Being Redirected from Google Searches [Solved] |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
|
|
|
  |
 Oct 21 2009, 10:00 AM
Post
#1
|
|
|
Member  Posts: 22 OS: Vista  |
Hey,
When I`m doing a google search my firefox does not take me to the page that I clicked on. If i copy and paste the url into a new window, it takes me to the correct page. I downloaded Hijack This, and here are the results.... I don`t really know what to make of this. Please help Chris Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:50:51 AM, on 10/21/2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18828) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Windows\System32\rundll32.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\taskmgr.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.search.yahoo.com/search?fr=mcafee&p=%s R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file) O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo...NPUplden-ca.cab O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\Kaspersky Internet Security 2010\kloehk.dll O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 7393 bytes |
 |
 
|
|
Oct 21 2009, 11:31 AM
Post
#2
|
|
 GeekU Teacher  Posts: 35,115 From: Dublin OS: XP |
hi
Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall** |
|
|
|
|
Oct 21 2009, 11:47 AM
Post
#3
|
|
|
Member Posts: 22 OS: Vista |
I'm a little hesistant to use Combo-Fix, I have run it in the past, and it changed some stuff on me that was very difficult to get back. It changed @(SHIFT+2) to a " and it took a couple system restores to get that functionality back.
I have a Malware Bytes Log, RootRepeal Log, and OLT Log. If you really need me to run Combo-Fix I can, but I will also need assistance in changing my keyboard settings back to normal. Malwarebytes' Anti-Malware 1.41 Database version: 3005 Windows 6.0.6002 Service Pack 2 10/21/2009 11:38:35 AM mbam-log-2009-10-21 (11-38-35).txt Scan type: Quick Scan Objects scanned: 105255 Time elapsed: 11 minute(s), 17 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) OTL Extras logfile created on: 10/21/2009 11:42:21 AM - Run 1 OTL by OldTimer - Version 3.0.21.0 Folder = C:\Users\Chris\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18828) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 86.57% Memory free 4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 286.10 Gb Total Space | 121.85 Gb Free Space | 42.59% Space Free | Partition Type: NTFS Drive D: | 11.99 Gb Total Space | 1.62 Gb Free Space | 13.51% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: CHRISEXNER Current User Name: Chris Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .chm [@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation) .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found chm.file [open] -- "%SystemRoot%\hh.exe" %1 (Microsoft Corporation) cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* File not found helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 "UacDisableNotify" = 0 "InternetSettingsDisableNotify" = 0 "AutoUpdateDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1369064247-611158546-1486992077-1000] "EnableNotifications" = 0 "EnableNotificationsRef" = 3 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- () [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- () ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{05C076E3-17C3-4998-8B4D-EB77CAEEB5A3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | "{15CA2385-BAEE-432E-9927-1A468CDA3277}" = rport=139 | protocol=6 | dir=out | app=system | "{1B03F111-EE7A-4F2F-9671-C05323B5CD55}" = lport=138 | protocol=17 | dir=in | app=system | "{20D0522A-03C0-4800-A13B-CA4F7DD86F39}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{262BA791-D623-4D67-81D1-B2FB277C7E4B}" = lport=139 | protocol=6 | dir=in | app=system | "{3050AE57-AB6B-44A6-A0DE-5C046B1EB032}" = rport=138 | protocol=17 | dir=out | app=system | "{61FE1F08-7393-4EBB-94FF-6819086F3FB9}" = rport=137 | protocol=17 | dir=out | app=system | "{7D02BAC5-9A85-4F56-8332-A35634F31A91}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service | "{8F49927B-EB60-46CD-81B4-69487782653E}" = rport=445 | protocol=6 | dir=out | app=system | "{9F55C543-A0BE-40ED-BB70-C7443C2D1D9C}" = lport=137 | protocol=17 | dir=in | app=system | "{AF09E766-7F13-4654-99FD-C6318E27F03D}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | "{B2C52829-FDA2-4CFA-AE2B-DD7177ADD5C3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{BF4DAD4D-412B-4DD1-845A-688A2FC54E4F}" = lport=445 | protocol=6 | dir=in | app=system | "{D5E0FDFE-58BF-43F8-A9BE-3614A45CCC94}" = lport=2869 | protocol=6 | dir=in | app=system | "{E8DA19AE-A8E9-4A88-837E-14F8D3C69A26}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0447AE38-7C30-4C35-BBBF-75628AB35994}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{050735A9-9A37-4C17-BCA8-54ADF05A7907}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | "{0D322E87-BBF6-4CAD-896F-74541A11DE9F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{0E2F4C08-EB5F-4B54-8C25-60C56F9BECF8}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | "{1953731C-B233-4F45-8DF8-ED8C0B5D8C26}" = protocol=17 | dir=in | app=c:\program files\smart pc utilities\vista services optimizer\updateagent.exe | "{1B610ADC-FD3D-4E33-807D-37B8902F7B50}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{1DD11A1A-6351-4C69-A3BC-A027053A7EB0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{22E8700D-E421-4103-89B2-138150BA5B67}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{25EC5CBE-1B1A-4228-A088-CA5C98DF7EF8}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{2AF2FE59-F35C-42D7-8A27-775B15C70211}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | "{37C9D8CB-27B7-4189-9863-859E0DFE2DBF}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | "{3EAEB132-C27F-42B2-9740-1C7F051DE986}" = protocol=6 | dir=in | app=c:\program files\smart pc utilities\vista services optimizer\servicesoptimizer.exe | "{426463D8-9F22-4846-AB31-AB53B34A3266}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | "{44429AC0-998E-438D-8D38-00275D1E94CA}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | "{571CDC4A-A891-439E-8CA0-A2EFA522ED09}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{58B77579-6600-4447-9AE0-1C36A9943369}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{5A592FC0-C02B-4B9E-9BBB-CC8F93622763}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{639A7E97-2B79-4A5C-BB7A-2A8BE0C02F99}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | "{6823E35B-F6B5-4F5D-A1E4-B22543538ADD}" = protocol=17 | dir=in | app=c:\program files\smart pc utilities\vista services optimizer\webupdate.exe | "{6F829903-B354-45E7-BC92-864A78283125}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{713904D8-B936-4196-99E6-684053553ADD}" = protocol=6 | dir=in | app=c:\program files\smart pc utilities\vista services optimizer\webupdate.exe | "{72CAFA92-5248-4CBD-B215-D5F95C198DDA}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{757BB851-DDD7-4AD2-B15C-A45C3583E451}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | "{7A127C45-A698-469C-9DC2-E900E5F22883}" = protocol=6 | dir=in | app=c:\program files\smart pc utilities\vista services optimizer\updateagent.exe | "{7E2E25CE-9BE7-4518-BE7F-A4F53F07DE0B}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | "{7E8B6C02-40BA-4907-80D7-452B0B099E22}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe | "{7F49BE1C-AB49-4957-BFBC-12E1F8D7DE27}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{86C50243-5292-4592-B878-798D4C36D3B0}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{8E8C4F64-7C87-4A4D-853A-E59CC4E303B5}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{9D21DD11-EA73-4970-BD68-AD58CC65FF6C}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{A0BBC6BB-B11C-460D-8D60-63EE86492C51}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{ABBF2B79-BE11-4D93-A92B-9F56E2BF9E44}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "{B2C620B0-7E10-4AFE-BF22-802613F31B6E}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{BAAD7051-B480-427D-ADCA-7487D39B10DC}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{BF007082-786E-488D-8852-7831CB95AE77}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{C168E174-6BEA-4387-B27A-7D3CB18615AB}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe | "{C458831B-8AC2-427C-B6B5-40B213999A06}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | "{C5A417AA-0B98-4B1E-9FA7-2E55CDF45C78}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{C9602FAB-FE6A-4F9B-96AA-66773782005F}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | "{C9D9D2FE-150F-4F40-852E-D4A7AEC52144}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{CFFE2708-0355-41DB-BB7F-C76F0E92FA6A}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | "{D2B69EB7-7169-4C02-B51E-3F0A5356C77D}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version4\teamviewer.exe | "{D562BE51-5064-4A52-BA5F-C47C082704D3}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{DA20D7FE-1116-4A2A-A172-219525DE2B5F}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | "{EA0EC611-6517-415D-87AA-5CCF1A239A40}" = protocol=17 | dir=in | app=c:\program files\smart pc utilities\vista services optimizer\servicesoptimizer.exe | "{F5BC8ACF-3168-4A34-8567-F652924D3C45}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version4\teamviewer.exe | "{F9697BD1-9E36-42F7-877F-D33F2707330B}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{FA2A0076-92D1-42DB-BC71-9AC02068411D}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "TCP Query User{2374D9F4-73C7-46ED-8BA0-A6BDFC22D10C}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | "TCP Query User{2C9A92D3-D247-496D-ACF6-74EC5E08AAB8}C:\program files\common files\nero\nero web\setupx.exe" = protocol=6 | dir=in | app=c:\program files\common files\nero\nero web\setupx.exe | "TCP Query User{57BA5D26-6EED-4440-ABE3-61F939993A48}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | "TCP Query User{E95593D0-B2EE-4E67-A8E6-42830E72A79C}C:\program files\adobe\photoshop elements 7.0\adobephotoshopelementsmediaserver.exe" = protocol=6 | dir=in | app=c:\program files\adobe\photoshop elements 7.0\adobephotoshopelementsmediaserver.exe | "UDP Query User{729B928D-0476-40CD-99EE-BF1360985E40}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | "UDP Query User{B133CB1A-DF0F-4A4C-A8D8-7D064416442E}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | "UDP Query User{D158D9E4-EA1F-4E8D-B30D-9E4A9EE5492B}C:\program files\common files\nero\nero web\setupx.exe" = protocol=17 | dir=in | app=c:\program files\common files\nero\nero web\setupx.exe | "UDP Query User{E652F124-810E-4D7D-BEC6-DC8890994BB6}C:\program files\adobe\photoshop elements 7.0\adobephotoshopelementsmediaserver.exe" = protocol=17 | dir=in | app=c:\program files\adobe\photoshop elements 7.0\adobephotoshopelementsmediaserver.