OTListIt logfile created on: 1/6/2009 7:34:41 PM - Run 1 OTListIt2 by OldTimer - Version 2.0.15.8 Folder = C:\Users\Tiong Jia Ming\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy 2.00 Gb Total Physical Memory | 1.50 Gb Available Physical Memory | 74.76% Memory free 4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 286.20 Gb Total Space | 207.95 Gb Free Space | 72.66% Space Free | Partition Type: NTFS Drive D: | 11.89 Gb Total Space | 1.65 Gb Free Space | 13.89% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DIT-NB0900960 Current User Name: Tiong Jia Ming Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2008/12/05 12:54:00 | 00,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvvsvc.exe PRC - [2008/09/11 19:52:52 | 00,237,650 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\STacSV.exe PRC - [2008/03/19 07:24:58 | 00,019,456 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\Hpservice.exe PRC - [2008/07/25 13:05:33 | 00,370,872 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe PRC - [2008/06/27 23:53:08 | 00,077,824 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\aestsrv.exe PRC - [2009/03/26 15:31:20 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe PRC - [2008/01/11 17:50:16 | 00,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe PRC - [2008/06/10 01:21:58 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe PRC - [2007/10/25 10:03:28 | 00,103,744 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe PRC - [2008/05/22 20:50:00 | 00,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe PRC - [2008/05/22 20:50:00 | 00,054,608 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe PRC - [2006/10/26 13:40:34 | 00,335,872 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe PRC - [2007/10/25 10:05:40 | 00,136,512 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\naPrdMgr.exe PRC - [2008/11/24 22:31:10 | 29,263,712 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe PRC - [2009/03/26 22:44:00 | 00,066,872 | ---- | M] () -- C:\Windows\system32\PnkBstrA.exe PRC - [2008/12/18 08:11:40 | 00,365,952 | ---- | M] () -- C:\Program Files\SMINST\BLService.exe PRC - [2008/09/15 22:13:38 | 00,241,734 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe PRC - [2008/11/24 22:31:08 | 00,239,968 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe PRC - [2008/11/24 22:31:12 | 00,087,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe PRC - [2008/10/29 14:29:41 | 02,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\Explorer.EXE PRC - [2008/11/27 08:13:08 | 00,296,320 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe PRC - [2008/11/27 08:13:08 | 00,116,096 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe PRC - [2009/03/25 19:44:18 | 00,147,554 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware Server\vmware-authd.exe PRC - [2007/05/01 12:28:46 | 00,269,104 | ---- | M] (VMware, Inc.) -- C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe PRC - [2009/03/25 19:44:18 | 00,135,168 | ---- | M] (VMware, Inc.) -- C:\Windows\system32\vmnat.exe PRC - [2006/02/09 02:50:00 | 00,578,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\CCM\CcmExec.exe PRC - [2009/03/25 19:44:18 | 00,106,496 | ---- | M] (VMware, Inc.) -- C:\Windows\system32\vmnetdhcp.exe PRC - [2008/01/22 01:09:26 | 00,217,088 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\Apoint.exe PRC - [2008/09/11 19:50:38 | 00,446,556 | ---- | M] (IDT, Inc.) -- C:\Program Files\IDT\WDM\sttray.exe PRC - [2008/11/29 09:04:26 | 01,148,200 | ---- | M] (CyberLink Corp.) -- C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe PRC - [2008/12/26 04:41:16 | 01,316,136 | ---- | M] (CyberLink Corp.) -- C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe PRC - [2008/12/26 04:41:20 | 00,189,736 | ---- | M] (CyberLink) -- C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe PRC - [2009/01/21 23:23:16 | 00,210,216 | R--- | M] (CyberLink Corp.) -- C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe PRC - [2008/11/19 10:35:44 | 00,914,224 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe PRC - [2008/01/21 10:23:32 | 01,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe PRC - [2008/10/11 04:24:44 | 00,206,128 | ---- | M] ( Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe PRC - [2009/04/14 09:12:52 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2008/12/09 07:34:24 | 00,054,576 | ---- | M] (Hewlett-Packard) -- C:\Program Files\HP\HP Software Update\hpwuSchd2.exe PRC - [2008/12/09 03:25:24 | 00,432,432 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe PRC - [2008/05/22 20:50:00 | 00,111,952 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe PRC - [2007/10/25 10:04:56 | 