C:\WINDOWS\system32\drivers\tandpl.sys ()
DRV - (enodpl) -- C:\WINDOWS\system32\drivers\enodpl.sys ()
DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USSMB/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.msn.com/sphome.aspx
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USSMB/1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USSMB/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.5.3
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.3.4

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2009\FFToolbar\ [2010/03/30 20:44:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/31 20:07:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/31 20:07:12 | 000,000,000 | ---D | M]

[2010/01/22 12:00:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Extensions
[2010/01/22 12:00:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Extensions\[removed]
[2010/04/07 18:50:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions
[2009/11/19 17:18:29 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009/07/31 16:50:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/18 15:13:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions\[removed]
[2010/03/18 15:13:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\BOLD\Application Data\Mozilla\Firefox\Profiles\fq7elrhe.default\extensions\staged-xpis
[2010/04/07 18:50:15 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/11/12 09:14:47 | 000,065,536 | ---- | M] () -- C:\Program Files\Mozilla Firefox\components\FFComm.dll
[2008/09/03 17:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
[2009/09/22 14:14:24 | 000,176,128 | ---- | M] (Dimdim, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npDimdimControl.dll
[2006/08/09 03:16:08 | 000,030,408 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npWebLaunch.dll

O1 HOSTS File: ([2010/03/17 23:03:02 | 000,380,737 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 http://www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 http://www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 http://www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 http://www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 http://www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 http://www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 http://www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 http://www.100888290cs.com
O1 - Hosts: 127.0.0.1 http://www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 http://www.10sek.com
O1 - Hosts: 127.0.0.1 http://www.1-2005-search.com
O1 - Hosts: 13117 more lines...
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()
O2 - BHO: (IE Developer Toolbar BHO) - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll (Bitdefender)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [atwtusb] C:\WINDOWS\System32\ATWTUSB.EXE ()
O4 - HKLM..\Run: [BDAgent] C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe (BitDefender S.R.L.)
O4 - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe (BitDefender)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] File not found
O4 - HKLM..\Run: [OEM13Mon.exe] C:\WINDOWS\OEM13Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKCU..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe (XemiComputers ltd.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [Advanced SystemCare 3] C:\Program Files\IObit\Advanced SystemCare\AWC.exe (IObit)
O4 - HKCU..\Run: [SmartRAM] C:\Program Files\IObit\Advanced SystemCare\Sup_SmartRAM.exe (IObit)
O4 - HKLM..\RunOnce: [WIAWizardMenu] C:\WINDOWS\System32\sti_ci.DLL (Microsoft Corporation)
F3 - HKCU WinNT: Load - (C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe) - C:\Documents and Settings\BOLD\Application Data\Microsoft\dllhst3g.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ClipSrv = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\clipsrv.exe /waitservice ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: DllHst = C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe /waitservice ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ClipSrv = C:\WINDOWS\System32\drivers\clipsrv.exe /waitservice ()
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258389455359 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\BOLD\Application Data\XemiComputers\Active Desktop Calendar\Desktop\Active Desktop Calendar.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\BOLD\Application Data\XemiComputers\Active Desktop Calendar\Desktop\Active Desktop Calendar.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 14:29:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/04/08 13:33:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Application Data\Malwarebytes
[2010/04/08 13:33:12 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/08 13:33:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/04/08 13:33:09 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/08 13:33:09 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/08 13:01:22 | 000,444,416 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\BOLD\Desktop\TFC.exe
[2010/04/07 15:17:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Application Data\Free Download Manager
[2010/04/07 15:17:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG
[2010/04/07 15:17:19 | 000,000,000 | ---D | C] -- C:\Program Files\Free Download Manager
[2010/04/06 13:31:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Local Settings\Application Data\RustemSoft
[2010/04/06 13:31:04 | 000,000,000 | ---D | C] -- C:\Program Files\RustemSoft
[2010/04/06 12:20:52 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\BOLD\Desktop\OTL.exe
[2010/04/05 15:55:36 | 000,000,000 | ---D | C] -- C:\Program Files\Notepad
[2010/04/05 07:38:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/04/05 07:38:43 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/04/05 07:38:42 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/05 07:38:42 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/05 07:38:42 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/03 09:56:19 | 000,000,000 | ---D | C] -- C:\Program Files\World Creator
[2010/04/03 09:51:16 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\BOLD\Recent
