[sage5]

Let's try this then.

Download the following & save to your Desktop.
OTViewIt


Run OTViewIt:

• Close all open windows and double click the OTViewIt icon on your Desktop
• Click the Run Scan button and let the program run uninterrupted.
• It will produce two logs for you. OTViewIt.txt will open automatically. The other one will be saved on your desktop as Extras.txt
• I will need you to post both those logs here. Use cut & paste, no need to Attach these

NOTE: These can be large files, not as large as the OTScanIt log, so probably best to cut & paste the text from each into a separate reply..

[Advertisements]

OTViewIt Extras logfile created on: 04.09.2008 17:19:54 - Run 1
OTViewIt by OldTimer - Version 1.0.1.8 Folder = C:\Documents and Settings\Øivind\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000414 | Country: Norway | Language: NOR | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 160,44 Gb Free Space | 68,89% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 280,89 Gb Free Space | 60,31% Space Free | Partition Type: NTFS
Drive E: | 698,64 Gb Total Space | 398,11 Gb Free Space | 56,98% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
[08.04.2004 02:00 PM | 00,140,800 | ---- | M] (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
[08.04.2004 02:00 PM | 00,140,800 | ---- | M] (Microsoft Corporation)

"C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe" = C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server
File not found

"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
[08.22.2008 11:57 AM | 00,267,056 | ---- | M] (BitTorrent, Inc.)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
File not found

"C:\Program Files\Steam\steamapps\gimme_more\team fortress 2\hl2.exe" = C:\Program Files\Steam\steamapps\gimme_more\team fortress 2\hl2.exe:*:Enabled:hl2
[09.01.2008 03:15 PM | 00,098,304 | ---- | M] ()

"E:\Spill\Call of duty 4\iw3mp.exe" = E:\Spill\Call of duty 4\iw3mp.exe:*:Enabled:Call of Duty® 4 - Modern Warfare™
[10.04.2007 09:14 AM | 03,325,952 | ---- | M] ()

"C:\Documents and Settings\Øivind\My Documents\Downloads\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\Grid\GRID.exe" = C:\Documents and Settings\Øivind\My Documents\Downloads\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\Grid\GRID.exe:*:Enabled:GRID Executable
File not found

"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
File not found

"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
File not found

"E:\Spill\Assassins Creed\AssassinsCreed_Dx9.exe" = E:\Spill\Assassins Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9
[05.05.2008 01:25 PM | 24,662,016 | ---- | M] (Ubisoft)

"E:\Spill\Assassins Creed\AssassinsCreed_Dx10.exe" = E:\Spill\Assassins Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10
[04.16.2008 05:35 PM | 25,667,160 | ---- | M] (Ubisoft)

"E:\Spill\Assassins Creed\AssassinsCreed_Launcher.exe" = E:\Spill\Assassins Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update
[02.22.2008 11:08 AM | 00,619,144 | ---- | M] (Ubisoft)

"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\English\setup.exe" = C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\English\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup
[02.08.2008 06:04 PM | 00,072,264 | ---- | M] (Kaspersky Lab)

"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe:*:Enabled:Kaspersky Anti-Virus
[02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab)

"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
[07.06.2006 06:53 PM | 20,034,600 | ---- | M] ()

"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
[07.24.2007 03:17 PM | 00,229,376 | ---- | M] (Apple Inc.)

"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
[07.30.2008 10:47 AM | 20,252,968 | ---- | M] (Apple Inc.)

"E:\Spill\System\ArmyOps.exe" = E:\Spill\System\ArmyOps.exe:*:Enabled:ArmyOps
[03.20.2008 10:30 AM | 00,131,072 | ---- | M] ()

"C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe" = C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe:*:Enabled:Kerio Personal Firewall 4 - GUI
[10.10.2005 09:56 AM | 02,887,680 | ---- | M] (Kerio Technologies)

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] - "%1" %*
.cmd [@ = cmdfile] - "%1" %*
.com [@ = comfile] - "%1" %*
.exe [@ = exefile] - "%1" %*
.pif [@ = piffile] - "%1" %*
.scr [@ = scrfile] - "%1" /S

========== Winsock2 Catalogs ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\]
NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - [07.24.2007 03:17 PM | 00,147,456 | ---- | M] (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll

========== HKEY_LOCAL_MACHINE Protocol Defaults ==========


========== HKEY_CURRENT_USER Protocol Defaults ==========


========== Protocol Handlers ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\]
ipp: [HKLM - No CLSID value]
msdaipp: [HKLM - No CLSID value]