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = HP Integrated Module with Bluetooth wireless technology 6.0.1.5500 "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour "{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer "{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger "{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support "{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID Sign-in Assistant "{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp "{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library "{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy "{17bdd424-56ad-4524-acab-04d8646bd883}" = "{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player "{1fd80dd6-ffb4-4be2-ab71-921e5a320a69}" = "{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check "{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 15 "{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg "{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan "{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2 "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3 "{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java™ 6 Update 6 "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7 "{33b86329-aa00-40bf-8682-93e3b1f0d7bf}" = "{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed "{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 E1 "{359CFC0A-BEB1-440D-95BA-CF63A86DA34F}" = Nero Recode "{368BA326-73AD-4351-84ED-3C0A7A52CC53}" = Nero Rescue Agent "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3C52E7DA-C431-4239-B66B-1BF703D5B194}" = Windows Live Photo Gallery "{4394DC3A-5DAC-4C80-A86E-FF462D0AD653}" = Windows 7 Upgrade Advisor Beta "{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision "{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update "{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress "{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 "{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7 "{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner "{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail "{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder "{689E0AB3-50B2-4E5A-9DCE-6DA9F5BE1314}" = BlackBerry® Media Sync "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{706BB40A-4102-4c89-8107-DC68C4EBD19B}" = HP Deskjet All-In-One Software 9.0 "{70b253bc-5d74-4477-ab22-f196b13f1be4}" = Nero 9 Trial "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart "{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights "{7920d86b-ca76-4f69-8545-0c83a278a354}" = "{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager "{7F362F06-A9A3-440F-8B19-6A01A72723C4}" = AuthenTec Fingerprint Sensor Minimum Install "{8347A7A5-4AB8-433F-82AA-496B0D189A9B}" = HP User Guides 0088 "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver "{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8c407fac-f373-413b-8c06-f1ed425ce668}" = "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard "{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007 "{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007 "{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007 "{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007 "{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007 "{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{93F54611-2701-454e-94AB-623F458D9E6B}" = DeviceDiscovery "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010 "{9E82B934-9A25-445B-B8DF-8012808074AC}" = Nero PhotoSnap "{9f8d6969-0150-4938-a640-5cf7f4bb2ad8}" = "{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor "{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime "{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress "{A9C365A3-06C0-43b4-A2DB-EDF0A6079AA9}" = DJ_AIO_Software "{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder "{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.7 "{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8 "{ae104306-67c4-4f7d-81f3-332f5fb949c3}" = "{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4 "{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant "{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan "{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles "{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B4B1F18B-5CED-4f8f-8A8F-1BD0503C222E}" = DJ_AIO_ProductContext "{B6B69D92-6CD8-4086-8D1D-7945BDA4AE5A}" = F4100_Help "{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit "{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter "{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter "{C1212AE3-DBB9-4365-8473-F8ABC7B06BBB}" = Pinnacle Instant DVD Recorder "{c26bf6ca-8f69-418f-a80d-6354d41474b9}" = "{C5A7CB6C-E76D-408F-BA0E-85605420FE9D}" = SoundTrax "{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials "{C7AF7F33-9092-997E-2D29-DE8095863FE3}" = DigitalPersona Personal 3.0.0 "{C9D88AF8-7B0A-4200-BFBC-7827A7535096}" = F4100_doccd "{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0 "{CC8E94A2-55C7-4460-953C-2A790180578C}" = LightScribe System Software "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM "{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component "{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker "{D9DCF92E-72EB-412D-AC71-3B01276E5F8B}" = Nero ShowTime "{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}" = iTunes "{E06C8E13-7A8C-434C-8548-34BC4762212D}" = Logitech Harmony Remote Software 7 "{e088d7b1-b2ce-4d21-b8e4-f1f1eae024db}" = "{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm "{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit "{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer "{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox "{eaf22ec7-ef78-4474-8979-2ba45e37dd9b}" = "{EE59E3BD-6B7D-4BBB-B9CD-20EA7AEF1E10}" = BlackBerry Desktop Software 5.0 "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F1861F30-3419-44DB-B2A1-C274825698B3}" = Nero Disc Copy Gadget "{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729) "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01 "{F56D6F46-1D62-4734-BF12-6457A1ED17BD}" = DJ_AIO_Software_min "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call "{F8FED11D-3584-4a72-8B26-E0951B655797}" = F4100 "{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool "{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0 "Adobe Shockwave Player" = Adobe Shockwave Player 11 "AviSynth" = AviSynth 2.5 "BBMediaSyncUninstall" = BlackBerry Media Sync "BlackBerry_{EE59E3BD-6B7D-4BBB-B9CD-20EA7AEF1E10}" = BlackBerry Desktop Software 5.0 "Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter "CNXT_AUDIO_HDA" = Conexant HD Audio "CNXT_MODEM_HDAUDIO_HERMOSA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP "doPDF 6 printer_is1" = doPDF 6.2 printer "ERUNT_is1" = ERUNT 1.1j "HandBrake" = HandBrake 0.9.3 "Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25149) "HP Imaging Device Functions" = HP Imaging Device Functions 9.0 "HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0 "InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager "InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010 "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.5.3)" = Mozilla Firefox (3.5.3) "NVIDIA Drivers" = NVIDIA Drivers "PROPLUS" = Microsoft Office Professional Plus 2007 "SynTPDeinstKey" = Synaptics Pointing Device Driver "TeamViewer 4" = TeamViewer 4 "Videora iPod Converter" = Videora iPod Converter 5.03 "WinLiveSuite_Wave3" = Windows Live Essentials "WinRAR archiver" = WinRAR archiver ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "BOXEE" = Boxee "uTorrent" = µTorrent ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 10/18/2009 9:46:30 PM | Computer Name = ChrisExner | Source = VSS | ID = 8193 Description = Error - 10/18/2009 9:46:30 PM | Computer Name = ChrisExner | Source = Windows Backup | ID = 4100 Description = Error - 10/18/2009 10:04:04 PM | Computer Name = ChrisExner | Source = WinMgmt | ID = 10 Description = Error - 10/18/2009 10:13:28 PM | Computer Name = ChrisExner | Source = WinMgmt | ID = 10 Description = Error - 10/18/2009 10:22:12 PM | Computer Name = ChrisExner | Source = WinMgmt | ID = 10 Description = Error - 10/18/2009 11:14:13 PM | Computer Name = ChrisExner | Source = Windows Backup | ID = 4104 Description = Error - 10/18/2009 11:28:18 PM | Computer Name = ChrisExner | Source = Application Error | ID = 1000 Description = Faulting application firefox.exe, version 1.9.1.3523, time stamp 0x4a92de61, faulting module nvLsp.dll, version 2.2.0.6781, time stamp 0x481061c8, exception code 0x40000015, fault offset 0x0000e0f5, process id 0x44c, application start time 0x01ca506b35b259e1. Error - 10/19/2009 1:06:40 AM | Computer Name = ChrisExner | Source = WinMgmt | ID = 10 Description = Error - 10/19/2009 1:27:05 AM | Computer Name = ChrisExner | Source = WinMgmt | ID = 10 Description = Error - 10/19/2009 12:07:46 PM | Computer Name = ChrisExner | Source = WinMgmt | ID = 10 Description = [ DigitalPersona Pro Events ] Error - 9/7/2009 11:48:28 PM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. Error - 9/8/2009 10:31:39 AM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. Error - 9/9/2009 9:50:47 AM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. Error - 9/9/2009 7:39:06 PM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. Error - 9/10/2009 10:24:45 PM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. Error - 9/11/2009 12:31:40 PM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. Error - 9/19/2009 8:58:36 AM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. Error - 9/20/2009 3:08:17 PM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. Error - 9/22/2009 2:20:09 PM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. Error - 9/27/2009 4:59:58 PM | Computer Name = ChrisExner | Source = DigitalPersona Pro | ID = 17827075 Description = Agent cannot start. Description: Found other running Agent. [ Media Center Events ] Error - 4/18/2009 8:53:17 PM | Computer Name = ChrisExner | Source = ehRecvr | ID = 4 Description = Error - 5/1/2009 3:46:32 AM | Computer Name = ChrisExner | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. [ OSession Events ] Error - 2/27/2009 11:43:37 AM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 112 seconds with 60 seconds of active time. This session ended with a crash. Error - 3/11/2009 9:10:27 PM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 438 seconds with 360 seconds of active time. This session ended with a crash. Error - 3/18/2009 1:28:00 PM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 1859 seconds with 120 seconds of active time. This session ended with a crash. Error - 4/22/2009 7:29:32 PM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 655 seconds with 120 seconds of active time. This session ended with a crash. Error - 4/28/2009 1:38:49 PM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 635 seconds with 60 seconds of active time. This session ended with a crash. Error - 4/28/2009 5:45:07 PM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 641 seconds with 180 seconds of active time. This session ended with a crash. Error - 6/4/2009 10:11:29 PM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2681 seconds with 540 seconds of active time. This session ended with a crash. Error - 6/24/2009 6:59:19 PM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 821 seconds with 780 seconds of active time. This session ended with a crash. Error - 6/24/2009 7:05:08 PM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 326 seconds with 240 seconds of active time. This session ended with a crash. Error - 7/28/2009 5:10:24 PM | Computer Name = ChrisExner | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 638 seconds with 120 seconds of active time. This session ended with a crash. [ System Events ] Error - 10/21/2009 12:59:28 PM | Computer Name = ChrisExner | Source = Service Control Manager | ID = 7031 Description = Error - 10/21/2009 12:59:28 PM | Computer Name = ChrisExner | Source = Service Control Manager | ID = 7034 Description = Error - 10/21/2009 12:59:29 PM | Computer Name = ChrisExner | Source = Service Control Manager | ID = 7034 Description = Error - 10/21/2009 12:59:29 PM | Computer Name = ChrisExner | Source = Service