[2010/04/02 11:48:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Application Data\OpenOffice.org
[2010/04/02 11:39:43 | 000,000,000 | ---D | C] -- C:\Program Files\JRE
[2010/04/02 11:39:37 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2010/04/02 11:39:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/04/02 08:46:51 | 000,000,000 | ---D | C] -- C:\Program Files\CompareIt
[2010/03/31 23:23:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Application Data\BitDefender
[2010/03/29 23:43:36 | 000,000,000 | ---D | C] -- C:\Program Files\VDMSound
[2010/03/27 14:47:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Softwrap
[2010/03/27 14:47:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Fonts
[2010/03/27 14:47:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Config
[2010/03/24 14:39:26 | 000,000,000 | ---D | C] -- C:\Program Files\thriXXX
[2010/03/17 22:30:43 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/03/17 12:12:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Temp
[2010/03/16 11:25:09 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/03/11 23:05:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BOLD\Local Settings\Application Data\none
[2010/03/11 08:52:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\IObit
[2009/06/30 13:02:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/06/30 12:42:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/05/14 07:09:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2009/05/11 09:09:35 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/05/11 09:09:35 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/05/11 09:09:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/05/11 09:09:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/04/08 13:47:53 | 000,528,020 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/04/08 13:47:53 | 000,445,938 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/04/08 13:47:53 | 000,072,978 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/04/08 13:44:21 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\AWC AutoSweep.job
[2010/04/08 13:43:49 | 000,052,592 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001
[2010/04/08 13:43:47 | 000,000,718 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/04/08 13:43:44 | 000,272,291 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010/04/08 13:43:36 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/04/08 13:43:31 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/04/08 13:43:30 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/04/08 13:43:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/08 13:43:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/08 13:43:15 | 3219,574,784 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/08 13:42:33 | 014,417,920 | -H-- | M] () -- C:\Documents and Settings\BOLD\NTUSER.DAT
[2010/04/08 13:42:31 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\BOLD\ntuser.ini
[2010/04/08 13:42:08 | 016,009,518 | -H-- | M] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\IconCache.db
[2010/04/08 13:41:00 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2639425400-4150335791-2106716870-1006UA.job
[2010/04/08 13:17:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/04/08 13:03:28 | 000,363,520 | ---- | M] () -- C:\Documents and Settings\BOLD\Desktop\rkill.exe
[2010/04/08 13:01:22 | 000,444,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\BOLD\Desktop\TFC.exe
[2010/04/08 08:34:25 | 000,118,272 | ---- | M] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/08 07:39:02 | 000,000,466 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI
[2010/04/07 21:41:00 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2639425400-4150335791-2106716870-1006Core.job
[2010/04/07 16:40:27 | 000,052,592 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat
[2010/04/06 12:20:52 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\BOLD\Desktop\OTL.exe
[2010/04/06 12:20:45 | 000,451,584 | ---- | M] () -- C:\Documents and Settings\BOLD\Desktop\CKScanner.exe
[2010/04/05 07:38:28 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2010/04/05 07:38:28 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/05 07:38:28 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/05 07:38:28 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/05 07:38:28 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/04/05 07:11:51 | 002,078,944 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/04/04 22:00:00 | 000,000,358 | ---- | M] () -- C:\WINDOWS\tasks\SmartDefrag.job
[2010/04/01 21:08:45 | 000,002,570 | ---- | M] () -- C:\Documents and Settings\BOLD\My Documents\mfc.jpg
[2010/04/01 18:21:56 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/04/01 17:51:28 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\null
[2010/03/30 20:42:47 | 000,081,984 | ---- | M] () -- C:\WINDOWS\System32\bdod.bin
[2010/03/30 12:28:39 | 000,046,080 | ---- | M] () -- C:\Documents and Settings\BOLD\My Documents\Invoice - Chris Bold 3-24-10.doc
[2010/03/30 00:46:30 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/30 00:45:52 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/28 21:35:54 | 000,026,112 | ---- | M] () -- C:\Documents and Settings\BOLD\Desktop\todo.doc
[2010/03/27 14:50:05 | 000,002,645 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\Global.sw2
[2010/03/27 14:47:53 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\SwSys2.bmp
[2010/03/27 14:47:53 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\SwSys1.bmp
[2010/03/25 21:18:54 | 000,152,064 | ---- | M] () -- C:\Documents and Settings\BOLD\My Documents\A REPORT ON HELEN KELLER BY ROWAN LASKY.doc
[2010/03/23 01:58:25 | 000,001,656 | ---- | M] () -- C:\Documents and Settings\BOLD\My Documents\584109eb_Fudgonaut.sav
[2010/03/21 13:03:53 | 000,000,375 | ---- | M] () -- C:\WINDOWS\System32\BDUpdateV1.xml
[2010/03/17 23:03:02 | 000,380,737 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/17 22:35:14 | 000,000,118 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI
[2010/03/17 22:31:46 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/03/17 21:40:22 | 000,000,121 | ---- | M] () -- C:\WINDOWS\bdagent.INI
[2010/03/15 12:50:57 | 000,033,416 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat

========== Files Created - No Company Name ==========

[2010/04/08 13:03:28 | 000,363,520 | ---- | C] () -- C:\Documents and Settings\BOLD\Desktop\rkill.exe
[2010/04/06 12:20:45 | 000,451,584 | ---- | C] () -- C:\Documents and Settings\BOLD\Desktop\CKScanner.exe
[2010/04/01 21:08:45 | 000,002,570 | ---- | C] () -- C:\Documents and Settings\BOLD\My Documents\mfc.jpg
[2010/03/30 12:28:39 | 000,046,080 | ---- | C] () -- C:\Documents and Settings\BOLD\My Documents\Invoice - Chris Bold 3-24-10.doc
[2010/03/28 21:33:17 | 000,095,744 | ---- | C] () -- C:\WINDOWS\sessmgr.exe
[2010/03/27 14:47:53 | 000,002,645 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\Global.sw2
[2010/03/27 14:47:53 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\SwSys2.bmp
[2010/03/27 14:47:53 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\SwSys1.bmp
[2010/03/25 21:15:08 | 000,152,064 | ---- | C] () -- C:\Documents and Settings\BOLD\My Documents\A REPORT ON HELEN KELLER BY ROWAN LASKY.doc
[2010/03/23 01:53:05 | 000,001,656 | ---- | C] () -- C:\Documents and Settings\BOLD\My Documents\584109eb_Fudgonaut.sav
[2010/03/17 22:31:09 | 000,001,024 | -H-- | C] () -- C:\Documents and Settings\All Users\ntuser.dat.LOG
[2010/02/20 10:46:43 | 000,000,025 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\.811261211181235583101118113995
[2010/02/05 22:00:15 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\mstsc.exe
[2010/01/22 08:54:52 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Application Data\cisvc.exe
[2010/01/21 17:16:05 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\logman.exe
[2010/01/21 01:04:21 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\clipsrv.exe
[2010/01/20 08:44:21 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\ieudinit.exe
[2010/01/15 00:17:33 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/12/28 11:48:59 | 000,743,552 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/11/23 17:47:55 | 000,031,567 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2009/11/23 13:47:57 | 000,000,225 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2009/11/23 13:47:57 | 000,000,093 | ---- | C] () -- C:\WINDOWS\brpcfx.ini
[2009/11/23 13:47:12 | 000,000,086 | ---- | C] () -- C:\WINDOWS\Brfaxrx.ini
[2009/11/23 13:47:10 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll
[2009/11/16 10:30:17 | 000,005,511 | ---- | C] () -- C:\WINDOWS\aiptbl.ini
[2009/11/16 01:10:45 | 000,000,466 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009/11/16 01:10:45 | 000,000,026 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2009/11/15 23:28:15 | 000,000,148 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI
[2009/11/15 23:28:15 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Brownie.ini
[2009/11/15 23:28:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brmx2001.ini
[2009/11/15 23:28:14 | 000,020,605 | ---- | C] () -- C:\WINDOWS\HL-4070CDW.INI
[2009/11/15 23:27:54 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\BRTCPCON.DLL
[2009/11/15 23:27:54 | 000,000,114 | ---- | C] () -- C:\WINDOWS\System32\BRLMW03A.INI
[2009/11/15 22:35:25 | 000,007,552 | ---- | C] () -- C:\WINDOWS\System32\drivers\enodpl.sys
[2009/11/15 22:35:25 | 000,004,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\tandpl.sys
[2009/11/06 11:58:04 | 000,178,975 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2009/10/31 13:13:45 | 000,000,714 | ---- | C] () -- C:\WINDOWS\Edofma.INI
[2009/10/22 19:10:26 | 000,139,152 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/10/22 19:10:25 | 000,139,152 | ---- | C] () -- C:\Documents and Settings\BOLD\Application Data\PnkBstrK.sys