00,136,512 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\UdaterUI.exe PRC - [2008/10/25 11:44:34 | 00,031,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe PRC - [2009/04/02 16:11:02 | 00,342,312 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe PRC - [2009/01/12 12:27:06 | 00,972,344 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe PRC - [2008/06/20 04:17:36 | 00,727,592 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe PRC - [2008/08/05 20:16:40 | 00,286,720 | ---- | M] () -- C:\Program Files\Launchy\Launchy.exe PRC - [2007/10/25 15:06:00 | 00,086,016 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\McTray.exe PRC - [2009/03/25 19:44:18 | 01,654,884 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware Server\vmserverdWin32.exe PRC - [2009/03/03 10:16:04 | 00,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wbem\wmiprvse.exe PRC - [2008/10/24 04:46:02 | 00,223,232 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe PRC - [2009/03/03 10:16:04 | 00,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wbem\wmiprvse.exe PRC - [2009/04/02 16:10:56 | 00,656,168 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe PRC - [2009/03/03 10:16:04 | 00,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wbem\wmiprvse.exe PRC - [2008/11/20 01:14:06 | 00,222,512 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe PRC - [2007/09/12 22:40:38 | 00,050,472 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\ApMsgFwd.exe PRC - [2007/10/26 01:23:36 | 00,049,152 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\Apntex.exe PRC - [2008/06/20 09:14:44 | 00,046,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe PRC - [2008/10/23 02:32:20 | 00,628,016 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe PRC - [2008/10/09 23:56:48 | 00,094,208 | ---- | M] (Hewlett-Packard) -- c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe PRC - [2008/06/20 04:17:36 | 01,624,616 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe PRC - [2008/01/21 10:25:33 | 00,202,240 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe PRC - [2008/01/21 10:25:33 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe PRC - [2009/04/29 10:47:32 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009/05/26 13:20:00 | 01,283,344 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe PRC - [2009/06/01 19:29:11 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Users\Tiong Jia Ming\Desktop\OTListIt2.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2008/06/27 23:53:08 | 00,077,824 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\aestsrv.exe -- (AESTFilters [Auto | Running]) SRV - [2009/03/26 15:31:20 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running]) SRV - [2008/01/11 17:50:16 | 00,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc [Auto | Running]) SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running]) SRV - [2006/02/09 02:50:00 | 00,578,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\CCM\CcmExec.exe -- (CcmExec [Auto | Running]) SRV - [2008/07/28 02:03:13 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2008/11/20 01:14:06 | 00,222,512 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe -- (Com4QLBEx [On_Demand | Running]) SRV - [2008/01/21 10:25:09 | 00,292,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehRecvr.exe -- (ehRecvr [On_Demand | Stopped]) SRV - [2006/11/02 20:35:29 | 00,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched [On_Demand | Stopped]) SRV - [2006/11/02 20:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart [Auto | Stopped]) SRV - [2008/06/20 09:14:44 | 00,046,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Running]) SRV - [2009/05/16 04:14:54 | 00,250,616 | ---- | M] (WildTangent, Inc.) -- C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe -- (GameConsoleService [On_Demand | Stopped]) SRV - [2008/10/09 23:56:48 | 00,094,208 | ---- | M] (Hewlett-Packard) -- c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe -- (HP Health Check Service [Auto | Running]) SRV - [2008/10/24 04:46:02 | 00,223,232 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe -- (hpqwmiex [On_Demand | Running]) SRV - [2008/03/19 07:24:58 | 00,019,456 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\Hpservice.exe -- (hpsrv [Auto | Running]) SRV - [2005/11/14 01:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped]) SRV - [2008/06/20 09:14:31 | 00,881,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - [2009/04/02 16:10:56 | 00,656,168 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running]) SRV - [2008/06/10 01:21:58 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService [Auto | Running]) SRV - [2007/10/25 10:03:28 | 00,103,744 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework [Unknown | Running]) SRV - [2008/05/22 20:50:00 | 00,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe -- (McShield [Unknown | Running]) SRV - [2008/05/22 20:50:00 | 00,054,608 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe -- (McTaskManager [Unknown | Running]) SRV - [2006/10/26 13:40:34 | 00,335,872 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe -- (MDM [Auto | Running]) SRV - [2008/10/25 11:44:08 | 00,065,888 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service [On_Demand | Stopped]) SRV - [2008/11/24 22:31:10 | 29,263,712 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ [On_Demand | Stopped]) SRV - [2008/11/24 22:31:10 | 29,263,712 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS [Auto | Running]) SRV - [2008/11/24 22:31:08 | 00,045,408 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper [Disabled | Stopped]) SRV - [2008/07/29 13:10:46 | 03,201,024 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon90 [Disabled | Stopped]) SRV - [2008/06/20 09:14:31 | 00,132,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - [2009/02/19 06:21:00 | 02,769,658 | ---- | M] (INCA Internet Co., Ltd.) -- C:\Windows\system32\GameMon.des -- (npggsvc [On_Demand | Stopped]) SRV - [2008/12/05 12:54:00 | 00,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvvsvc.exe -- (nvsvc [Auto | Running]) SRV - [2008/11/04 01:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped]) SRV - [2006/10/27 06:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2009/03/26 22:44:00 | 00,066,872 | ---- | M] () -- C:\Windows\system32\PnkBstrA.exe -- (PnkBstrA [Auto | Running]) SRV - [2009/05/07 09:07:02 | 00,338,816 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\Users\Tiong Jia Ming\AppData\Local\Temp\QOMMFZT.exe -- (QOMMFZT [On_Demand | Stopped]) SRV - [2008/12/18 08:11:40 | 00,365,952 | ---- | M] () -- C:\Program Files\SMINST\BLService.exe -- (Recovery Service for Windows [Auto | Running]) SRV - [2008/09/15 22:13:38 | 00,241,734 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe -- (RichVideo [Auto | Running]) SRV - (SQLBrowser [Auto | Running]) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) SRV - (SQLWriter [Auto | Running]) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation) SRV - (STacSV [Auto | Running]) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\STacSV.exe (IDT, Inc.) SRV - (Steam Client Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (TVCapSvc [Auto | Running]) -- C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe () SRV - (TVSched [Auto | Running]) -- C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe () SRV - (VMAuthdService [Auto | Running]) -- C:\Program Files\VMware\VMware Server\vmware-authd.exe (VMware, Inc.) SRV - (VMnetDHCP [Auto | Running]) -- C:\Windows\system32\vmnetdhcp.exe (VMware, Inc.) SRV - (vmount2 [Auto | Running]) -- C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe (VMware, Inc.) SRV - (vmserverdWin32 [Auto | Running]) -- C:\Program Files\VMware\VMware Server\vmserverdWin32.exe (VMware, Inc.) SRV - (VMware NAT Service [Auto | Running]) -- C:\Windows\system32\vmnat.exe (VMware, Inc.) SRV - (vpnagent [Auto | Running]) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.) SRV - (WinDefend [Auto | Running]) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (WMPNetworkSvc [On_Demand | Running]) -- C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - (Accelerometer [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\Accelerometer.sys (Hewlett-Packard Corporation) DRV - (adp94xx [Boot | Running]) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (adpahci [Boot | Running]) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (adpu160m [Boot | Running]) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (adpu320 [Boot | Running]) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (aic78xx [Boot | Running]) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (aliide [Boot | Running]) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (ApfiltrService [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (arc [Boot | Running]) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (arcsas [Boot | Running]) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (BrFiltLo [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrFiltUp [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (Brserid [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrSerWdm [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (BrUsbSer [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (btwaudio [On_Demand | Running]) -- C:\Windows\system32\drivers\btwaudio.sys (Broadcom