Control Manager | ID = 7034 Description = Error - 10/21/2009 12:59:29 PM | Computer Name = ChrisExner | Source = Service Control Manager | ID = 7034 Description = Error - 10/21/2009 12:59:30 PM | Computer Name = ChrisExner | Source = Service Control Manager | ID = 7034 Description = Error - 10/21/2009 1:12:34 PM | Computer Name = ChrisExner | Source = Service Control Manager | ID = 7000 Description = Error - 10/21/2009 1:12:34 PM | Computer Name = ChrisExner | Source = Service Control Manager | ID = 7001 Description = Error - 10/21/2009 1:12:55 PM | Computer Name = ChrisExner | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20 Description = Error - 10/21/2009 1:28:54 PM | Computer Name = ChrisExner | Source = Microsoft-Windows-LanguagePackSetup | ID = 1003 Description = < End of report > OTL logfile created on: 10/21/2009 11:42:21 AM - Run 1 OTL by OldTimer - Version 3.0.21.0 Folder = C:\Users\Chris\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18828) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 86.57% Memory free 4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 286.10 Gb Total Space | 121.85 Gb Free Space | 42.59% Space Free | Partition Type: NTFS Drive D: | 11.99 Gb Total Space | 1.62 Gb Free Space | 13.51% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: CHRISEXNER Current User Name: Chris Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2009/10/21 11:41:21 | 00,521,216 | ---- | M] (OldTimer Tools) -- C:\Users\Chris\Downloads\OTL.exe PRC - [2009/09/23 13:38:18 | 00,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009/09/11 10:43:26 | 00,908,280 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009/08/28 19:42:54 | 00,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe PRC - [2009/08/20 13:34:04 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe PRC - [2009/07/30 09:29:42 | 00,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe PRC - [2009/04/11 00:28:15 | 00,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\wmiprvse.exe PRC - [2009/04/11 00:28:08 | 00,037,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\unsecapp.exe PRC - [2009/04/11 00:27:36 | 02,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\Explorer.EXE PRC - [2009/04/11 00:27:20 | 00,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\AUDIODG.EXE PRC - [2009/01/26 15:31:10 | 01,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe PRC - [2008/12/04 02:42:00 | 00,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvvsvc.exe PRC - [2008/09/16 12:03:18 | 00,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe PRC - [2008/04/24 03:32:30 | 00,598,016 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe PRC - [2008/03/28 02:06:00 | 00,095,528 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe PRC - [2008/03/28 02:05:00 | 01,045,800 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe PRC - [2008/01/20 20:24:43 | 00,275,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mcbuilder.exe PRC - [2008/01/20 20:24:39 | 00,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskmgr.exe PRC - [2007/10/18 06:37:04 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\DRIVERS\xaudio.exe PRC - [2007/09/19 15:31:34 | 00,202,032 | ---- | M] ( Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe PRC - [2006/12/19 10:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\Windows\System32\IoctlSvc.exe ========== Win32 Services (SafeList) ========== SRV - File not found -- -- (RoxLiveShare9 [Disabled | Stopped]) SRV - [2009/09/23 13:38:18 | 00,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0 [Auto | Running]) SRV - [2009/09/21 16:36:02 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Stopped]) SRV - [2009/08/28 19:42:54 | 00,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running]) SRV - [2009/08/20 13:34:04 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService [Auto | Running]) SRV - [2009/07/30 09:29:42 | 00,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe -- (TeamViewer4 [Auto | Running]) SRV - [2009/07/03 15:56:14 | 00,303,376 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe -- (AVP [Auto | Running]) SRV - [2009/05/10 09:37:03 | 00,651,720 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [Disabled | Stopped]) SRV - [2009/04/11 00:28:25 | 01,017,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wevtsvc.dll -- (Eventlog [Auto | Running]) SRV - [2009/03/30 16:28:36 | 01,533,808 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc [Disabled | Stopped]) SRV - [2009/03/29 22:42:14 | 00,066,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2009/02/18 12:39:20 | 00,043,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [Disabled | Stopped]) SRV - [2009/02/18 12:38:43 | 00,129,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - [2009/02/18 12:38:42 | 00,879,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - [2009/01/26 15:31:10 | 01,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService [Auto | Running]) SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running]) SRV - [2008/12/04 02:42:00 | 00,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvvsvc.exe -- (nvsvc [Auto | Running]) SRV - [2008/11/04 01:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped]) SRV - [2008/09/16 12:03:18 | 00,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0 [Auto | Running]) SRV - [2008/04/24 03:32:30 | 00,598,016 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM) [Auto | Running]) SRV - [2008/04/24 03:31:54 | 00,176,128 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp [Disabled | Stopped]) SRV - [2008/01/20 20:25:33 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc [Disabled | Stopped]) SRV - [2008/01/20 20:25:09 | 00,292,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehRecvr.exe -- (ehRecvr [Disabled | Stopped]) SRV - [2008/01/20 20:23:32 | 00,272,952 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend [Disabled | Stopped]) SRV - [2007/10/18 06:37:04 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\DRIVERS\xaudio.exe -- (XAudioService [Auto | Running]) SRV - [2007/09/20 12:02:58 | 00,299,008 | ---- | M] (DigitalPersona, Inc.) -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost [Disabled | Stopped]) SRV - [2007/09/19 17:30:52 | 00,065,536 | ---- | M] (Hewlett-Packard) -- c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe -- (HP Health Check Service [Disabled | Stopped]) SRV - [2007/05/31 09:21:24 | 00,379,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm [Disabled | Stopped]) SRV - [2007/05/31 09:21:18 | 00,183,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr [Disabled | Stopped]) SRV - [2007/03/11 22:02:52 | 00,131,072 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc [Auto | Running]) SRV - [2007/03/11 21:24:50 | 00,217,088 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08 [Disabled | Stopped]) SRV - [2007/03/05 11:30:06 | 00,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb [On_Demand | Stopped]) SRV - [2006/12/19 10:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\Windows\System32\IoctlSvc.exe -- (PLFlash DeviceIoControl Service [Auto | Running]) SRV - [2006/11/08 16:35:38 | 00,053,248 | ---- | M] (Hewlett-Packard) -- C:\Windows\System32\HPZipm12.dll -- (Pml Driver HPZ12 [Disabled | Stopped]) SRV - [2006/11/08 16:35:36 | 00,043,520 | ---- | M] (Hewlett-Packard) -- C:\Windows\System32\HPZinw12.dll -- (Net Driver HPZ12 [Auto | Running]) SRV - [2006/11/02 06:35:29 | 00,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched [Disabled | Stopped]) SRV - [2006/11/02 06:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart [Disabled | Stopped]) SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2006/05/02 16:41:28 | 00,135,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe -- (hpqwmiex [Disabled | Stopped]) SRV - [2004/10/22 04:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped]) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default = CD 33 74 A1 84 40 1F 4A 9A 6E C3 33 24 F2 32 FC [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "chrome://jumpstart/content/tabView.xul" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1 FF - prefs.js..extensions.enabledItems: {ee56ecf0-6e7a-479a-8162-e123a991c7e7}:0.4.4 FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.5 FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe41}:1.0.9 FF - prefs.js..extensions.enabledItems: {77b819fa-95ad-4f2c-ac7c-486b356188a9}:1.5.20090525 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}:6.0.06 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:0.0.0 FF - prefs.js..extensions.enabledItems: jumpstart@mihailo.lalevic:0.5a3.4 FF - prefs.js..extensions.enabledItems: {61D0D7AF-4FF6-476a-B68F-6531F613A6D8}:0.2.2 FF - prefs.js..extensions.enabledItems: en-US@dictionaries.addons.mozilla.org:4.0.0 FF - prefs.js..extensions.enabledItems: {b41cb5f0-2e52-11de-8c30-0800200c9a66}:1.3.2 FF - prefs.js..extensions.enabledItems: chromifox@altmusictv.com:1.1.3 FF - prefs.js..extensions.enabledItems: {D46E8522-6E86-44b1-A622-58C0668AD78E}:3.2.2 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.3 FF - prefs.js..extensions.enabledItems: {de5809e0-2b07-11dd-bd0b-0800200c9a66}:1.1.0 FF - prefs.js..extensions.enabledItems: {748c4950-24f2-11de-8c30-0800200c9a66}:1.4.12 FF - prefs.js..extensions.enabledItems: {7cc7c81a-dfac-4013-ac95-02ee389ae7e7}:1.0 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/06/23 17:02:38 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/10/15 07:40:08 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/10/15 07:40:08 | 00,000,000 | ---D | M] [2008/06/07 15:20:28 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Extensions [2008/06/07 15:20:28 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/10/21 10:33:32 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions [2009/10/12 11:29:01 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe41} [2009/10/12 11:29:01 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{61D0D7AF-4FF6-476a-B68F-6531F613A6D8} [2009/10/10 08:29:59 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{748c4950-24f2-11de-8c30-0800200c9a66} [2009/07/05 08:20:24 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9} [2009/10/10 08:34:24 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{7cc7c81a-dfac-4013-ac95-02ee389ae7e7} [2009/10/10 08:29:44 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{b41cb5f0-2e52-11de-8c30-0800200c9a66} [2009/08/29 08:38:58 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009/10/10 08:35:28 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{D46E8522-6E86-44b1-A622-58C0668AD78E} [2009/09/26 10:33:22 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [2009/10/07 22:17:31 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{de5809e0-2b07-11dd-bd0b-0800200c9a66} [2009/10/10 08:19:00 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{ee56ecf0-6e7a-479a-8162-e123a991c7e7} [2009/09/11 15:33:49 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\chromifox@altmusictv.com [2009/10/02 14:38:13 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\en-US@dictionaries.addons.mozilla.org [2009/10/18 20:50:35 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\firecookie@janodvarko.cz [2009/07/07 17:14:13 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\jumpstart@mihailo.lalevic [2009/10/10 08:35:36 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\dba6e0bj.default\extensions\{D46E8522-6E86-44b1-A622-58C0668AD78E}\chrome\mozapps\extensions [2009/10/14 10:14:05 | 00,002,447 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\dba6e0bj.default\searchplugins\album-cover-artorg.xml [2009/10/14 10:13:55 | 00,001,696 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\dba6e0bj.default\searchplugins\bing--google.xml [2009/10/14 10:11:30 | 00,000,921 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\dba6e0bj.default\searchplugins\dictionarycom.xml [2009/10/14 10:13:08 | 00,003,138 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\dba6e0bj.default\searchplugins\ebay-search-suggest.xml [2009/10/21 10:33:34 | 00,004,868 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\dba6e0bj.default\searchplugins\isohunt---bt-search.xml [2009/10/14 10:12:32 | 00,001,042 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\dba6e0bj.default\searchplugins\wikipedia-eng.xml [2009/10/14 10:12:07 | 00,004,153 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\dba6e0bj.default\searchplugins\youtube.xml [2009/10/21 10:33:32 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009/09/11 10:43:32 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2008/11/15 15:50:54 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [2008/06/08 03:50:55 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} [2008/07/08 21:32:48 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [2009/03/07 19:06:23 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} [2009/03/28 10:27:54 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009/08/05 18:03:01 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2009/09/11 10:43:25 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/09/11 10:43:25 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2008/11/04 10:15:38 | 00,114,688 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\np32dsw.dll [2009/07/25 05:23:01 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll [2009/09/11 10:43:27 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll [2006/10/26 20:12:16 | 00,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2009/10/02 23:13:10 | 00,095,600 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2009/09/09 22:40:22 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2009/09/09 22:40:23 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2009/09/09 22:40:23 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2009/09/09 22:40:23 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2009/09/09 22:40:24 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2009/09/09 22:40:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2009/09/09 22:40:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2009/06/30 09:36:36 | 00,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml [2009/06/30 09:36:36 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/06/30 09:36:36 | 00,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml [2009/06/30 09:36:36 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/06/30 09:36:36 | 00,000,769 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml [2009/06/30 09:36:36 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/06/30 09:36:36 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/06/30 09:36:36 | 00,000,831 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml O1 HOSTS File: (344090 bytes) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 11797 more lines... O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found. O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab) O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. O4 - HKLM..\Run: [avp] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [QlbCtrl] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe ( Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) O4 - HKCU..\Run: [Lsass Service] C:\Users\Chris\AppData\Roaming\Microsoft\Windows\lsass.exe File not found O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm () O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\napinsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\wshbth.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\nvLsp.dll (NVIDIA) O13 - gopher Prefix: missing O15 - HKLM\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4.../OGAControl.cab (Office Genuine Advantage Validation Tool) O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_02) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo...NPUplden-ca.cab (Windows Live Hotmail Photo Upload Tool) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.59.176.13 64.59.176.15 64.59.177.226 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\Kaspersky) - File not found O20 - AppInit_DLLs: (Internet) - File not found O20 - AppInit_DLLs: (Security) - C:\Windows\System32\Security.dll (Microsoft Corporation) O20 - AppInit_DLLs: (2010\mzvkbd.dll) - File not found O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\Kaspersky) - File not found O20 - AppInit_DLLs: (Internet) - File not found O20 - AppInit_DLLs: (Security) - C:\Windows\System32\Security.dll (Microsoft Corporation) O20 - AppInit_DLLs: (2010\mzvkbd3.dll) - File not found O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\Kaspersky) - File not found O20 - AppInit_DLLs: (Internet) - File not found O20 - AppInit_DLLs: (Security) - C:\Windows\System32\Security.dll (Microsoft Corporation) O20 - AppInit_DLLs: (2010\kloehk.dll) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008/03/10 11:32:10 | 00,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2005/09/11 09:18:54 | 00,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ] O33 - MountPoints2\{a7175f3c-4eca-11de-bffd-001e37e33656}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found O35 - comfile [open] -- "%1" %* File not found O35 - exefile [open] -- "%1" %* File not found NetSvcs: FastUserSwitchingCompatibility - Service key not found. File not found NetSvcs: Ias - Service key not found. File not found NetSvcs: Irmon - Service key not found. File not found NetSvcs: Nla - Service key not found. File not found NetSvcs: Ntmssvc - Service key not found. File not found NetSvcs: NWCWorkstation - Service key not found. File not found NetSvcs: Nwsapagent - Service key not found. File not found NetSvcs: SRService - Service key not found. File not found NetSvcs: Wmi - Service key not found. File not found NetSvcs: WmdmPmSp - Service key not found. File not found NetSvcs: LogonHours - Service key not found. File not found NetSvcs: PCAudit - Service key not found. File not found NetSvcs: helpsvc - Service key not found. File not found NetSvcs: uploadmgr - Service key not found. File not found ========== Files/Folders - Created Within 14 Days ========== [2009/10/15 08:07:34 | 00,000,000 | ---D | C] -- C:\ProgramData\Research In Motion [2009/10/12 16:41:46 | 00,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\BOXEE [2009/10/17 19:44:11 | 00,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\NeroDigital™ [2009/10/15 11:25:43 | 00,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Geckofx [2009/10/15 14:02:20 | 00,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\HandBrake [2009/10/21 09:28:48 | 00,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Temp(183) [2009/10/17 13:05:03 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\LightScribe [2009/10/15 11:25:01 | 00,000,000 | ---D | C] -- C:\Program Files\AviSynth 2.5 [2009/10/12 16:40:55 | 00,000,000 | ---D | C] -- C:\Program Files\Boxee [2009/10/21 11:20:48 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT [2009/10/15 13:58:07 | 00,000,000 | ---D | C] -- C:\Program Files\HandBrake [2009/10/20 10:02:16 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/10/20 10:02:16 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware(141) [2009/10/15 11:24:53 | 00,000,000 | ---D | C] -- C:\Program Files\Red Kawa [2009/10/21 09:49:08 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2009/10/21 11:21:32 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT [2009/10/21 09:28:48 | 00,000,000 | ---D | C] -- C:\Windows\temp [2009/10/21 09:07:06 | 00,000,000 | ---D | C] -- C:\Qoobox [2009/10/20 10:02:29 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/10/20 10:02:17 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2009/10/15 09:00:47 | 00,027,136 | ---- | C] (Research in Motion Ltd) -- C:\Windows\System32\drivers\RimSerial.sys ========== Files - Modified Within 14 Days ========== [2009/10/21 11:32:47 | 00,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{6B2AA5CB-1F5D-4047-A920-7AACE8C34729}.job [2009/10/21 11:20:49 | 00,000,674 | ---- | M] () -- C:\Users\Chris\Desktop\ERUNT.lnk [2009/10/21 11:13:30 | 00,103,491 | ---- | M] () -- C:\ProgramData\nvModes.dat [2009/10/21 11:13:30 | 00,103,491 | ---- | M] () -- C:\ProgramData\nvModes.001 [2009/10/21 11:11:41 | 00,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2009/10/21 11:11:40 | 00,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2009/10/21 11:11:29 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2009/10/21 11:11:25 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2009/10/21 11:10:45 | 31,529,61536 | -HS- | M] () -- C:\hiberfil.sys [2009/10/21 10:33:55 | 02,975,418 | -H-- | M] () -- C:\Users\Chris\AppData\Local\IconCache.db [2009/10/20 12:26:13 | 00,000,472 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job [2009/10/19 16:27:22 | 01,478,638 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2009/10/19 16:27:22 | 00,675,284 | ---- | M] () -- C:\Windows\System32\perfh00C.dat [2009/10/19 16:27:22 | 00,603,282 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2009/10/19 16:27:22 | 00,128,422 | ---- | M] () -- C:\Windows\System32\perfc00C.dat [2009/10/19 16:27:22 | 00,106,696 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2009/10/18 21:46:48 | 00,344,090 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts [2009/10/17 13:41:51 | 00,000,231 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\default.rss [2009/10/17 13:37:59 | 00,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2009/10/16 01:25:47 | 00,006,944 | ---- | M] () -- C:\Users\Chris\AppData\Local\d3d9caps.dat [2009/10/15 10:23:52 | 00,000,256 | ---- | M] () -- C:\Windows\System32\pool.bin [2009/10/15 10:21:15 | 00,020,502 | ---- | M] () -- C:\Users\Chris\Documents\Contacts.CSV [2009/10/15 10:21:13 | 00,038,431 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Comma Separated Values (Windows).ADR [2009/10/15 09:24:19 | 00,115,704 | ---- | M] () -- C:\Users\Chris\AppData\Local\GDIPFONTCACHEV1.DAT [2009/10/15 09:24:18 | 00,000,363 | ---- | M] () -- C:\Windows\win.ini [2009/10/15 09:20:01 | 00,446,472 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2009/10/14 07:58:35 | 00,108,059 | ---- | M] () -- C:\Windows\System32\drivers\klin.dat [2009/10/14 07:58:35 | 00,095,259 | ---- | M] () -- C:\Windows\System32\drivers\klick.dat [2009/10/07 22:29:01 | 00,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat ========== Files - No Company Name ========== [2009/10/21 11:20:49 | 00,000,674 | ---- | C] () -- C:\Users\Chris\Desktop\ERUNT.lnk [2009/10/17 15:23:12 | 00,774,144 | ---- | C] () -- C:\Windows\System32\NEROINSTAEC43759.DB [2009/10/17 13:26:06 | 00,000,231 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\default.rss [2009/10/15 10:21:13 | 00,038,431 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\Comma Separated Values (Windows).ADR [2009/10/15 10:21:08 | 00,020,502 | ---- | C] () -- C:\Users\Chris\Documents\Contacts.CSV [2009/09/26 17:28:57 | 00,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009/08/02 08:07:22 | 02,975,418 | -H-- | C] () -- C:\Users\Chris\AppData\Local\IconCache.db [2009/07/27 21:53:36 | 00,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009/07/26 22:47:18 | 00,000,400 | ---- | C] () -- C:\Users\Chris\AppData\Local\RAExpertHistory.xml [2009/02/24 13:13:15 | 00,048,586 | ---- | C] () -- C:\ProgramData\xpif-v02030a.dtd [2009/02/23 17:14:01 | 00,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2009/01/07 19:16:18 | 00,103,491 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009/01/07 19:16:18 | 00,103,491 | ---- | C] () -- C:\ProgramData\nvModes.001 [2008/12/06 08:52:27 | 00,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2008/10/10 19:47:26 | 00,000,006 | -HS- | C] () -- C:\Users\Chris\AppData\Roaming\desktop.ini [2008/10/10 19:47:26 | 00,000,006 | -HS- | C] () -- C:\Users\Chris\AppData\Local\desktop.ini [2008/10/07 21:15:42 | 00,030,920 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\UserTile.png [2008/08/10 22:00:35 | 00,006,944 | ---- | C] () -- C:\Users\Chris\AppData\Local\d3d9caps.dat [2008/07/01 17:46:04 | 00,000,000 | ---- | C] () -- C:\Windows\Irremote.ini [2008/07/01 10:21:14 | 00,110,415 | ---- | C] () -- C:\ProgramData\BM479a1adf.xml [2008/07/01 10:21:14 | 00,103,318 | ---- | C] () -- C:\ProgramData\BM479a1adf.txt [2008/07/01 10:21:14 | 00,000,022 | ---- | C] () -- C:\ProgramData\pskt.ini [2008/06/21 18:11:57 | 00,524,288 | -HS- | C] () -- C:\ProgramData\ntuser.dat{3af34bc2-3fe3-11dd-8c5d-001e6848a838}.TMContainer00000000000000000002.regtrans-ms [2008/06/21 18:11:57 | 00,262,144 | ---- | C] () -- C:\ProgramData\ntuser.dat [2008/06/21 18:11:57 | 00,065,536 | -HS- | C] () -- C:\ProgramData\ntuser.dat{3af34bc2-3fe3-11dd-8c5d-001e6848a838}.TM.blf [2008/06/21 18:11:57 | 00,005,120 | -H-- | C] () -- C:\ProgramData\ntuser.dat.LOG1 [2008/06/21 18:11:57 | 00,000,000 | -H-- | C] () -- C:\ProgramData\ntuser.dat.LOG2 [2008/06/09 19:54:08 | 00,000,152 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\wklnhst.dat [2008/06/08 09:33:46 | 00,000,000 | ---- | C] () -- C:\Users\Chris\AppData\Local\FnF4.txt [2008/06/07 16:06:36 | 00,194,560 | ---- | C] () -- C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/06/07 16:05:24 | 00,103,491 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\nvModes.001 [2008/06/07 16:04:13 | 00,103,491 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\nvModes.dat [2008/06/07 14:48:39 | 00,000,000 | ---- | C] () -- C:\Users\Chris\AppData\Local\QSwitch.txt [2008/06/07 14:48:39 | 00,000,000 | ---- | C] () -- C:\Users\Chris\AppData\Local\DSwitch.txt [2008/06/07 14:48:39 | 00,000,000 | ---- | C] () -- C:\Users\Chris\AppData\Local\AtStart.txt [2008/06/07 14:48:30 | 00,115,704 | ---- | C] () -- C:\Users\Chris\AppData\Local\GDIPFONTCACHEV1.DAT [2008/06/07 14:30:38 | 00,007,043 | ---- | C] () -- C:\ProgramData\hpzinstall.log [2008/04/11 19:22:28 | 00,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll [2008/02/04 18:23:10 | 00,693,792 | ---- | C] () -- C:\Windows\System32\OGACheckControl.DLL [2007/09/05 13:52:04 | 00,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll [2006/11/02 06:50:50 | 00,000,174 | -HS- | C] () -- C:\Program Files\desktop.ini [2006/11/02 06:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 04:23:31 | 00,000,363 | ---- | C] () -- C:\Windows\win.ini [2006/11/02 04:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\system.ini [2006/11/02 01:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006/03/09 03:58:00 | 01,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2001/11/14 14:56:00 | 01,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll ========== LOP Check ========== [2009/10/21 09:21:55 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming [2008/11/16 13:56:21 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Blackberry Desktop [2009/10/12 16:41:46 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\BOXEE [2009/09/27 12:40:19 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\CyberLink [2008/06/07 14:48:13 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\DigitalPersona [2009/01/31 19:00:56 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\GetRightToGo [2009/10/15 07:40:23 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\ICAClient [2008/12/06 10:20:23 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\LimeWire [2008/06/07 14:26:44 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Macrovision [2006/11/02 06:37:34 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Media Center Programs [2008/07/03 20:15:20 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\muvee Technologies [2009/09/29 21:13:59 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\NCH Software [2009/09/29 17:10:24 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\NCH Swift Sound [2009/09/08 09:25:34 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Opera [2009/10/15 09:27:21 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Research In Motion [2008/10/10 20:17:41 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Roxio [2009/07/27 18:01:15 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\TeamViewer [2008/06/09 19:54:18 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Template [2008/07/16 20:35:06 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Thunderbird [2009/10/04 13:43:29 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\uniblue [2009/10/21 10:38:56 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\uTorrent [2009/03/04 17:24:04 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Wallpapers [2009/02/24 15:15:51 | 00,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Xerox [2009/10/20 12:26:13 | 00,000,472 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job [2009/10/21 11:11:29 | 00,000,006 | -H-- | M] () -- C:\Windows\Tasks\SA.DAT [2009/10/21 11:00:24 | 00,032,592 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2009/10/21 11:32:47 | 00,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{6B2AA5CB-1F5D-4047-A920-7AACE8C34729}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < %systemroot%\system32\eventlog.dll > < %systemroot%\system32\scecli.dll > [2009/04/11 00:28:24 | 00,177,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\scecli.dll < %systemroot%\netlogon.dll > < %systemroot%\system32\cngaudit.dll > [2006/11/02 03:46:03 | 00,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cngaudit.dll < %systemroot%\system32\sceclt.dll > < %systemroot%\ntelogon.dll > < %systemroot%\system32\logevent.dll > ========== Alternate Data Streams ========== @Alternate Data Stream - 76 bytes -> C:\Users\Chris\Documents\Travis Robin MC Program.doc:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Chris\Documents\Reparis.xls:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Chris\Documents\LExner Resume 080831.doc:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Chris\Documents\LExner Refrences 080831.doc:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Chris\Documents\Chris Exner - Process.doc:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Chris\Documents\auto lease deductions.pdf:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Chris\Documents\Amy Letter.doc:Roxio EMC Stream @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:1CFFB598 < End of report > ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/10/21 11:40 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP2 ================================================== Drivers ------------------- Name: 1394BUS.SYS Image Path: C:\Windows\system32\DRIVERS\1394BUS.SYS Address: 0x9269D000 Size: 57344 File Visible: - Signed: - Status: - Name: acpi.sys Image Path: C:\Windows\system32\drivers\acpi.sys Address: 0x8060A000 Size: 286720 File Visible: - Signed: - Status: - Name: ACPI_HAL Image Path: \Driver\ACPI_HAL Address: 0x82E07000 Size: 3903488 File Visible: - Signed: - Status: - Name: afd.sys Image Path: C:\Windows\system32\drivers\afd.sys Address: 0x9952B000 Size: 294912 File Visible: - Signed: - Status: - Name: amdk8.sys Image Path: C:\Windows\system32\DRIVERS\amdk8.sys Address: 0x83B10000 Size: 65536 File Visible: - Signed: - Status: - Name: atapi.sys Image Path: C:\Windows\system32\drivers\atapi.sys Address: 0x80722000 Size: 32768 File Visible: - Signed: - Status: - Name: ataport.SYS Image Path: C:\Windows\system32\drivers\ataport.SYS Address: 0x8072A000 Size: 122880 File Visible: - Signed: - Status: - Name: ATMFD.DLL Image Path: C:\Windows\System32\ATMFD.DLL Address: 0xA2AC0000 Size: 311296 File Visible: - Signed: - Status: - Name: ATSwpDrv.sys Image Path: C:\Windows\system32\DRIVERS\ATSwpDrv.sys Address: 0x94ACF000 Size: 139904 File Visible: - Signed: - Status: - Name: BATTC.SYS Image Path: C:\Windows\system32\DRIVERS\BATTC.SYS Address: 0x8069A000 Size: 40960 File Visible: - Signed: - Status: - Name: bcmwl6.sys Image Path: C:\Windows\system32\DRIVERS\bcmwl6.sys Address: 0x92A00000 Size: 1343488 File Visible: - Signed: - Status: - Name: Beep.SYS Image Path: C:\Windows\System32\Drivers\Beep.SYS Address: 0x94B3A000 Size: 28672 File Visible: - Signed: - Status: - Name: BOOTVID.dll Image Path: C:\Windows\system32\BOOTVID.dll Address: 0x80420000 Size: 32768 File Visible: - Signed: - Status: - Name: bowser.sys Image Path: C:\Windows\system32\DRIVERS\bowser.sys Address: 0x82492000 Size: 102400 File Visible: - Signed: - Status: - Name: cdd.dll Image Path: C:\Windows\System32\cdd.dll Address: 0xA2AB0000 Size: 57344 File Visible: - Signed: - Status: - Name: cdfs.sys Image Path: C:\Windows\system32\DRIVERS\cdfs.sys Address: 0xAEB04000 Size: 90112 File Visible: - Signed: - Status: - Name: cdrom.sys Image Path: C:\Windows\system32\DRIVERS\cdrom.sys Address: 0x83BA3000 Size: 98304 File Visible: - Signed: - Status: - Name: CHDRT32.sys Image Path: C:\Windows\system32\drivers\CHDRT32.sys Address: 0x94A01000 Size: 208896 File Visible: - Signed: - Status: - Name: CI.dll Image Path: C:\Windows\system32\CI.dll Address: 0x80469000 Size: 917504 File Visible: - Signed: - Status: - Name: CLASSPNP.SYS Image Path: C:\Windows\system32\drivers\CLASSPNP.SYS Address: 0x8AFAB000 Size: 135168 File Visible: - Signed: - Status: - Name: CLFS.SYS Image Path: C:\Windows\system32\CLFS.SYS Address: 0x80428000 Size: 266240 File Visible: - Signed: - Status: - Name: CmBatt.sys Image Path: C:\Windows\system32\DRIVERS\CmBatt.sys Address: 0x83B20000 Size: 14208 File Visible: - Signed: - Status: - Name: compbatt.sys Image Path: C:\Windows\system32\DRIVERS\compbatt.sys Address: 0x80697000 Size: 10496 File Visible: - Signed: - Status: - Name: crashdmp.sys Image Path: C:\Windows\System32\Drivers\crashdmp.sys Address: 0x99A60000 Size: 53248 File Visible: - Signed: - Status: - Name: crcdisk.sys Image Path: C:\Windows\system32\drivers\crcdisk.sys Address: 0x8AFCC000 Size: 36864 File Visible: - Signed: - Status: - Name: dfsc.sys Image Path: C:\Windows\System32\Drivers\dfsc.sys Address: 0x99A49000 Size: 94208 File Visible: - Signed: - Status: - Name: disk.sys Image Path: C:\Windows\system32\drivers\disk.sys Address: 0x8AF9A000 Size: 69632 File Visible: - Signed: - Status: - Name: drmk.sys Image Path: C:\Windows\system32\drivers\drmk.sys Address: 0x94A61000 Size: 151552 File Visible: - Signed: - Status: - Name: dump_atapi.sys Image Path: C:\Windows\System32\Drivers\dump_atapi.sys Address: 0x99A78000 Size: 32768 File Visible: No Signed: - Status: - Name: dump_dumpata.sys Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys Address: 0x99A6D000 Size: 45056 File Visible: No Signed: - Status: - Name: Dxapi.sys Image Path: C:\Windows\System32\drivers\Dxapi.sys Address: 0x99A80000 Size: 40960 File Visible: - Signed: - Status: - Name: dxgkrnl.sys Image Path: C:\Windows\System32\drivers\dxgkrnl.sys Address: 0x93743000 Size: 651264 File Visible: - Signed: - Status: - Name: ecache.sys Image Path: C:\Windows\System32\drivers\ecache.sys Address: 0x8AF73000 Size: 