[2009/09/24 13:51:08 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\PUTTY.RND
[2009/09/21 16:48:25 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2009/09/21 16:48:25 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2009/09/21 16:48:25 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2009/09/21 16:48:25 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2009/09/21 16:48:25 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2009/09/21 16:48:25 | 000,000,021 | ---- | C] () -- C:\WINDOWS\SurCode.INI
[2009/09/16 17:51:23 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009/09/16 17:51:23 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2009/09/16 17:51:21 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009/09/16 17:51:21 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/09/16 17:51:21 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009/09/16 17:51:20 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/09/16 17:51:19 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009/06/22 00:07:20 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/05/14 19:24:03 | 000,000,121 | ---- | C] () -- C:\WINDOWS\bdagent.INI
[2009/05/04 21:36:53 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\nvRegDev.dll
[2009/04/26 21:42:47 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2009/04/26 08:06:25 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2009/04/25 13:33:17 | 000,118,272 | ---- | C] () -- C:\Documents and Settings\BOLD\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/25 10:25:01 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2009/04/25 10:25:01 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2009/04/25 10:25:01 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2009/04/24 15:19:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\w32apiw.dll
[2009/04/24 13:17:56 | 000,000,025 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\.119889580931711767808769176
[2009/04/24 13:15:43 | 000,000,021 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\.311018984119889580931149468956
[2009/04/24 12:18:47 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/04/24 10:40:04 | 014,417,920 | -H-- | C] () -- C:\Documents and Settings\BOLD\NTUSER.DAT
[2009/04/24 10:40:04 | 000,001,024 | -H-- | C] () -- C:\Documents and Settings\BOLD\ntuser.dat.LOG
[2009/04/24 10:40:04 | 000,000,278 | -HS- | C] () -- C:\Documents and Settings\BOLD\ntuser.ini
[2009/04/24 10:39:47 | 000,262,144 | ---- | C] () -- C:\Documents and Settings\All Users\NTUSER.DAT
[2009/04/17 04:30:57 | 000,001,153 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2009/04/17 01:52:46 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/04/17 01:44:37 | 000,000,279 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/04/17 01:42:04 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll
[2009/04/17 01:42:03 | 000,753,664 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2009/03/03 12:18:04 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2008/10/09 16:31:54 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\txmlutil.dll
[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/04/25 14:26:32 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2007/01/31 14:50:32 | 000,913,408 | ---- | C] () -- C:\WINDOWS\System32\xreglib.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >

RKill.log
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as BOLD on 04/08/2010 at 13:29:49.