Corporation.) DRV - (btwavdt [On_Demand | Running]) -- C:\Windows\system32\drivers\btwavdt.sys (Broadcom Corporation.) DRV - (btwrchid [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\btwrchid.sys (Broadcom Corporation.) DRV - (cmdide [Boot | Running]) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (E1G60 [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\E1G60I32.sys (Intel Corporation) DRV - (elxstor [Boot | Running]) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (enecir [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\enecir.sys (ENE TECHNOLOGY INC.) DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (hcmon [Auto | Running]) -- C:\Windows\system32\Drivers\hcmon.sys (VMware, Inc.) DRV - (HpCISSs [Boot | Running]) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (hpdskflt [Boot | Running]) -- C:\Windows\system32\DRIVERS\hpdskflt.sys (Hewlett-Packard Corporation) DRV - (HpqKbFiltr [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.) DRV - (iaStorV [Boot | Running]) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (iirsp [Boot | Running]) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (iteatapi [Boot | Running]) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (iteraid [Boot | Running]) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (JMCR [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\jmcr.sys (JMicron Technology Corporation) DRV - (LSI_FC [Boot | Running]) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (LSI_SAS [Boot | Running]) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (LSI_SCSI [Boot | Running]) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (megasas [Boot | Running]) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (MegaSR [Boot | Running]) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (mfeapfk [On_Demand | Running]) -- C:\Windows\system32\drivers\mfeapfk.sys (McAfee, Inc.) DRV - (mfeavfk [On_Demand | Running]) -- C:\Windows\system32\drivers\mfeavfk.sys (McAfee, Inc.) DRV - (mfebopk [On_Demand | Running]) -- C:\Windows\system32\drivers\mfebopk.sys (McAfee, Inc.) DRV - (mfehidk [On_Demand | Running]) -- C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.) DRV - (mfetdik [System | Running]) -- C:\Windows\system32\drivers\mfetdik.sys (McAfee, Inc.) DRV - (Mraid35x [Boot | Running]) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (NETw3v32 [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\NETw3v32.sys (Intel Corporation) DRV - (NETw5v32 [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\NETw5v32.sys (Intel Corporation) DRV - (nfrd960 [Boot | Running]) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (ntrigdigi [On_Demand | Stopped]) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (NVHDA [On_Demand | Running]) -- C:\Windows\system32\drivers\nvhda32v.sys (NVIDIA Corporation) DRV - (nvlddmkm [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\nvlddmkm.sys (NVIDIA Corporation) DRV - (nvraid [Boot | Running]) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor [Boot | Running]) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (prepdrvr [On_Demand | Stopped]) -- C:\Windows\system32\CCM\prepdrv.sys (Microsoft Corporation) DRV - (ql2300 [Boot | Running]) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (ql40xx [Boot | Running]) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (RTL8169 [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\Rtlh86.sys (Realtek Corporation ) DRV - (secdrv [Auto | Running]) -- C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (SiSRaid4 [Boot | Running]) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (STHDA [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\stwrt.sys (IDT, Inc.) DRV - (Symc8xx [Boot | Running]) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_hi [Boot | Running]) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Sym_u3 [Boot | Running]) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (uliahci [Boot | Running]) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (UlSata [Boot | Running]) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (ulsata2 [Boot | Running]) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (USBAAPL [On_Demand | Stopped]) -- C:\Windows\System32\Drivers\usbaapl.sys (Apple, Inc.) DRV - (viaide [Boot | Running]) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (VMnetAdapter [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\vmnetadapter.sys (VMware, Inc.) DRV - (VMnetBridge [Auto | Running]) -- C:\Windows\system32\DRIVERS\vmnetbridge.sys (VMware, Inc.) DRV - (VMnetuserif [Auto | Running]) -- C:\Windows\system32\drivers\vmnetuserif.sys (VMware, Inc.) DRV - (vmx86 [Auto | Running]) -- C:\Windows\system32\Drivers\vmx86.sys (VMware, Inc.) DRV - (vpnva [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\vpnva.sys (Cisco Systems, Inc.) DRV - (vsmraid [Boot | Running]) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (vstor2 [Auto | Running]) -- C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vstor2.sys (VMware, Inc.) DRV - (yukonwlh [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\yk60x86.sys (Marvell) DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49} [Auto | Running]) -- C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl (CyberLink Corp.) DRV - (MBAMSwissArmy [On_Demand | Running]) -- C:\Windows\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_sg&c=91&bd=Pavilion&pf=cnnb IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_sg&c=91&bd=Pavilion&pf=cnnb IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_sg&c=91&bd=Pavilion&pf=cnnb IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=orange]========== FireFox ==========[/color] FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.0 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.1 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2009/03/26 22:09:02 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/29 10:47:34 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/29 10:47:34 | 00,000,000 | ---D | M] [2009/03/31 20:41:34 | 00,000,000 | ---D | M] -- C:\Users\Tiong Jia Ming\AppData\Roaming\mozilla\Extensions [2009/03/31 20:41:34 | 00,000,000 | ---D | M] -- C:\Users\Tiong Jia Ming\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/06/01 12:22:07 | 00,000,000 | ---D | M] -- C:\Users\Tiong Jia Ming\AppData\Roaming\mozilla\Firefox\Profiles\eeicmhpg.default\extensions [2009/05/18 14:34:50 | 00,000,000 | ---D | M] -- C:\Users\Tiong Jia Ming\AppData\Roaming\mozilla\Firefox\Profiles\eeicmhpg.default\extensions\personas@christopher.beard [2009/04/14 09:13:12 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009/04/29 10:47:34 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/04/14 09:13:13 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009/04/29 10:47:32 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/04/29 10:47:32 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2009/04/23 13:49:33 | 00,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml [2009/04/23 13:49:33 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/04/23 13:49:33 | 00,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml [2009/04/23 13:49:33 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/04/23 13:49:33 | 00,000,759 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml [2009/04/23 13:49:33 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/04/23 13:49:33 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/04/23 13:49:33 | 00,000,831 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - Reg Error: Key error. File not found O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll (McAfee, Inc.) O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] "C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" (CyberLink) O4 - HKLM..\Run: [ctfmon.exe] c:\some_undistinguished_folder\Ultra Keylogger\ctfmon.exe File not found O4 - HKLM..\Run: [DVDAgent] "C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe" (CyberLink Corp.) O4 - HKLM..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" (Microsoft Corporation) O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard) O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard) O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.) O4 - HKLM..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey (McAfee, Inc.) O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) O4 - HKLM..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start ( Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.) O4 - HKLM..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE (McAfee, Inc.) O4 - HKLM..\Run: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [TSMAgent] "C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" (CyberLink Corp.) O4 - HKLM..\Run: [TVAgent] "C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe" (CyberLink Corp.) O4 - HKLM..\Run: [UCam_Menu] "C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam" (CyberLink Corp.) O4 - HKLM..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePDIRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0" (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" (CyberLink Corp.) O4 - HKLM..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide (Microsoft Corporation) O4 - HKLM..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard) O4 - HKCU..\Run: [Browse Book Coal Jugs] "C:\ProgramData\anti cdrom inter.n81xa" () O4 - HKCU..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN (Hewlett-Packard) O4 - HKCU..\Run: [KIND CASH] "C:\ProgramData\Peak anti anti.knvxhqh" () O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent (Malwarebytes Corporation) O4 - Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O4 - Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Launchy.lnk = C:\Program Files\Launchy\Launchy.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-SG\local\search.html () O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 (Microsoft Corporation) O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [@%SystemRoot%\system32\nlasvc.dll,-1000] - C:\Windows\system32\NLAapi.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [@%SystemRoot%\system32\napinsp.dll,-1000] - C:\Windows\system32\napinsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [@%SystemRoot%\system32\pnrpnsp.dll,-1000] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [@%SystemRoot%\system32\pnrpnsp.dll,-1001] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [Bluetooth Namespace] - C:\Windows\system32\wshbth.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O22 - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45A29BCE2FBD} - Fences - C:\Program Files\Stardock\Fences\DesktopDock.dll (Stardock) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/19 05:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009/06/01 19:31:49 | 00,000,000 | R--D | M] [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [2009/06/01 19:32:26 | 00,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2009/06/01 19:32:24 | 00,040,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/06/01 19:32:22 | 00,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2009/06/01 19:32:22 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/06/01 19:31:49 | 03,371,376 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Tiong Jia Ming\Desktop\mbam-setup.exe [2009/06/01 19:31:24 | 00,000,000 | ---D | C] -- C:\Rooter$ [2009/06/01 19:31:03 | 00,267,612 | ---- | C] () -- C:\Users\Tiong Jia Ming\Desktop\Rooter.exe [2009/06/01 19:29:00 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Users\Tiong Jia Ming\Desktop\OTListIt2.exe [2009/06/01 19:26:01 | 00,026,624 | ---- | C] () -- C:\Users\Tiong Jia Ming\Documents\TBCM quick guide.doc [2009/06/01 15:49:46 | 01,085,952 | ---- | C] () -- C:\Users\Tiong Jia Ming\Desktop\Tutorial 4.doc [2009/06/01 15:42:51 | 00,000,000 | ---D | C] -- C:\Windows\System32\EventProviders [2009/06/01 15:42:47 | 00,000,000 | ---D | C] -- C:\8dc97f25605d4af8500432dd51ee [2009/06/01 14:22:45 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\AppData\Roaming\Malwarebytes [2009/06/01 14:22:39 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2009/06/01 14:15:10 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT [2009/06/01 14:14:25 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT [2009/06/01 13:07:47 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\Desktop\GeeksToGo [2009/05/28 21:59:19 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\AppData\Roaming\Motorola [2009/05/28 09:48:44 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\AppData\Roaming\Wireshark [2009/05/28 08:53:18 | 22,312,984 | ---- | C] () -- C:\Users\Tiong Jia Ming\Desktop\wireshark-setup-1.0.8.exe [2009/05/27 16:44:11 | 00,002,171 | ---- | C] () -- C:\Users\Tiong Jia Ming\Desktop\Exteel.lnk [2009/05/26 14:26:03 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\AppData\Roaming\PlayFirst [2009/05/26 14:26:03 | 00,000,000 | ---D | C] -- C:\ProgramData\PlayFirst [2009/05/21 21:22:31 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center [2009/05/20 15:54:42 | 00,001,688 | ---- | C] () -- C:\Users\Tiong Jia Ming\Desktop\Team Fortress 2.lnk [2009/05/15 20:15:11 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\AppData\Roaming\Scilab [2009/05/15 20:15:02 | 00,000,845 | ---- | C] () -- C:\Users\Public\Desktop\scilab-5.1.1.lnk [2009/05/15 20:11:12 | 00,000,000 | ---D | C] -- C:\Program Files\scilab-5.1.1 [2009/05/12 17:05:46 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\Desktop\TBCM [2009/05/12 13:58:10 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\AppData\Roaming\Launchy [2009/05/12 13:57:47 | 00,000,806 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Launchy.lnk [2009/05/12 13:57:45 | 00,000,000 | ---D | C] -- C:\Program Files\Launchy [2009/05/12 11:41:20 | 54,585,344 | ---- | C] () -- C:\gparted-livecd-0.3.4-11.iso [2009/05/08 22:17:55 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\AppData\Roaming\vlc [2009/05/08 22:17:40 | 00,000,859 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk [2009/05/08 22:17:28 | 00,000,000 | ---D | C] -- C:\Program Files\VideoLAN [2009/05/08 21:45:53 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\Desktop\MuSiC [2009/05/08 21:44:50 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\Desktop\MoVieS [2009/05/07 09:32:55 | 00,000,010 | -H-- | C] () -- C:\htnazk.gst [2009/05/06 12:51:01 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\Desktop\ITSE [2009/05/05 12:24:26 | 12,771,3280 | ---- | C] () -- C:\en_win_srv_2003_r2_standard_with_sp2_cd2_X13-68583.iso [2009/05/05 11:43:05 | 62,307,5328 | ---- | C] () -- C:\en_win_srv_2003_r2_standard_with_sp2_cd1_X13-04790.iso [2009/05/04 13:27:16 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\Desktop\ONOW [2009/05/04 13:27:02 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\Desktop\COS [2009/05/04 13:26:29 | 00,000,000 | ---D | C] -- C:\Users\Tiong Jia Ming\Desktop\JavA pRoGrAmMinG [2009/04/01 13:40:13 | 00,000,174 | ---- | C] () -- C:\Windows\hpbafd.ini [2009/04/01 12:06:55 | 00,000,306 | ---- | C] () -- C:\Windows\ODBC.INI [2009/04/01 11:26:06 | 00,000,280 | ---- | C] () -- C:\Windows\System32\epoPGPsdk.dll.sig [2009/04/01 11:24:30 | 00,000,467 | ---- | C] () -- C:\Windows\SMSCFG.ini [2009/03/26 22:41:53 | 00,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2009/03/26 22:40:45 | 00,000,319 | ---- | C] () -- C:\Windows\game.ini [2006/11/02 20:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 18:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\win.ini [2006/11/02 18:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\system.ini [2006/11/02 15:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2001/11/15 04:56:00 | 01,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll [color=orange]========== Files - Modified Within 30 Days ==========[/color] [2009/06/01 19:32:26 | 00,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2009/06/01 19:31:51 | 03,371,376 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Tiong Jia Ming\Desktop\mbam-setup.exe [2009/06/01 19:31:07 | 00,267,612 | ---- | M] () -- C:\Users\Tiong Jia Ming\Desktop\Rooter.exe [2009/06/01 19:29:11 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Users\Tiong Jia Ming\Desktop\OTListIt2.exe [2009/06/01 19:26:02 | 00,026,624 | ---- | M] () -- C:\Users\Tiong Jia Ming\Documents\TBCM quick guide.doc [2009/06/01 19:02:32 | 00,000,467 | ---- | M] () -- C:\Windows\SMSCFG.ini [2009/06/01 19:00:51 | 00,049,494 | ---- | M] () -- C:\ProgramData\nvModes.001 [2009/06/01 19:00:13 | 00,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2009/06/01 19:00:13 | 00,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2009/06/01 19:00:13 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2009/06/01 19:00:02 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2009/06/01 18:59:53 | 31,865,77408 | -HS- | M] () -- C:\hiberfil.sys [2009/06/01 16:44:34 | 00,001,076 | ---- | M] () -- C:\Windows\bthservsdp.dat [2009/06/01 16:41:14 | 00,829,136 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2009/06/01 16:41:14 | 00,698,200 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2009/06/01 16:41:14 | 00,142,802 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2009/06/01 15:49:48 | 01,085,952 | ---- | M] () -- C:\Users\Tiong Jia Ming\Desktop\Tutorial 4.doc [2009/06/01 14:55:22 | 00,049,494 | ---- | M] () -- C:\ProgramData\nvModes.dat [2009/06/01 12:25:12 | 00,000,436 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{3BBFBB06-7CFA-4A0F-8F5F-CE4B40212AE2}.job [2009/05/28 08:54:29 | 22,312,984 | ---- | M] () -- C:\Users\Tiong Jia Ming\Desktop\wireshark-setup-1.0.8.exe [2009/05/28 08:35:12 | 00,000,174 | ---- | M] () -- C:\Windows\hpbafd.ini [2009/05/27 16:44:11 | 00,002,171 | ---- | M] () -- C:\Users\Tiong Jia Ming\Desktop\Exteel.lnk [2009/05/26 13:20:08 | 00,040,160 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/05/26 13:19:56 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2009/05/20 15:54:42 | 00,001,688 | ---- | M] () -- C:\Users\Tiong Jia Ming\Desktop\Team Fortress 2.lnk [2009/05/15 20:15:02 | 00,000,845 | ---- | M] () -- C:\Users\Public\Desktop\scilab-5.1.1.lnk [2009/05/12 13:57:47 | 00,000,806 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Launchy.lnk [2009/05/12 11:45:51 | 54,585,344 | ---- | M] () -- C:\gparted-livecd-0.3.4-11.iso [2009/05/10 22:01:09 | 00,000,010 | -H-- | M] () -- C:\htnazk.gst [2009/05/08 22:17:40 | 00,000,859 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk [2009/05/07 15:16:29 | 24,699,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mrt.exe [2009/05/05 11:26:05 | 00,022,328 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2009/05/05 11:25:55 | 00,103,736 | ---- | M] () -- C:\Windows\System32\PnkBstrB.exe < End of report >