View Full Version : computer issues, please help
Hi there and thanks for any help you can provide. My PC is running extremely slow and seems to lock up on occasion. I am not getting any kind of error message but hope you can help me fix any issues that may be slowing system up.
I currently run sspybot, spyblaster, malware bytes, ccleaner adaware and AVG anti virus on the pc.
I ran ERUNT and DDS, attached are the DDS files from the download.
Again thanks.
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Juan at 9:24:31.40 on Thu 03/17/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.50 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\WINDOWS\system32\hphmon03.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\Juan\Application Data\Smilebox\SmileboxTray.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\IF9O9EBB\dds[1].scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
uInternet Connection Wizard,ShellNext = hxxp://www.samsphotoclub.com/login/index.asp
uInternet Settings,ProxyOverride = localhost;*.local
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
mURLSearchHooks: H - No File
BHO: Yahoo! Companion BHO: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\ycomp5_5_7_0.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\ycomp5_5_7_0.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: @c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll
uRun: [SmileboxTray] "c:\documents and settings\juan\application data\smilebox\SmileboxTray.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [MMTray] "c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe"
mRun: [vptray] c:\program files\navnt\vptray.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [RoxioEngineUtility] "c:\program files\common files\roxio shared\system\EngUtil.exe"
mRun: [RoxioDragToDisc] "c:\program files\roxio\easy cd creator 6\dragtodisc\DrgToDsc.exe"
mRun: [RoxioAudioCentral] "c:\program files\roxio\easy cd creator 6\audiocentral\RxMon.exe"
mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
mRun: [MimBoot] c:\progra~1\musicm~1\musicm~2\mimboot.exe
mRun: [Microsoft Works Update Detection] c:\program files\common files\microsoft shared\works shared\WkUFind.exe
mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe
mRun: [IAAnotif] c:\program files\intel\intel application accelerator\iaanotif.exe
mRun: [HPHmon03] c:\windows\system32\hphmon03.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [<NO NAME>]
mRun: [Bing Bar] "c:\program files\msn toolbar\platform\5.0.1449.0\mswinext.exe"
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\juan\startm~1\programs\startup\hotlla~1.lnk - c:\program files\hotllama media\player\WiseUpdt.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\americ~1.lnk - c:\program files\america online 9.0\aoltray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ciscos~1.lnk - c:\program files\cisco systems\vpn client\vpngui.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: plaxo.com\www
Trusted Zone: musicmatch.com\online
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: Photobucket Publisher - hxxp://s154.photobucket.com/csve/ie_plugin.php
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://utilities.pcpitstop.com/da/PCPitStop.CAB
DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} - hxxp://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www.costcophotocenter.com/CostcoActivia.cab
DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - hxxp://www.putfile.com/includes/ImageUploader4-5.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_5/PhotoCenter_ActiveX_Control.cab
DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://samsclubus.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} - hxxp://mdpatriotstangs.myphotoalbum.com/ImageUploader4.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://secure.bah.com/dana-cached/setup/JuniperSetupSP1.cab
DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://samsclubus.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 251728]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 299984]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-10 14336]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-1-6 6128720]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400]
R2 NAVAPEL;NAVAPEL;c:\program files\navnt\Navapel.sys [2002-6-7 17968]
R2 RosettaStoneDaemon;RosettaStoneDaemon;c:\program files\rosettastoneltdservices\RosettaStoneDaemon.exe [2009-9-3 444224]
R3 Angel;Angel MPEG Device;c:\windows\system32\drivers\Angel.sys [1980-1-1 337536]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192]
S2 Norton AntiVirus Server;Norton AntiVirus Client;c:\program files\navnt\rtvscan.exe [2002-8-2 483328]
S3 NAVAP;NAVAP;c:\program files\navnt\navap.sys [2002-6-7 186096]
S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090812.008\NAVENG.sys [2009-8-13 87888]
S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090812.008\NAVEX15.sys [2009-8-13 875728]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-6-21 189792]
.
=============== Created Last 30 ================
.
2011-02-18 23:54:37 -------- d-----w- c:\program files\iPod
2011-02-18 23:54:21 -------- d-----w- c:\program files\iTunes
2011-02-18 23:47:07 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll
2011-02-18 23:47:07 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll
2011-02-18 23:47:06 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll
2011-02-18 23:47:06 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll
2011-02-18 23:47:06 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll
2011-02-18 23:47:06 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll
2011-02-18 23:47:06 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll
2011-02-17 16:03:28 -------- d-----w- c:\docume~1\juan\locals~1\applic~1\PackageAware
2011-02-17 13:13:17 -------- d-----w- c:\docume~1\juan\applic~1\ParetoLogic
.
==================== Find3M ====================
.
2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34:28 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:59:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:59:19 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 23:59:19 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:26:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55:26 385024 ----a-w- c:\windows\system32\html.iec
.
============= FINISH: 9:27:02.47 ===============
:snwelcome:
Please read Before You Post (http://forums.spybot.info/showthread.php?t=288)
While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.
Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware except for the programs we may run.
Read this about SmileBox, you may want to uninstall it
http://www.pcpitstop.com/libraries/process/i/SmileboxTray.exe.html
I am looking at your main Antivirus program as AVG, but I am also seeing markers in your log for McAfee and Symantec. Have you tried uninstalling McAfee and Symantec at one time.
You said you ran Malwarebytes, did it find anything ?
The wife hasnt use Smilebox in a long time so i can uninstall if it would help???
AVG is what I use now, McAfee and Symantec must be old sodtware, should I uninstall that aswell?
Ran Malwarebytes again, no issues were found.
Thanks for your help.
Hi,
I would uninstall Smilebox and also Symantec and Mcafee, after you uninstall both Anti virus programs you can run these tools to make sure there gone
Norton Removal
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039
Mcafee Removal Tool
http://majorgeeks.com/McAfee_Consumer_Product_Removal_Tool_d5420.html
After you uninstall those programs reboot and run these programs
Please download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.
Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Hi again, I remove smilebox and downloaded tool to remove mcafee. I didnt have any luck with the norton tool, connection error kept coming up.
downloaded and ran ATF cleeaner.
downloaded ran OTL, here are the reports, thanks again:
OTL logfile created on: 3/23/2011 12:10:42 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Juan\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
510.00 Mb Total Physical Memory | 186.00 Mb Available Physical Memory | 36.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 45.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.31 Gb Total Space | 56.42 Gb Free Space | 39.09% Space Free | Partition Type: NTFS
Drive G: | 931.51 Gb Total Space | 848.01 Gb Free Space | 91.04% Space Free | Partition Type: NTFS
Computer Name: DGCWJG61 | User Name: Juan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\Juan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe (Rosetta Stone Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe (Musicmatch, Inc.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe (Musicmatch, Inc.)
PRC - C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe ()
PRC - C:\Program Files\Real\RealPlayer\realplay.exe (RealNetworks, Inc.)
PRC - C:\Program Files\America Online 9.0\aoltray.exe (America Online, Inc.)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
PRC - C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
PRC - C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe (Roxio)
PRC - C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe (Roxio, Inc.)
PRC - C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe (Roxio, Inc.)
PRC - C:\WINDOWS\SYSTEM32\hphmon03.exe (Hewlett-Packard)
PRC - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb04.exe (HP)
PRC - C:\Program Files\NavNT\vptray.exe (Symantec Corporation)
PRC - C:\Program Files\NavNT\defwatch.exe (Symantec Corporation)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\Juan\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (Akamai) -- c:\Program Files\Common Files\Akamai\netsession_win_d76cf65.dll ()
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (RosettaStoneDaemon) -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe (Rosetta Stone Ltd.)
SRV - (DSBrokerService) -- C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (CCALib8) -- C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (KodakCCS) -- C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe (Eastman Kodak Company)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (IAANTMon) -- C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe (Intel Corporation)
SRV - (AOL ACS) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
SRV - (Pml Driver) -- C:\WINDOWS\SYSTEM32\hphipm09.exe (HP)
SRV - (Norton AntiVirus Server) -- C:\Program Files\NavNT\rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) -- C:\Program Files\NavNT\defwatch.exe (Symantec Corporation)
========== Driver Services (SafeList) ==========
DRV - (Avgldx86) -- C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) -- C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090812.008\navex15.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090812.008\naveng.sys (Symantec Corporation)
DRV - (IrBus) -- C:\WINDOWS\SYSTEM32\DRIVERS\irbus.sys (Microsoft Corporation)
DRV - (Cdr4_xp) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys (Roxio)
DRV - (dsunidrv) -- C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys (Gteko Ltd.)
DRV - (DSproct) -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (DcCam) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcCam.sys (Eastman Kodak Company)
DRV - (Exportit) -- C:\WINDOWS\SYSTEM32\DRIVERS\ExportIt.sys (Eastman Kodak Company)
DRV - (DcPTP) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcPtp.sys (Eastman Kodak Company)
DRV - (DcLps) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcLps.sys (Eastman Kodak Company)
DRV - (DCFS2K) -- C:\WINDOWS\SYSTEM32\DRIVERS\DCFS2k.sys (Eastman Kodak Company)
DRV - (DcFpoint) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcFpoint.sys (Eastman Kodak Company)
DRV - (ASCTRM) -- C:\WINDOWS\System32\drivers\asctrm.sys (Windows (R) 2000 DDK provider)
DRV - (Angel) -- C:\WINDOWS\SYSTEM32\DRIVERS\Angel.sys (Emuzed, Inc.)
DRV - (ati2mtag) -- C:\WINDOWS\SYSTEM32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (CVPNDRVA) -- C:\WINDOWS\SYSTEM32\DRIVERS\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (IntelC53) -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC53.sys (Intel Corporation)
DRV - (b57w2k) -- C:\WINDOWS\SYSTEM32\DRIVERS\b57xp32.sys (Broadcom Corporation)
DRV - (senfilt) -- C:\WINDOWS\SYSTEM32\DRIVERS\senfilt.sys (Sensaura)
DRV - (cdrbsdrv) -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS (B.H.A Corporation)
DRV - (IntelC52) -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC52.sys (Intel Corporation)
DRV - (IntelC51) -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC51.sys (Intel Corporation)
DRV - (mohfilt) -- C:\WINDOWS\SYSTEM32\DRIVERS\mohfilt.sys (Intel Corporation)
DRV - (vsdatant) -- C:\WINDOWS\SYSTEM32\vsdatant.sys (Zone Labs Inc.)
DRV - (DNE) -- C:\WINDOWS\SYSTEM32\DRIVERS\dne2000.sys (Deterministic Networks, Inc.)
DRV - (CVirtA) -- C:\WINDOWS\SYSTEM32\DRIVERS\CVirtA.sys (Cisco Systems, Inc.)
DRV - (pfc) -- C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys (Padus, Inc.)
DRV - (cdudf_xp) -- C:\WINDOWS\System32\drivers\Cdudf_xp.sys (Roxio)
DRV - (UdfReadr_xp) -- C:\WINDOWS\System32\drivers\UdfReadr_xp.sys (Roxio)
DRV - (pwd_2k) -- C:\WINDOWS\System32\drivers\pwd_2K.sys (Roxio)
DRV - (Cdralw2k) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Roxio)
DRV - (mmc_2K) -- C:\WINDOWS\System32\drivers\Mmc_2k.sys (Roxio)
DRV - (dvd_2K) -- C:\WINDOWS\System32\drivers\Dvd_2k.sys (Roxio)
DRV - (Dot4 HPH09) -- C:\WINDOWS\SYSTEM32\DRIVERS\hphid409.sys (HP)
DRV - (Dot4Storage HPH09) Storage Class Driver for IEEE-1284.4 (HPH09) -- C:\WINDOWS\SYSTEM32\DRIVERS\hphs2k09.sys (Hewlett-Packard)
DRV - (Dot4Print HPH09) -- C:\WINDOWS\SYSTEM32\DRIVERS\hphipr09.sys (HP)
DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (omci) -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (sonypvs1) -- C:\WINDOWS\SYSTEM32\DRIVERS\sonypvs1.sys (Sony Corporation)
DRV - (SymEvent) -- C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (CDRPDACC) -- C:\Program Files\321Studios\Shared\CDRPDACC.SYS (Arrowkey)
DRV - (NAVAPEL) -- C:\Program Files\NavNT\Navapel.sys ()
DRV - (NAVAP) -- C:\Program Files\NavNT\navap.sys ()
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/28 09:17:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\Firefox [2010/12/25 13:07:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/12/26 04:03:28 | 000,000,000 | ---D | M]
[2009/03/14 22:39:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Juan\Application Data\Mozilla\Extensions
[2009/03/14 22:39:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Juan\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2009/01/29 10:51:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\extensions
[2009/01/29 16:23:48 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
Hosts file not found
O2 - BHO: (Yahoo! Companion BHO) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O3 - HKLM\..\Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [HPHmon03] C:\WINDOWS\SYSTEM32\hphmon03.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [MimBoot] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mimboot.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [RoxioAudioCentral] C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe (Roxio, Inc.)