159744 File Visible: - Signed: - Status: - Name: fileinfo.sys Image Path: C:\Windows\system32\drivers\fileinfo.sys Address: 0x8077A000 Size: 65536 File Visible: - Signed: - Status: - Name: fltmgr.sys Image Path: C:\Windows\system32\drivers\fltmgr.sys Address: 0x80748000 Size: 204800 File Visible: - Signed: - Status: - Name: Fs_Rec.SYS Image Path: C:\Windows\System32\Drivers\Fs_Rec.SYS Address: 0x94AF2000 Size: 36864 File Visible: - Signed: - Status: - Name: fwpkclnt.sys Image Path: C:\Windows\System32\drivers\fwpkclnt.sys Address: 0x83AF5000 Size: 110592 File Visible: - Signed: - Status: - Name: GEARAspiWDM.sys Image Path: C:\Windows\System32\Drivers\GEARAspiWDM.sys Address: 0x83BBB000 Size: 21120 File Visible: - Signed: - Status: - Name: hal.dll Image Path: C:\Windows\system32\hal.dll Address: 0x831C0000 Size: 208896 File Visible: - Signed: - Status: - Name: HDAudBus.sys Image Path: C:\Windows\system32\DRIVERS\HDAudBus.sys Address: 0x92600000 Size: 577536 File Visible: - Signed: - Status: - Name: HIDCLASS.SYS Image Path: C:\Windows\system32\DRIVERS\HIDCLASS.SYS Address: 0x83B24000 Size: 65536 File Visible: - Signed: - Status: - Name: HIDPARSE.SYS Image Path: C:\Windows\system32\DRIVERS\HIDPARSE.SYS Address: 0x83B34000 Size: 28672 File Visible: - Signed: - Status: - Name: HpqKbFiltr.sys Image Path: C:\Windows\system32\DRIVERS\HpqKbFiltr.sys Address: 0x937EE000 Size: 16768 File Visible: - Signed: - Status: - Name: HpqRemHid.sys Image Path: C:\Windows\system32\DRIVERS\HpqRemHid.sys Address: 0x8AE09000 Size: 7168 File Visible: - Signed: - Status: - Name: HTTP.sys Image Path: C:\Windows\system32\drivers\HTTP.sys Address: 0x8240A000 Size: 438272 File Visible: - Signed: - Status: - Name: i8042prt.sys Image Path: C:\Windows\system32\DRIVERS\i8042prt.sys Address: 0x92B48000 Size: 77824 File Visible: - Signed: - Status: - Name: kbdclass.sys Image Path: C:\Windows\system32\DRIVERS\kbdclass.sys Address: 0x937F3000 Size: 45056 File Visible: - Signed: - Status: - Name: kbdhid.sys Image Path: C:\Windows\system32\DRIVERS\kbdhid.sys Address: 0x927F6000 Size: 36864 File Visible: - Signed: - Status: - Name: kdcom.dll Image Path: C:\Windows\system32\kdcom.dll Address: 0x80408000 Size: 28672 File Visible: - Signed: - Status: - Name: kl1.sys Image Path: C:\Windows\system32\DRIVERS\kl1.sys Address: 0x9900B000 Size: 5373952 File Visible: - Signed: - Status: - Name: klbg.sys Image Path: C:\Windows\system32\drivers\klbg.sys Address: 0x8078A000 Size: 45056 File Visible: - Signed: - Status: - Name: klif.sys Image Path: C:\Windows\system32\DRIVERS\klif.sys Address: 0x94A86000 Size: 299008 File Visible: - Signed: - Status: - Name: klim6.sys Image Path: C:\Windows\system32\DRIVERS\klim6.sys Address: 0x995C4000 Size: 28672 File Visible: - Signed: - Status: - Name: klmouflt.sys Image Path: C:\Windows\system32\DRIVERS\klmouflt.sys Address: 0x92B8B000 Size: 36864 File Visible: - Signed: - Status: - Name: ks.sys Image Path: C:\Windows\system32\DRIVERS\ks.sys Address: 0x83BC1000 Size: 172032 File Visible: - Signed: - Status: - Name: ksecdd.sys Image Path: C:\Windows\System32\Drivers\ksecdd.sys Address: 0x83804000 Size: 462848 File Visible: - Signed: - Status: - Name: lltdio.sys Image Path: C:\Windows\system32\DRIVERS\lltdio.sys Address: 0x99B64000 Size: 65536 File Visible: - Signed: - Status: - Name: luafv.sys Image Path: C:\Windows\system32\drivers\luafv.sys Address: 0x99A99000 Size: 110592 File Visible: - Signed: - Status: - Name: mdmxsdk.sys Image Path: C:\Windows\system32\DRIVERS\mdmxsdk.sys Address: 0x825A6000 Size: 12672 File Visible: - Signed: - Status: - Name: monitor.sys Image Path: C:\Windows\system32\DRIVERS\monitor.sys Address: 0x99A8A000 Size: 61440 File Visible: - Signed: - Status: - Name: mouclass.sys Image Path: C:\Windows\system32\DRIVERS\mouclass.sys Address: 0x92B94000 Size: 45056 File Visible: - Signed: - Status: - Name: mountmgr.sys Image Path: C:\Windows\System32\drivers\mountmgr.sys Address: 0x80712000 Size: 65536 File Visible: - Signed: - Status: - Name: mrxsmb.sys Image Path: C:\Windows\system32\DRIVERS\mrxsmb.sys Address: 0x824AB000 Size: 126976 File Visible: - Signed: - Status: - Name: mrxsmb10.sys Image Path: C:\Windows\system32\DRIVERS\mrxsmb10.sys Address: 0x824CA000 Size: 233472 File Visible: - Signed: - Status: - Name: mrxsmb20.sys Image Path: C:\Windows\system32\DRIVERS\mrxsmb20.sys Address: 0x82503000 Size: 98304 File Visible: - Signed: - Status: - Name: Msfs.SYS Image Path: C:\Windows\System32\Drivers\Msfs.SYS Address: 0x94B7E000 Size: 45056 File Visible: - Signed: - Status: - Name: msisadrv.sys Image Path: C:\Windows\system32\drivers\msisadrv.sys Address: 0x80659000 Size: 32768 File Visible: - Signed: - Status: - Name: msiscsi.sys Image Path: C:\Windows\system32\DRIVERS\msiscsi.sys Address: 0x92B9F000 Size: 192512 File Visible: - Signed: - Status: - Name: msrpc.sys Image Path: C:\Windows\system32\drivers\msrpc.sys Address: 0x83980000 Size: 176128 File Visible: - Signed: - Status: - Name: mssmbios.sys Image Path: C:\Windows\system32\DRIVERS\mssmbios.sys Address: 0x927EC000 Size: 40960 File Visible: - Signed: - Status: - Name: mup.sys Image Path: C:\Windows\System32\Drivers\mup.sys Address: 0x8AF64000 Size: 61440 File Visible: - Signed: - Status: - Name: ndis.sys Image Path: C:\Windows\system32\drivers\ndis.sys Address: 0x83875000 Size: 1093632 File Visible: - Signed: - Status: - Name: ndistapi.sys Image Path: C:\Windows\system32\DRIVERS\ndistapi.sys Address: 0x92BF0000 Size: 45056 File Visible: - Signed: - Status: - Name: ndisuio.sys Image Path: C:\Windows\system32\DRIVERS\ndisuio.sys Address: 0x99B9E000 Size: 40960 File Visible: - Signed: - Status: - Name: ndiswan.sys Image Path: C:\Windows\system32\DRIVERS\ndiswan.sys Address: 0x9277A000 Size: 143360 File Visible: - Signed: - Status: - Name: NDProxy.SYS Image Path: C:\Windows\System32\Drivers\NDProxy.SYS Address: 0x839E6000 Size: 69632 File Visible: - Signed: - Status: - Name: netbios.sys Image Path: C:\Windows\system32\DRIVERS\netbios.sys Address: 0x995CB000 Size: 57344 File Visible: - Signed: - Status: - Name: netbt.sys Image Path: C:\Windows\System32\DRIVERS\netbt.sys Address: 0x99573000 Size: 204800 File Visible: - Signed: - Status: - Name: NETIO.SYS Image Path: C:\Windows\system32\drivers\NETIO.SYS Address: 0x839AB000 Size: 241664 File Visible: - Signed: - Status: - Name: Npfs.SYS Image Path: C:\Windows\System32\Drivers\Npfs.SYS Address: 0x94B89000 Size: 57344 File Visible: - Signed: - Status: - Name: nsiproxy.sys Image Path: C:\Windows\system32\drivers\nsiproxy.sys Address: 0x99A3F000 Size: 40960 File Visible: - Signed: - Status: - Name: Ntfs.sys Image Path: C:\Windows\System32\Drivers\Ntfs.sys Address: 0x8AE0B000 Size: 1114112 File Visible: - Signed: - Status: - Name: ntkrnlpa.exe Image Path: C:\Windows\system32\ntkrnlpa.exe Address: 0x82E07000 Size: 3903488 File Visible: - Signed: - Status: - Name: Null.SYS Image Path: C:\Windows\System32\Drivers\Null.SYS Address: 0x94B33000 Size: 28672 File Visible: - Signed: - Status: - Name: nvlddmkm.sys Image Path: C:\Windows\system32\DRIVERS\nvlddmkm.sys Address: 0x93001000 Size: 7606688 File Visible: - Signed: - Status: - Name: nvsmu.sys Image Path: C:\Windows\system32\DRIVERS\nvsmu.sys Address: 0x83B44000 Size: 32768 File Visible: - Signed: - Status: - Name: nwifi.sys Image Path: C:\Windows\system32\DRIVERS\nwifi.sys Address: 0x99B74000 Size: 172032 File Visible: - Signed: - Status: - Name: ohci1394.sys Image Path: C:\Windows\system32\DRIVERS\ohci1394.sys Address: 0x9268D000 Size: 62208 File Visible: - Signed: - Status: - Name: pacer.sys Image Path: C:\Windows\system32\DRIVERS\pacer.sys Address: 0x995AE000 Size: 90112 File Visible: - Signed: - Status: - Name: partmgr.sys Image Path: C:\Windows\System32\drivers\partmgr.sys Address: 0x80688000 Size: 61440 File Visible: - Signed: - Status: - Name: pci.sys Image Path: C:\Windows\system32\drivers\pci.sys Address: 0x80661000 Size: 159744 File Visible: - Signed: - Status: - Name: pciide.sys Image Path: C:\Windows\system32\drivers\pciide.sys Address: 0x806FD000 Size: 28672 File Visible: - Signed: - Status: - Name: PCIIDEX.SYS Image Path: C:\Windows\system32\drivers\PCIIDEX.SYS Address: 0x80704000 Size: 57344 File Visible: - Signed: - Status: - Name: peauth.sys Image Path: C:\Windows\system32\drivers\peauth.sys Address: 0xAEA08000 Size: 909312 File Visible: - Signed: - Status: - Name: PnpManager Image Path: \Driver\PnpManager Address: 0x82E07000 Size: 3903488 File Visible: - Signed: - Status: - Name: portcls.sys Image Path: C:\Windows\system32\drivers\portcls.sys Address: 0x94A34000 Size: 184320 File Visible: - Signed: - Status: - Name: PSHED.dll Image Path: C:\Windows\system32\PSHED.dll Address: 0x8040F000 Size: 69632 File Visible: - Signed: - Status: - Name: PxHelp20.sys Image Path: C:\Windows\System32\Drivers\PxHelp20.sys Address: 0x80795000 Size: 35712 File Visible: - Signed: - Status: - Name: rasacd.sys Image Path: C:\Windows\System32\DRIVERS\rasacd.sys Address: 0x94B97000 Size: 36864 File Visible: - Signed: - Status: - Name: rasl2tp.sys Image Path: C:\Windows\system32\DRIVERS\rasl2tp.sys Address: 0x92BD9000 Size: 94208 File Visible: - Signed: - Status: - Name: raspppoe.sys Image Path: C:\Windows\system32\DRIVERS\raspppoe.sys Address: 0x9279D000 Size: 61440 File Visible: - Signed: - Status: - Name: raspptp.sys Image Path: C:\Windows\system32\DRIVERS\raspptp.sys Address: 0x927AC000 Size: 81920 File Visible: - Signed: - Status: - Name: rassstp.sys Image Path: C:\Windows\system32\DRIVERS\rassstp.sys Address: 0x927C0000 Size: 86016 File Visible: - Signed: - Status: - Name: RAW Image Path: \FileSystem\RAW Address: 0x82E07000 Size: 3903488 File Visible: - Signed: - Status: - Name: rdbss.sys Image Path: C:\Windows\system32\DRIVERS\rdbss.sys Address: 0x99A03000 Size: 245760 File Visible: - Signed: - Status: - Name: RDPCDD.sys Image Path: C:\Windows\System32\DRIVERS\RDPCDD.sys Address: 0x94B6E000 Size: 32768 File Visible: - Signed: - Status: - Name: rdpencdd.sys Image Path: C:\Windows\system32\drivers\rdpencdd.sys Address: 0x94B76000 Size: 32768 File Visible: - Signed: - Status: - Name: rimmptsk.sys Image Path: C:\Windows\system32\DRIVERS\rimmptsk.sys Address: 0x926C5000 Size: 61440 File Visible: - Signed: - Status: - Name: RimSerial.sys Image Path: C:\Windows\system32\DRIVERS\RimSerial.sys Address: 0x927D5000 Size: 27136 File Visible: - Signed: - Status: - Name: rimsptsk.sys Image Path: C:\Windows\system32\DRIVERS\rimsptsk.sys Address: 0x926D4000 Size: 81920 File Visible: - Signed: - Status: - Name: rixdptsk.sys Image Path: C:\Windows\system32\DRIVERS\rixdptsk.sys Address: 0x926E8000 Size: 331776 File Visible: - Signed: - Status: - Name: rootrepeal.sys Image Path: C:\Windows\system32\drivers\rootrepeal.sys Address: 0xAEB22000 Size: 49152 File Visible: No Signed: - Status: - Name: rspndr.sys Image Path: C:\Windows\system32\DRIVERS\rspndr.sys Address: 0x99BA8000 Size: 77824 File Visible: - Signed: - Status: - Name: sdbus.sys Image Path: C:\Windows\system32\DRIVERS\sdbus.sys Address: 0x926AB000 Size: 106496 File Visible: - Signed: - Status: - Name: secdrv.SYS Image Path: C:\Windows\System32\Drivers\secdrv.SYS Address: 0xAEAE6000 Size: 40960 File Visible: - Signed: - Status: - Name: smb.sys Image Path: C:\Windows\system32\DRIVERS\smb.sys Address: 0x94BB6000 Size: 81920 File Visible: - Signed: - Status: - Name: spldr.sys Image Path: C:\Windows\System32\Drivers\spldr.sys Address: 0x8AF5C000 Size: 32768 File Visible: - Signed: - Status: - Name: spsys.sys Image Path: C:\Windows\system32\drivers\spsys.sys Address: 0x99AB4000 Size: 720896 File Visible: - Signed: - Status: - Name: srv.sys Image Path: C:\Windows\System32\DRIVERS\srv.sys Address: 0x82542000 Size: 311296 File Visible: - Signed: - Status: - Name: srv2.sys Image Path: C:\Windows\System32\DRIVERS\srv2.sys Address: 0x8251B000 Size: 159744 File Visible: - Signed: - Status: - Name: srvnet.sys Image Path: C:\Windows\System32\DRIVERS\srvnet.sys Address: 0x82475000 Size: 118784 File Visible: - Signed: - Status: - Name: storport.sys Image Path: C:\Windows\system32\DRIVERS\storport.sys Address: 0x92739000 Size: 266240 File Visible: - Signed: - Status: - Name: swenum.sys Image Path: C:\Windows\system32\DRIVERS\swenum.sys Address: 0x92BFB000 Size: 4992 File Visible: - Signed: - Status: - Name: SynTP.sys Image Path: C:\Windows\system32\DRIVERS\SynTP.sys Address: 0x92B5B000 Size: 192768 File Visible: - Signed: - Status: - Name: tcpip.sys Image Path: C:\Windows\System32\drivers\tcpip.sys Address: 0x83A0B000 Size: 958464 File Visible: - Signed: - Status: - Name: tcpipreg.sys Image Path: C:\Windows\System32\drivers\tcpipreg.sys Address: 0xAEAF0000 Size: 49152 File Visible: - Signed: - Status: - Name: TDI.SYS Image Path: C:\Windows\system32\DRIVERS\TDI.SYS Address: 0x92BCE000 Size: 45056 File Visible: - Signed: - Status: - Name: tdx.sys Image Path: C:\Windows\system32\DRIVERS\tdx.sys Address: 0x94BA0000 Size: 90112 File Visible: - Signed: - Status: - Name: termdd.sys Image Path: C:\Windows\system32\DRIVERS\termdd.sys Address: 0x927DC000 Size: 65536 File Visible: - Signed: - Status: - Name: TSDDD.dll Image Path: C:\Windows\System32\TSDDD.dll Address: 0xA2A90000 Size: 36864 File Visible: - Signed: - Status: - Name: tunmp.sys Image Path: C:\Windows\system32\DRIVERS\tunmp.sys Address: 0x8AE00000 Size: 36864 File Visible: - Signed: - Status: - Name: tunnel.sys Image Path: C:\Windows\system32\DRIVERS\tunnel.sys Address: 0x8AFF5000 Size: 45056 File Visible: - Signed: - Status: - Name: umbus.sys Image Path: C:\Windows\system32\DRIVERS\umbus.sys Address: 0x83BEB000 Size: 53248 File Visible: - Signed: - Status: - Name: usbccgp.sys Image Path: C:\Windows\system32\DRIVERS\usbccgp.sys Address: 0x94AFB000 Size: 94208 File Visible: - Signed: - Status: - Name: USBD.SYS Image Path: C:\Windows\system32\DRIVERS\USBD.SYS Address: 0x937FE000 Size: 8192 File Visible: - Signed: - Status: - Name: usbehci.sys Image Path: C:\Windows\system32\DRIVERS\usbehci.sys Address: 0x83B94000 Size: 61440 File Visible: - Signed: - Status: - Name: usbhub.sys Image Path: C:\Windows\system32\DRIVERS\usbhub.sys Address: 0x8079E000 Size: 217088 File Visible: - Signed: - Status: - Name: usbohci.sys Image Path: C:\Windows\system32\DRIVERS\usbohci.sys Address: 0x83B4C000 Size: 40960 File Visible: - Signed: - Status: - Name: USBPORT.SYS Image Path: C:\Windows\system32\DRIVERS\USBPORT.SYS Address: 0x83B56000 Size: 253952 File Visible: - Signed: - Status: - Name: usbvideo.sys Image Path: C:\Windows\System32\Drivers\usbvideo.sys Address: 0x94B12000 Size: 134016 File Visible: - Signed: - Status: - Name: vga.sys Image Path: C:\Windows\System32\drivers\vga.sys Address: 0x94B41000 Size: 49152 File Visible: - Signed: - Status: - Name: VIDEOPRT.SYS Image Path: C:\Windows\System32\drivers\VIDEOPRT.SYS Address: 0x94B4D000 Size: 135168 File Visible: - Signed: - Status: - Name: volmgr.sys Image Path: C:\Windows\system32\drivers\volmgr.sys Address: 0x806A4000 Size: 61440 File Visible: - Signed: - Status: - Name: volmgrx.sys Image Path: C:\Windows\System32\drivers\volmgrx.sys Address: 0x806B3000 Size: 303104 File Visible: - Signed: - Status: - Name: volsnap.sys Image Path: C:\Windows\system32\drivers\volsnap.sys Address: 0x8AF23000 Size: 233472 File Visible: - Signed: - Status: - Name: wanarp.sys Image Path: C:\Windows\system32\DRIVERS\wanarp.sys Address: 0x995D9000 Size: 77824 File Visible: - Signed: - Status: - Name: watchdog.sys Image Path: C:\Windows\System32\drivers\watchdog.sys Address: 0x937E2000 Size: 49152 File Visible: - Signed: - Status: - Name: wd.sys Image Path: C:\Windows\system32\drivers\wd.sys Address: 0x8AF1B000 Size: 32768 File Visible: - Signed: - Status: - Name: Wdf01000.sys Image Path: C:\Windows\system32\drivers\Wdf01000.sys Address: 0x80549000 Size: 507904 File Visible: - Signed: - Status: - Name: WDFLDR.SYS Image Path: C:\Windows\system32\drivers\WDFLDR.SYS Address: 0x805C5000 Size: 53248 File Visible: - Signed: - Status: - Name: Win32k Image Path: \Driver\Win32k Address: 0xA2870000 Size: 2105344 File Visible: - Signed: - Status: - Name: win32k.sys Image Path: C:\Windows\System32\win32k.sys Address: 0xA2870000 Size: 2105344 File Visible: - Signed: - Status: - Name: wmiacpi.sys Image Path: C:\Windows\system32\DRIVERS\wmiacpi.sys Address: 0x83B3B000 Size: 36864 File Visible: - Signed: - Status: - Name: WMILIB.SYS Image Path: C:\Windows\system32\drivers\WMILIB.SYS Address: 0x80650000 Size: 36864 File Visible: - Signed: - Status: - Name: WMIxWDM Image Path: \Driver\WMIxWDM Address: 0x82E07000 Size: 3903488 File Visible: - Signed: - Status: - Name: ws2ifsl.sys Image Path: C:\Windows\system32\drivers\ws2ifsl.sys Address: 0x995A5000 Size: 36864 File Visible: - Signed: - Status: - Name: xaudio.sys Image Path: C:\Windows\system32\DRIVERS\xaudio.sys Address: 0xAEAFC000 Size: 32768 File Visible: - Signed: - Status: - |
|
|
|
|
Oct 21 2009, 01:34 PM
Post
#4
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
I do need to have you run combofix
|
|
|
|
|
Oct 21 2009, 04:43 PM
Post
#5
|
|
|
Member Posts: 22 OS: Vista |
ComboFix 09-10-20.03 - Chris 10/21/2009 9:11.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3006.1644 [GMT -6:00] Running from: c:\users\Chris\Desktop\Combo-Fix.exe SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-1369064247-611158546-1486992077-500 c:\$recycle.bin\S-1-5-21-1556918365-2345412578-3046410725-500 c:\programdata\ntuser.dat{3af34bc2-3fe3-11dd-8c5d-001e6848a838}.TMContainer00000000000000000001.regtrans-ms c:\users\Chris\AppData\Roaming\.# c:\users\Chris\AppData\Roaming\.#\MBX@FF0@1D628F8.### c:\users\Chris\AppData\Roaming\.#\MBX@FF0@1D62928.### c:\users\Chris\AppData\Roaming\.#\MBX@FF0@1D62958.### c:\users\Chris\Documents\deletekey01.reg c:\windows\Installer\229fbdbb.msi c:\windows\Installer\3f400.msi c:\windows\Installer\783221d.msi c:\windows\system32\AutoRun.inf c:\windows\system32\KBL.LOG c:\windows\system32\oem26.inf c:\windows\system32\oem29.inf c:\windows\system32\oem4.inf c:\windows\system32\oem46.inf . ((((((((((((((((((((((((( Files Created from 2009-09-21 to 2009-10-21 ))))))))))))))))))))))))))))))) . 2009-10-21 15:22 . 2009-10-21 15:23 -------- d-----w- c:\users\Chris\AppData\Local\temp 2009-10-21 15:22 . 2009-10-21 15:22 -------- d-----w- c:\users\postgres\AppData\Local\temp 2009-10-21 15:22 . 2009-10-21 15:22 -------- d-----w- c:\users\Default\AppData\Local\temp 2009-10-21 15:22 . 2009-10-21 15:22 -------- d-----w- c:\users\ADMINI~1\AppData\Local\temp 2009-10-21 02:33 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll 2009-10-21 02:33 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe 2009-10-21 02:33 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll 2009-10-21 02:33 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-10-21 02:31 . 2009-08-07 01:23 171608 ----a-w- c:\windows\system32\wuwebv.dll 2009-10-21 02:31 . 2009-08-07 00:44 33792 ----a-w- c:\windows\system32\wuapp.exe 2009-10-20 16:02 . 2009-09-10 20:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-20 16:02 . 2009-09-10 20:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-20 16:02 . 2009-10-20 16:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-10-18 01:44 . 2009-10-18 01:44 -------- d-----w- c:\users\Chris\AppData\Roaming\NeroDigital™ 2009-10-17 21:23 . 2008-02-28 20:26 1414440 ----a-w- c:\windows\system32\ShellManager310E2D762.dll 2009-10-17 19:05 . 2009-10-17 19:05 -------- d-----w- c:\program files\Common Files\LightScribe 2009-10-16 05:40 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll 2009-10-16 05:39 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-10-16 05:39 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-10-15 20:02 . 2009-10-15 20:02 -------- d-----w- c:\users\Chris\AppData\Local\HandBrake 2009-10-15 19:58 . 2009-10-16 04:24 -------- d-----w- c:\program files\HandBrake 2009-10-15 17:25 . 2009-10-15 17:25 -------- d-----w- c:\users\Chris\AppData\Local\Geckofx 2009-10-15 17:25 . 2009-10-15 17:25 -------- d-----w- c:\program files\AviSynth 2.5 2009-10-15 17:24 . 2009-10-15 17:24 -------- d-----w- c:\program files\Red Kawa 2009-10-15 15:00 . 2009-01-09 22:18 27136 ----a-w- c:\windows\system32\drivers\RimSerial.sys 2009-10-15 14:07 . 2009-10-15 14:07 -------- d-----w- c:\programdata\Research In Motion 2009-10-12 22:41 . 2009-10-12 22:41 -------- d-----w- c:\users\Chris\AppData\Roaming\BOXEE 2009-10-12 22:40 . 2009-10-12 22:42 -------- d-----w- c:\program files\Boxee 2009-10-08 20:20 . 2009-10-01 16:29 195440 ------w- c:\windows\system32\MpSigStub.exe 2009-10-06 20:35 . 2009-10-06 20:35 -------- d-----w- c:\users\Chris\AppData\Roaming\Malwarebytes 2009-10-06 20:34 . 2009-10-06 20:34 -------- d-----w- c:\programdata\Malwarebytes 2009-10-04 18:53 . 2009-10-04 18:56 -------- d-----w- c:\users\Chris\AppData\Local\Smart_PC_Utilities,_Ltd 2009-10-04 18:51 . 2009-10-04 18:51 -------- d-----w- c:\program files\Smart PC Utilities 2009-09-30 03:14 . 2007-09-18 09:37 262144 ----a-w- c:\users\Chris\AppData\Roaming\NCH Software\Components\flacdec\flacdec.exe 2009-09-30 03:13 . 2009-09-30 03:13 -------- d-----w- c:\users\Chris\AppData\Roaming\NCH Software 2009-09-30 03:13 . 2007-08-29 21:36 110592 ----a-w- c:\users\Chris\AppData\Roaming\NCH Software\Components\mp3el\mp3enc.exe 2009-09-29 23:13 . 2009-09-29 23:13 -------- d-----w- c:\programdata\NCH Swift Sound 2009-09-29 23:10 . 2009-09-29 23:10 -------- d-----w- c:\users\Chris\AppData\Roaming\NCH Swift Sound 2009-09-28 19:39 . 2008-04-17 19:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll 2009-09-28 19:39 . 2009-05-18 20:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-09-28 19:36 . 2009-09-28 19:36 -------- d-----w- c:\program files\iPod 2009-09-28 19:36 . 2009-09-28 19:39 -------- d-----w- c:\program files\iTunes 2009-09-27 18:38 . 2009-09-27 18:38 -------- d-----w- c:\users\Chris\AppData\Roaming\NeroDigital™ 2009-09-26 23:28 . 2009-10-03 18:41 -------- d-----w- c:\users\Chris\AppData\Roaming\skypePM 2009-09-26 23:18 . 2009-10-04 19:40 -------- d-----w- c:\programdata\Skype . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-21 14:44 . 2008-06-08 09:01 -------- d-----w- c:\users\Chris\AppData\Roaming\uTorrent 2009-10-20 15:54 . 2008-12-18 21:48 -------- d-----w- c:\programdata\Kaspersky Lab 2009-10-20 15:54 . 2009-01-08 01:16 103491 ----a-w- c:\programdata\nvModes.dat 2009-10-19 22:27 . 2008-03-10 15:44 675284 ----a-w- c:\windows\system32\perfh00C.dat 2009-10-19 22:27 . 2008-03-10 15:44 128422 ----a-w- c:\windows\system32\perfc00C.dat 2009-10-19 04:27 . 2008-07-03 02:40 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2009-10-19 03:38 . 2008-07-03 02:40 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-10-17 21:26 . 2008-07-02 00:50 -------- d-----w- c:\program files\Common Files\Nero 2009-10-17 21:26 . 2008-07-02 00:50 -------- d-----w- c:\programdata\Nero 2009-10-17 19:21 . 2008-07-02 00:59 -------- d-----w- c:\users\Chris\AppData\Roaming\Nero 2009-10-17 19:18 . 2008-07-01 23:05 -------- d-----w- c:\program files\Nero 2009-10-16 23:12 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-10-16 23:05 . 2008-06-07 20:39 -------- d-----w- c:\programdata\Microsoft Help 2009-10-16 07:25 . 2008-08-11 04:00 6944 ----a-w- c:\users\Chris\AppData\Local\d3d9caps.dat 2009-10-15 16:23 . 