Okay this is what came out in the OTL.txt
OTL logfile created on: 4/15/2010 10:43:07 PM - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\CrossMatch\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1,022.00 Mb Total Physical Memory | 651.00 Mb Available Physical Memory | 64.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 27.94 Gb Total Space | 20.23 Gb Free Space | 72.41% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: PERSONAL-JYR9DE
Current User Name: CrossMatch
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Processes (SafeList) ========== PRC - [2010/04/15 21:09:12 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\CrossMatch\Desktop\OTL.exe
PRC - [2010/04/03 09:25:41 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/07/21 13:34:33 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2009/05/13 15:48:22 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2009/03/02 12:08:47 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2007/02/20 14:44:05 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2004/08/04 00:56:50 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003/01/23 15:06:04 | 000,004,608 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\system32\carpserv.exe
PRC - [2002/10/11 12:30:44 | 000,126,976 | R--- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2001/11/06 14:55:58 | 000,420,864 | ---- | M] (P.I. Engineering, Inc.) -- C:\Program Files\PIEngineering\X-keys\XKWdkApp.exe
========== Modules (SafeList) ========== MOD - [2010/04/15 21:09:12 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\CrossMatch\Desktop\OTL.exe
MOD - [2004/08/04 00:57:02 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
MOD - [2002/10/11 12:30:26 | 000,065,536 | R--- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll
========== Win32 Services (SafeList) ========== SRV - [2009/07/21 13:34:33 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009/05/13 15:48:22 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2005/03/30 16:46:56 | 000,411,920 | ---- | M] (Eastman Kodak Company) [On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\KodakCCS.exe -- (KodakCCS)
========== Driver Services (SafeList) ========== DRV - [2009/11/25 11:19:02 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/05/11 09:12:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/03/30 09:33:07 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2009/02/13 11:35:05 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2005/06/16 14:41:02 | 000,037,150 | ---- | M] (Eastman Kodak Company) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\DcCam.sys -- (DcCam)
DRV - [2005/03/31 08:00:08 | 000,152,081 | ---- | M] (Eastman Kodak Company) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ExportIt.sys -- (Exportit)
DRV - [2005/03/31 07:47:56 | 000,070,262 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DcPtp.sys -- (DcPTP)
DRV - [2005/03/31 07:47:50 | 000,008,022 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DcLps.sys -- (DcLps)
DRV - [2005/03/31 07:47:48 | 000,038,673 | ---- | M] (Eastman Kodak Company) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\DCFS2k.sys -- (DCFS2K)
DRV - [2005/03/31 07:47:42 | 000,061,564 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DcFpoint.sys -- (DcFpoint)
DRV - [2004/08/03 23:07:56 | 000,059,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2003/02/04 22:04:52 | 000,031,799 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\a311.sys -- ({5C8B2B62-A385-11d5-A78B-00104B672758})
DRV - [2003/02/04 22:04:48 | 000,033,335 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\a310.sys -- ({5C8B2B65-A385-11d5-A78B-00104B672758})
DRV - [2003/01/23 15:06:12 | 000,022,400 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\strmdisp.sys -- (StreamDispatcher)
DRV - [2003/01/23 15:05:00 | 000,153,344 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2003/01/23 15:03:04 | 000,585,984 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/01/23 15:02:00 | 001,067,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2002/12/17 11:41:36 | 000,042,368 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2002/12/10 17:53:24 | 000,236,121 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CamDrL21.sys -- (PhilCam8116) Logitech QuickCam Pro 3000(PID_08B0)
DRV - [2002/11/11 17:57:16 | 000,193,840 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97) Audio Driver (WDM)
DRV - [2002/10/11 12:21:36 | 000,264,528 | R--- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2001/09/20 10:58:48 | 000,153,824 | ---- | M] (Zoran Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NUVvid2.sys -- (NUVision)
DRV - [2001/09/20 10:47:38 | 000,025,184 | ---- | M] (Zoran Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nuvaud2.sys -- (nuvaud2)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =
http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr7/*http://www.yahoo.com/ext/search/search.html IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL =
http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems:
jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/03 09:25:53 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/15 21:24:10 | 000,000,000 | ---D | M]
[2010/02/27 19:04:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CrossMatch\Application Data\Mozilla\Extensions
[2010/04/15 22:31:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CrossMatch\Application Data\Mozilla\Firefox\Profiles\w6uqh005.default\extensions
[2010/04/15 19:08:55 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\CrossMatch\Application Data\Mozilla\Firefox\Profiles\w6uqh005.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/04/15 22:31:59 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/15 21:49:43 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/15 21:49:10 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
O1 HOSTS File: ([2002/09/03 15:39:21 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: () - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CARPService] C:\WINDOWS\System32\carpserv.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [X-keys Programming] C:\Program Files\PIEngineering\X-keys\XKWdkApp.exe (P.I. Engineering, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Yahoo! Search - C:\Program Files\Yahoo!\Common [2010/02/18 13:05:52 | 000,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &Dictionary - C:\Program Files\Yahoo!\Common [2010/02/18 13:05:52 | 000,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &Maps - C:\Program Files\Yahoo!\Common [2010/02/18 13:05:52 | 000,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &SMS - C:\Program Files\Yahoo!\Common [2010/02/18 13:05:52 | 000,000,000 | ---D | M]
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O9 - Extra 'Tools' menuitem : Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71}
http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes
file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java
file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\CrossMatch\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\CrossMatch\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/06/06 10:01:01 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ========== [2010/04/15 21:50:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/04/15 21:49:40 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/04/15 21:49:39 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/15 21:49:39 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/15 21:49:39 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/15 21:49:03 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/04/15 21:21:52 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/04/15 21:09:05 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\CrossMatch\Desktop\OTL.exe
[2010/04/15 19:37:45 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/04/15 19:35:06 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/04/15 19:35:06 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/04/15 19:35:06 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/04/15 19:35:06 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/04/15 19:34:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/04/15 19:33:03 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/04/15 19:22:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[2010/04/15 15:48:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
[2010/04/15 15:48:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US
[2010/04/15 15:46:17 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie7
[2010/04/15 15:45:47 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
[2010/04/15 15:44:51 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
[2010/04/15 15:43:31 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
[2010/04/15 15:29:55 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\CrossMatch\Recent
[2010/04/15 14:23:44 | 015,452,536 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\CrossMatch\My Documents\IE7-WindowsXP-x86-enu.exe
[2010/04/15 11:00:45 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/04/14 20:23:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\CrossMatch\Application Data\Malwarebytes
[2010/04/14 20:22:57 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/14 20:22:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/04/14 20:22:47 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/14 20:22:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/01 14:22:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\CrossMatch\Application Data\Cool Record Edit Pro
[2010/04/01 14:00:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\CrossMatch\Application Data\Free Sound Recorder
[2010/04/01 13:59:36 | 000,348,160 | ---- | C] (NCT Company Ltd.) -- C:\WINDOWS\System32\NCTWMAFile2.dll
[2010/04/01 13:59:35 | 001,986,560 | ---- | C] (NCT Company Ltd.) -- C:\WINDOWS\System32\NCTAudioFile2.dll
[2010/04/01 13:59:35 | 001,212,416 | ---- | C] (Online Media Technologies Ltd.) -- C:\WINDOWS\System32\NCTAudioInformation2.dll
[2010/04/01 13:59:35 | 000,602,112 | ---- | C] (Online Media Technologies Ltd.) -- C:\WINDOWS\System32\NCTAudioTransform2.dll
[2010/04/01 13:59:35 | 000,479,232 | ---- | C] (Online Media Technologies Ltd.) -- C:\WINDOWS\System32\NCTAudioVisualization2.dll
[2010/04/01 13:59:35 | 000,458,752 | ---- | C] (Online Media Technologies Ltd.) -- C:\WINDOWS\System32\NCTAudioRecord2.dll
[2010/04/01 13:59:35 | 000,458,752 | ---- | C] (Online Media Technologies Ltd.) -- C:\WINDOWS\System32\NCTAudioPlayer2.dll
[2010/04/01 13:59:35 | 000,417,792 | ---- | C] (Online Media Technologies Ltd.) -- C:\WINDOWS\System32\NCTTextToAudio2.dll
[2010/04/01 13:59:34 | 000,880,640 | ---- | C] (Online Media Technologies Ltd.) -- C:\WINDOWS\System32\NCTAudioEditor2.dll
[2010/04/01 13:59:34 | 000,835,584 | ---- | C] (NCT) -- C:\WINDOWS\System32\NCTAudioCDGrabber2.dll
[2010/04/01 13:59:31 | 000,000,000 | ---D | C] -- C:\Program Files\Free Sound Recorder
[2010/04/01 13:35:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\CrossMatch\dwhelper
[2010/04/01 11:14:46 | 000,089,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\VB5DB.DLL
[2010/03/25 09:49:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\CrossMatch\Application Data\FileMaker
[2010/03/25 09:46:34 | 000,000,000 | ---D | C] -- C:\Program Files\FileMaker
[2010/03/25 09:36:30 | 006,130,728 | ---- | C] (EXP Systems LLC) -- C:\Documents and Settings\CrossMatch\My Documents\Install_PDFR_v225.exe
[2010/02/18 12:45:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/02/18 12:43:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/02/18 11:03:47 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/02/18 11:03:47 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\CrossMatch\Desktop\*.tmp files -> C:\Documents and Settings\CrossMatch\Desktop\*.tmp -> ]
========== Files - Modified Within 30 Days ========== [2010/04/15 22:06:30 | 000,011,447 | ---- | M] () -- C:\Documents and Settings\CrossMatch\Desktop\Gallinas_Polacas.jpg
[2010/04/15 21:51:23 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/15 21:51:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/15 21:50:16 | 005,767,168 | -H-- | M] () -- C:\Documents and Settings\CrossMatch\NTUSER.DAT
[2010/04/15 21:50:16 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\CrossMatch\ntuser.ini
[2010/04/15 21:50:07 | 006,417,676 | -H-- | M] () -- C:\Documents and Settings\CrossMatch\Local Settings\Application Data\IconCache.db
[2010/04/15 21:49:09 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/04/15 21:49:09 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/15 21:49:09 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/15 21:49:09 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/15 21:49:09 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/04/15 21:09:12 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\CrossMatch\Desktop\OTL.exe
[2010/04/15 19:44:58 | 000,000,246 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/04/15 19:37:53 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/04/15 19:28:22 | 003,916,476 | R--- | M] () -- C:\Documents and Settings\CrossMatch\Desktop\ComboFix.exe
[2010/04/15 15:46:02 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/04/15 15:41:31 | 000,018,944 | ---- | M] () -- C:\Documents and Settings\CrossMatch\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/15 15:02:55 | 011,845,325 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Jose_Medina_Tambora2_en_Vivo.wmv
[2010/04/15 11:00:45 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\CrossMatch\Desktop\HijackThis.lnk
[2010/04/14 23:31:23 | 000,432,128 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Outside_Mailing_LA_and_Pub.fp5
[2010/04/14 20:23:03 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/14 13:28:31 | 021,602,950 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\201004101534280.SXC_7ABRIL_PASTOR_OQ.flv
[2010/04/13 00:42:28 | 000,001,548 | ---- | M] () -- C:\Documents and Settings\CrossMatch\Desktop\CCleaner.lnk
[2010/04/12 13:52:26 | 000,024,064 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\vapors.doc
[2010/04/10 11:19:54 | 000,024,064 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\US Post office Packages.doc
[2010/04/10 10:01:55 | 000,000,349 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\PCLECHAL.INI
[2010/04/09 13:40:49 | 000,025,088 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Ritmo_965_Video_Data.doc
[2010/04/06 10:03:11 | 014,278,711 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\MAYRA_Y_CELINES_-_POR_LAS_DUDAS.flv
[2010/04/03 14:25:17 | 000,024,576 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Paypal_freezing_funds.doc
[2010/04/01 14:00:25 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010/04/01 13:59:40 | 000,000,649 | ---- | M] () -- C:\Documents and Settings\CrossMatch\Desktop\Free Sound Recorder.lnk
[2010/03/31 10:26:10 | 000,026,624 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Iphone_that_MuraliBurra_wants.doc
[2010/03/30 19:26:25 | 000,420,864 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Outside_Mailing_LA_and_Pub Copy.fp5
[2010/03/30 11:14:46 | 000,024,064 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Listado de Compra.doc
[2010/03/29 15:24:58 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/29 15:24:46 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/26 22:52:49 | 000,025,600 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Texto_traducido_Aireen.doc
[2010/03/25 11:13:39 | 000,608,256 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Outside_Mailing_Contacts.fp5
[2010/03/25 10:03:17 | 000,325,632 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Resume_Sending_Database_used_for_Mom.fp5
[2010/03/25 09:58:18 | 000,231,424 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Database_Generic_for_sending_letters.fp5
[2010/03/25 09:53:15 | 000,313,344 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Contacts_Sonia_Marrero.fp5
[2010/03/25 09:47:06 | 000,000,960 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\FileMaker Pro.lnk
[2010/03/21 21:33:33 | 000,024,064 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Quéeee liiiiindo se ve con el Grupo Mayombe.doc
[2010/03/18 23:20:48 | 000,024,064 | ---- | M] () -- C:\Documents and Settings\CrossMatch\My Documents\Murali Burra Address.doc
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\CrossMatch\Desktop\*.tmp files -> C:\Documents and Settings\CrossMatch\Desktop\*.tmp -> ]
========== Files Created - No Company Name ========== [2010/04/15 22:06:30 | 000,011,447 | ---- | C] () -- C:\Documents and Settings\CrossMatch\Desktop\Gallinas_Polacas.jpg
[2010/04/15 19:37:53 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/04/15 19:37:49 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/04/15 19:35:06 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/04/15 19:35:06 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/04/15 19:35:06 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/04/15 19:35:06 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/04/15 19:35:06 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/04/15 19:27:11 | 003,916,476 | R--- | C] () -- C:\Documents and Settings\CrossMatch\Desktop\ComboFix.exe
[2010/04/15 15:44:05 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/04/15 15:09:03 | 011,845,325 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Jose_Medina_Tambora2_en_Vivo.wmv
[2010/04/15 14:28:14 | 000,060,928 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\1x2_ML3000_labels_Real_Estate.doc
[2010/04/15 14:28:14 | 000,033,792 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\2x4_Labels_Avon_Solicitar_Cat_Reciente_Gladys.doc
[2010/04/15 11:00:45 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\CrossMatch\Desktop\HijackThis.lnk
[2010/04/14 20:23:03 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/14 13:27:47 | 021,602,950 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\201004101534280.SXC_7ABRIL_PASTOR_OQ.flv
[2010/04/12 13:52:26 | 000,024,064 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\vapors.doc
[2010/04/10 11:19:53 | 000,024,064 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\US Post office Packages.doc
[2010/04/09 13:35:28 | 000,025,088 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Ritmo_965_Video_Data.doc
[2010/04/06 09:54:55 | 014,278,711 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\MAYRA_Y_CELINES_-_POR_LAS_DUDAS.flv
[2010/04/03 14:25:16 | 000,024,576 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Paypal_freezing_funds.doc
[2010/04/01 13:59:40 | 000,000,649 | ---- | C] () -- C:\Documents and Settings\CrossMatch\Desktop\Free Sound Recorder.lnk
[2010/04/01 13:59:36 | 000,113,486 | ---- | C] () -- C:\WINDOWS\System32\NCTWMAProfiles.prx
[2010/03/30 11:11:35 | 000,024,064 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Listado de Compra.doc
[2010/03/29 19:18:13 | 000,026,624 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Iphone_that_MuraliBurra_wants.doc
[2010/03/26 22:49:22 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Texto_traducido_Aireen.doc
[2010/03/25 12:27:09 | 000,420,864 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Outside_Mailing_LA_and_Pub Copy.fp5
[2010/03/25 11:13:34 | 000,432,128 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Outside_Mailing_LA_and_Pub.fp5
[2010/03/25 10:03:17 | 000,325,632 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Resume_Sending_Database_used_for_Mom.fp5
[2010/03/25 09:57:39 | 000,608,256 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Outside_Mailing_Contacts.fp5
[2010/03/25 09:47:05 | 000,000,960 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\FileMaker Pro.lnk
[2010/03/25 09:41:08 | 000,313,344 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Contacts_Sonia_Marrero.fp5
[2010/03/25 09:39:56 | 000,231,424 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Database_Generic_for_sending_letters.fp5
[2010/03/21 21:33:32 | 000,024,064 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Quéeee liiiiindo se ve con el Grupo Mayombe.doc
[2010/03/18 23:20:47 | 000,024,064 | ---- | C] () -- C:\Documents and Settings\CrossMatch\My Documents\Murali Burra Address.doc
[2008/09/16 18:24:22 | 000,018,944 | ---- | C] () -- C:\Documents and Settings\CrossMatch\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/26 15:13:59 | 000,007,472 | ---- | C] () -- C:\Program Files\ORDER.TXT
[2007/06/26 15:13:59 | 000,006,465 | ---- | C] () -- C:\Program Files\LICENSE.TXT
[2007/06/26 15:13:59 | 000,004,376 | ---- | C] () -- C:\Program Files\WINZIP.TXT
[2007/06/26 15:13:59 | 000,004,102 | ---- | C] () -- C:\Program Files\WHATSNEW.TXT
[2007/06/26 15:13:59 | 000,003,942 | ---- | C] () -- C:\Program Files\VENDOR.TXT
[2007/06/26 15:13:59 | 000,003,055 | ---- | C] () -- C:\Program Files\README.TXT
[2007/06/26 15:13:59 | 000,000,434 | ---- | C] () -- C:\Program Files\FILE_ID.DIZ
[2007/06/26 15:13:59 | 000,000,105 | ---- | C] () -- C:\Program Files\DELETE0.TXT
[2007/02/11 11:21:01 | 000,000,022 | ---- | C] () -- C:\Documents and Settings\CrossMatch\presets.ini
[2007/01/26 02:04:12 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\mase32.dll
[2007/01/26 02:04:12 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\ma32.dll
[2005/09/23 10:13:00 | 000,001,024 | -H-- | C] () -- C:\Documents and Settings\CrossMatch\ntuser.dat.LOG
[2005/09/23 10:13:00 | 000,000,178 | -HS- | C] () -- C:\Documents and Settings\CrossMatch\ntuser.ini
[2005/09/23 10:12:59 | 005,767,168 | -H-- | C] () -- C:\Documents and Settings\CrossMatch\NTUSER.DAT
[2005/09/09 14:33:32 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2003/06/06 16:42:18 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS4o.DLL
[2003/06/06 16:12:06 | 000,003,541 | ---- | C] () -- C:\WINDOWS\SigPlus.ini
[2003/06/06 16:08:14 | 000,262,144 | ---- | C] () -- C:\Documents and Settings\All Users\NTUSER.DAT
[2003/06/06 16:08:14 | 000,001,024 | -H-- | C] () -- C:\Documents and Settings\All Users\NTUSER.DAT.LOG
[2003/06/06 15:04:05 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2003/06/06 10:16:28 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/10 17:43:12 | 000,011,653 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2002/09/03 15:54:44 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2000/09/08 17:53:50 | 000,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll
< End of report >
THIS IS WAS CAME OUT IN THE EXTRAS.TXT FILE:
OTL Extras logfile created on: 4/15/2010 10:43:07 PM - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\CrossMatch\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1,022.00 Mb Total Physical Memory | 651.00 Mb Available Physical Memory | 64.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 27.94 Gb Total Space | 20.23 Gb Free Space | 72.41% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: PERSONAL-JYR9DE
Current User Name: CrossMatch
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
]
[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- ()
"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater -- ()
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe:*:Enabled:Render Manager -- (Pinnacle Systems)
"C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile -- ( )
"C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe:*:Enabled:umi -- (Pinnacle Systems)
"C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin -- (Pinnacle Systems)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38441BE7-79B0-42B8-8297-833704F949FE}" = HLPIndex
"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK
"{432C3720-37BF-4BD7-8E49-F38E090246D0}" = CR2
"{48C82F7A-F100-4DAB-A310-8E18BF2159E1}" = ESSvpot
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EDB1CA5-983F-4FC3-A8E3-E34981E05A60}" = Pinnacle VideoSpin
"{4F677FC7-7AA8-412B-A957-F13CBE1C7331}" = ESSSONIC
"{52504CE6-E909-4113-B232-4AFEC6543A61}" = B44Inst
"{54C8FE84-89C4-40E8-976C-439EB0729BD6}" = CardRd81
"{58EDAD68-7839-42D8-A6AD-854A9ECB8224}" = FileMaker Pro 6
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7959721D-8268-4565-9E0E-C41A9F4848A9}" = SigmaTel AC97 Audio Drivers
"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics Driver
"{8BB4B58A-A402-4DE8-8FCD-287E60B88DD8}" = ESSCT
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{A5B3EB8A-4071-42F0-8E8E-7A8342AA8E69}" = ESSvpaht
"{AADAC983-FDE9-42FA-8FD9-7BB324155593}" = HLPRFO
"{AC76BA86-7AD7-1033-7B44-000000000001}" = Adobe Reader 6.0
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{B08EFBF9-7E97-44B0-A077-8B6C10C6D98A}" = X-keys
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{CA60320D-6A16-49C8-A34F-84EEF4799567}" = ESSTUTOR
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Applian FLV Player2.0.24" = Applian FLV Player
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1" = Conexant D480 MDC V.92 Modem
"Free Sound Recorder_is1" = Free Sound Recorder 2010 v8.2.1
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{52504CE6-E909-4113-B232-4AFEC6543A61}" = Broadcom 440x Driver Installer
"LiveUpdate" = LiveUpdate 1.80 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4
"SynTPDeinstKey" = Synaptics TouchPad
"Topaz e-Signatures SigPlus 3.23" = Topaz e-Signatures SigPlus 3.23
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR archiver
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Customizations" = Yahoo! Browser Services
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 2/18/2010 12:50:05 PM | Computer Name = PERSONAL-JYR9DE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from:
with error: The specified server cannot perform the requested operation.
Error - 2/18/2010 12:50:05 PM | Computer Name = PERSONAL-JYR9DE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from:
with error: The specified server cannot perform the requested operation.
Error - 2/18/2010 12:50:05 PM | Computer Name = PERSONAL-JYR9DE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from:
with error: The specified server cannot perform the requested operation.
Error - 2/26/2010 10:33:07 PM | Computer Name = PERSONAL-JYR9DE | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 6.0.2900.2180, faulting
module mshtml.dll, version 6.0.2900.2180, fault address 0x0009d1a8.
Error - 2/26/2010 10:33:59 PM | Computer Name = PERSONAL-JYR9DE | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 6.0.2900.2180, faulting
module mshtml.dll, version 6.0.2900.2180, fault address 0x0009d1a8.
Error - 2/27/2010 8:28:45 PM | Computer Name = PERSONAL-JYR9DE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from:
with error: This operation returned because the timeout period expired.
Error - 4/5/2010 10:41:22 AM | Computer Name = PERSONAL-JYR9DE | Source = ESENT | ID = 490
Description = svchost (1032) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
for read / write access failed with system error 32 (0x00000020): "The process
cannot access the file because it is being used by another process. ". The open
file operation will fail with error -1032 (0xfffffbf8).
Error - 4/5/2010 3:40:04 PM | Computer Name = PERSONAL-JYR9DE | Source = ESENT | ID = 490
Description = svchost (1024) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
for read / write access failed with system error 32 (0x00000020): "The process
cannot access the file because it is being used by another process. ". The open
file operation will fail with error -1032 (0xfffffbf8).
Error - 4/12/2010 8:43:59 AM | Computer Name = PERSONAL-JYR9DE | Source = ESENT | ID = 490
Description = svchost (1040) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
for read / write access failed with system error 32 (0x00000020): "The process
cannot access the file because it is being used by another process. ". The open
file operation will fail with error -1032 (0xfffffbf8).
Error - 4/13/2010 3:19:33 PM | Computer Name = PERSONAL-JYR9DE | Source = ESENT | ID = 490
Description = svchost (1036) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
for read / write access failed with system error 32 (0x00000020): "The process
cannot access the file because it is being used by another process. ". The open
file operation will fail with error -1032 (0xfffffbf8).
[ System Events ]
Error - 3/25/2010 10:55:22 PM | Computer Name = PERSONAL-JYR9DE | Source = BITS | ID = 1654791
Description = The BITS job list is not in a recognized format. It may have been
created by a different version of BITS. The job list has been cleared.
Error - 4/1/2010 8:55:16 AM | Computer Name = PERSONAL-JYR9DE | Source = BITS | ID = 1654791
Description = The BITS job list is not in a recognized format. It may have been
created by a different version of BITS. The job list has been cleared.
Error - 4/5/2010 8:53:11 PM | Computer Name = PERSONAL-JYR9DE | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.
Error - 4/5/2010 8:53:11 PM | Computer Name = PERSONAL-JYR9DE | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053
Error - 4/8/2010 8:55:14 AM | Computer Name = PERSONAL-JYR9DE | Source = BITS | ID = 1654791
Description = The BITS job list is not in a recognized format. It may have been
created by a different version of BITS. The job list has been cleared.
Error - 4/14/2010 7:14:38 PM | Computer Name = PERSONAL-JYR9DE | Source = BITS | ID = 1654791
Description = The BITS job list is not in a recognized format. It may have been
created by a different version of BITS. The job list has been cleared.
Error - 4/14/2010 8:45:05 PM | Computer Name = PERSONAL-JYR9DE | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
IntelIde
Error - 4/15/2010 9:44:08 AM | Computer Name = PERSONAL-JYR9DE | Source = BITS | ID = 1654791
Description = The BITS job list is not in a recognized format. It may have been
created by a different version of BITS. The job list has been cleared.
Error - 4/15/2010 9:25:19 PM | Computer Name = PERSONAL-JYR9DE | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.
Error - 4/15/2010 9:25:19 PM | Computer Name = PERSONAL-JYR9DE | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053
< End of report >