Processes terminated by Rkill or while it was running:

C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\BOLD\Desktop\rkill.exe

Rkill completed on 04/08/2010 at 13:29:52.

Malwarebytes.log
Malwarebytes' Anti-Malware 1.45
http://www.malwarebytes.org

Database version: 3970

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/8/2010 1:41:39 PM
mbam-log-2010-04-08 (13-41-39).txt

Scan type: Quick scan
Objects scanned: 110995
Time elapsed: 5 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 14
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 140

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\bisoft (Worm.Bagle) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\sK9Ou0s (Worm.Bagle) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cmstp (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\spool (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\spool (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mstsc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cmstp (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\comrepl (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\esent utl (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\logman (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rsvp (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\esent utl (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\logman (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cisvc (Trojan.Rodecap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cisvc (Trojan.Rodecap) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\BOLD\Application Data\drivers\downld (Worm.Bagle) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23611062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23680796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23757812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23758609.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23758656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23782250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23782531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23782546.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23815156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23818000.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23819875.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23865312.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23867656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23868046.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23868640.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23869609.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23896781.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23898156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23898375.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23961031.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\23961671.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\24052390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\24055562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\24057671.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\24108625.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\24112656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\24113796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\24143843.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\24144484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38718187.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38718234.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38718250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38803453.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38803515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38803531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38838687.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38841281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38843078.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38883156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38884406.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38884781.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38885375.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38885390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38917625.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38918250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38918437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38968890.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38968937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38975859.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38976812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\38977250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\39025906.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\39028484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\39030296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\39040953.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\39041578.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\39041750.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53527515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53528625.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53618281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53618359.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53618375.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53639671.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53639703.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53700140.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53700156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53709640.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53711703.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53713468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53752046.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53753406.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53753843.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53754437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53754484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53754515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53776390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53779859.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53780078.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53837218.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53837296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53837312.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53843843.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53844515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53845046.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53981796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53983015.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53984015.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53992656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53993218.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\53993390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68538671.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68539468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68560125.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68560500.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68560515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68580046.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68580062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68580078.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68589796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68592281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68594078.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68612968.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68632062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68633687.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68634062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68634640.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68635578.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68635593.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68659421.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68661281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68661484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68708281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68708953.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68730406.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68731171.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68731625.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68782546.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68784515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68785203.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68793156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68793734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\drivers\downld\68793921.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\Microsoft\cmstp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\dllhst3g.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\logman.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\Microsoft\logman.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\Microsoft\rsvp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\mstsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\mstsc.exe (Trojan.Zaplo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\spoolsv.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\cisvc.exe (Backdoor.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\comrepl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system\esentutl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system\mstsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Local Settings\Application Data\Microsoft\cmstp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Local Settings\Application Data\Microsoft\comrepl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Local Settings\Application Data\Microsoft\esentutl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Local Settings\Application Data\rsvp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\BOLD\Application Data\spoolsv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

VirusTotal.txt
File sessmgr.exe received on 2010.04.08 20:02:26 (UTC)
Current status: finished
Result: 24/39 (61.54%)
Compact
Print results
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.04.08 Trojan.Win32.Cosmu!IK
AhnLab-V3 5.0.0.2 2010.04.08 -
AntiVir 7.10.6.49 2010.04.08 TR/Downloader.Gen
Antiy-AVL 2.0.3.7 2010.04.08 -
Authentium 5.2.0.5 2010.04.08 W32/Horst.C.gen!Eldorado
Avast 4.8.1351.0 2010.04.08 Win32:Rodecap
Avast5 5.0.332.0 2010.04.08 Win32:Rodecap
AVG 9.0.0.787 2010.04.08 -
BitDefender 7.2 2010.04.08 -
CAT-QuickHeal 10.00 2010.04.08 -
ClamAV 0.96.0.3-git 2010.04.08 -
Comodo 4541 2010.04.08 TrojWare.Win32.Scar.~d002
DrWeb 5.0.2.03300 2010.04.08 -
eSafe 7.0.17.0 2010.04.08 -
eTrust-Vet 35.2.7414 2010.04.08 Win32/Alureon.AOO
F-Prot 4.5.1.85 2010.04.08 W32/Horst.C.gen!Eldorado
F-Secure 9.0.15370.0 2010.04.08 Trojan:W32/Cosmu.gen!A
Fortinet 4.0.14.0 2010.04.08 -
GData 19 2010.04.08 Win32:Rodecap
Ikarus T3.1.1.80.0 2010.04.08 Trojan.Win32.Cosmu
Jiangmin 13.0.900 2010.04.08 -
Kaspersky 7.0.0.125 2010.04.08 -
McAfee-GW-Edition 6.8.5 2010.04.08 Heuristic.BehavesLike.Win32.Downloader.H
Microsoft 1.5605 2010.04.08 Trojan:Win32/Rodecap.A
NOD32 5011 2010.04.08 a variant of Win32/Rodecap.AA
Norman 6.04.11 2010.04.08 W32/Malware
nProtect 2009.1.8.0 2010.04.06 -
Panda 10.0.2.2 2010.04.08 Trj/Genetic.gen
PCTools 7.0.3.5 2010.04.08 -
Prevx 3.0 2010.04.08 High Risk Fraudulent Security Program
Rising 22.42.03.03 2010.04.08 Trojan.DL.Win32.Downloader.GEN
Sophos 4.52.0 2010.04.08 -
Sunbelt 6152 2010.04.08 BehavesLike.Win32.Malware (v)
Symantec 20091.2.0.41 2010.04.08 Suspicious.Insight
TheHacker 6.5.2.0.258 2010.04.08 Trojan/Downloader.gen
TrendMicro 9.120.0.1004 2010.04.08 TROJ_HORST.SMPE
VBA32 3.12.12.4 2010.04.05 suspected of Win32.Trojan.Downloader (http://...)
ViRobot 2010.4.8.2267 2010.04.08 -
VirusBuster 5.0.27.0 2010.04.08 Trojan.Cosmu.Gen
Additional information
File size: 95744 bytes
MD5...: 31f7b5efc5be13e3356998a6efb6e294
SHA1..: 7a85bb36a7764a247e7d8d498abac03e1d39df13
SHA256: 60717386ee8d67c9d4b9f4b108d420758590a6e91460b20e5bbf430cd681bd46
ssdeep: 1536:kCFq5HscoGGL+SduGnEiGjyAAe0AbwmlqY5N:kyq5HsiUuWIUAvlqY5N
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xaa03
timedatestamp.....: 0x4b572471 (Wed Jan 20 15:42:41 2010)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x12a49 0x12c00 6.46 2f90ccdb2fe22ec98bf14a34f6769d02
.rdata 0x14000 0x33e2 0x3400 5.58 1608942614d058e636f4ae6defccf3b6
.data 0x18000 0x8ca0 0x1200 2.31 bad2eb94ee34cb3647b4c158f395b42d

( 7 imports )
> USER32.dll: GetWindow, GetSystemMetrics, CreateAcceleratorTableA
> ADVAPI32.dll: OpenProcessToken, RegQueryValueExA, RegCreateKeyExA, RegSetValueExA, RegDisablePredefinedCache, RegEnumKeyExA, LookupAccountSidA, GetTokenInformation, RegCloseKey, RegEnumValueA, RegOpenKeyExA
> PSAPI.DLL: GetDeviceDriverBaseNameA, GetPerformanceInfo, EnumDeviceDrivers
> WS2_32.dll: -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: TlsAlloc, FlushFileBuffers, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, LCMapStringW, LCMapStringA, GetStringTypeW, GetStringTypeA, HeapReAlloc, CloseHandle, GetTickCount, SetErrorMode, GetWindowsDirectoryA, GetVolumeInformationA, DeviceIoControl, GetCurrentDirectoryA, SetFileTime, WriteFile, CreateFileA, ExitProcess, CreateMutexA, OpenMutexA, Sleep, CreateProcessA, GetEnvironmentVariableA, GetShortPathNameA, GetCurrentProcess, MultiByteToWideChar, GetModuleFileNameA, SetEnvironmentVariableA, CopyFileA, SetFileAttributesA, GetLastError, CreateDirectoryA, CreateThread, GetLocalTime, GetDriveTypeA, GetLogicalDriveStringsA, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, RtlUnwind, GetCommandLineA, GetStartupInfoA, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetStdHandle, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, LoadLibraryA, InitializeCriticalSectionAndSpinCount, HeapFree, HeapAlloc, RaiseException, HeapSize, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapCreate, VirtualFree, QueryPerformanceCounter, GetCurrentProcessId, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, SetFilePointer, GetConsoleCP, GetConsoleMode, GetLocaleInfoA, VirtualAlloc

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=6A61DDBC004E5D3F7690018B47765B00F1D5DCE7' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=6A61DDBC004E5D3F7690018B47765B00F1D5DCE7</a>

Note: although some of these applications removed several pieces of malware I did not know of, my original problem still persists.

Thanks for your continuing help!

deltalima

April 9, 2010, 9:16 AM UTC

Hi Bold,

Run OTL Script

Double-click OTL.exe to start the program.

Copy and Paste the following code into the

textbox. Do not include the word Code



:processes

clipsrv.exe

:otl

O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

F3 - HKCU WinNT: Load - (C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe) - C:\Documents and Settings\BOLD\Application Data\Microsoft\dllhst3g.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ClipSrv = C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\clipsrv.exe /waitservice ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: DllHst = C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe /waitservice ()

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ClipSrv = C:\WINDOWS\System32\drivers\clipsrv.exe /waitservice ()

:files

C:\Documents and Settings\BOLD\Local Settings\Application Data\mstsc.exe

C:\Documents and Settings\BOLD\Application Data\cisvc.exe

C:\Documents and Settings\BOLD\Local Settings\Application Data\logman.exe

C:\Documents and Settings\BOLD\Local Settings\Application Data\clipsrv.exe

C:\Documents and Settings\BOLD\Local Settings\Application Data\ieudinit.exe

C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe

C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\clipsrv.exe

C:\Documents and Settings\BOLD\Local Settings\Temp\~temp\hmbst27\lsass.exe

:commands

[EMPTYTEMP]

[REBOOT]

Then click the Run Fix button at the top.
Click .
OTL may ask to reboot the machine. Please do so if asked.
The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Please run a quick scan with Malwarebytes and post the log along with the report from OTL.

Bold

April 10, 2010, 5:45 PM UTC

OTL report:
All processes killed
========== PROCESSES ==========
No active process named clipsrv.exe was found!
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

C:\Documents and Settings\BOLD\Application Data\Microsoft\dllhst3g.exe moved successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\Load:C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\ClipSrv deleted successfully.
C:\Documents and Settings\BOLD\Local Settings\Application Data\clipsrv.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\DllHst deleted successfully.
File C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe /waitservice not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\ClipSrv deleted successfully.
C:\WINDOWS\System32\drivers\clipsrv.exe moved successfully.
========== FILES ==========
C:\Documents and Settings\BOLD\Local Settings\Application Data\mstsc.exe moved successfully.
C:\Documents and Settings\BOLD\Application Data\cisvc.exe moved successfully.
C:\Documents and Settings\BOLD\Local Settings\Application Data\logman.exe moved successfully.
File\Folder C:\Documents and Settings\BOLD\Local Settings\Application Data\clipsrv.exe not found.
C:\Documents and Settings\BOLD\Local Settings\Application Data\ieudinit.exe moved successfully.
File\Folder C:\DOCUME~1\BOLD\APPLIC~1\MICROS~1\dllhst3g.exe not found.
File\Folder C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\clipsrv.exe not found.
C:\Documents and Settings\BOLD\Local Settings\Temp\~temp\hmbst27\lsass.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: BOLD
->Temp folder emptied: 2318304 bytes
->Temporary Internet Files folder emptied: 26341067 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 84915886 bytes
->Google Chrome cache emptied: 9514317 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 3005 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2705 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 117.00 mb

OTL by OldTimer - Version 3.2.1.0 log created on 04102010_102913

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

MalwareBytes report:
Malwarebytes' Anti-Malware 1.45
http://www.malwarebytes.org

Database version: 3970

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/10/2010 10:41:59 AM
mbam-log-2010-04-10 (10-41-59).txt

Scan type: Quick scan
Objects scanned: 110440
Time elapsed: 5 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Thanks again deltalima - I can't express how grateful I am for your help

deltalima

April 10, 2010, 5:55 PM UTC

Hi Bold,

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a new HijackThis log and also let me know how your computer is running now.

Bold

April 12, 2010, 3:44 AM UTC

Kapersky log:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, April 11, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, April 11, 2010 11:42:48
Records in database: 3935152
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 309449
Threats found: 2
Infected objects found: 6
Suspicious objects found: 0
Scan duration: 05:27:16

File name / Threat / Threats count
C:\Documents and Settings\BOLD\Desktop\WORK\THIRD HATCH\Vital Energy\site-www.thevitalenergycenter.com-20100315-084343.zip Infected: Backdoor.PHP.C99Shell.bv 2
C:\Documents and Settings\BOLD\Desktop\WORK\THIRD HATCH\Vital Energy\site-www.thevitalenergycenter.com-20100319-194412.zip Infected: Backdoor.PHP.C99Shell.bv 2
C:\Documents and Settings\BOLD\Desktop\WORK\THIRD HATCH\Vital Energy\_OLD\OLD SITE\site-www.thevitalenergycenter.com-20091020-160438.zip Infected: Backdoor.PHP.C99Shell.bv 1
C:\_OTL\MovedFiles\04102010_102913\C_Documents and Settings\BOLD\Local Settings\Temp\~temp\hmbst27\lsass.exe Infected: Trojan-Mailfinder.Win32.Blen.si 1

Selected area has been scanned.

HijackThis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:40:59 PM, on 4/11/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\DRIVERS\o2flash.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\OEM13Mon.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\Logi_MwX.Exe
C:\WINDOWS\system32\atwtusb.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Adobe\Adobe Photoshop CS4\Photoshop.exe
C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USSMB/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USSMB/1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.com/USSMB/1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: IE Developer Toolbar BHO - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [OEM13Mon.exe] C:\WINDOWS\OEM13Mon.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeBridge] //~
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare\AWC.exe" /startup
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\BOLD\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [IEudinit] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\ieudinit.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [IEudinit] C:\DOCUME~1\BOLD\LOCALS~1\APPLIC~1\ieudinit.exe /waitservice (User 'Default user')
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258389455359
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c9f9baeab53ff0) (gupdate1c9f9baeab53ff0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O2FLASH - O2Micro International - C:\WINDOWS\system32\DRIVERS\o2flash.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 12477 bytes

I haven't been using my computer much this weekend, though I will be using it extensively tomorrow - I will respond with my findings. Thanls you!

deltalima

April 12, 2010, 12:38 PM UTC

Hi Bold,

Please see here.

The scans we run often reveal information that most businesses would not want exposed in an open forum, and there are other legal constraints and ramifications involved with business machines that we are not equipped or trained to deal with.

As the computer is used for business I will ask for the thread to be closed.