2008-10-11 01:49 256 ----a-w- c:\windows\system32\pool.bin 2009-10-15 15:27 . 2008-11-12 04:20 -------- d-----w- c:\users\Chris\AppData\Roaming\Research In Motion 2009-10-15 15:24 . 2008-06-07 20:48 115704 ----a-w- c:\users\Chris\AppData\Local\GDIPFONTCACHEV1.DAT 2009-10-15 15:16 . 2008-10-11 01:42 -------- d-----w- c:\program files\Common Files\Roxio Shared 2009-10-15 15:16 . 2008-10-11 01:42 -------- d-----w- c:\programdata\Roxio 2009-10-15 15:16 . 2008-06-08 22:40 -------- d-----w- c:\program files\Common Files\PX Storage Engine 2009-10-15 15:00 . 2008-11-12 03:43 -------- d-----w- c:\program files\Common Files\Research In Motion 2009-10-15 14:07 . 2008-11-12 03:43 -------- d-----w- c:\program files\Research In Motion 2009-10-15 13:41 . 2008-03-10 17:02 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-10-15 13:40 . 2009-02-23 22:38 -------- d-----w- c:\users\Chris\AppData\Roaming\ICAClient 2009-10-14 16:16 . 2008-06-08 09:52 -------- d-----w- c:\program files\Common Files\Adobe 2009-10-14 13:58 . 2008-12-18 21:51 95259 ----a-w- c:\windows\system32\drivers\klick.dat 2009-10-14 13:58 . 2008-12-18 21:51 108059 ----a-w- c:\windows\system32\drivers\klin.dat 2009-10-08 21:15 . 2008-04-12 01:41 -------- d-----w- c:\programdata\NVIDIA 2009-10-08 04:29 . 2008-04-12 01:14 12 ----a-w- c:\windows\bthservsdp.dat 2009-10-06 22:34 . 2008-03-10 16:58 -------- d-----w- c:\program files\Hewlett-Packard 2009-10-04 19:43 . 2009-01-04 18:11 -------- d-----w- c:\program files\Uniblue 2009-10-04 19:43 . 2009-01-04 18:37 -------- d-----w- c:\programdata\DriverScanner 2009-10-04 19:43 . 2009-01-04 18:12 -------- d-----w- c:\users\Chris\AppData\Roaming\uniblue 2009-09-28 19:36 . 2008-06-07 21:53 -------- d-----w- c:\program files\Common Files\Apple 2009-09-27 20:59 . 2008-06-08 22:39 -------- d-----w- c:\program files\DivX 2009-09-27 20:42 . 2009-09-08 15:24 -------- d-----w- c:\program files\Opera 2009-09-27 20:29 . 2008-06-11 02:27 -------- d-----w- c:\program files\Windows Live 2009-09-27 20:03 . 2008-07-17 02:33 -------- d-----w- c:\program files\Mozilla Thunderbird 2009-09-27 20:02 . 2008-06-07 21:27 -------- d-----w- c:\program files\McAfee 2009-09-27 19:58 . 2008-03-10 17:52 -------- d-----w- c:\program files\CyberLink 2009-09-27 19:57 . 2008-04-12 01:29 -------- d-----w- c:\program files\HP 2009-09-27 19:52 . 2008-04-12 01:36 -------- d-----w- c:\programdata\WildTangent 2009-09-27 18:40 . 2008-06-08 16:23 -------- d-----w- c:\users\Chris\AppData\Roaming\CyberLink 2009-09-26 23:28 . 2009-09-26 23:28 56 ---ha-w- c:\programdata\ezsidmv.dat 2009-09-14 09:29 . 2009-10-16 05:38 144896 ----a-w- c:\windows\system32\drivers\srv2.sys 2009-09-10 14:24 . 2008-06-07 21:59 -------- d-----w- c:\users\Chris\AppData\Roaming\Apple Computer 2009-09-10 04:47 . 2009-09-10 04:45 -------- d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-09-10 04:40 . 2009-09-10 04:38 -------- d-----w- c:\program files\QuickTime 2009-09-09 23:33 . 2008-06-10 22:50 -------- d-----w- c:\program files\Microsoft Silverlight 2009-09-04 11:41 . 2009-10-16 05:38 60928 ----a-w- c:\windows\system32\msasn1.dll 2009-08-29 01:42 . 2009-08-29 01:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-08-29 01:42 . 2009-08-29 01:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-08-29 00:27 . 2009-09-02 21:24 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-08-29 00:14 . 2009-09-02 21:24 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-08-27 05:22 . 2009-10-16 05:38 916480 ----a-w- c:\windows\system32\wininet.dll 2009-08-27 05:17 . 2009-10-16 05:38 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-08-27 05:17 . 2009-10-16 05:38 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-08-27 03:42 . 2009-10-16 05:38 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-08-19 00:13 . 2009-08-19 00:13 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat 2009-08-19 00:06 . 2008-12-18 21:48 7282720 --sha-w- c:\windows\system32\drivers\fidbox.dat 2009-08-19 00:06 . 2008-12-18 21:48 1179680 --sha-w- c:\windows\system32\drivers\fidbox2.dat 2009-08-18 05:33 . 2009-08-18 05:33 1193832 ----a-w- c:\windows\system32\FM20.DLL 2009-08-14 16:27 . 2009-09-09 18:53 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys 2009-08-14 15:53 . 2009-09-09 18:52 17920 ----a-w- c:\windows\system32\netevent.dll 2009-08-14 13:49 . 2009-09-09 18:52 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE 2009-08-14 13:49 . 2009-09-09 18:52 11264 ----a-w- c:\windows\system32\MRINFO.EXE 2009-08-14 13:49 . 2009-09-09 18:52 17920 ----a-w- c:\windows\system32\ROUTE.EXE 2009-08-14 13:49 . 2009-09-09 18:52 27136 ----a-w- c:\windows\system32\NETSTAT.EXE 2009-08-14 13:49 . 2009-09-09 18:52 19968 ----a-w- c:\windows\system32\ARP.EXE 2009-08-14 13:49 . 2009-09-09 18:52 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE 2009-08-14 13:49 . 2009-09-09 18:52 10240 ----a-w- c:\windows\system32\finger.exe 2009-08-14 13:48 . 2009-09-09 18:52 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2009-08-14 13:48 . 2009-09-09 18:53 105984 ----a-w- c:\windows\system32\netiohlp.dll 2009-07-25 11:23 . 2008-09-27 14:34 411368 ----a-w- c:\windows\system32\deploytk.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704] "avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) "EnableLUA"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli DPPWDFLT [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk backup=c:\windows\pss\Bluetooth.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^Users^Chris^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup backupExtension=.Startup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):50,02,c1,5f,3e,0f,ca,01 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1369064247-611158546-1486992077-1000] "EnableNotificationsRef"=dword:00000003 R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [12/15/2008 8:41 PM 33808] R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [5/15/2009 6:50 PM 21008] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [10/18/2009 9:35 PM 1153368] R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [7/30/2009 9:29 AM 185640] R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\System32\drivers\klmouflt.sys [5/16/2009 8:59 PM 19472] R4 MBAMProtector;MBAMProtector;c:\windows\System32\drivers\mbam.sys [10/20/2009 10:02 AM 19160] S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 12:03 PM 169312] S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\System32\drivers\WSDPrint.sys [1/20/2008 8:23 PM 16896] S4 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [3/30/2009 4:28 PM 1533808] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2009-10-21 c:\windows\Tasks\User_Feed_Synchronization-{6B2AA5CB-1F5D-4047-A920-7AACE8C34729}.job - c:\windows\system32\msfeedssync.exe [2009-10-16 03:41] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.hotmail.com/ mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=laptop uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://ca.search.yahoo.com/search?fr=mcafee&p=%s IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm LSP: %SYSTEMROOT%\system32\nvLsp.dll FF - ProfilePath - c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\dba6e0bj.default\ FF - prefs.js: browser.search.selectedEngine - Wikipedia (Eng) FF - prefs.js: browser.startup.homepage - chrome://jumpstart/content/tabView.xul FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - ORPHANS REMOVED - - - - HKCU-Run-Lsass Service - c:\users\Chris\AppData\Roaming\Microsoft\Windows\lsass.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-21 09:23 Windows 6.0.6002 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run Lsass Service = c:\users\Chris\AppData\Roaming\Microsoft\Windows\lsass.exe??????????????????????#??????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1369064247-611158546-1486992077-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5719E726-E463-8DF9-092F-89389DFAB6BD}*] "haljgepaipfmhpan"=hex:6a,61,69,6c,6f,64,61,6a,6b,64,69,63,61,65,65,66,66,66, 6f,6f,00,00 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(728) c:\windows\system32\DPPWDFLT.dll . Completion time: 2009-10-21 9:28 ComboFix-quarantined-files.txt 2009-10-21 15:28 Pre-Run: 132,169,527,296 bytes free Post-Run: 131,578,658,816 bytes free - - End Of File - - 1C1BC614552029C6BBC70483F3FCDA0F |
|
|
|
|
Oct 22 2009, 04:41 AM
Post
#6
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
hi
Download TFC to your desktop
Please download Malwarebytes' Anti-Malware from Here Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan.
|
|
|
|
|
Oct 24 2009, 12:30 PM
Post
#7
|
|
|
Member Posts: 22 OS: Vista |
I ran the TLC and it did its thing, and asked me to restart, which I did. I ran Malware Bytes, it didn't find anything, the log is below. I wasn't able to run the Kaspersky site scan, because I have the full version of it installed on my computer. I ran a full Kaspersky scan; it didn't find anything, I don't know how to extract a log from the scan I ran, but like I said, it didn't find anything.
I also tried running Combo-Fix again, and it would start, then a couple min into what ever it is doing, my screen would go black, and my computer would freeze, I would have to manually power of my machine, it get it back working again. Thanks in Advance Chris Malwarebytes' Anti-Malware 1.41 Database version: 3026 Windows 6.0.6002 Service Pack 2 10/24/2009 12:16:48 PM mbam-log-2009-10-24 (12-16-48).txt Scan type: Quick Scan Objects scanned: 106167 Time elapsed: 20 minute(s), 57 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) |
|
|
|
|
Oct 25 2009, 05:57 AM
Post
#8
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
post a new HJT Log
|
|
|
|
|
Oct 25 2009, 09:13 AM
Post
#9
|
|
|
Member Posts: 22 OS: Vista |
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:12:56 AM, on 10/25/2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18828) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Windows\system32\taskmgr.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Chris\Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O13 - Gopher Prefix: O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/...can8/oscan8.cab O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo...NPUplden-ca.cab O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\Kaspersky Internet Security 2010\kloehk.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 7716 bytes |
|
|
|
|
Oct 25 2009, 10:05 AM
Post
#10
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
Your logs are clean
Follow these steps to uninstall Combofix and tools used in the removal of malware
Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here : http://www.adobe.com/products/acrobat/readstep2.html Please download JavaRa to your desktop and unzip it to its own folder
Below I have included a number of recommendations for how to protect your computer against malware infections.
Thank you for your patience, and performing all of the procedures requested. |
|
|
|
|
Oct 29 2009, 05:17 PM
Post
#11
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic. |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
10 / 865 | 16th February 2009 - 11:51 PM Derko started - last by handhfan |
|||||
 |
24 / 1,071 | 12th May 2009 - 02:12 PM Lenny1341 started - last by fenzodahl512 |
|||||
|
39 / 1,301 | 17th May 2009 - 02:56 AM Wasuremono started - last by heir |
|||||
|
13 / 231 | 7th August 2009 - 12:30 PM jumper5 started - last by Rorschach112 |
|||||
|
Time is now: 21st November 2009 - 09:16 AM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising