VIRUS IMPORTANT

OTListIt Extras logfile created on: 14/05/2009 09:53:40 - Run 4
OTListIt2 by OldTimer - Version 2.0.15.7 Folder = C:\Documents and Settings\Isaac Billantwi\Mes documents\Downloads\Programs
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18241)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1013,35 Mb Total Physical Memory | 304,91 Mb Available Physical Memory | 30,09% Memory free
2,39 Gb Paging File | 1,53 Gb Available in Paging File | 63,91% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,92 Gb Total Space | 63,09 Gb Free Space | 84,21% Space Free | Partition Type: NTFS
Drive D: | 74,13 Gb Total Space | 69,59 Gb Free Space | 93,88% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SASSAMBA-56FBC9
Current User Name: Isaac Billantwi
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 1 Day
Company Name Whitelist: On

[color=orange]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation)
.cpl [@ = cplfile] -- C:\WINDOWS\system32\shell32.DLL (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] -- C:\WINDOWS\system32\mshta.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.inf [@ = inffile] -- C:\WINDOWS\System32\NOTEPAD.EXE ()
.ini [@ = inifile] -- C:\WINDOWS\System32\NOTEPAD.EXE ()
.url [@ = InternetShortcut] -- C:\WINDOWS\system32\ieframe.DLL (Microsoft Corporation)
.js [@ = JSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.reg [@ = regfile] -- C:\WINDOWS\regedit.exe (Microsoft Corporation)
.txt [@ = txtfile] -- C:\WINDOWS\system32\NOTEPAD.EXE ()
.vbe [@ = VBEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

[HKEY_USERS\S-1-5-21-507921405-1326574676-1417001333-1002\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

[color=orange]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

[color=orange]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2008/04/13 18:34:22 | 00,142,848 | ---- | M] (Microsoft Corporation) -- %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2008/04/13 18:34:22 | 00,142,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019
[2008/07/08 16:04:38 | 00,036,864 | ---- | M] (ActiveState Corporation) -- C:\Program Files\aMSN\bin\wish.exe:*:Enabled:Wish Application
File not found -- C:\Documents and Settings\Isaac Billantwi\Mes documents\Downloads\Compressed\Infiltrat\Server.exe:*:Enabled:Server
[2009/05/06 12:57:02 | 13,170,104 | ---- | M] (MusicLab, LLC) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare
File not found -- C:\gelgke.exe:*:Enabled:gelgke
[2009/05/13 14:09:46 | 00,342,848 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\DNA\btdna.exe:*:Enabled:DNA
[2008/11/21 01:41:28 | 00,637,232 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
[2009/05/08 21:14:41 | 10,889,230 | ---- | M] (PortableTurk.com) -- C:\Documents and Settings\Isaac Billantwi\Mes documents\Downloads\Programs\iMesh_v7.2.0.51345.exe:*:Disabled:Portabled by Atalay

[color=orange]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP610_series" = Canon MP610 series
"{1A524CFE-DF85-4555-8BC2-0C89DBD8BC2C}" = PC Connectivity Solution
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{422FADA9-FED2-41D7-B5FA-472BB98B7784}" = Petit Larousse 2009
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{58BAA8D0-404E-4585-9FD3-ED1BB72AC2EE}" = Adobe Flash Player 9 ActiveX
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = Analyseur et SDK MSXML 4.0 SP2
"{90120000-0010-040C-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (French) 12
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007
"{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-0044-040C-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A394342-4A68-4EBA-85A6-55B559F4E700}" = Microsoft .NET Framework 1.1 French Language Pack
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A8C3710A-0BCA-4F10-9EC3-A302A1F1FA82}" = Nokia PC Suite
"{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}" = ScanSoft OmniPage SE 4
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3F19A5F-35A8-4FDB-A6ED-0F4CE398DA48}" = Nokia Connectivity Cable Driver
"{C514C594-23AA-4F13-A070-DB8BDB27594F}" = Windows Live Mail
"{C774410D-3EF9-4DE7-AC01-332613163ECF}" = Kaspersky Internet Security 7.0
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}" = SpeedTouch USB Software
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}" = Microsoft .NET Framework 2.0 Language Pack - FRA
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Package de pilotes Windows - Nokia pccsmcfd (10/12/2007 6.85.4.0)
"9CD348AE9C64C4B939B624E8E24F3903EFDFC82B" = Package de pilotes Windows - Nokia Modem (05/22/2008 7.00.0.1)
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"aMSN" = aMSN 0.97.2
"AntiVir PersonalEdition Premium" = Avira AntiVir Premium
"BearShare" = BearShare
"C5A76DC11BABDA0A881E7BE8DDEB641365A77FFD" = Package de pilotes Windows - Nokia Modem (05/22/2008 3.8)
"Canon MP610 series User Registration" = Canon MP610 series User Registration
"CANONIJPLM100" = PIXMA Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CPLBonus" = Kels' CPL Bonus Pack!
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Foxit Reader" = Foxit Reader
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8 Beta 2
"InstallWIX_{C774410D-3EF9-4DE7-AC01-332613163ECF}" = Kaspersky Internet Security 7.0
"Internet Download Manager" = Internet Download Manager
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - FRA" = Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"Nokia PC Suite" = Nokia PC Suite
"Paint.NET 3.36" = Paint.NET 3.36
"PhotoFiltre Studio" = PhotoFiltre Studio
"PowerISO" = PowerISO
"PROPLUS" = Microsoft Office Professional Plus 2007
"SmartMovie Converter" = SmartMovie Converter
"SuperCopier2" = SuperCopier2
"VLC media player" = VLC media player 0.9.8a
"WallpaperToy" = Wallpaper Changer for Windows XP
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WinRAR archiver" = Archiveur WinRAR
"WinSnap" = WinSnap
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5

[color=orange]========== HKEY_CURRENT_USER Uninstall List ==========[/color]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
"Windows Vista Screensavers" = Windows Vista Screensavers
"Windows Vista Wallpapers" = Windows Vista Wallpapers

[color=orange]========== HKEY_USERS Uninstall List ==========[/color]

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Windows Vista Screensavers" = Windows Vista Screensavers
"Windows Vista Wallpapers" = Windows Vista Wallpapers

[color=orange]========== HKEY_USERS Uninstall List ==========[/color]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Windows Vista Screensavers" = Windows Vista Screensavers
"Windows Vista Wallpapers" = Windows Vista Wallpapers

[color=orange]========== HKEY_USERS Uninstall List ==========[/color]

[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Windows Vista Screensavers" = Windows Vista Screensavers
"Windows Vista Wallpapers" = Windows Vista Wallpapers

[color=orange]========== HKEY_USERS Uninstall List ==========[/color]

[HKEY_USERS\S-1-5-21-507921405-1326574676-1417001333-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
"Windows Vista Screensavers" = Windows Vista Screensavers
"Windows Vista Wallpapers" = Windows Vista Wallpapers

[color=orange]========== Last 10 Event Log Errors ==========[/color]

[ Application Events ]
Error - 06/05/2009 09:15:06 | Computer Name = SASSAMBA-56FBC9 | Source = EventSystem | ID = 4609
Description = Le système d'événements de COM+ a détecté un code de renvoi erroné
lors de son traitement interne. Le HRESULT est 800401FE à partir de la ligne 44
de f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Contactez les services
du Support Technique Microsoft pour signaler cette erreu

Error - 06/05/2009 10:36:42 | Computer Name = SASSAMBA-56FBC9 | Source = EventSystem | ID = 4609
Description = Le système d'événements de COM+ a détecté un code de renvoi erroné
lors de son traitement interne. Le HRESULT est 800401FE à partir de la ligne 44
de f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Contactez les services
du Support Technique Microsoft pour signaler cette erreu

Error - 06/05/2009 12:02:20 | Computer Name = SASSAMBA-56FBC9 | Source = EventSystem | ID = 4609
Description = Le système d'événements de COM+ a détecté un code de renvoi erroné
lors de son traitement interne. Le HRESULT est 800401FE à partir de la ligne 44
de f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Contactez les services
du Support Technique Microsoft pour signaler cette erreu

Error - 06/05/2009 17:59:59 | Computer Name = SASSAMBA-56FBC9 | Source = EventSystem | ID = 4609
Description = Le système d'événements de COM+ a détecté un code de renvoi erroné
lors de son traitement interne. Le HRESULT est 800401FE à partir de la ligne 44
de f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Contactez les services
du Support Technique Microsoft pour signaler cette erreu

Error - 07/05/2009 19:55:07 | Computer Name = SASSAMBA-56FBC9 | Source = EventSystem | ID = 4609
Description = Le système d'événements de COM+ a détecté un code de renvoi erroné
lors de son traitement interne. Le HRESULT est 800401FE à partir de la ligne 44
de f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Contactez les services
du Support Technique Microsoft pour signaler cette erreu

Error - 07/05/2009 20:22:12 | Computer Name = SASSAMBA-56FBC9 | Source = EventSystem | ID = 4609
Description = Le système d'événements de COM+ a détecté un code de renvoi erroné
lors de son traitement interne. Le HRESULT est 800401FE à partir de la ligne 44
de f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Contactez les services
du Support Technique Microsoft pour signaler cette erreu

Error - 07/05/2009 20:44:25 | Computer Name = SASSAMBA-56FBC9 | Source = Google Update | ID = 20
Description =

Error - 08/05/2009 13:24:49 | Computer Name = SASSAMBA-56FBC9 | Source = Google Update | ID = 20
Description =

Error - 08/05/2009 17:38:44 | Computer Name = SASSAMBA-56FBC9 | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 07/05/2009 05:36:23 | Computer Name = SASSAMBA-56FBC9 | Source = Tcpip | ID = 4198
Description = Le système a détecté un conflit d'adresses pour l'adresse IP 192.168.1.1
avec le système d'adresse physique réseau 00:12:BF:0C:C2:13. L'interface locale
a été désactivée.

Error - 08/05/2009 10:19:39 | Computer Name = SASSAMBA-56FBC9 | Source = ipnathlp | ID = 31008
Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de
résolution de noms à partir du registre. La donnée est le code de l'erreur.

Error - 08/05/2009 12:32:28 | Computer Name = SASSAMBA-56FBC9 | Source = ipnathlp | ID = 31008
Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de
résolution de noms à partir du registre. La donnée est le code de l'erreur.

Error - 08/05/2009 13:13:50 | Computer Name = SASSAMBA-56FBC9 | Source = ipnathlp | ID = 31008
Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de
résolution de noms à partir du registre. La donnée est le code de l'erreur.

Error - 08/05/2009 16:02:16 | Computer Name = SASSAMBA-56FBC9 | Source = ipnathlp | ID = 31008
Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de
résolution de noms à partir du registre. La donnée est le code de l'erreur.

Error - 08/05/2009 17:29:58 | Computer Name = SASSAMBA-56FBC9 | Source = ipnathlp | ID = 31008
Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de
résolution de noms à partir du registre. La donnée est le code de l'erreur.

Error - 08/05/2009 18:30:45 | Computer Name = SASSAMBA-56FBC9 | Source = ipnathlp | ID = 31008
Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de
résolution de noms à partir du registre. La donnée est le code de l'erreur.

Error - 09/05/2009 04:59:00 | Computer Name = SASSAMBA-56FBC9 | Source = ipnathlp | ID = 31008
Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de
résolution de noms à partir du registre. La donnée est le code de l'erreur.

Error - 09/05/2009 05:43:48 | Computer Name = SASSAMBA-56FBC9 | Source = ipnathlp | ID = 31008
Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de
résolution de noms à partir du registre. La donnée est le code de l'erreur.

Error - 09/05/2009 15:20:29 | Computer Name = SASSAMBA-56FBC9 | Source = ipnathlp | ID = 31008
Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de
résolution de noms à partir du registre. La donnée est le code de l'erreur.


< End of report >