O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe (Roxio)
O4 - HKLM..\Run: [RoxioEngineUtility] C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe (Roxio)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [UpdateManager] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKLM..\Run: [vptray] C:\Program Files\NavNT\vptray.exe (Symantec Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe (America Online, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\Juan\Start Menu\Programs\Startup\HOTLLAMA Update Check.lnk = C:\Program Files\HOTLLAMA MEDIA\Player\WiseUpdt.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)
O15 - HKCU\..Trusted Domains: //@install.mar@ ([]msni in My Computer)
O15 - HKCU\..Trusted Domains: //@mail.mar@ ([]msni in Local intranet)
O15 - HKCU\..Trusted Domains: plaxo.com ([www] https in Trusted sites)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcpitstop.com/da/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} http://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab (Disney Online Games ActiveX Control)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www.costcophotocenter.com/CostcoActivia.cab (Snapfish Activia)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.putfile.com/includes/ImageUploader4-5.cab (Image Uploader Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} http://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_5/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://samsclubus.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab (Java Plug-in 1.4.0)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} http://mdpatriotstangs.myphotoalbum.com/ImageUploader4.cab (MyPhotoAlbum Easy Upload Tool Combo Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://secure.bah.com/dana-cached/setup/JuniperSetupSP1.cab (JuniperSetupControlXP Class)
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} http://samsclubus.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Photobucket Publisher http://s154.photobucket.com/csve/ie_plugin.php (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.242.0.12
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\SYSTEM32\NavLogon.dll ()
O24 - Desktop Components:0 () - http://i13.servimg.com/u/f13/11/74/92/51/black_10.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Juan\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Juan\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/08 16:37:01 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/03/23 12:09:42 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Juan\Desktop\OTL.exe
[1980/01/01 02:00:00 | 000,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/03/23 12:09:48 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Juan\Desktop\OTL.exe
[2011/03/23 12:04:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At3.job
[2011/03/23 11:55:32 | 004,124,672 | R--- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2011/03/23 11:55:32 | 002,737,152 | R--- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mb
[2011/03/23 11:51:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/03/23 11:51:07 | 534,941,696 | -HS- | M] () -- C:\hiberfil.sys
[2011/03/23 10:10:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2011/03/23 08:10:43 | 109,599,474 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/03/22 20:40:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At2.job
[2011/03/22 14:00:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At4.job
[2011/03/22 03:36:00 | 000,000,378 | ---- | M] () -- C:\WINDOWS\tasks\DriverCure.job
[2011/03/21 16:13:01 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Microsoft Office Word 2003.lnk
[2011/03/19 16:40:14 | 000,178,688 | ---- | M] () -- C:\Documents and Settings\Juan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/19 10:53:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/03/18 17:45:42 | 000,016,963 | ---- | M] () -- C:\Documents and Settings\Juan\.recently-used.xbel
[2011/03/17 09:30:44 | 000,005,535 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Attach.zip
[2011/03/17 09:19:43 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\NTREGOPT.lnk
[2011/03/17 09:19:43 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\ERUNT.lnk
[2011/03/13 10:08:16 | 000,445,370 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT
[2011/03/13 10:08:16 | 000,072,576 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT
[2011/03/12 00:39:50 | 000,001,485 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Remote Desktop Connection.lnk
[2011/03/11 19:11:20 | 000,199,700 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/03/09 04:04:23 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/03/04 10:34:27 | 000,519,943 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Phillies tics.pdf
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/03/18 17:45:42 | 000,016,963 | ---- | C] () -- C:\Documents and Settings\Juan\.recently-used.xbel
[2011/03/17 09:30:44 | 000,005,535 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\Attach.zip
[2011/03/17 09:19:43 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\NTREGOPT.lnk
[2011/03/17 09:19:43 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\ERUNT.lnk
[2011/03/04 10:34:23 | 000,519,943 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\Phillies tics.pdf
[2010/10/29 09:05:51 | 000,072,820 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/10/15 16:00:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\IntIgn0xF28456.dat
[2010/01/02 15:52:39 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2009/09/23 09:28:50 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2007/06/21 16:19:02 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007/06/19 15:42:32 | 000,143,384 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2007/03/01 12:06:06 | 000,000,047 | ---- | C] () -- C:\WINDOWS\VistaEmail.ini
[2007/02/06 12:43:40 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/11/02 12:39:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\gxqydaiv.dll
[2006/07/18 00:37:02 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe
[2006/07/14 19:39:35 | 000,000,031 | ---- | C] () -- C:\WINDOWS\sbwin32.INI
[2005/11/29 20:02:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2005/08/02 14:51:54 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2005/05/08 17:05:00 | 000,000,560 | ---- | C] () -- C:\Documents and Settings\Juan\Application Data\ViewerApp.dat
[2005/05/08 16:34:23 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll
[2005/03/21 17:24:56 | 000,178,688 | ---- | C] () -- C:\Documents and Settings\Juan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/01/24 16:01:18 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/01/13 20:32:53 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Juan\Application Data\PFP120JPR.{PB
[2005/01/13 20:32:53 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Juan\Application Data\PFP120JCM.{PB
[2005/01/13 20:22:30 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini
[2005/01/10 18:32:32 | 000,000,199 | ---- | C] () -- C:\WINDOWS\ppdrv.ini
[2005/01/10 17:49:43 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2005/01/10 17:43:13 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Juan\Local Settings\Application Data\fusioncache.dat
[2005/01/04 19:24:32 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/01/04 19:22:08 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/01/04 19:22:07 | 000,000,264 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/01/04 19:19:35 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2005/01/04 19:07:22 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2005/01/04 19:06:32 | 000,445,370 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2005/01/04 19:06:32 | 000,072,576 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2005/01/04 18:52:20 | 000,000,517 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/19 18:22:58 | 000,000,791 | ---- | C] () -- C:\WINDOWS\ORUN32.INI
[2004/08/19 18:13:18 | 000,338,648 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/19 18:06:50 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/19 18:03:06 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/19 15:25:28 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2004/08/19 15:25:28 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[2004/08/10 07:00:00 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll
[2004/08/10 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2004/08/10 07:00:00 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/10 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2004/08/10 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2004/08/10 07:00:00 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll
[2004/08/10 07:00:00 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/10 07:00:00 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll
[2004/08/10 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2004/08/10 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2004/08/10 07:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\SECUPD.DAT
[2004/08/10 07:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 07:00:00 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\FXSPERF.INI
[2004/08/10 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2004/07/19 18:01:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\SETPWRCG.EXE
[2004/05/26 17:09:26 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\DSRIRREM.EXE
[2003/03/12 03:03:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/02/27 06:42:54 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2003/01/30 19:55:40 | 000,036,864 | ---- | C] () -- C:\WINDOWS\hpfsched.exe
[2003/01/30 19:54:28 | 000,003,691 | ---- | C] () -- C:\WINDOWS\hphinfs.dat
[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/08/03 00:03:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\NavLogon.dll
[2002/05/24 01:00:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lockout.dll
[2002/05/24 01:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\lockres.dll
[2001/08/14 11:47:08 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\vxpsapi.dll
[2000/09/08 17:53:50 | 000,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll
[1980/01/01 02:00:00 | 000,389,120 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[1980/01/01 02:00:00 | 000,102,480 | ---- | C] () -- C:\WINDOWS\System32\EzRating.dll
[1980/01/01 02:00:00 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[1980/01/01 02:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\EzdCoIns.dll
========== LOP Check ==========
[2010/10/29 09:54:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/29 09:38:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/10/29 09:52:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2005/01/04 18:49:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DIGStream
[2009/09/22 11:14:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DriverCure
[2009/06/22 05:32:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Juniper Networks
[2010/10/29 09:34:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2005/01/10 18:17:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSN Messenger 6.1.0155
[2011/02/17 09:42:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010/06/14 10:07:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RosettaStoneLtdServices
[2010/10/16 22:36:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2011/02/05 18:55:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2006/02/17 18:04:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/10/27 09:03:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/12/27 18:23:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/01/02 15:52:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Atari
[2010/10/29 09:57:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\AVG10
[2010/10/24 21:42:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Blitware
[2010/01/28 11:08:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/09/22 11:11:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\DriverCure
[2010/03/22 10:45:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Facebook
[2011/03/18 17:45:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\gtk-2.0
[2007/05/06 19:16:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\ieSpell
[2010/04/12 23:04:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\ImgBurn
[2007/08/31 14:55:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Juniper Networks
[2005/01/24 18:23:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Leadertech
[2005/02/27 13:13:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\MSNInstaller
[2006/04/15 20:08:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Musicmatch
[2011/02/17 09:13:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\ParetoLogic
[2010/10/15 15:44:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Registry Mechanic
[2008/09/07 19:56:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\SmartDraw
[2007/01/03 19:21:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Snapfish
[2011/02/17 12:05:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Uniblue
[2007/06/06 07:59:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Juan\Application Data\Viewpoint
[2011/03/23 10:10:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job
[2011/03/22 20:40:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job
[2011/03/23 12:04:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\Tasks\At3.job
[2011/03/22 14:00:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\Tasks\At4.job
[2011/03/22 03:36:00 | 000,000,378 | ---- | M] () -- C:\WINDOWS\Tasks\DriverCure.job
[2005/01/10 17:42:44 | 000,000,258 | ---- | M] () -- C:\WINDOWS\Tasks\ISP signup reminder 1.job
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >
OTL Extras logfile created on: 3/23/2011 12:10:42 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Juan\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
510.00 Mb Total Physical Memory | 186.00 Mb Available Physical Memory | 36.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 45.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.31 Gb Total Space | 56.42 Gb Free Space | 39.09% Space Free | Partition Type: NTFS
Drive G: | 931.51 Gb Total Space | 848.01 Gb Free Space | 91.04% Space Free | Partition Type: NTFS
Computer Name: DGCWJG61 | User Name: Juan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"1069:TCP" = 1069:TCP:*:Enabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (America Online, Inc.)
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (America Online, Inc)
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- (America Online, Inc.)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (America Online, Inc.)
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (America Online, Inc)
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- (America Online, Inc.)
"C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer -- (LimeWire)
"C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" = C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater -- ()
"C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- ()
"C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdServices.exe" = C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdServices.exe:127.0.0.1/255.255.255.255:Enabled:Rosetta Stone Ltd Services -- (Rosetta Stone Ltd.)
"C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe" = C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe:127.0.0.1/255.255.255.255:Enabled:Rosetta Stone Daemon -- (Rosetta Stone Ltd.)
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\HP\HP Deskjet 3000 J310 series\Bin\DeviceSetup.exe" = C:\Program Files\HP\HP Deskjet 3000 J310 series\Bin\DeviceSetup.exe:LocalSubNet:Enabled:HP Device Setup -- (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Deskjet 3000 J310 series\Bin\HPNetworkCommunicator.exe" = C:\Program Files\HP\HP Deskjet 3000 J310 series\Bin\HPNetworkCommunicator.exe:LocalSubNet:Enabled:HP Network Communicator -- (Hewlett-Packard Co.)
"C:\Program Files\AVG\AVG10\avgdiagex.exe" = C:\Program Files\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnostics 2011 -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgnsx.exe" = C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgemcx.exe" = C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled:Personal E-mail Scanner -- (AVG Technologies CZ, s.r.o.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000000-785F-478A-BAA2-87F1A136068C}" = MSN Encarta Plus Support Files
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{07295ABF-1245-415A-BE06-863271753443}" = ShowBiz
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD
"{2477B5FC-A1E0-411A-BF19-4D5C81A2603A}" = HP Deskjet 3000 J310 series Basic Device Software
"{25EF00BE-F17B-11D6-88EA-000476CD2443}" = Verizon Online
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{2E086814-7392-4E0F-ADB8-54A81E47406C}" = Broadcom Advanced Control Suite 2
"{326057C5-6185-4C85-A630-9C2FC2DB3F93}" = Rosetta Stone Ltd Services
"{32F66A20-7614-11D4-BD11-00104BD3F987}" = MathPlayer
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZeroInstallers
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{38441BE7-79B0-42B8-8297-833704F949FE}" = HLPIndex
"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold
"{432C3720-37BF-4BD7-8E49-F38E090246D0}" = CR2
"{48C82F7A-F100-4DAB-A310-8E18BF2159E1}" = ESSvpot
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement
"{4F1CECBC-670F-4daa-81D6-944B12450917}" = DIGReqEx
"{4F677FC7-7AA8-412B-A957-F13CBE1C7331}" = ESSSONIC
"{4F7177E9-2B54-48B4-AAFD-03FA1F87A542}" = Bing Bar Platform
"{54C8FE84-89C4-40E8-976C-439EB0729BD6}" = CardRd81
"{5624C000-B109-11D4-9DB4-00E0290FCAC5}" = VPN Client
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57EC14EF-9A27-11D6-85E9-F476176AA204}" = USB Card Reader
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{5E835305-63BB-4E55-BBB7-EEBBE67774DB}" = MyDVD
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{60E971B7-51A0-48CA-8687-C6B8F094A409}" = Sonic Simple Backup
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{644F9DBE-CEDB-45AF-ACB8-E26692B74F62}" = Easy CD & DVD Creator 6
"{654A65DA-7173-4B51-ACEB-F855201EE033}" = HP Deskjet 3000 J310 series Help
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.3
"{68D60342-7686-45C9-B8EB-40EF843D0460}" = Dell Networking Guide
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{728278A1-0BB7-45E4-AC5E-91D7C0FD1EDE}" = EarthLink setup files
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{78D944D7-A97B-4004-AB0A-B5AD06839940}" = My Way Search Assistant
"{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor
"{7A3F0566-5E05-4919-9C98-456F6B5CF831}" = Get High Speed Internet!
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{81A34902-9D0B-4920-A25C-4CDC5D14B328}" = Jasc Paint Shop Pro 8 Dell Edition
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85D3CC30-8859-481A-9654-FD9B74310BEF}" = Musicmatch® Jukebox
"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp
"{883D5F66-40C7-491A-9277-DD36243EA957}" = HP Deskjet 3000 J310 series Product Improvement Study
"{8855FF30-19CE-4CB1-A654-87B38369CCE1}" = Sonic RecordNow DX
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8BB4B58A-A402-4DE8-8FCD-287E60B88DD8}" = ESSCT
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Application Accelerator
"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3 Platinum
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{9F7FC79B-3059-4264-9450-39EB368E3220}" = Microsoft Picture It! Library 9
"{A276502A-8979-44FB-8090-90CF72F22ABC}" = AVG 2011
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5B3EB8A-4071-42F0-8E8E-7A8342AA8E69}" = ESSvpaht
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AADAC983-FDE9-42FA-8FD9-7BB324155593}" = HLPRFO
"{ABEB838C-A1A7-4C5D-B7E1-8B4314600155}" = MSN Messenger 6.1
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B95B1BA9-F887-4B3C-8D3A-CCD4C4675120}" = Microsoft Default Manager
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{BD12EB47-DBDF-11D3-BEEA-00A0CC272509}" = Norton AntiVirus Corporate Edition
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C769B501-2BE8-46ed-9E69-118F008A0917}" = DIGOpt
"{C797EAF2-707A-4239-BDF3-F2672314A734}" = First Step Guide
"{C9A87D86-FDFD-418B-BF96-EF09320973B3}" = PC Inspector smart recovery
"{CA60320D-6A16-49C8-A34F-84EEF4799567}" = ESSTUTOR
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}" = Jasc Paint Shop Photo Album
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2DFC174-494B-435D-BB9D-D82520D03C28}" = My Sam's Club Digital Photo Center
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DBA8B9E1-C6FF-4624-9598-73D3B41A0900}" = Microsoft Picture It! Express 9
"{E35AF511-B618-4D02-B559-0F2147341D3B}" = AVG 2011
"{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP
"{F8C6BABF-0837-4EA0-AD6C-8E5A392A7538}" = ImageMixer VCD2
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic
"Accent_on_Interactivity_1.0" = Accent on Interactivity 1.6
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Akamai" = Akamai NetSession Interface
"America Online us" = America Online (Choose which version to remove)
"AOL Connectivity Services" = AOL Connectivity Services
"AOLCoach" = AOL Coach Version 1.0(Build:20040229.1 en)
"ATI Display Driver" = ATI Display Driver
"AVG" = AVG 2011
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"CAL" = Canon Camera Access Library
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC5" = Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CCleaner" = CCleaner
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"CSCLIB" = Canon Camera Support Core Library
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"Disney Pirates of the Caribbean Online" = Disney Pirates of the Caribbean Online
"Disney's Toontown Online" = Disney's Toontown Online
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.2
"DVD X Rescue" = DVD X Rescue
"DVDXCopyPlatinum" = DVDXCopy Platinum 3.2.1
"EOS Utility" = Canon Utilities EOS Utility
"ERUNT_is1" = ERUNT 1.1j
"ESPNMotion" = ESPNMotion
"HOTLLAMA Media Player" = HOTLLAMA Media Player
"HOTLLAMA Media Player - Update" = HOTLLAMA Media Player - Update
"HP Photo Creations" = HP Photo Creations
"hp photosmart printer series" = hp photosmart printer series (Remove only)
"ie8" = Windows Internet Explorer 8
"ieSpell" = ieSpell
"ImgBurn" = ImgBurn
"InstallShield_{2E086814-7392-4E0F-ADB8-54A81E47406C}" = Broadcom Advanced Control Suite 2
"Intel(R) 537EP V9x DF PCI Modem" = Intel(R) 537EP V9x DF PCI Modem
"Jetcast" = Jetcast 3.2.4
"LiveUpdate1.7" = LiveUpdate 1.7 (Symantec Corporation)
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MSNINST" = MSN
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"PC Pitstop Driver Alert_is1" = PC Pitstop Driver Alert 1.0
"PhotoStitch" = Canon Utilities PhotoStitch
"PictureIt_POD_v9" = Microsoft Picture It! Library 9
"PictureIt_v9" = Microsoft Picture It! Express 9
"Pro Media Director_is1" = Pro Media Director Version 2.0.0.1
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RealPlayer 6.0" = RealPlayer Basic
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"SpywareBlaster_is1" = SpywareBlaster 4.4
"StreetPlugin" = Learn2 Player (Uninstall Only)
"ViewpointMediaPlayer" = Viewpoint Media Player
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.4.2
"Yahoo! Anti-Spy" = Yahoo! Anti-Spy
"Yahoo! Companion" = Yahoo! Toolbar
"YInstHelper" = Yahoo! Install Manager
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Juniper_Networks_Cache_Cleaner 5.3.0" = Juniper Networks Cache Cleaner 5.3.0
"Neoteris_Host_Checker" = Juniper Networks Host Checker
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 3/17/2011 12:45:21 PM | Computer Name = DGCWJG61 | Source = Norton AntiVirus | ID = 16711694
Description = Norton AntiVirus services failed to start. Virus definition file is
invalid. (CC001000)
Error - 3/18/2011 9:33:04 AM | Computer Name = DGCWJG61 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x4ec683bd.
Error - 3/18/2011 9:52:06 AM | Computer Name = DGCWJG61 | Source = Application Error | ID = 1000
Description = Faulting application DRWTSN32.EXE, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.
Error - 3/18/2011 10:00:07 AM | Computer Name = DGCWJG61 | Source = Norton AntiVirus | ID = 16711694
Description = Norton AntiVirus services failed to start. Virus definition file is
invalid. (CC001000)
Error - 3/20/2011 1:06:37 AM | Computer Name = DGCWJG61 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
Error - 3/20/2011 1:06:39 AM | Computer Name = DGCWJG61 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
Error - 3/21/2011 11:22:35 AM | Computer Name = DGCWJG61 | Source = Norton AntiVirus | ID = 16711694
Description = Norton AntiVirus services failed to start. Virus definition file is
invalid. (CC001000)
Error - 3/23/2011 11:23:08 AM | Computer Name = DGCWJG61 | Source = Norton AntiVirus | ID = 16711694
Description = Norton AntiVirus services failed to start. Virus definition file is
invalid. (CC001000)
Error - 3/23/2011 11:42:40 AM | Computer Name = DGCWJG61 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.
Error - 3/23/2011 11:52:42 AM | Computer Name = DGCWJG61 | Source = Norton AntiVirus | ID = 16711694
Description = Norton AntiVirus services failed to start. Virus definition file is
invalid. (CC001000)
[ Media Center Events ]
Error - 2/8/2010 10:34:57 PM | Computer Name = DGCWJG61 | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 2/8/2010 9:34:57 PM. You may need to reschedule your recordings.
[ System Events ]
Error - 3/22/2011 8:40:00 PM | Computer Name = DGCWJG61 | Source = Schedule | ID = 7901
Description = The At2.job command failed to start due to the following error: %%2147942405
Error - 3/23/2011 10:10:00 AM | Computer Name = DGCWJG61 | Source = Schedule | ID = 7901
Description = The At1.job command failed to start due to the following error: %%2147942405
Error - 3/23/2011 11:14:21 AM | Computer Name = DGCWJG61 | Source = DCOM | ID = 10010
Description = The server {0228576F-6E6C-4E1A-B175-0E46A316AFE2} did not register
with DCOM within the required timeout.
Error - 3/23/2011 11:23:32 AM | Computer Name = DGCWJG61 | Source = Service Control Manager | ID = 7023
Description = The Norton AntiVirus Client service terminated with the following
error: %%10
Error - 3/23/2011 11:29:53 AM | Computer Name = DGCWJG61 | Source = DCOM | ID = 10010
Description = The server {0228576F-6E6C-4E1A-B175-0E46A316AFE2} did not register
with DCOM within the required timeout.
Error - 3/23/2011 11:53:27 AM | Computer Name = DGCWJG61 | Source = Service Control Manager | ID = 7023
Description = The Norton AntiVirus Client service terminated with the following
error: %%10
Error - 3/23/2011 11:57:03 AM | Computer Name = DGCWJG61 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the iPod Service service
to connect.
Error - 3/23/2011 11:57:04 AM | Computer Name = DGCWJG61 | Source = DCOM | ID = 10005
Description = DCOM got error "%1053" attempting to start the service iPod Service
with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
Error - 3/23/2011 11:57:04 AM | Computer Name = DGCWJG61 | Source = Service Control Manager | ID = 7000
Description = The iPod Service service failed to start due to the following error:
%%1053
Error - 3/23/2011 12:04:00 PM | Computer Name = DGCWJG61 | Source = Schedule | ID = 7901
Description = The At3.job command failed to start due to the following error: %%2147942405
< End of report >
This should get rid of Symantec
Backup Your Registry with ERUNT:
Download erunt.zip to your Desktop from here:
http://aumha.org/downloads/erunt.zip
Right-click erunt.zip, select Extract All... and follow the prompts to extract ERUNT to a new folder on your Desktop
Inside the new folder, double-click ERUNT.exe to start the program
OK all the prompts to back up your registry to the default location.Note: to restore your registry, go to the backup folder and start ERDNT.exe
Run OTL.exe
Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
:OTL
PRC - C:\Program Files\NavNT\vptray.exe (Symantec Corporation)
PRC - C:\Program Files\NavNT\defwatch.exe (Symantec Corporation)
SRV - (Norton AntiVirus Server) -- C:\Program Files\NavNT\rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) -- C:\Program Files\NavNT\defwatch.exe (Symantec Corporation)
DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090812.008\navex15.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090812.008\naveng.sys (Symantec Corporation)
DRV - (SymEvent) -- C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (NAVAPEL) -- C:\Program Files\NavNT\Navapel.sys ()
DRV - (NAVAP) -- C:\Program Files\NavNT\navap.sys ()
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
:Services
:Reg
:Files
:Commands
[purity]
[emptytemp]
[RESETHOSTS]
[start explorer]
[Reboot]
Then click the Run Fix button at the top <--Not run scan
Let the program run unhindered, reboot when it is done
Then post the results of the log and a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Ran ERUNT.
Ran fix on OTL, looked like it locked up at the end, some hosting error, logged off then it showed following report. Do I need to rerun? BTW, Im getting a Norton Unavailable message pop up.
Thanks.
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF262C.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF2637.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF267C.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF268B.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF2797.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF27A2.tmp not found!
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\QDX3A326\showthread[1].htm moved successfully.
File move failed. C:\WINDOWS\temp\Perflib_Perfdata_11dc.dat scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\T30DebugLogFile.txt scheduled to be moved on reboot.
Registry entries deleted on Reboot...
Go ahead and run OTL to scan and post a new OTL log
Ran OTL on Min output and didnt check the boxes, here is the log, thanks:
OTL logfile created on: 3/25/2011 7:47:38 AM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Juan\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
510.00 Mb Total Physical Memory | 137.00 Mb Available Physical Memory | 27.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.31 Gb Total Space | 55.39 Gb Free Space | 38.39% Space Free | Partition Type: NTFS
Drive G: | 931.51 Gb Total Space | 848.01 Gb Free Space | 91.04% Space Free | Partition Type: NTFS
Computer Name: DGCWJG61 | User Name: Juan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\Juan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe (Musicmatch, Inc.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe (Musicmatch, Inc.)
PRC - C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe ()
PRC - C:\Program Files\Real\RealPlayer\realplay.exe (RealNetworks, Inc.)
PRC - C:\Program Files\America Online 9.0\aoltray.exe (America Online, Inc.)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
PRC - C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe (Roxio)
PRC - C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe (Roxio, Inc.)
PRC - C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe (Roxio, Inc.)
PRC - C:\WINDOWS\SYSTEM32\hphmon03.exe (Hewlett-Packard)
PRC - C:\Program Files\NavNT\vptray.exe (Symantec Corporation)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\Juan\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (Akamai) -- c:\Program Files\Common Files\Akamai\netsession_win_d76cf65.dll ()
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (RosettaStoneDaemon) -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe (Rosetta Stone Ltd.)
SRV - (DSBrokerService) -- C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (CCALib8) -- C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (KodakCCS) -- C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe (Eastman Kodak Company)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (IAANTMon) -- C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe (Intel Corporation)
SRV - (AOL ACS) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
SRV - (Pml Driver) -- C:\WINDOWS\SYSTEM32\hphipm09.exe (HP)
========== Driver Services (SafeList) ==========
DRV - (NAVAPEL) -- File not found
DRV - (Avgldx86) -- C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) -- C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (IrBus) -- C:\WINDOWS\SYSTEM32\DRIVERS\irbus.sys (Microsoft Corporation)
DRV - (Cdr4_xp) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys (Roxio)
DRV - (dsunidrv) -- C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys (Gteko Ltd.)
DRV - (DSproct) -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (DcCam) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcCam.sys (Eastman Kodak Company)
DRV - (Exportit) -- C:\WINDOWS\SYSTEM32\DRIVERS\ExportIt.sys (Eastman Kodak Company)
DRV - (DcPTP) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcPtp.sys (Eastman Kodak Company)
DRV - (DcLps) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcLps.sys (Eastman Kodak Company)
DRV - (DCFS2K) -- C:\WINDOWS\SYSTEM32\DRIVERS\DCFS2k.sys (Eastman Kodak Company)
DRV - (DcFpoint) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcFpoint.sys (Eastman Kodak Company)
DRV - (ASCTRM) -- C:\WINDOWS\System32\drivers\asctrm.sys (Windows (R) 2000 DDK provider)
DRV - (Angel) -- C:\WINDOWS\SYSTEM32\DRIVERS\Angel.sys (Emuzed, Inc.)
DRV - (ati2mtag) -- C:\WINDOWS\SYSTEM32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (CVPNDRVA) -- C:\WINDOWS\SYSTEM32\DRIVERS\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (IntelC53) -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC53.sys (Intel Corporation)
DRV - (b57w2k) -- C:\WINDOWS\SYSTEM32\DRIVERS\b57xp32.sys (Broadcom Corporation)
DRV - (senfilt) -- C:\WINDOWS\SYSTEM32\DRIVERS\senfilt.sys (Sensaura)
DRV - (cdrbsdrv) -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS (B.H.A Corporation)
DRV - (IntelC52) -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC52.sys (Intel Corporation)
DRV - (IntelC51) -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC51.sys (Intel Corporation)
DRV - (mohfilt) -- C:\WINDOWS\SYSTEM32\DRIVERS\mohfilt.sys (Intel Corporation)
DRV - (vsdatant) -- C:\WINDOWS\SYSTEM32\vsdatant.sys (Zone Labs Inc.)
DRV - (DNE) -- C:\WINDOWS\SYSTEM32\DRIVERS\dne2000.sys (Deterministic Networks, Inc.)
DRV - (CVirtA) -- C:\WINDOWS\SYSTEM32\DRIVERS\CVirtA.sys (Cisco Systems, Inc.)
DRV - (pfc) -- C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys (Padus, Inc.)
DRV - (cdudf_xp) -- C:\WINDOWS\System32\drivers\Cdudf_xp.sys (Roxio)
DRV - (UdfReadr_xp) -- C:\WINDOWS\System32\drivers\UdfReadr_xp.sys (Roxio)
DRV - (pwd_2k) -- C:\WINDOWS\System32\drivers\pwd_2K.sys (Roxio)
DRV - (Cdralw2k) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Roxio)
DRV - (mmc_2K) -- C:\WINDOWS\System32\drivers\Mmc_2k.sys (Roxio)
DRV - (dvd_2K) -- C:\WINDOWS\System32\drivers\Dvd_2k.sys (Roxio)
DRV - (Dot4 HPH09) -- C:\WINDOWS\SYSTEM32\DRIVERS\hphid409.sys (HP)
DRV - (Dot4Storage HPH09) Storage Class Driver for IEEE-1284.4 (HPH09) -- C:\WINDOWS\SYSTEM32\DRIVERS\hphs2k09.sys (Hewlett-Packard)
DRV - (Dot4Print HPH09) -- C:\WINDOWS\SYSTEM32\DRIVERS\hphipr09.sys (HP)
DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (omci) -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (sonypvs1) -- C:\WINDOWS\SYSTEM32\DRIVERS\sonypvs1.sys (Sony Corporation)
DRV - (SymEvent) -- C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (CDRPDACC) -- C:\Program Files\321Studios\Shared\CDRPDACC.SYS (Arrowkey)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/28 09:17:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\Firefox [2010/12/25 13:07:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/12/26 04:03:28 | 000,000,000 | ---D | M]
[2009/03/14 22:39:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Juan\Application Data\Mozilla\Extensions
[2009/03/14 22:39:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Juan\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2009/01/29 10:51:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\extensions
[2009/01/29 16:23:48 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
Hosts file not found
O2 - BHO: (Yahoo! Companion BHO) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O3 - HKLM\..\Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [HPHmon03] C:\WINDOWS\SYSTEM32\hphmon03.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [MimBoot] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mimboot.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [RoxioAudioCentral] C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe (Roxio, Inc.)
O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe (Roxio)
O4 - HKLM..\Run: [RoxioEngineUtility] C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe (Roxio)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [UpdateManager] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKLM..\Run: [vptray] C:\Program Files\NavNT\vptray.exe (Symantec Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe (America Online, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\Juan\Start Menu\Programs\Startup\HOTLLAMA Update Check.lnk = C:\Program Files\HOTLLAMA MEDIA\Player\WiseUpdt.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)
O15 - HKCU\..Trusted Domains: //@install.mar@ ([]msni in My Computer)
O15 - HKCU\..Trusted Domains: //@mail.mar@ ([]msni in Local intranet)
O15 - HKCU\..Trusted Domains: plaxo.com ([www] https in Trusted sites)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcpitstop.com/da/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} http://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab (Disney Online Games ActiveX Control)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www.costcophotocenter.com/CostcoActivia.cab (Snapfish Activia)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.putfile.com/includes/ImageUploader4-5.cab (Image Uploader Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} http://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_5/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://samsclubus.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab (Java Plug-in 1.4.0)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} http://mdpatriotstangs.myphotoalbum.com/ImageUploader4.cab (MyPhotoAlbum Easy Upload Tool Combo Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://secure.bah.com/dana-cached/setup/JuniperSetupSP1.cab (JuniperSetupControlXP Class)
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} http://samsclubus.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Photobucket Publisher http://s154.photobucket.com/csve/ie_plugin.php (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.242.0.12
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\SYSTEM32\NavLogon.dll ()
O24 - Desktop Components:0 () - http://i13.servimg.com/u/f13/11/74/92/51/black_10.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Juan\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Juan\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/08 16:37:01 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/03/25 03:00:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2011/03/24 11:34:11 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/03/23 12:09:42 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Juan\Desktop\OTL.exe
[1980/01/01 02:00:00 | 000,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll
========== Files - Modified Within 30 Days ==========
[2011/03/24 20:40:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At2.job
[2011/03/24 14:00:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At4.job
[2011/03/24 12:29:32 | 004,124,672 | R--- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2011/03/24 12:29:32 | 002,737,152 | R--- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mb
[2011/03/24 12:04:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At3.job
[2011/03/24 10:11:12 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2011/03/23 17:34:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/03/23 17:33:55 | 534,941,696 | -HS- | M] () -- C:\hiberfil.sys
[2011/03/23 12:09:48 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Juan\Desktop\OTL.exe
[2011/03/23 08:10:43 | 109,599,474 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/03/22 03:36:00 | 000,000,378 | ---- | M] () -- C:\WINDOWS\tasks\DriverCure.job
[2011/03/21 16:13:01 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Microsoft Office Word 2003.lnk
[2011/03/19 16:40:14 | 000,178,688 | ---- | M] () -- C:\Documents and Settings\Juan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/19 10:53:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/03/18 17:45:42 | 000,016,963 | ---- | M] () -- C:\Documents and Settings\Juan\.recently-used.xbel
[2011/03/17 09:30:44 | 000,005,535 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Attach.zip
[2011/03/17 09:19:43 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\NTREGOPT.lnk
[2011/03/17 09:19:43 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\ERUNT.lnk
[2011/03/17 03:02:00 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/03/13 10:08:16 | 000,445,370 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT
[2011/03/13 10:08:16 | 000,072,576 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT
[2011/03/12 00:39:50 | 000,001,485 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Remote Desktop Connection.lnk
[2011/03/11 19:11:20 | 000,199,700 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/03/04 10:34:27 | 000,519,943 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Phillies tics.pdf
========== Files Created - No Company Name ==========
[2011/03/18 17:45:42 | 000,016,963 | ---- | C] () -- C:\Documents and Settings\Juan\.recently-used.xbel
[2011/03/17 09:30:44 | 000,005,535 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\Attach.zip
[2011/03/17 09:19:43 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\NTREGOPT.lnk
[2011/03/17 09:19:43 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\ERUNT.lnk
[2011/03/04 10:34:23 | 000,519,943 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\Phillies tics.pdf
[2010/10/29 09:05:51 | 000,072,820 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/10/15 16:00:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\IntIgn0xF28456.dat
[2010/01/02 15:52:39 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2009/09/23 09:28:50 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2007/06/21 16:19:02 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007/06/19 15:42:32 | 000,143,384 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2007/03/01 12:06:06 | 000,000,047 | ---- | C] () -- C:\WINDOWS\VistaEmail.ini
[2007/02/06 12:43:40 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/11/02 12:39:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\gxqydaiv.dll
[2006/07/18 00:37:02 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe
[2006/07/14 19:39:35 | 000,000,031 | ---- | C] () -- C:\WINDOWS\sbwin32.INI
[2005/11/29 20:02:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2005/08/02 14:51:54 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2005/05/08 17:05:00 | 000,000,560 | ---- | C] () -- C:\Documents and Settings\Juan\Application Data\ViewerApp.dat
[2005/05/08 16:34:23 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll
[2005/03/21 17:24:56 | 000,178,688 | ---- | C] () -- C:\Documents and Settings\Juan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/01/24 16:01:18 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/01/13 20:32:53 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Juan\Application Data\PFP120JPR.{PB
[2005/01/13 20:32:53 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Juan\Application Data\PFP120JCM.{PB
[2005/01/13 20:22:30 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini
[2005/01/10 18:32:32 | 000,000,199 | ---- | C] () -- C:\WINDOWS\ppdrv.ini
[2005/01/10 17:49:43 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2005/01/10 17:43:13 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Juan\Local Settings\Application Data\fusioncache.dat
[2005/01/04 19:24:32 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/01/04 19:22:08 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/01/04 19:22:07 | 000,000,264 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/01/04 19:19:35 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2005/01/04 19:07:22 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2005/01/04 19:06:32 | 000,445,370 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2005/01/04 19:06:32 | 000,072,576 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2005/01/04 18:52:20 | 000,000,517 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/19 18:22:58 | 000,000,791 | ---- | C] () -- C:\WINDOWS\ORUN32.INI
[2004/08/19 18:13:18 | 000,338,648 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/19 18:06:50 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/19 18:03:06 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/19 15:25:28 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2004/08/19 15:25:28 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[2004/08/10 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2004/08/10 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2004/08/10 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2004/08/10 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2004/08/10 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2004/08/10 07:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\SECUPD.DAT
[2004/08/10 07:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 07:00:00 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\FXSPERF.INI
[2004/08/10 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2004/07/19 18:01:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\SETPWRCG.EXE
[2004/05/26 17:09:26 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\DSRIRREM.EXE
[2003/03/12 03:03:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/02/27 06:42:54 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2003/01/30 19:55:40 | 000,036,864 | ---- | C] () -- C:\WINDOWS\hpfsched.exe
[2003/01/30 19:54:28 | 000,003,691 | ---- | C] () -- C:\WINDOWS\hphinfs.dat
[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/08/03 00:03:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\NavLogon.dll
[2002/05/24 01:00:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lockout.dll
[2002/05/24 01:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\lockres.dll
[2001/08/14 11:47:08 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\vxpsapi.dll
[2000/09/08 17:53:50 | 000,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll
[1980/01/01 02:00:00 | 000,389,120 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[1980/01/01 02:00:00 | 000,102,480 | ---- | C] () -- C:\WINDOWS\System32\EzRating.dll
[1980/01/01 02:00:00 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[1980/01/01 02:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\EzdCoIns.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >
BTW, Im still getting that new Norton Corp Ed error stating "feature you are trying to use on network is unavailable..." when I start up, its a pain to close out, wants to keep opening, anything to do about that, Thx
Lets see if we can find more info on Symantec
Download and Run SystemLook
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1 (http://jpshortstuff.247fixes.com/SystemLook.exe)
Download Mirror #2 (http://images.malwareremoval.com/jpshortstuff/SystemLook.exe)
Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
:filefind
Symantec
Norton
:folderfind
Symantec
Norton
:regfind
Symantec
Norton
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Here u go, Thanks again:
SystemLook 04.09.10 by jpshortstuff
Log created at 10:40 on 25/03/2011 by Juan
Administrator - Elevation successful
========== filefind ==========
Searching for "Symantec"
No files found.
Searching for "Norton"
No files found.
========== folderfind ==========
Searching for "Symantec"
C:\Documents and Settings\Alex\Local Settings\Application Data\Symantec d------ [20:47 20/12/2006]
C:\Documents and Settings\All Users\Application Data\Symantec d------ [20:15 05/04/2005]
C:\Documents and Settings\Juan\Local Settings\Application Data\Symantec d------ [22:30 29/11/2005]
C:\Documents and Settings\Paula\Local Settings\Application Data\Symantec d------ [01:13 12/12/2005]
C:\Program Files\Symantec d------ [20:15 05/04/2005]
C:\_OTL\MovedFiles\03242011_113411\C_Program Files\Symantec d------ [15:34 24/03/2011]
Searching for "Norton"
No folders found.
========== regfind ==========
Searching for "Symantec"
[HKEY_CURRENT_USER\Control Panel\MMCPL]
"SYMLIVE"="C:\Program Files\Symantec\LiveUpdate\S32LUCP1.CPL"
[HKEY_CURRENT_USER\Software\Microsoft\MSN\Toolbar\Shared\Obsidian\AutoFill]
"Local"="www.nytimes.com 1
email 16
zip 13
new.aol.com 1
zip 13
desiredsn 3
zip or postal code 13
actionform.zipcode 13
zipcode 13
first name 5
actionform.firstname 5
firstname 5
last name 7
actionform.lastname 7
lastname 7
zip or
postal code 13
actionform.zipcode 13
zipcode 13
day phone 17
actionform.dayphone 17
dayphone 17
www.amazon.com 1
email 16
emailcheck 16
enteraddressfullname 4
username 4
enteraddressaddressline1 9
enteraddressaddressline2 10
enteraddresscity 11
enteraddressstateorregion 12
zip 13
phone number 17
enteraddressphonenumber 17
wiki.answers.com 1
email address 16
wpemail 16
email 16
r.espn.go.com 1
cellareacode 20
cellprefix 21
cellnumber 22
twitter.com 1
user[name] 4
www.ticketmaster.com 1
first
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03E0E6C2-363B-11D3-B536-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03E0E6C2-363B-11D3-B536-00902771A435}\ProgID]
@="Symantec.stCheckForUpdates.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03E0E6C2-363B-11D3-B536-00902771A435}\VersionIndependentProgID]
@="Symantec.stCheckForUpdates"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A577C17-24F8-11D3-B530-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A577C17-24F8-11D3-B530-00902771A435}\ProgID]
@="Symantec.stInetTransferItem.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A577C17-24F8-11D3-B530-00902771A435}\VersionIndependentProgID]
@="Symantec.stInetTransferItem"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A577C19-24F8-11D3-B530-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A577C19-24F8-11D3-B530-00902771A435}\ProgID]
@="Symantec.stInetBatchGet.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A577C19-24F8-11D3-B530-00902771A435}\VersionIndependentProgID]
@="Symantec.stInetBatchGet"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D4C11A1-6BD0-11D3-B542-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D4C11A1-6BD0-11D3-B542-00902771A435}\ProgID]
@="Symantec.stLUProgressCallback.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D4C11A1-6BD0-11D3-B542-00902771A435}\VersionIndependentProgID]
@="Symantec.stLUProgressCallback"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D4C11A3-6BD0-11D3-B542-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D4C11A3-6BD0-11D3-B542-00902771A435}\ProgID]
@="Symantec.stCallbackManager.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D4C11A3-6BD0-11D3-B542-00902771A435}\VersionIndependentProgID]
@="Symantec.stCallbackManager"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ED40800-D38D-11D3-B562-00902771A435}\InProcServer32]
@="C:\Program Files\Symantec\LiveUpdate\LuComServerPS.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ED40801-D38D-11D3-B562-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ED40801-D38D-11D3-B562-00902771A435}\ProgID]
@="Symantec.stLog.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ED40801-D38D-11D3-B562-00902771A435}\VersionIndependentProgID]
@="Symantec.stLog"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17580E5F-7B07-11D2-BF1F-00A024D73444}\InprocServer32]
@="C:\Program Files\Symantec\LiveUpdate\ProductRegCom.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17580E5F-7B07-11D2-BF1F-00A024D73444}\ProgID]
@="Symantec.luProductReg.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17580E5F-7B07-11D2-BF1F-00A024D73444}\VersionIndependentProgID]
@="Symantec.luProductReg"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CEFD16C-91C2-4953-986E-EE77DE2DCF94}\InprocServer32]
@="C:\Program Files\Symantec\LiveUpdate\NetDetectController.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2045EFE5-99CF-11D2-B40A-00600831DD76}\InprocServer32]
@="C:\Program Files\Symantec\LiveUpdate\ProductRegCom.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2045EFE5-99CF-11D2-B40A-00600831DD76}\ProgID]
@="Symantec.luGroup.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2045EFE5-99CF-11D2-B40A-00600831DD76}\VersionIndependentProgID]
@="Symantec.luGroup"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B83B324-49FD-11D3-B538-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B83B324-49FD-11D3-B538-00902771A435}\ProgID]
@="Symantec.stSettings.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B83B324-49FD-11D3-B538-00902771A435}\VersionIndependentProgID]
@="Symantec.stSettings"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C5B6502-5731-11D3-B53D-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C5B6502-5731-11D3-B53D-00902771A435}\ProgID]
@="Symantec.stHostCatalog.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C5B6502-5731-11D3-B53D-00902771A435}\VersionIndependentProgID]
@="Symantec.stHostCatalog"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{407FE4AA-5D36-11D2-80D5-00A0C9749E83}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{407FE4AB-5D36-11D2-80D5-00A0C9749E83}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4128E694-4BB9-11D1-8190-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4128E695-4BB9-11D1-8190-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43943CCA-883C-11D1-83A4-00A0C9749EEF}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\webshell.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{592DC44C-4977-11D1-818D-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{592DC44F-4977-11D1-818D-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C2714F-4478-11D3-B537-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C2714F-4478-11D3-B537-00902771A435}\ProgID]
@="Symantec.stPatchCatalog.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C2714F-4478-11D3-B537-00902771A435}\VersionIndependentProgID]
@="Symantec.stPatchCatalog"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C27151-4478-11D3-B537-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C27151-4478-11D3-B537-00902771A435}\ProgID]
@="Symantec.stPatch.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C27151-4478-11D3-B537-00902771A435}\VersionIndependentProgID]
@="Symantec.stPatch"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D37EC8-8342-11D3-B54C-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D37EC8-8342-11D3-B54C-00902771A435}\ProgID]
@="Symantec.stDisScriptEngine.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D37EC8-8342-11D3-B54C-00902771A435}\VersionIndependentProgID]
@="Symantec.stDisScriptEngine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F6F6788-4009-11D1-8184-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91581CB1-0E7B-11D1-9D93-00A0C95C1762}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\webshell.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91581CB1-0E7B-11D1-9D93-00A0C95C1762}\ToolboxBitmap32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\webshell.dll, 1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{921BD9FB-4963-11D1-818D-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B91B0CAD-D866-11D1-B78C-00A0C99C7131}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B91B0CAE-D866-11D1-B78C-00A0C99C7131}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDA77241-42F6-11d0-85E2-00AA001FE28C}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEE62D80-4A07-11D1-818E-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C10E2CC6-1525-11D3-B527-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C10E2CC6-1525-11D3-B527-00902771A435}\ProgID]
@="Symantec.stInetGetFile.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C10E2CC6-1525-11D3-B527-00902771A435}\VersionIndependentProgID]
@="Symantec.stInetGetFile"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C859248A-513E-11D1-8194-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C859248B-513E-11D1-8194-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D99C2ADA-AE36-11D1-8220-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D99C2ADB-AE36-11D1-8220-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E381F1E0-910E-11D1-AB1E-00A0C90F8F6F}\InProcServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\Transman.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F8E2BDBE-5723-11D3-B53D-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F8E2BDBE-5723-11D3-B53D-00902771A435}\ProgID]
@="Symantec.stHost.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F8E2BDBE-5723-11D3-B53D-00902771A435}\VersionIndependentProgID]
@="Symantec.stHost"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC894628-B91D-11D1-8254-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC894629-B91D-11D1-8254-00A0C95C0756}\InprocServer32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE207EB8-122B-11D3-B527-00902771A435}\LocalServer32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE207EB8-122B-11D3-B527-00902771A435}\ProgID]
@="Symantec.stInetConnParms.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE207EB8-122B-11D3-B527-00902771A435}\VersionIndependentProgID]
@="Symantec.stInetConnParms"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LiveupdateFile\DefaultIcon]
@="C:\Program Files\Symantec\LiveUpdate\LUALL.EXE,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.luGroup]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.luGroup\CurVer]
@="Symantec.luGroup.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.luGroup.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.luProductReg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.luProductReg\CurVer]
@="Symantec.luProductReg.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.luProductReg.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stCallbackManager]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stCallbackManager\CurVer]
@="Symantec.stCallbackManager.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stCallbackManager.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stCheckForUpdates]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stCheckForUpdates\CurVer]
@="Symantec.stCheckForUpdates.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stCheckForUpdates.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stDisScriptEngine]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stDisScriptEngine\CurVer]
@="Symantec.stDisScriptEngine.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stDisScriptEngine.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stHost]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stHost\CurVer]
@="Symantec.stHost.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stHost.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stHostCatalog]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stHostCatalog\CurVer]
@="Symantec.stHostCatalog.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stHostCatalog.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetBatchGet]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetBatchGet\CurVer]
@="Symantec.stInetBatchGet.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetBatchGet.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetConnParms]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetConnParms\CurVer]
@="Symantec.stInetConnParms.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetConnParms.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetGetFile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetGetFile\CurVer]
@="Symantec.stInetGetFile.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetGetFile.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetTransferItem]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetTransferItem\CurVer]
@="Symantec.stInetTransferItem.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stInetTransferItem.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stLog]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stLog\CurVer]
@="Symantec.stLog.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stLog.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stLUProgressCallback]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stLUProgressCallback\CurVer]
@="Symantec.stLUProgressCallback.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stLUProgressCallback.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stPatch]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stPatch\CurVer]
@="Symantec.stPatch.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stPatch.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stPatchCatalog]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stPatchCatalog\CurVer]
@="Symantec.stPatchCatalog.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stPatchCatalog.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stSettings]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stSettings\CurVer]
@="Symantec.stSettings.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Symantec.stSettings.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{17580E52-7B07-11D2-BF1F-00A024D73444}\1.0\0\win32]
@="C:\Program Files\Symantec\LiveUpdate\ProductRegCom.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{17580E52-7B07-11D2-BF1F-00A024D73444}\1.0\HELPDIR]
@="C:\Program Files\Symantec\LiveUpdate\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2E76B2B4-C603-11D1-826C-00A0C95C0756}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPDlgs.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2E76B2B4-C603-11D1-826C-00A0C95C0756}\1.0\HELPDIR]
@="C:\Program Files\Common Files\Symantec Shared\SSC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{51B9BCA6-4A06-11D3-B538-00902771A435}\1.0\0\win32]
@="C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{51B9BCA6-4A06-11D3-B538-00902771A435}\1.0\HELPDIR]
@="C:\PROGRA~1\Symantec\LIVEUP~1\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{536604BF-B82E-11D1-8252-00A0C95C0756}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\ldvpui.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{536604BF-B82E-11D1-8252-00A0C95C0756}\1.0\HELPDIR]
@="C:\Program Files\Common Files\Symantec Shared\SSC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{592DC449-4977-11D1-818D-00A0C95C0756}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{592DC449-4977-11D1-818D-00A0C95C0756}\1.0\HELPDIR]
@="C:\Program Files\Common Files\Symantec Shared\SSC\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{64B4A5AB-0799-11D1-812A-00A0C95C0756}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPTask.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{64B4A5AB-0799-11D1-812A-00A0C95C0756}\1.0\HELPDIR]
@="C:\Program Files\Common Files\Symantec Shared\SSC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F952B50-BCEE-11D1-82D6-00A0C9749EEF}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F952B50-BCEE-11D1-82D6-00A0C9749EEF}\1.0\HELPDIR]
@="C:\Program Files\Common Files\Symantec Shared\SSC\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E9145BE-703D-11D1-81C9-00A0C95C0756}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDVPView.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E9145BE-703D-11D1-81C9-00A0C95C0756}\1.0\HELPDIR]
@="C:\Program Files\Common Files\Symantec Shared\SSC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C546DD23-7302-4E47-A4C1-E8417AD4243F}\1.0\0\win32]
@="C:\Program Files\Symantec\LiveUpdate\NetDetectController.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C546DD23-7302-4E47-A4C1-E8417AD4243F}\1.0\HELPDIR]
@="C:\Program Files\Symantec\LiveUpdate\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E381F1A0-910E-11D1-AB1E-00A0C90F8F6F}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\Transman.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F32F2023-8607-11D1-8892-0080C75FFCC4}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\LDDateTm.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F32F2023-8607-11D1-8892-0080C75FFCC4}\1.0\HELPDIR]
@="C:\Program Files\Common Files\Symantec Shared\SSC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FAD5CC54-0E68-11D1-9D91-00A0C95C1762}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\webshell.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FAD5CC54-0E68-11D1-9D91-00A0C95C1762}\1.0\HELPDIR]
@="C:\Program Files\Common Files\Symantec Shared\SSC\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FF1C1AB5-C27D-11D1-8263-00A0C95C0756}\1.0\0\win32]
@="C:\Program Files\Common Files\Symantec Shared\SSC\ExchngUI.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FF1C1AB5-C27D-11D1-8263-00A0C95C0756}\1.0\HELPDIR]
@="C:\Program Files\Common Files\Symantec Shared\SSC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\AMS2\Installed\Files]
"C:\WINDOWS\system32\PDS.DLL"="SYMANTEC_NAVCORP"
[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\AMS2\Installed\Files]
"C:\WINDOWS\system32\CBA.DLL"="SYMANTEC_NAVCORP"
[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\AMS2\Installed\Files]
"C:\WINDOWS\system32\NTS.DLL"="SYMANTEC_NAVCORP"
[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\AMS2\Installed\Files]
"C:\WINDOWS\system32\MSGSYS.DLL"="SYMANTEC_NAVCORP"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\LUALL.EXE]
@="C:\Program Files\Symantec\LiveUpdate\LUALL.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\LUALL.EXE]
"Path"="C:\Program Files\Symantec\LiveUpdate"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Common Files\Symantec Shared\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Common Files\Symantec Shared\SSC\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0101DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\Transman.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2101DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\30C96B46C13AC304A90FB72D69ED2FA8]
"74BE21DBFDBD3D11EBAE000ACC725290"="C:\Program Files\Common Files\Symantec Shared\SSC\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3101DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\webshell.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4FAD13E67E644D11A804000B0D045B88]
"74BE21DBFDBD3D11EBAE000ACC725290"="C:\Program Files\Common Files\Symantec Shared\SSC\exchngui.ldl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6045AEEDE79010A428DE775A427ED711]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\ExchngUI.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9001DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\LDDateTm.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A001DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B001DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\LDVPDlgs.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C001DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\LDVPTask.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D001DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\ldvpui.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E001DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\LDVPView.ocx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F001DD4505ED3D11EBAE000ACC725290]
"74BE21DBFDBD3D11EBAE000ACC725290"="C?\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290\InstallProperties]
"HelpLink"="http://www.symantec.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290\InstallProperties]
"Publisher"="Symantec Corporation"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290\InstallProperties]
"URLInfoAbout"="http://www.symantec.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290\InstallProperties]
"URLUpdateInfo"="http://www.symantec.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\Program Files\Symantec\SYMEVNT.386"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\Program Files\Symantec\SYMEVNT1.DLL"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\Program Files\Symantec\S32EVNT1.DLL"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\Program Files\Symantec\SYMEVENT.SYS"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\Program Files\Symantec\S32STAT.DLL"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdate1.7]
"UninstallString"="C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdate1.7]
"DisplayName"="LiveUpdate 1.7 (Symantec Corporation)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdate1.7]
"InstallLocation"="C:\Program Files\Symantec\LiveUpdate"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdate1.7]
"Publisher"="Symantec Corporation"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD12EB47-DBDF-11D3-BEEA-00A0CC272509}]
"HelpLink"="http://www.symantec.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD12EB47-DBDF-11D3-BEEA-00A0CC272509}]
"Publisher"="Symantec Corporation"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD12EB47-DBDF-11D3-BEEA-00A0CC272509}]
"URLInfoAbout"="http://www.symantec.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD12EB47-DBDF-11D3-BEEA-00A0CC272509}]
"URLUpdateInfo"="http://www.symantec.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec]
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus NT\Install\7.50]
"SharedComponents"="C:\Program Files\Symantec"
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus NT\Install\7.50]
"SymantecShared"="C:\Program Files\Common Files\Symantec Shared"
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedUsage]
"LiveUpdate1"="C:\Program Files\Symantec\LiveUpdate"
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedUsage]
"LiveUpdate"="C:\Program Files\Symantec\LiveUpdate"
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedUsage]
@="C:\Program Files\Symantec"
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedUsage]
"Location1"="C:\Program Files\Symantec"
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedUsage\S32STAT.DLL]
@="C:\Program Files\Symantec"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\VirtualDeviceDrivers]
"VDD"="C:\PROGRA~1\Symantec\S32EVNT1.DLL"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\LiveUpdate]
"EventMessageFile"="C:\Program Files\Symantec\LiveUpdate\LuComServer.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SymEvent]
"ImagePath"="\??\C:\Program Files\Symantec\SYMEVENT.SYS"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\VirtualDeviceDrivers]
"VDD"="C:\PROGRA~1\Symantec\S32EVNT1.DLL"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\LiveUpdate]
"EventMessageFile"="C:\Program Files\Symantec\LiveUpdate\LuComServer.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SymEvent]
"ImagePath"="\??\C:\Program Files\Symantec\SYMEVENT.SYS"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers]
"VDD"="C:\PROGRA~1\Symantec\S32EVNT1.DLL"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\LiveUpdate]
"EventMessageFile"="C:\Program Files\Symantec\LiveUpdate\LuComServer.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SymEvent]
"ImagePath"="\??\C:\Program Files\Symantec\SYMEVENT.SYS"
[HKEY_USERS\S-1-5-21-1944777543-2185336954-2013689522-1005\Control Panel\MMCPL]
"SYMLIVE"="C:\Program Files\Symantec\LiveUpdate\S32LUCP1.CPL"
[HKEY_USERS\S-1-5-21-1944777543-2185336954-2013689522-1005\Software\Microsoft\MSN\Toolbar\Shared\Obsidian\AutoFill]
"Local"="www.nytimes.com 1
email 16
zip 13
new.aol.com 1
zip 13
desiredsn 3
zip or postal code 13
actionform.zipcode 13
zipcode 13
first name 5
actionform.firstname 5
firstname 5
last name 7
actionform.lastname 7
lastname 7
zip or
postal code 13
actionform.zipcode 13
zipcode 13
day phone 17
actionform.dayphone 17
dayphone 17
www.amazon.com 1
email 16
emailcheck 16
enteraddressfullname 4
username 4
enteraddressaddressline1 9
enteraddressaddressline2 10
enteraddresscity 11
enteraddressstateorregion 12
zip 13
phone number 17
enteraddressphonenumber 17
wiki.answers.com 1
email address 16
wpemail 16
email 16
r.espn.go.com 1
cellareacode 20
cellprefix 21
cellnumber 22
twitter.com 1
user[name]
Searching for "Norton"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Norton AntiVirus Corporate Edition]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Program Files\NavNT\vptray.exe"="Norton AntiVirus"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{536604C2-B82E-11D1-8252-00A0C95C0756}]
@="Norton AntiVirus UI"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\74BE21DBFDBD3D11EBAE000ACC725290]
"NortonAntiVirus"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290]
"ProductName"="Norton AntiVirus Corporate Edition"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LDVPUI.LDVPUICtrl.1]
@="Norton AntiVirus UI"
[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Common]
"SelectedMessage"="Norton AntiVirus found a virus in an attachment from ~D.
"
[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Common]
"WarningMessage"="Norton AntiVirus found a virus in an attachment from ~D.
"
[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Common]
"SenderMessage"="Norton AntiVirus found a virus in an attachment you (~D) sent to ~I.
To ensure the recipient(s) are able to use the files you sent, perform a virus scan on your computer, clean any infected files, then resend this attachment.
"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\Compatibility\NortonSystemInfo]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290\Features]
"NortonAntiVirus"="4!HGHems_8WQ4`lq^w`T=v5}m1ZF!A7HV8,6gCeGBJ_A1xoy`9Z'%J -cwy_PH?Gw`9?wf((A4.2j&{8CRm&Xw$9-8SVaC`EZs%,SX4z?Hz8~eQJgPyBY7E?EsV^vdXAtVk6aX8eg,?aV~!jg%g(s?-L[J}ox%4lk`3aj%g(s?-L[J}ox%1QW8i6m%g(s?-L[J}ox%2QW8i6m%g(s?-L[J}ox%3QW8i6m%g(s?-L[J}ox%4QW8i6m%g(s?-L[J}ox%Nquwp39&g(s?-L[J}ox%G'y1e?}'g(tB-L[J}ox%Kquwp39&g(s?-L[J}ox%Mquwp39&g(s?-L[J}ox%u8%AU~@&g(s?-L[J}ox%fZ2XUCK&g(s?-L[J}ox%-U'JEAm'g('G2XapN..AH2XtW6w'g(tB-L[J}ox%t+H?C8[%g(s?-L[J}ox%u+H?C8[%g(s?-L[J}ox%v+H?C8[%g(s?-L[J}ox%w+H?C8[%g(s?-L[J}ox%x+H?C8[%g(s?-L[J}ox%y+H?C8[%g(s?-L[J}ox%z+H?C8[%g(s?-L[J}ox%{+H?C8[%g(s?-L[J}ox%~+H?C8[%g(s?-L[J}ox%!,H?C8[%g(s?-L[J}ox%%,H?C8[%g(s?-L[J}ox%',H?C8[%g(s?-L[J}ox%&,H?C8[%g(s?-L[J}ox%(,H?C8[%g(s?-L[J}ox%L(m_pP9ek?aCK3^noq](}n6t,JUpK=!b`XEfU66n-jc%JK2)g(Ls0XaxSexSBtIKK8B)g(Ny0XaxSexS*A=qZe&*g(+P2XapN..AG.j{]s**g(Zz3XapN..AHe^[n%s*g(0I4XaxSexS%jY0(z7qf(fVbqFgkW_B83
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290\InstallProperties]
"DisplayName"="Norton AntiVirus Corporate Edition"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD12EB47-DBDF-11D3-BEEA-00A0CC272509}]
"DisplayName"="Norton AntiVirus Corporate Edition"
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus NT]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application]
"Sources"="WSH WMIAdapter WMI.NET Provider Extension WmdmPmSN WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv Tlntsvr System.ServiceModel.Install 3.0.0.0 System.ServiceModel 3.0.0.0 System.Runtime.Serialization 3.0.0.0 System.IO.Log 3.0.0.0 System.IdentityModel 3.0.0.0 SysmonLog Starter Spybot - Search & Destroy 2 SpoolerCtrs SonicMCEBurnEngine Software Restriction Policies Software Installation SNL HiveManager ServiceModel Audit 3.0.0.0 SecurityCenter SeaPort SclgNtfy SceSrv SceCli safrslv SAFrdms RPC Remote Assistance PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup Norton AntiVirus NDP1.1sp1-KB979906-X86 NDP1.1sp1-KB953297-X86 NDP1.1sp1-KB2416447-X86 MSSQLSERVER/MSDE MSSOAP MSSHA MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft.Transactions.Bridge 3.0.0.0 Microsoft Office 11 Microsoft H.323 Telephony Service Provider Micr
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Norton AntiVirus]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application]
"Sources"="WSH WMIAdapter WMI.NET Provider Extension WmdmPmSN WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv Tlntsvr System.ServiceModel.Install 3.0.0.0 System.ServiceModel 3.0.0.0 System.Runtime.Serialization 3.0.0.0 System.IO.Log 3.0.0.0 System.IdentityModel 3.0.0.0 SysmonLog Starter Spybot - Search & Destroy 2 SpoolerCtrs SonicMCEBurnEngine Software Restriction Policies Software Installation SNL HiveManager ServiceModel Audit 3.0.0.0 SecurityCenter SeaPort SclgNtfy SceSrv SceCli safrslv SAFrdms RPC Remote Assistance PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup Norton AntiVirus NDP1.1sp1-KB979906-X86 NDP1.1sp1-KB953297-X86 NDP1.1sp1-KB2416447-X86 MSSQLSERVER/MSDE MSSOAP MSSHA MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft.Transactions.Bridge 3.0.0.0 Microsoft Office 11 Microsoft H.323 Telephony Service Provider Micr
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Norton AntiVirus]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application]
"Sources"="WSH WMIAdapter WMI.NET Provider Extension WmdmPmSN WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv Tlntsvr System.ServiceModel.Install 3.0.0.0 System.ServiceModel 3.0.0.0 System.Runtime.Serialization 3.0.0.0 System.IO.Log 3.0.0.0 System.IdentityModel 3.0.0.0 SysmonLog Starter Spybot - Search & Destroy 2 SpoolerCtrs SonicMCEBurnEngine Software Restriction Policies Software Installation SNL HiveManager ServiceModel Audit 3.0.0.0 SecurityCenter SeaPort SclgNtfy SceSrv SceCli safrslv SAFrdms RPC Remote Assistance PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup Norton AntiVirus NDP1.1sp1-KB979906-X86 NDP1.1sp1-KB953297-X86 NDP1.1sp1-KB2416447-X86 MSSQLSERVER/MSDE MSSOAP MSSHA MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft.Transactions.Bridge 3.0.0.0 Microsoft Office 11 Microsoft H.323 Telephony Service Provider
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Norton AntiVirus]
[HKEY_USERS\S-1-5-21-1944777543-2185336954-2013689522-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Norton AntiVirus Corporate Edition]
[HKEY_USERS\S-1-5-21-1944777543-2185336954-2013689522-1005\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Program Files\NavNT\vptray.exe"="Norton AntiVirus"
-= EOF =-
There are a ton of entries in the registry, lets try this instead in lew of messing with the windows registry.
Back up your registry again with ERUNT
Open OTL.exe
Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
:processes
killallprocesses
:OTL
DRV - (SymEvent) -- C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
O4 - HKLM..\Run: [vptray] C:\Program Files\NavNT\vptray.exe (Symantec Corporation)
:Services
:Reg
:Files
:Commands
[emptytemp]
[start explorer]
[Reboot]
Then click the Run Fix button at the top. <--Not run Scan
Let the program run unhindered, reboot when it is done
Then post the results of the log it produces.
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Then download the trial of this program and do a search for Norton and Symantec and let it uninstall what it finds
http://www.revouninstaller.com/
Ran fix, heres the log:
All processes killed
========== PROCESSES ==========
========== OTL ==========
Service SymEvent stopped successfully!
Service SymEvent deleted successfully!
C:\Program Files\Symantec\SYMEVENT.SYS moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\vptray deleted successfully.
C:\Program Files\NavNT\vptray.exe moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Alex
->Temp folder emptied: 1027120 bytes
->Temporary Internet Files folder emptied: 651289 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 805 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Juan
->Temp folder emptied: 1134065 bytes
->Temporary Internet Files folder emptied: 7052865 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 1116 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
User: Paula
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1056288 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 11.00 mb
OTL by OldTimer - Version 3.2.22.3 log created on 03262011_132310
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF3870.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF387B.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF39AC.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF39B7.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF3A8F.tmp not found!
File\Folder C:\Documents and Settings\Juan\Local Settings\Temp\~DF3AB0.tmp not found!
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\WC5W66NC\showthread[1].htm moved successfully.
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\WC5W66NC\st[1] moved successfully.
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\WC5W66NC\st[2] moved successfully.
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\U1SJ2M3J\fc[1].htm moved successfully.
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\U1SJ2M3J\md[1].htm moved successfully.
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\PJJXAOIU\welcome[1].txt moved successfully.
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\581W49HP\iframe[1].htm moved successfully.
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\581W49HP\st[1] moved successfully.
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\581W49HP\st[2] moved successfully.
C:\Documents and Settings\Juan\Local Settings\Temporary Internet Files\Content.IE5\581W49HP\st[3] moved successfully.
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_1d4.dat not found!
Registry entries deleted on Reboot...
new OTL log :
OTL logfile created on: 3/26/2011 1:48:06 PM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Juan\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
510.00 Mb Total Physical Memory | 92.00 Mb Available Physical Memory | 18.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 45.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.31 Gb Total Space | 56.09 Gb Free Space | 38.87% Space Free | Partition Type: NTFS
Drive G: | 931.51 Gb Total Space | 848.01 Gb Free Space | 91.04% Space Free | Partition Type: NTFS
Computer Name: DGCWJG61 | User Name: Juan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\Juan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe (Rosetta Stone Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe (Musicmatch, Inc.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe (Musicmatch, Inc.)
PRC - C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe ()
PRC - C:\Program Files\Real\RealPlayer\realplay.exe (RealNetworks, Inc.)
PRC - C:\Program Files\America Online 9.0\aoltray.exe (America Online, Inc.)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
PRC - C:\Program Files\Intel\Intel Application Accelerator\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
PRC - C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe (Roxio)
PRC - C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe (Roxio, Inc.)
PRC - C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe (Roxio, Inc.)
PRC - C:\WINDOWS\SYSTEM32\hphmon03.exe (Hewlett-Packard)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\Juan\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (Akamai) -- c:\Program Files\Common Files\Akamai\netsession_win_d76cf65.dll ()
SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (RosettaStoneDaemon) -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe (Rosetta Stone Ltd.)
SRV - (DSBrokerService) -- C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (CCALib8) -- C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (KodakCCS) -- C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe (Eastman Kodak Company)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (IAANTMon) -- C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe (Intel Corporation)
SRV - (AOL ACS) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
SRV - (Pml Driver) -- C:\WINDOWS\SYSTEM32\hphipm09.exe (HP)
========== Driver Services (SafeList) ==========
DRV - (Avgldx86) -- C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) -- C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (IrBus) -- C:\WINDOWS\SYSTEM32\DRIVERS\irbus.sys (Microsoft Corporation)
DRV - (Cdr4_xp) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys (Roxio)
DRV - (dsunidrv) -- C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys (Gteko Ltd.)
DRV - (DSproct) -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (DcCam) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcCam.sys (Eastman Kodak Company)
DRV - (Exportit) -- C:\WINDOWS\SYSTEM32\DRIVERS\ExportIt.sys (Eastman Kodak Company)
DRV - (DcPTP) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcPtp.sys (Eastman Kodak Company)
DRV - (DcLps) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcLps.sys (Eastman Kodak Company)
DRV - (DCFS2K) -- C:\WINDOWS\SYSTEM32\DRIVERS\DCFS2k.sys (Eastman Kodak Company)
DRV - (DcFpoint) -- C:\WINDOWS\SYSTEM32\DRIVERS\DcFpoint.sys (Eastman Kodak Company)
DRV - (ASCTRM) -- C:\WINDOWS\System32\drivers\asctrm.sys (Windows (R) 2000 DDK provider)
DRV - (Angel) -- C:\WINDOWS\SYSTEM32\DRIVERS\Angel.sys (Emuzed, Inc.)
DRV - (ati2mtag) -- C:\WINDOWS\SYSTEM32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (CVPNDRVA) -- C:\WINDOWS\SYSTEM32\DRIVERS\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (IntelC53) -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC53.sys (Intel Corporation)
DRV - (b57w2k) -- C:\WINDOWS\SYSTEM32\DRIVERS\b57xp32.sys (Broadcom Corporation)
DRV - (senfilt) -- C:\WINDOWS\SYSTEM32\DRIVERS\senfilt.sys (Sensaura)
DRV - (cdrbsdrv) -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS (B.H.A Corporation)
DRV - (IntelC52) -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC52.sys (Intel Corporation)
DRV - (IntelC51) -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC51.sys (Intel Corporation)
DRV - (mohfilt) -- C:\WINDOWS\SYSTEM32\DRIVERS\mohfilt.sys (Intel Corporation)
DRV - (vsdatant) -- C:\WINDOWS\SYSTEM32\vsdatant.sys (Zone Labs Inc.)
DRV - (DNE) -- C:\WINDOWS\SYSTEM32\DRIVERS\dne2000.sys (Deterministic Networks, Inc.)
DRV - (CVirtA) -- C:\WINDOWS\SYSTEM32\DRIVERS\CVirtA.sys (Cisco Systems, Inc.)
DRV - (pfc) -- C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys (Padus, Inc.)
DRV - (cdudf_xp) -- C:\WINDOWS\System32\drivers\Cdudf_xp.sys (Roxio)
DRV - (UdfReadr_xp) -- C:\WINDOWS\System32\drivers\UdfReadr_xp.sys (Roxio)
DRV - (pwd_2k) -- C:\WINDOWS\System32\drivers\pwd_2K.sys (Roxio)
DRV - (Cdralw2k) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Roxio)
DRV - (mmc_2K) -- C:\WINDOWS\System32\drivers\Mmc_2k.sys (Roxio)
DRV - (dvd_2K) -- C:\WINDOWS\System32\drivers\Dvd_2k.sys (Roxio)
DRV - (Dot4 HPH09) -- C:\WINDOWS\SYSTEM32\DRIVERS\hphid409.sys (HP)
DRV - (Dot4Storage HPH09) Storage Class Driver for IEEE-1284.4 (HPH09) -- C:\WINDOWS\SYSTEM32\DRIVERS\hphs2k09.sys (Hewlett-Packard)
DRV - (Dot4Print HPH09) -- C:\WINDOWS\SYSTEM32\DRIVERS\hphipr09.sys (HP)
DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (omci) -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (sonypvs1) -- C:\WINDOWS\SYSTEM32\DRIVERS\sonypvs1.sys (Sony Corporation)
DRV - (CDRPDACC) -- C:\Program Files\321Studios\Shared\CDRPDACC.SYS (Arrowkey)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/28 09:17:51 | 000,000,000 | ---D | M]
[2009/03/14 22:39:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Juan\Application Data\Mozilla\Extensions
[2009/03/14 22:39:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Juan\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2009/01/29 10:51:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\extensions
[2009/01/29 16:23:48 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
Hosts file not found
O2 - BHO: (Yahoo! Companion BHO) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [HPHmon03] C:\WINDOWS\SYSTEM32\hphmon03.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [MimBoot] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mimboot.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [RoxioAudioCentral] C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe (Roxio, Inc.)
O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe (Roxio)
O4 - HKLM..\Run: [RoxioEngineUtility] C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe (Roxio)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [UpdateManager] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe (America Online, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\Juan\Start Menu\Programs\Startup\HOTLLAMA Update Check.lnk = C:\Program Files\HOTLLAMA MEDIA\Player\WiseUpdt.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)
O15 - HKCU\..Trusted Domains: //@install.mar@ ([]msni in My Computer)
O15 - HKCU\..Trusted Domains: //@mail.mar@ ([]msni in Local intranet)
O15 - HKCU\..Trusted Domains: plaxo.com ([www] https in Trusted sites)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcpitstop.com/da/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} http://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab (Disney Online Games ActiveX Control)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www.costcophotocenter.com/CostcoActivia.cab (Snapfish Activia)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.putfile.com/includes/ImageUploader4-5.cab (Image Uploader Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} http://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_5/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://samsclubus.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab (Java Plug-in 1.4.0)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} http://mdpatriotstangs.myphotoalbum.com/ImageUploader4.cab (MyPhotoAlbum Easy Upload Tool Combo Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://secure.bah.com/dana-cached/setup/JuniperSetupSP1.cab (JuniperSetupControlXP Class)
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} http://samsclubus.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Photobucket Publisher http://s154.photobucket.com/csve/ie_plugin.php (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.242.0.12
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\SYSTEM32\NavLogon.dll ()
O24 - Desktop Components:0 () - http://i13.servimg.com/u/f13/11/74/92/51/black_10.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Juan\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Juan\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/08 16:37:01 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/03/24 11:34:11 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/03/23 12:09:42 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Juan\Desktop\OTL.exe
[1980/01/01 02:00:00 | 000,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll
========== Files - Modified Within 30 Days ==========
[2011/03/26 13:46:27 | 004,124,672 | R--- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2011/03/26 13:46:25 | 002,737,152 | R--- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mb
[2011/03/26 13:36:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/03/26 13:36:35 | 534,941,696 | -HS- | M] () -- C:\hiberfil.sys
[2011/03/26 13:13:13 | 000,017,487 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\WhiteSox schedula 2011 Spring.htm
[2011/03/26 12:04:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At3.job
[2011/03/26 10:53:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/03/26 10:10:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2011/03/26 09:32:14 | 109,948,674 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/03/26 03:36:00 | 000,000,378 | ---- | M] () -- C:\WINDOWS\tasks\DriverCure.job
[2011/03/25 20:40:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At2.job
[2011/03/25 14:00:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\At4.job
[2011/03/25 10:40:04 | 000,075,264 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\SystemLook.exe
[2011/03/25 10:35:10 | 000,307,686 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\alex bb card back.bmp
[2011/03/25 10:27:46 | 000,298,454 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Alex BB card.bmp
[2011/03/25 09:59:19 | 000,041,747 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Mo enter.jpg
[2011/03/23 12:09:48 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Juan\Desktop\OTL.exe
[2011/03/21 16:13:01 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Microsoft Office Word 2003.lnk
[2011/03/19 16:40:14 | 000,178,688 | ---- | M] () -- C:\Documents and Settings\Juan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/18 17:45:42 | 000,016,963 | ---- | M] () -- C:\Documents and Settings\Juan\.recently-used.xbel
[2011/03/17 09:30:44 | 000,005,535 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Attach.zip
[2011/03/17 09:19:43 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\NTREGOPT.lnk
[2011/03/17 09:19:43 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\ERUNT.lnk
[2011/03/17 03:02:00 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/03/13 10:08:16 | 000,445,370 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT
[2011/03/13 10:08:16 | 000,072,576 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT
[2011/03/12 00:39:50 | 000,001,485 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Remote Desktop Connection.lnk
[2011/03/11 19:11:20 | 000,199,700 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/03/04 10:34:27 | 000,519,943 | ---- | M] () -- C:\Documents and Settings\Juan\Desktop\Phillies tics.pdf
========== Files Created - No Company Name ==========
[2011/03/26 13:13:12 | 000,017,487 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\WhiteSox schedula 2011 Spring.htm
[2011/03/25 10:39:59 | 000,075,264 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\SystemLook.exe
[2011/03/25 10:35:10 | 000,307,686 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\alex bb card back.bmp
[2011/03/25 10:27:46 | 000,298,454 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\Alex BB card.bmp
[2011/03/25 09:59:42 | 000,041,747 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\Mo enter.jpg
[2011/03/18 17:45:42 | 000,016,963 | ---- | C] () -- C:\Documents and Settings\Juan\.recently-used.xbel
[2011/03/17 09:30:44 | 000,005,535 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\Attach.zip
[2011/03/17 09:19:43 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\NTREGOPT.lnk
[2011/03/17 09:19:43 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\ERUNT.lnk
[2011/03/04 10:34:23 | 000,519,943 | ---- | C] () -- C:\Documents and Settings\Juan\Desktop\Phillies tics.pdf
[2010/10/29 09:05:51 | 000,072,820 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/10/15 16:00:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\IntIgn0xF28456.dat
[2010/01/02 15:52:39 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2009/09/23 09:28:50 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2007/06/21 16:19:02 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007/06/19 15:42:32 | 000,143,384 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2007/03/01 12:06:06 | 000,000,047 | ---- | C] () -- C:\WINDOWS\VistaEmail.ini
[2007/02/06 12:43:40 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/11/02 12:39:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\gxqydaiv.dll
[2006/07/18 00:37:02 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe
[2006/07/14 19:39:35 | 000,000,031 | ---- | C] () -- C:\WINDOWS\sbwin32.INI
[2005/11/29 20:02:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2005/08/02 14:51:54 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2005/05/08 17:05:00 | 000,000,560 | ---- | C] () -- C:\Documents and Settings\Juan\Application Data\ViewerApp.dat
[2005/05/08 16:34:23 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll
[2005/03/21 17:24:56 | 000,178,688 | ---- | C] () -- C:\Documents and Settings\Juan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/01/24 16:01:18 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/01/13 20:32:53 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Juan\Application Data\PFP120JPR.{PB
[2005/01/13 20:32:53 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Juan\Application Data\PFP120JCM.{PB
[2005/01/13 20:22:30 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini
[2005/01/10 18:32:32 | 000,000,199 | ---- | C] () -- C:\WINDOWS\ppdrv.ini
[2005/01/10 17:49:43 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2005/01/10 17:43:13 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Juan\Local Settings\Application Data\fusioncache.dat
[2005/01/04 19:24:32 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/01/04 19:22:08 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/01/04 19:22:07 | 000,000,264 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/01/04 19:19:35 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2005/01/04 19:07:22 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2005/01/04 19:06:32 | 000,445,370 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2005/01/04 19:06:32 | 000,072,576 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2005/01/04 18:52:20 | 000,000,517 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/19 18:22:58 | 000,000,791 | ---- | C] () -- C:\WINDOWS\ORUN32.INI
[2004/08/19 18:13:18 | 000,338,648 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/19 18:06:50 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/19 18:03:06 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/19 15:25:28 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2004/08/19 15:25:28 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[2004/08/10 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2004/08/10 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2004/08/10 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2004/08/10 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2004/08/10 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2004/08/10 07:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\SECUPD.DAT
[2004/08/10 07:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 07:00:00 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\FXSPERF.INI
[2004/08/10 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2004/07/19 18:01:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\SETPWRCG.EXE
[2004/05/26 17:09:26 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\DSRIRREM.EXE
[2003/03/12 03:03:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/02/27 06:42:54 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2003/01/30 19:55:40 | 000,036,864 | ---- | C] () -- C:\WINDOWS\hpfsched.exe
[2003/01/30 19:54:28 | 000,003,691 | ---- | C] () -- C:\WINDOWS\hphinfs.dat
[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/08/03 00:03:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\NavLogon.dll
[2002/05/24 01:00:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lockout.dll
[2002/05/24 01:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\lockres.dll
[2001/08/14 11:47:08 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\vxpsapi.dll
[2000/09/08 17:53:50 | 000,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll
[1980/01/01 02:00:00 | 000,389,120 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[1980/01/01 02:00:00 | 000,102,480 | ---- | C] () -- C:\WINDOWS\System32\EzRating.dll
[1980/01/01 02:00:00 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[1980/01/01 02:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\EzdCoIns.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >
Norton Corp Ed error stating "feature you are trying to use on network is unavailable. Did this go away ?
Installed and ran revouninstaller (NOTE: AVG noted as Trojan backdoor prog and recomm to quaranty, ran as instructed, advise if I need to uninstall later), found Norton Corp Ed put upon tryiing to uninstall I was asked for a password to remove Norton, if one came with the purchase of PC I wouldnt know where its at, will this cause any issues other than pop ups mentioned earlier? BTW, I havent seen the pop ups the last few times Ive rebooted...
Thanks
Our last fix with OTL should have stopped the pop ups. Not sure what the password is, did you try entering none and see if it will proceed ?
If not than you look ok
None, did not work to remove norton.
So Im good to go know? Do I have to remove all the programs we downloaded in remove software?
Thx for all your help, hope it speeds the pC up.
This is what I would do, post in one of these forums for help removing Norton.
http://www.bleepingcomputer.com/forums/forum25.html
http://forums.whatthetech.com/index.php?showforum=124
Glad things are running better for you :bigthumb:
Lets make sure there in nothing else lurking
Open Malwarebytes....Check for updates....Run the quick scan , remove anything it finds and post the log
Then
Please run this free online virus scanner from ESET (http://www.eset.com/onlinescan/)
Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is ticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic
Ran update, it asked for restart, restarted slow and gave me a blue error shut down screen, rebooted, ran Malware, here is the log:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6179
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
3/27/2011 12:23:47 AM
mbam-log-2011-03-27 (00-23-47).txt
Scan type: Quick scan
Objects scanned: 197415
Time elapsed: 13 minute(s), 42 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Lets make sure there is no rootkit causing you issues
Download the GMER Rootkit Scanner (http://www.gmer.net/gmer.zip). Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double click GMER.exe.
http://img.photobucket.com/albums/v666/sUBs/gmer_zip.gif
If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
http://www.geekstogo.com/misc/guide_icons/GMER_thumb.jpg (http://www.geekstogo.com/misc/guide_icons/GMER_instructions.jpg)
Click the image to enlarge it
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
Save the log where you can easily find it, such as your desktop.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Please copy and paste the report into your Post.
Here is the log for GMER, I did not have time to run ESET last night before your last post, do you wish for me to still run or wwait for results of the GMER scan? Thx
GMER 1.0.15.15570 - http://www.gmer.net
Rootkit quick scan 2011-03-27 09:28:32
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST316002 rev.8.12
Running: gmer.exe; Driver: C:\DOCUME~1\Juan\LOCALS~1\Temp\awlyapob.sys
---- Devices - GMER 1.0.15 ----
Device atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation)
AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
---- EOF - GMER 1.0.15 ----
GMER looks ok, yes please run ESET when you get the time and post the log please
tried running ESET, I can hear the bleep for the, allow the activex control , but see it up top, then the bow/web page closes....
Try this one
Running TrendMicro HouseCall:
Click Download HouseCall (http://go.trendmicro.com/housecall7/HousecallLauncher.exe) to begin. Please note that HouseCall requires a small download before it can scan your computer.
Download it to your desktop
Double click HousecallLauncher.exe
Select the Full Scan option.
Let the scan run then post the results to this thread.
Or this one
Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply .
Downloaded and ran Housecall, results stated "no threats found"
:bigthumb:
How are things running now , any issues ?
seems to be running good, no pop ups or error pages.....do I know remove all downloads/logs etc?
Thanks for your help
Your very welcome, lets do this
Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups
How did I get infected in the first place ?
Read these links and find out how to prevent getting infected again.
Tutorial for System Restore (http://www.bleepingcomputer.com/tutorials/tutorial56.html) <-- Do this first to prevent yourself from being reinfected.
WhattheTech (http://forums.whatthetech.com/So_how_did_I_get_infected_in_the_first_place_t57817.html)
Grinler BleepingComputer (http://www.bleepingcomputer.com/forums/topic2520.html)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)
Safe Surfn
Ken
OTL and those logs were removed, still have ERNT, ReyoUninstaller and some of their logs on desktop. Do I need to remove via remove/instaal windows prog? or just delete from desktop? Thx
You can just try uninstalling them via Add Remove Programs in the Control Panel.
Ken :)
Removed Erunt and Reyo, couldnt see Housecaller on there so I just deleted the desktop icon and remainding logs.
Thanks again for all your help, have a great week.
Your very welcome my friend
Take Care,
Ken :)
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.