========== Protocol Filters ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{18F11181-EA1A-42AE-AF89-4867C7F7A6FA}" = Sound Blaster X-Fi
"{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet
"{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java™ 6 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{333BECA0-DED8-4139-A516-8D9E44E22669}" = Kerio Personal Firewall
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D654496-9C3D-4565-858C-3E551ECDA4E2}" = Virtual Cable Tester
"{3DE0053C-FD9A-483E-B7C9-B06E4392206E}" = iTunes
"{43FFE159-3199-4188-A1CD-629166AD1033}" = Nero 7 Ultra Edition
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{49C88E44-1B38-4FC6-824E-2BDA3063B0E3}" = Apple Mobile Device Support
"{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}" = Kaspersky Anti-Virus 7.0
"{4C590030-7469-453E-8589-D15DA9D03F52}" = ANIWZCS2 Service
"{53C020C2-8C1A-11D9-8BDE-F66BAD1E3F3A}" = EndNote 9 Volume License Edition
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{5A0B7BA5-4682-4273-81C2-69B17E649103}" = GRID
"{65F1CF63-31E0-450B-96F3-4A88BE7361A6}" = AGEIA PhysX v7.07.09
"{6846389C-BAC0-4374-808E-B120F86AF5D7}" = Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76C24F39-B161-498F-BD8B-C64789812D13}_is1" = ConvertXtoDVD 3.0.0.9
"{7B5CE976-C7A9-4E38-A7F3-6C8EF025DD8E}" = ANIO Service
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{91120414-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AC76BA86-7AD7-1033-7B44-A81200000003}_Adobe Reader 8.1.2" = Adobe Reader 8.1.2 Security Update 1 (KB403742)
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C04E32E0-0416-434D-AFB9-6969D703A9EF}" = MSXML 4.0 SP2 (KB936181)
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{D7D2F494-89E3-42ED-8A2B-75BDD9B464CB}" = D-Link RangeBooster N DWA-140
"{D873FA4B-C374-4F8A-8D9A-130DB56FAB16}" = America's Army
"{DC3065BF-95B4-42C5-B47D-0B713CDA75D0}" = Creative Zen Vision M
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E0FA1DC5-FEBF-4E7B-8FA3-DB94233E952D}" = Razer Lycosa
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"{F7338FA3-DAB5-49B2-900D-0AFB5760C166}" = PC Probe II
"{FF3D660E-E5CC-47FD-8050-1B4DE3BA81A9}" = Dual-Core Optimizer
"53F13DB4D9611FD63BE580F06F0729BF236ABE68" = Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"593AFD5277FA19E67C70E56534B45B0DDD9ED9FE" = Windows Driver Package - Razer (HidUsb) HIDClass (01/11/2007 1.0)
"7-Zip" = 7-Zip 4.57
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"ALUpdate_is1" = ALUpdate
"ALZip_is1" = ALZip
"AudioCS" = Creative Audio Console
"Creative Removable Disk Manager" = Creative Removable Disk Manager
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"getPlus®_ocx" = getPlus®_ocx
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"InstallWIX_{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}" = Kaspersky Anti-Virus 7.0
"ISI ResearchSoft - Export Helper" = ISI ResearchSoft - Export Helper
"KB873339" = Windows XP Hotfix - KB873339
"KB885835" = Windows XP Hotfix - KB885835
"KB885836" = Windows XP Hotfix - KB885836
"KB886185" = Windows XP Hotfix - KB886185
"KB887472" = Windows XP Hotfix - KB887472
"KB888302" = Windows XP Hotfix - KB888302
"KB890046" = Security Update for Windows XP (KB890046)
"KB890859" = Windows XP Hotfix - KB890859
"KB891781" = Windows XP Hotfix - KB891781
"KB893756" = Security Update for Windows XP (KB893756)
"KB893803v2" = Windows Installer 3.1 (KB893803)
"KB894391" = Update for Windows XP (KB894391)
"KB896358" = Security Update for Windows XP (KB896358)
"KB896423" = Security Update for Windows XP (KB896423)
"KB896428" = Security Update for Windows XP (KB896428)
"KB898461" = Update for Windows XP (KB898461)
"KB899587" = Security Update for Windows XP (KB899587)
"KB899591" = Security Update for Windows XP (KB899591)
"KB900485" = Update for Windows XP (KB900485)
"KB900725" = Security Update for Windows XP (KB900725)
"KB901017" = Security Update for Windows XP (KB901017)
"KB901214" = Security Update for Windows XP (KB901214)
"KB902400" = Security Update for Windows XP (KB902400)
"KB905414" = Security Update for Windows XP (KB905414)
"KB905749" = Security Update for Windows XP (KB905749)
"KB908519" = Security Update for Windows XP (KB908519)
"KB908531" = Update for Windows XP (KB908531)
"KB910437" = Update for Windows XP (KB910437)
"KB911280" = Update for Windows XP (KB911280)
"KB911562" = Security Update for Windows XP (KB911562)
"KB911564" = Security Update for Windows Media Player (KB911564)
"KB911927" = Security Update for Windows XP (KB911927)
"KB913580" = Security Update for Windows XP (KB913580)
"KB914388" = Security Update for Windows XP (KB914388)
"KB914389" = Security Update for Windows XP (KB914389)
"KB915865" = Hotfix for Windows XP (KB915865)
"KB916595" = Update for Windows XP (KB916595)
"KB918118" = Security Update for Windows XP (KB918118)
"KB918439" = Security Update for Windows XP (KB918439)
"KB920213" = Security Update for Windows XP (KB920213)
"KB920670" = Security Update for Windows XP (KB920670)
"KB920683" = Security Update for Windows XP (KB920683)
"KB920685" = Security Update for Windows XP (KB920685)
"KB920872" = Update for Windows XP (KB920872)
"KB922582" = Update for Windows XP (KB922582)
"KB922819" = Security Update for Windows XP (KB922819)
"KB923191" = Security Update for Windows XP (KB923191)
"KB923414" = Security Update for Windows XP (KB923414)
"KB923980" = Security Update for Windows XP (KB923980)
"KB924270" = Security Update for Windows XP (KB924270)
"KB924667" = Security Update for Windows XP (KB924667)
"KB925398_WMP64" = Security Update for Windows Media Player 6.4 (KB925398)
"KB925902" = Security Update for Windows XP (KB925902)
"KB926239" = Hotfix for Windows XP (KB926239)
"KB926255" = Security Update for Windows XP (KB926255)
"KB926436" = Security Update for Windows XP (KB926436)
"KB927779" = Security Update for Windows XP (KB927779)
"KB927802" = Security Update for Windows XP (KB927802)
"KB928255" = Security Update for Windows XP (KB928255)
"KB928843" = Security Update for Windows XP (KB928843)
"KB929123" = Security Update for Windows XP (KB929123)
"KB929399" = Hotfix for Windows Media Format 11 SDK (KB929399)
"KB930178" = Security Update for Windows XP (KB930178)
"KB930916" = Update for Windows XP (KB930916)
"KB931261" = Security Update for Windows XP (KB931261)
"KB931784" = Security Update for Windows XP (KB931784)
"KB932168" = Security Update for Windows XP (KB932168)
"KB932823-v3" = Update for Windows XP (KB932823-v3)
"KB933729" = Security Update for Windows XP (KB933729)
"KB935839" = Security Update for Windows XP (KB935839)
"KB935840" = Security Update for Windows XP (KB935840)
"KB936021" = Security Update for Windows XP (KB936021)
"KB936782_WMP11" = Security Update for Windows Media Player 11 (KB936782)
"KB937894" = Security Update for Windows XP (KB937894)
"KB938127-IE7" = Security Update for Windows Internet Explorer 7 (KB938127)
"KB938828" = Update for Windows XP (KB938828)
"KB939683" = Hotfix for Windows Media Player 11 (KB939683)
"KB941569" = Security Update for Windows XP (KB941569)
"KB941644" = Security Update for Windows XP (KB941644)
"KB941693" = Security Update for Windows XP (KB941693)
"KB942763" = Update for Windows XP (KB942763)
"KB943055" = Security Update for Windows XP (KB943055)
"KB943460" = Security Update for Windows XP (KB943460)
"KB943485" = Security Update for Windows XP (KB943485)
"KB944653" = Security Update for Windows XP (KB944653)
"KB945553" = Security Update for Windows XP (KB945553)
"KB946026" = Security Update for Windows XP (KB946026)
"KB948590" = Security Update for Windows XP (KB948590)
"KB950749" = Security Update for Windows XP (KB950749)
"KB950759-IE7" = Security Update for Windows Internet Explorer 7 (KB950759)
"KB950760" = Security Update for Windows XP (KB950760)
"KB950762" = Security Update for Windows XP (KB950762)
"KB950974" = Security Update for Windows XP (KB950974)
"KB951066" = Security Update for Windows XP (KB951066)
"KB951072-v2" = Update for Windows XP (KB951072-v2)
"KB951376-v2" = Security Update for Windows XP (KB951376-v2)
"KB951698" = Security Update for Windows XP (KB951698)
"KB951748" = Security Update for Windows XP (KB951748)
"KB951978" = Update for Windows XP (KB951978)
"KB952287" = Hotfix for Windows XP (KB952287)
"KB952954" = Security Update for Windows XP (KB952954)
"KB953838-IE7" = Security Update for Windows Internet Explorer 7 (KB953838)
"KB953839" = Security Update for Windows XP (KB953839)
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.9.5 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.0)" = Mozilla Firefox (3.0)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"mv61xxDriver" = marvell 61xx
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"PokerStars" = PokerStars
"PopupPopper" = Bayden PopupPopper (remove only)
"RivaTuner" = RivaTuner v2.09
"Skype_is1" = Skype 2.5
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"SpywareBlaster_is1" = SpywareBlaster 4.1
"SpywareGuard_is1" = SpywareGuard v2.2
"Steam App 3483" = Peggle Extreme
"SysInfo" = Creative System Information
"SystemRequirementsLab" = System Requirements Lab
"Terrorist Takedown - Conflict in Mogadishu" = Terrorist Takedown - Conflict in Mogadishu
"VLC media player" = VideoLAN VLC media player 0.8.6h
"WgaNotify" = Windows Genuine Advantage Notifications (KB905474)
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows Mobile Device Handbook" = Windows Mobile® Device Handbook
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========


[ Application Events ]
Error - 06.08.2008 14:57:40 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Error
Description = Faulting application iexplore.exe, version 7.0.6000.16674, faulting
module ieframe.dll, version 7.0.6000.16674, fault address 0x00095721.

Error - 06.08.2008 18:20:35 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Hang
Description = Hanging application ConvertXtoDvd.exe, version 3.0.0.9, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 06.08.2008 18:49:55 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Hang
Description = Hanging application Steam.exe, version 1.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 10.08.2008 11:53:26 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Error
Description = Faulting application ANIWZCSdS.exe, version 1.0.3.7034, faulting module
user32.dll, version 5.1.2600.3099, fault address 0x00015a48.

Error - 10.08.2008 12:25:34 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Error
Description = Faulting application nero.exe, version 7.8.5.0, faulting module nerofiledialog.dll,
version 2.0.5.0, fault address 0x00013a37.

Error - 13.08.2008 14:31:59 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Hang
Description = Hanging application ATF-Cleaner.exe, version 3.0.0.2, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 13.08.2008 15:46:20 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Hang
Description = Hanging application iTunes.exe, version 7.7.1.11, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 14.08.2008 14:03:30 - Computer Name = STASJONÆR - User Name = User SID not found - Source = ESENT
Description = wuauclt (4960) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb"
for read / write access failed with system error 32 (0x00000020): "The process
cannot access the file because it is being used by another process. ". The open
file operation will fail with error -1032 (0xfffffbf8).

Error - 14.08.2008 14:03:30 - Computer Name = STASJONÆR - User Name = User SID not found - Source = ESENT
Description = wuauclt (4960) Unable to write a shadowed header for file C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb.
Error -1032.

Error - 14.08.2008 14:03:36 - Computer Name = STASJONÆR - User Name = User SID not found - Source = ESENT
Description = wuauclt (4960) Database recovery/restore failed with unexpected error
-1032.


[ Internet Explorer Events ]

[ Security Events ]

[ System Events ]
Error - 17.08.2008 20:16:18 - Computer Name = STASJONÆR - User Name = NT AUTHORITY\SYSTEM - Source = DCOM
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 17.08.2008 20:57:54 - Computer Name = STASJONÆR - User Name = NT AUTHORITY\SYSTEM - Source = DCOM
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 17.08.2008 21:09:30 - Computer Name = STASJONÆR - User Name = NT AUTHORITY\SYSTEM - Source = DCOM
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 17.08.2008 21:10:19 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Service Control Manager
Description = The following boot-start or system-start driver(s) failed to load:
AmdK8 AsIO Fips kl1 klif

Error - 17.08.2008 21:10:31 - Computer Name = STASJONÆR - User Name = NT AUTHORITY\SYSTEM - Source = DCOM
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 17.08.2008 21:14:14 - Computer Name = STASJONÆR - User Name = User SID not found - Source = WinDefend
Description = %%827 has encountered an error trying to load signatures and will
attempt reverting back to a known-good set of signatures. Signatures Attempted: %%824

Error
Code: 0x8050a001 Error description: The program can't find definition files that
help detect unwanted software. Check for updates to the definition files, and then
try again. For information on installing updates, see Help and Support. Signatures
loading: %%825 Loading signature version: 1.41.172.0 Loading engine version: 1.1.3807.0

Error - 29.08.2008 09:19:48 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Cdrom
Description = The device, \Device\CdRom0, has a bad block.

Error - 29.08.2008 13:06:06 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Service Control Manager
Description = The PnkBstrA service terminated unexpectedly. It has done this 1
time(s).

Error - 01.09.2008 07:48:38 - Computer Name = STASJONÆR - User Name = User SID not found - Source = AmdLLD
Description = AdjustCoreTSC() Node[ 0 ] Core[ 0 ] Cpu[ 0 ] Affinity[ 0x1 ] Error:
HalGetBusDataByOffset() failed reading north-bridge TSC.

Error - 01.09.2008 21:27:04 - Computer Name = STASJONÆR - User Name = User SID not found - Source = System Error
Description = Error code 100000d1, parameter1 00000000, parameter2 00000002, parameter3
00000008, parameter4 00000000.


< End of report >


OTViewIt logfile created on: 04.09.2008 17:19:54 - Run 1
OTViewIt by OldTimer - Version 1.0.1.8 Folder = C:\Documents and Settings\Øivind\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000414 | Country: Norway | Language: NOR | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 160,44 Gb Free Space | 68,89% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 280,89 Gb Free Space | 60,31% Space Free | Partition Type: NTFS
Drive E: | 698,64 Gb Total Space | 398,11 Gb Free Space | 56,98% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: STASJONÆR
Current User Name: Øivind
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Whitelist: On

===== Processes - Non-Microsoft Only =====

[08.20.2007 02:05 PM | 01,671,168 | ---- | M] (D-Link) - C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe
[11.20.2007 04:53 PM | 00,147,456 | ---- | M] (Razer USA Ltd.) - C:\Program Files\Razer\Lycosa\razerhid.exe
[02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
[04.28.2008 08:25 PM | 02,707,456 | ---- | M] () - C:\Program Files\RivaTuner v2.09\RivaTuner.exe
[08.29.2003 07:05 PM | 00,360,448 | ---- | M] () - C:\Program Files\SpywareGuard\sgmain.exe
[08.29.2003 11:14 AM | 00,233,472 | ---- | M] () - C:\Program Files\SpywareGuard\sgbhp.exe
[02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
[10.10.2005 09:58 AM | 01,617,920 | ---- | M] (Kerio Technologies) - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
[10.10.2005 09:56 AM | 02,887,680 | ---- | M] (Kerio Technologies) - C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
[08.08.2008 07:25 PM | 00,066,872 | ---- | M] () - C:\WINDOWS\system32\PnkBstrA.exe
[01.07.2008 01:28 PM | 00,143,360 | ---- | M] () - C:\Program Files\Razer\Lycosa\razertra.exe
[10.10.2005 09:56 AM | 02,887,680 | ---- | M] (Kerio Technologies) - C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
[08.22.2008 11:57 AM | 00,267,056 | ---- | M] (BitTorrent, Inc.) - C:\Program Files\uTorrent\uTorrent.exe

===== Win32 Services - Non-Microsoft Only =====

(ANIWZCSdService) ANIWZCSd Service [Auto | Stopped]
[01.19.2007 11:49 AM | 00,049,152 | ---- | M] (Wireless Service) - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

(AVP) Kaspersky Anti-Virus 7.0 [Auto | Running]
[02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

(Creative Audio Engine Licensing Service) Creative Audio Engine Licensing Service [On_Demand | Stopped]
[08.26.2008 07:10 PM | 00,079,360 | ---- | M] (Creative Labs) - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe

(KPF4) Kerio Personal Firewall 4 [Auto | Running]
[10.10.2005 09:58 AM | 01,617,920 | ---- | M] (Kerio Technologies) - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

(PnkBstrA) PnkBstrA [Auto | Running]
[08.08.2008 07:25 PM | 00,066,872 | ---- | M] () - C:\WINDOWS\system32\PnkBstrA.exe

===== Driver Services - Non-Microsoft Only =====

(AmdK8) AMD Processor Driver [System | Running]
[06.18.2006 11:37 PM | 00,036,864 | ---- | M] (Advanced Micro Devices) - C:\WINDOWS\system32\drivers\AmdK8.sys

(AmdLLD) AMD Low Level Device Driver [On_Demand | Running]
[06.29.2007 02:47 PM | 00,034,304 | ---- | M] (AMD, Inc.) - C:\WINDOWS\system32\drivers\AmdLLD.sys

(ANIO) ANIO Service [Auto | Running]
[12.11.2005 11:55 AM | 00,028,195 | ---- | M] (Alpha Networks Inc.) - C:\WINDOWS\system32\ANIO.sys

(AsIO) AsIO [System | Running]
[10.18.2006 09:12 PM | 00,012,664 | R--- | M] () - C:\WINDOWS\system32\drivers\AsIO.sys

(fwdrv) Firewall Driver [System | Running]
[09.26.2005 11:05 AM | 00,286,720 | ---- | M] (Kerio Technologies) - C:\WINDOWS\system32\drivers\fwdrv.sys

(khips) Kerio HIPS Driver [System | Running]
[09.26.2005 11:05 AM | 00,081,920 | ---- | M] () - C:\WINDOWS\system32\drivers\khips.sys

(kl1) kl1 [Boot | Running]
[08.03.2008 09:54 AM | 00,112,144 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\kl1.sys

(klif) klif [System | Running]
[12.28.2007 07:51 PM | 00,195,344 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\klif.sys

(klim5) Kaspersky Anti-Virus NDIS Filter [On_Demand | Running]
[12.13.2007 01:28 PM | 00,024,592 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\klim5.sys

(LycoFltr) Lycosa Keyboard [On_Demand | Running]
[01.18.2008 02:43 PM | 00,016,128 | ---- | M] (Razer USA Ltd.) - C:\WINDOWS\system32\drivers\Lycosa.sys

(MTsensor) ATK0110 ACPI UTILITY [On_Demand | Running]
[08.14.2004 04:56 AM | 00,005,810 | R--- | M] () - C:\WINDOWS\system32\drivers\ASACPI.sys

(mv61xx) mv61xx [Boot | Running]
[06.15.2007 09:52 AM | 00,143,256 | ---- | M] (Marvell Semiconductor, Inc.) - C:\WINDOWS\system32\drivers\mv61xx.sys

(pcouffin) VSO Software pcouffin [On_Demand | Running]
[06.25.2008 04:33 PM | 00,047,360 | ---- | M] (VSO Software) - C:\WINDOWS\system32\drivers\pcouffin.sys

(RivaTuner32) RivaTuner32 [On_Demand | Running]
[04.28.2008 08:25 PM | 00,009,088 | ---- | M] () - C:\Program Files\RivaTuner v2.09\RivaTuner32.sys

(rt2870) Ralink 802.11n USB Wireless LAN Card Driver [On_Demand | Running]
[07.28.2007 02:50 PM | 00,517,632 | ---- | M] (Ralink Technology, Corp.) - C:\WINDOWS\system32\drivers\rt2870.sys

(SASDIFSV) SASDIFSV [System | Running]
[08.28.2008 03:52 PM | 00,008,944 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS

(SASENUM) SASENUM [On_Demand | Stopped]
[02.16.2006 04:51 PM | 00,004,096 | R--- | M] (SuperAdBlocker, Inc.) - C:\Program Files\SUPERAntiSpyware\SASENUM.SYS

(SASKUTIL) SASKUTIL [System | Running]
[08.28.2008 03:52 PM | 00,055,024 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

(sptd) sptd [Boot | Running]
[06.26.2008 10:29 AM | 00,685,816 | ---- | M] () - C:\WINDOWS\system32\drivers\sptd.sys

(yukonwxp) NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller [On_Demand | Stopped]
[06.08.2007 10:15 AM | 00,262,912 | ---- | M] (Marvell) - C:\WINDOWS\system32\drivers\yk51x86.sys

========== Run Keys ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt" = C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [07.23.2007 11:06 AM | 00,077,824 | ---- | M] (AMD)
"AudioDrvEmulator" = "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" [11.04.2005 06:07 PM | 00,049,152 | ---- | M] (Creative Technology Ltd.)
"AVP" = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab)
"Cpu Level Up help" = C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe [11.30.2007 08:03 PM | 00,881,152 | ---- | M] ()
"CPU Power Monitor" = "C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe" [10.16.2007 11:35 AM | 00,626,176 | ---- | M] ()
"CTDVDDET" = "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [06.18.2003 01:00 AM | 00,045,056 | ---- | M] (Creative Technology Ltd)
"CTHelper" = CTHELPER.EXE [02.20.2008 08:58 PM | 00,019,456 | ---- | M] (Creative Technology Ltd)
"CTxfiHlp" = CTXFIHLP.EXE [07.11.2008 03:50 PM | 00,019,968 | ---- | M] (Creative Technology Ltd)
"D-Link D-Link RangeBooster N DWA-140" = C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe [08.20.2007 02:05 PM | 01,671,168 | ---- | M] (D-Link)
"Lycosa" = "C:\Program Files\Razer\Lycosa\razerhid.exe" [11.20.2007 04:53 PM | 00,147,456 | ---- | M] (Razer USA Ltd.)
"NvCplDaemon" = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [05.16.2008 02:01 PM | 13,529,088 | ---- | M] (NVIDIA Corporation)
"NvMediaCenter" = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [05.16.2008 02:01 PM | 00,086,016 | ---- | M] (NVIDIA Corporation)
"nwiz" = nwiz.exe /install [05.16.2008 02:01 PM | 01,630,208 | ---- | M] ()
"RCSystem" = "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup [11.04.2005 06:07 PM | 00,049,152 | ---- | M] (Creative Technology Ltd.)
"RivaTuner" = "C:\Program Files\RivaTuner v2.09\RivaTuner.exe" /T [04.28.2008 08:25 PM | 02,707,456 | ---- | M] ()
"RivaTunerStartupDaemon" = "C:\Program Files\RivaTuner v2.09\RivaTuner.exe" /S [04.28.2008 08:25 PM | 02,707,456 | ---- | M] ()
"UpdReg" = C:\WINDOWS\UpdReg.EXE [05.11.2000 01:00 AM | 00,090,112 | ---- | M] (Creative Technology Ltd.)
"VolPanel" = "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r [07.28.2006 09:56 AM | 00,122,880 | ---- | M] (Creative Technology Ltd)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = Reg Error: Value load does not exist or could not be read.
"run" = Reg Error: Value run does not exist or could not be read.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" =
"run" = Reg Error: Value run does not exist or could not be read.

========== Startup Folders ==========

[All Users Startup Folder - C:\Documents and Settings\All Users\Start Menu\Programs\Startup]

[Øivind Startup Folder - C:\Documents and Settings\Øivind\Start Menu\Programs\Startup]
[08.29.2003 07:05 PM | 00,360,448 | ---- | M] () - C:\Documents and Settings\Øivind\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

========== BHO's ==========

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
HKLM CLSID: (Adobe PDF Reader Link Helper) - [10.22.2006 11:08 PM | 00,062,080 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41353F8B-78CE-48A5-BE44-153ED293D192}]
HKLM CLSID: (Control Popups in Internet Explorer) - [05.26.2003 11:41 PM | 00,109,568 | ---- | M] (Bayden Systems) C:\Program Files\PopupPopper\PopLib.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A368E80-174F-4872-96B5-0B27DDD11DB2}]
HKLM CLSID: (SpywareGuardDLBLOCK.CBrowserHelper) - [08.02.2003 11:24 PM | 00,192,512 | R--- | M] () C:\Program Files\SpywareGuard\dlprotect.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
HKLM CLSID: (Spybot-S&D IE Protection) - [01.28.2008 11:43 AM | 01,554,256 | ---- | M] (Safer Networking Limited) C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
HKLM CLSID: (SSVHelper Class) - [06.10.2008 04:27 AM | 00,509,328 | ---- | M] (Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

========== Toolbars ==========

========== AppInit_Dlls ==========

========== Shell Execute Hooks ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}" =
HKLM CLSID: (SABShellExecuteHook Class) - [08.28.2008 03:52 PM | 00,077,824 | ---- | M] (SuperAdBlocker.com) C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
"{81559C35-8464-49F7-BB0E-07A383BEF910}" =
HKLM CLSID: (SpywareGuard.Handler) - [08.02.2003 11:20 PM | 00,126,976 | R--- | M] () C:\Program Files\SpywareGuard\spywareguard.dll

========== HKLM Security Providers ==========

========== HKLM Winlogon Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell]
= Explorer.exe
>Explorer.exe - [06.13.2007 12:23 PM | 01,033,216 | ---- | M] (Microsoft Corporation) C:\WINDOWS\explorer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit]
= C:\WINDOWS\system32\userinit.exe,
>C:\WINDOWS\system32\userinit.exe - [08.04.2004 02:00 PM | 00,024,576 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\userinit.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost]
= logonui.exe
>logonui.exe - [08.04.2004 02:00 PM | 00,514,560 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\logonui.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet]
= rundll32 shell32,Control_RunDLL "sysdm.cpl"
>rundll32 shell32 - [10.26.2007 05:36 AM | 08,454,656 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
>Control_RunDLL "sysdm.cpl" - [08.04.2004 02:00 PM | 00,298,496 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\sysdm.cpl

========== User's Winlogon Settings ==========

========== Winlogon Notify Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
"DllName" = C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [08.28.2008 03:52 PM | 00,352,256 | ---- | M] (SUPERAntiSpyware.com)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
"DllName" = C:\WINDOWS\system32\klogon.dll [02.08.2008 06:37 PM | 00,219,664 | ---- | M] (Kaspersky Lab)

========== Policies ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
Unable to open key or key not present!


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"dontdisplaylastusername" = 0
"legalnoticecaption" =
"legalnoticetext" =
"shutdownwithoutlogon" = 1
"undockwithoutlogon" = 1

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun" = 145

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
Unable to open key or key not present!


========== Lsa Authentication Packages ==========

========== Lsa Security Packages ==========

========== Desktop Components ==========

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"FriendlyName" = "My Current Home Page"
"Source" = "About:Home"
"SubscribedURL" = "About:Home"

========== Safeboot Options ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]
"AlternateShell" = cmd.exe

========== Disabled MsConfig Items ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^Øivind^Start Menu^Programs^Startup^MarvellTrayStartup.lnk]
"path" = C:\Documents and Settings\Øivind\Start Menu\Programs\Startup\MarvellTrayStartup.lnk File not found
"backup" = C:\WINDOWS\pss\MarvellTrayStartup.lnk File not found
"location" = Startup
"command" = C:\PROGRA~1\Marvell\61xx\tray\RaidTray.bat File not found
"item" = MarvellTrayStartup

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = Reader_sl
"hkey" = HKLM
"command" = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [01.11.2008 10:16 PM | 00,039,792 | ---- | M] (Adobe Systems Incorporated)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Ai Nap]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = AiNap
"hkey" = HKLM
"command" = C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe [09.06.2007 11:19 AM | 01,426,432 | ---- | M] ()
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ANIWZCS2Service]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = WZCSLDR2
"hkey" = HKLM
"command" = C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe [01.19.2007 11:49 AM | 00,049,152 | ---- | M] (Wireless Service)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AppleSyncNotifier]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = AppleSyncNotifier
"hkey" = HKLM
"command" = C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [07.22.2008 08:42 PM | 00,116,040 | ---- | M] (Apple Inc.)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = NMBgMonitor
"hkey" = HKCU
"command" = C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [03.12.2007 01:49 PM | 00,153,136 | ---- | M] (Nero AG)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = iTunesHelper
"hkey" = HKLM
"command" = C:\Program Files\iTunes\iTunesHelper.exe [07.30.2008 10:47 AM | 00,289,064 | ---- | M] (Apple Inc.)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NeroFilterCheck]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = NeroCheck
"hkey" = HKLM
"command" = C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [03.09.2007 06:53 PM | 00,153,136 | ---- | M] (Nero AG)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = qttask
"hkey" = HKLM
"command" = C:\Program Files\QuickTime\QTTask.exe [05.27.2008 10:50 AM | 00,413,696 | ---- | M] (Apple Inc.)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunJavaUpdateSched]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = jusched
"hkey" = HKLM
"command" = C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [06.10.2008 04:27 AM | 00,144,784 | ---- | M] (Sun Microsystems, Inc.)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SUPERAntiSpyware]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = SUPERAntiSpyware
"hkey" = HKCU
"command" = C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE [08.28.2008 03:52 PM | 01,576,176 | ---- | M] (SUPERAntiSpyware.com)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"system.ini" = 0
"win.ini" = 0
"bootini" = 0
"services" = 0
"startup" = 2

========== CDRom AutoRun Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun" = 1

========== Autorun Files on Drives ==========

AUTOEXEC.BAT []
[06.25.2008 03:59 PM | 00,000,000 | ---- | M] () C:\AUTOEXEC.BAT [ NTFS ]

AUTOEXEC.BAT []
[04.27.2008 08:13 PM | 00,000,000 | ---- | M] () D:\AUTOEXEC.BAT [ NTFS ]

========== MountPoints2 ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3082f0d3-5e1a-11dd-add1-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ec3f273-5514-11dd-adc7-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ec3f274-5514-11dd-adc7-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e0216ed2-482c-11dd-adaf-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e25-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e26-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e27-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e28-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e29-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

========== DNS Name Servers ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{32815B77-6891-404B-A6CD-DA7926FFE6BB}]
Servers: 193.213.112.4,130.67.60.68 | Description: D-Link DWA-140 RangeBooster N USB Adapter

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{33BD519D-F9D1-461D-990E-5AE414EC6025}]
Servers: | Description: Windows Mobile-based Device

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{6ED0AA5B-9546-4B3E-8630-35C1D95ED623}]
Servers: | Description: Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{DB270EE0-F019-4276-B87F-93270A5E5F89}]
Servers: | Description: 1394 Net Adapter

========== Hosts File ==========

HOSTS File = (250769 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
First 25 entries...
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.1001-search.info
127.0.0.1 1001-search.info
127.0.0.1 www.100888290cs.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.10sek.com
127.0.0.1 10sek.com
127.0.0.1 www.123topsearch.com
127.0.0.1 123topsearch.com
127.0.0.1 www.132.com
127.0.0.1 132.com
127.0.0.1 www.136136.net
127.0.0.1 136136.net



========== Files/Folders - Created Within 30 days ==========

[08.17.2008 11:11 PM | ---D | C] - C:\Config.Msi
[08.26.2008 07:14 PM | ---D | C] - C:\Guru3D.com
[09.02.2008 03:59 PM | 00,813,056 | ---- | C] () - C:\pbsetup.exe
[09.02.2008 04:11 PM | 00,000,054 | ---- | C] () - C:\pbuser.htm
[09.02.2008 04:11 PM | 00,009,678 | ---- | C] () - C:\pbgame.htm
[08.29.2008 11:04 AM | 00,010,880 | ---- | C] (Aureal, Inc.) - C:\WINDOWS\System32\dllcache\admjoy.sys
[08.29.2008 11:04 AM | 00,020,160 | ---- | C] (ADMtek Incorporated) - C:\WINDOWS\System32\dllcache\adm8511.sys
[08.29.2008 11:04 AM | 00,046,112 | ---- | C] (Adaptec, Inc ) - C:\WINDOWS\System32\dllcache\adptsf50.sys
[08.29.2008 11:04 AM | 00,061,440 | ---- | C] (Color Flatbed Scanner) - C:\WINDOWS\System32\dllcache\acerscad.dll
[08.29.2008 11:04 AM | 00,084,480 | ---- | C] (VIA Technologies, Inc.) - C:\WINDOWS\System32\dllcache\ac97via.sys
[08.29.2008 11:04 AM | 00,148,352 | ---- | C] (3dfx Interactive, Inc.) - C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[08.29.2008 11:04 AM | 00,297,728 | ---- | C] (Silicon Integrated Systems Corp.) - C:\WINDOWS\System32\dllcache\ac97sis.sys
[08.29.2008 11:04 AM | 00,462,848 | ---- | C] (Aureal Inc.) - C:\WINDOWS\System32\dllcache\a3dapi.dll
[08.29.2008 11:04 AM | 00,553,984 | ---- | C] (Aureal, Inc.) - C:\WINDOWS\System32\dllcache\adm8820.sys
[08.29.2008 11:04 AM | 00,584,448 | ---- | C] (Aureal, Inc.) - C:\WINDOWS\System32\dllcache\adm8810.sys
[08.29.2008 11:04 AM | 00,689,216 | ---- | C] (3dfx Interactive, Inc.) - C:\WINDOWS\System32\dllcache\3dfxvs.dll
[08.29.2008 11:04 AM | 00,747,392 | ---- | C] (Aureal, Inc.) - C:\WINDOWS\System32\dllcache\adm8830.sys
[08.29.2008 11:04 AM | 00,762,780 | ---- | C] (3Com, Inc.) - C:\WINDOWS\System32\dllcache\3cwmcru.sys
[08.29.2008 11:05 AM | 00,002,944 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brfilt.sys
[08.29.2008 11:05 AM | 00,003,168 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brparimg.sys
[08.29.2008 11:05 AM | 00,003,968 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brfiltup.sys
[08.29.2008 11:05 AM | 00,009,472 | ---- | C] () - C:\WINDOWS\System32\dllcache\ativmdcd.sys
[08.29.2008 11:05 AM | 00,009,728 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brcoinst.dll
[08.29.2008 11:05 AM | 00,010,240 | ---- | C] () - C:\WINDOWS\System32\dllcache\atipcxxx.sys
[08.29.2008 11:05 AM | 00,012,160 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brfiltlo.sys
[08.29.2008 11:05 AM | 00,012,800 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brevif.dll
[08.29.2008 11:05 AM | 00,015,360 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brmfbidi.dll
[08.29.2008 11:05 AM | 00,016,969 | ---- | C] (AmbiCom, Inc.) - C:\WINDOWS\System32\dllcache\amb8002.sys
[08.29.2008 11:05 AM | 00,017,152 | ---- | C] () - C:\WINDOWS\System32\dllcache\atitunep.sys
[08.29.2008 11:05 AM | 00,017,152 | ---- | C] () - C:\WINDOWS\System32\dllcache\atitvsnd.sys
[08.29.2008 11:05 AM | 00,019,456 | ---- | C] () - C:\WINDOWS\System32\dllcache\ativttxx.sys
[08.29.2008 11:05 AM | 00,019,456 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brbidiif.dll
[08.29.2008 11:05 AM | 00,023,552 | ---- | C] () - C:\WINDOWS\System32\dllcache\atixbar.sys
[08.29.2008 11:05 AM | 00,026,624 | ---- | C] () - C:\WINDOWS\System32\dllcache\ativxbar.sys
[08.29.2008 11:05 AM | 00,026,880 | ---- | C] () - C:\WINDOWS\System32\dllcache\atirtsnd.sys
[08.29.2008 11:05 AM | 00,029,696 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brmflpt.dll
[08.29.2008 11:05 AM | 00,032,256 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brmfrsmg.exe
[08.29.2008 11:05 AM | 00,036,128 | ---- | C] (3Dfx Interactive, Inc.) - C:\WINDOWS\System32\dllcache\banshee.sys
[08.29.2008 11:05 AM | 00,036,992 | ---- | C] (Aztech Systems Ltd) - C:\WINDOWS\System32\dllcache\aztw2320.sys
[08.29.2008 11:05 AM | 00,037,568 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\avmwan.sys
[08.29.2008 11:05 AM | 00,039,552 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brparwdm.sys
[08.29.2008 11:05 AM | 00,041,472 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brmfusb.dll
[08.29.2008 11:05 AM | 00,046,464 | ---- | C] () - C:\WINDOWS\System32\dllcache\atibt829.sys
[08.29.2008 11:05 AM | 00,049,920 | ---- | C] () - C:\WINDOWS\System32\dllcache\atirtcap.sys
[08.29.2008 11:05 AM | 00,077,568 | ---- | C] (ATI Technologies, Inc.) - C:\WINDOWS\System32\dllcache\ati.sys
[08.29.2008 11:05 AM | 00,087,552 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\avmcoxp.dll
[08.29.2008 11:05 AM | 00,089,952 |

[Conkey]

OTViewIt Extras logfile created on: 04.09.2008 17:19:54 - Run 1
OTViewIt by OldTimer - Version 1.0.1.8 Folder = C:\Documents and Settings\Øivind\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000414 | Country: Norway | Language: NOR | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 160,44 Gb Free Space | 68,89% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 280,89 Gb Free Space | 60,31% Space Free | Partition Type: NTFS
Drive E: | 698,64 Gb Total Space | 398,11 Gb Free Space | 56,98% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
[08.04.2004 02:00 PM | 00,140,800 | ---- | M] (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
[08.04.2004 02:00 PM | 00,140,800 | ---- | M] (Microsoft Corporation)

"C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe" = C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server
File not found

"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
[08.22.2008 11:57 AM | 00,267,056 | ---- | M] (BitTorrent, Inc.)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
File not found

"C:\Program Files\Steam\steamapps\gimme_more\team fortress 2\hl2.exe" = C:\Program Files\Steam\steamapps\gimme_more\team fortress 2\hl2.exe:*:Enabled:hl2
[09.01.2008 03:15 PM | 00,098,304 | ---- | M] ()

"E:\Spill\Call of duty 4\iw3mp.exe" = E:\Spill\Call of duty 4\iw3mp.exe:*:Enabled:Call of Duty® 4 - Modern Warfare™
[10.04.2007 09:14 AM | 03,325,952 | ---- | M] ()

"C:\Documents and Settings\Øivind\My Documents\Downloads\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\Grid\GRID.exe" = C:\Documents and Settings\Øivind\My Documents\Downloads\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\Grid\GRID.exe:*:Enabled:GRID Executable
File not found

"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
File not found

"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
File not found

"E:\Spill\Assassins Creed\AssassinsCreed_Dx9.exe" = E:\Spill\Assassins Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9
[05.05.2008 01:25 PM | 24,662,016 | ---- | M] (Ubisoft)

"E:\Spill\Assassins Creed\AssassinsCreed_Dx10.exe" = E:\Spill\Assassins Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10
[04.16.2008 05:35 PM | 25,667,160 | ---- | M] (Ubisoft)

"E:\Spill\Assassins Creed\AssassinsCreed_Launcher.exe" = E:\Spill\Assassins Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update
[02.22.2008 11:08 AM | 00,619,144 | ---- | M] (Ubisoft)

"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\English\setup.exe" = C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\English\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup
[02.08.2008 06:04 PM | 00,072,264 | ---- | M] (Kaspersky Lab)

"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe:*:Enabled:Kaspersky Anti-Virus
[02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab)

"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
[07.06.2006 06:53 PM | 20,034,600 | ---- | M] ()

"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
[07.24.2007 03:17 PM | 00,229,376 | ---- | M] (Apple Inc.)

"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
[07.30.2008 10:47 AM | 20,252,968 | ---- | M] (Apple Inc.)

"E:\Spill\System\ArmyOps.exe" = E:\Spill\System\ArmyOps.exe:*:Enabled:ArmyOps
[03.20.2008 10:30 AM | 00,131,072 | ---- | M] ()

"C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe" = C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe:*:Enabled:Kerio Personal Firewall 4 - GUI
[10.10.2005 09:56 AM | 02,887,680 | ---- | M] (Kerio Technologies)

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] - "%1" %*
.cmd [@ = cmdfile] - "%1" %*
.com [@ = comfile] - "%1" %*
.exe [@ = exefile] - "%1" %*
.pif [@ = piffile] - "%1" %*
.scr [@ = scrfile] - "%1" /S

========== Winsock2 Catalogs ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\]
NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - [07.24.2007 03:17 PM | 00,147,456 | ---- | M] (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll

========== HKEY_LOCAL_MACHINE Protocol Defaults ==========


========== HKEY_CURRENT_USER Protocol Defaults ==========


========== Protocol Handlers ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\]
ipp: [HKLM - No CLSID value]
msdaipp: [HKLM - No CLSID value]

========== Protocol Filters ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{18F11181-EA1A-42AE-AF89-4867C7F7A6FA}" = Sound Blaster X-Fi
"{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet
"{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java™ 6 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{333BECA0-DED8-4139-A516-8D9E44E22669}" = Kerio Personal Firewall
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D654496-9C3D-4565-858C-3E551ECDA4E2}" = Virtual Cable Tester
"{3DE0053C-FD9A-483E-B7C9-B06E4392206E}" = iTunes
"{43FFE159-3199-4188-A1CD-629166AD1033}" = Nero 7 Ultra Edition
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{49C88E44-1B38-4FC6-824E-2BDA3063B0E3}" = Apple Mobile Device Support
"{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}" = Kaspersky Anti-Virus 7.0
"{4C590030-7469-453E-8589-D15DA9D03F52}" = ANIWZCS2 Service
"{53C020C2-8C1A-11D9-8BDE-F66BAD1E3F3A}" = EndNote 9 Volume License Edition
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{5A0B7BA5-4682-4273-81C2-69B17E649103}" = GRID
"{65F1CF63-31E0-450B-96F3-4A88BE7361A6}" = AGEIA PhysX v7.07.09
"{6846389C-BAC0-4374-808E-B120F86AF5D7}" = Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76C24F39-B161-498F-BD8B-C64789812D13}_is1" = ConvertXtoDVD 3.0.0.9
"{7B5CE976-C7A9-4E38-A7F3-6C8EF025DD8E}" = ANIO Service
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{91120414-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AC76BA86-7AD7-1033-7B44-A81200000003}_Adobe Reader 8.1.2" = Adobe Reader 8.1.2 Security Update 1 (KB403742)
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C04E32E0-0416-434D-AFB9-6969D703A9EF}" = MSXML 4.0 SP2 (KB936181)
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{D7D2F494-89E3-42ED-8A2B-75BDD9B464CB}" = D-Link RangeBooster N DWA-140
"{D873FA4B-C374-4F8A-8D9A-130DB56FAB16}" = America's Army
"{DC3065BF-95B4-42C5-B47D-0B713CDA75D0}" = Creative Zen Vision M
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E0FA1DC5-FEBF-4E7B-8FA3-DB94233E952D}" = Razer Lycosa
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"{F7338FA3-DAB5-49B2-900D-0AFB5760C166}" = PC Probe II
"{FF3D660E-E5CC-47FD-8050-1B4DE3BA81A9}" = Dual-Core Optimizer
"53F13DB4D9611FD63BE580F06F0729BF236ABE68" = Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"593AFD5277FA19E67C70E56534B45B0DDD9ED9FE" = Windows Driver Package - Razer (HidUsb) HIDClass (01/11/2007 1.0)
"7-Zip" = 7-Zip 4.57
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"ALUpdate_is1" = ALUpdate
"ALZip_is1" = ALZip
"AudioCS" = Creative Audio Console
"Creative Removable Disk Manager" = Creative Removable Disk Manager
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"getPlus®_ocx" = getPlus®_ocx
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"InstallWIX_{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}" = Kaspersky Anti-Virus 7.0
"ISI ResearchSoft - Export Helper" = ISI ResearchSoft - Export Helper
"KB873339" = Windows XP Hotfix - KB873339
"KB885835" = Windows XP Hotfix - KB885835
"KB885836" = Windows XP Hotfix - KB885836
"KB886185" = Windows XP Hotfix - KB886185
"KB887472" = Windows XP Hotfix - KB887472
"KB888302" = Windows XP Hotfix - KB888302
"KB890046" = Security Update for Windows XP (KB890046)
"KB890859" = Windows XP Hotfix - KB890859
"KB891781" = Windows XP Hotfix - KB891781
"KB893756" = Security Update for Windows XP (KB893756)
"KB893803v2" = Windows Installer 3.1 (KB893803)
"KB894391" = Update for Windows XP (KB894391)
"KB896358" = Security Update for Windows XP (KB896358)
"KB896423" = Security Update for Windows XP (KB896423)
"KB896428" = Security Update for Windows XP (KB896428)
"KB898461" = Update for Windows XP (KB898461)
"KB899587" = Security Update for Windows XP (KB899587)
"KB899591" = Security Update for Windows XP (KB899591)
"KB900485" = Update for Windows XP (KB900485)
"KB900725" = Security Update for Windows XP (KB900725)
"KB901017" = Security Update for Windows XP (KB901017)
"KB901214" = Security Update for Windows XP (KB901214)
"KB902400" = Security Update for Windows XP (KB902400)
"KB905414" = Security Update for Windows XP (KB905414)
"KB905749" = Security Update for Windows XP (KB905749)
"KB908519" = Security Update for Windows XP (KB908519)
"KB908531" = Update for Windows XP (KB908531)
"KB910437" = Update for Windows XP (KB910437)
"KB911280" = Update for Windows XP (KB911280)
"KB911562" = Security Update for Windows XP (KB911562)
"KB911564" = Security Update for Windows Media Player (KB911564)
"KB911927" = Security Update for Windows XP (KB911927)
"KB913580" = Security Update for Windows XP (KB913580)
"KB914388" = Security Update for Windows XP (KB914388)
"KB914389" = Security Update for Windows XP (KB914389)
"KB915865" = Hotfix for Windows XP (KB915865)
"KB916595" = Update for Windows XP (KB916595)
"KB918118" = Security Update for Windows XP (KB918118)
"KB918439" = Security Update for Windows XP (KB918439)
"KB920213" = Security Update for Windows XP (KB920213)
"KB920670" = Security Update for Windows XP (KB920670)
"KB920683" = Security Update for Windows XP (KB920683)
"KB920685" = Security Update for Windows XP (KB920685)
"KB920872" = Update for Windows XP (KB920872)
"KB922582" = Update for Windows XP (KB922582)
"KB922819" = Security Update for Windows XP (KB922819)
"KB923191" = Security Update for Windows XP (KB923191)
"KB923414" = Security Update for Windows XP (KB923414)
"KB923980" = Security Update for Windows XP (KB923980)
"KB924270" = Security Update for Windows XP (KB924270)
"KB924667" = Security Update for Windows XP (KB924667)
"KB925398_WMP64" = Security Update for Windows Media Player 6.4 (KB925398)
"KB925902" = Security Update for Windows XP (KB925902)
"KB926239" = Hotfix for Windows XP (KB926239)
"KB926255" = Security Update for Windows XP (KB926255)
"KB926436" = Security Update for Windows XP (KB926436)
"KB927779" = Security Update for Windows XP (KB927779)
"KB927802" = Security Update for Windows XP (KB927802)
"KB928255" = Security Update for Windows XP (KB928255)
"KB928843" = Security Update for Windows XP (KB928843)
"KB929123" = Security Update for Windows XP (KB929123)
"KB929399" = Hotfix for Windows Media Format 11 SDK (KB929399)
"KB930178" = Security Update for Windows XP (KB930178)
"KB930916" = Update for Windows XP (KB930916)
"KB931261" = Security Update for Windows XP (KB931261)
"KB931784" = Security Update for Windows XP (KB931784)
"KB932168" = Security Update for Windows XP (KB932168)
"KB932823-v3" = Update for Windows XP (KB932823-v3)
"KB933729" = Security Update for Windows XP (KB933729)
"KB935839" = Security Update for Windows XP (KB935839)
"KB935840" = Security Update for Windows XP (KB935840)
"KB936021" = Security Update for Windows XP (KB936021)
"KB936782_WMP11" = Security Update for Windows Media Player 11 (KB936782)
"KB937894" = Security Update for Windows XP (KB937894)
"KB938127-IE7" = Security Update for Windows Internet Explorer 7 (KB938127)
"KB938828" = Update for Windows XP (KB938828)
"KB939683" = Hotfix for Windows Media Player 11 (KB939683)
"KB941569" = Security Update for Windows XP (KB941569)
"KB941644" = Security Update for Windows XP (KB941644)
"KB941693" = Security Update for Windows XP (KB941693)
"KB942763" = Update for Windows XP (KB942763)
"KB943055" = Security Update for Windows XP (KB943055)
"KB943460" = Security Update for Windows XP (KB943460)
"KB943485" = Security Update for Windows XP (KB943485)
"KB944653" = Security Update for Windows XP (KB944653)
"KB945553" = Security Update for Windows XP (KB945553)
"KB946026" = Security Update for Windows XP (KB946026)
"KB948590" = Security Update for Windows XP (KB948590)
"KB950749" = Security Update for Windows XP (KB950749)
"KB950759-IE7" = Security Update for Windows Internet Explorer 7 (KB950759)
"KB950760" = Security Update for Windows XP (KB950760)
"KB950762" = Security Update for Windows XP (KB950762)
"KB950974" = Security Update for Windows XP (KB950974)
"KB951066" = Security Update for Windows XP (KB951066)
"KB951072-v2" = Update for Windows XP (KB951072-v2)
"KB951376-v2" = Security Update for Windows XP (KB951376-v2)
"KB951698" = Security Update for Windows XP (KB951698)
"KB951748" = Security Update for Windows XP (KB951748)
"KB951978" = Update for Windows XP (KB951978)
"KB952287" = Hotfix for Windows XP (KB952287)
"KB952954" = Security Update for Windows XP (KB952954)
"KB953838-IE7" = Security Update for Windows Internet Explorer 7 (KB953838)
"KB953839" = Security Update for Windows XP (KB953839)
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.9.5 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.0)" = Mozilla Firefox (3.0)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"mv61xxDriver" = marvell 61xx
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"PokerStars" = PokerStars
"PopupPopper" = Bayden PopupPopper (remove only)
"RivaTuner" = RivaTuner v2.09
"Skype_is1" = Skype 2.5
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"SpywareBlaster_is1" = SpywareBlaster 4.1
"SpywareGuard_is1" = SpywareGuard v2.2
"Steam App 3483" = Peggle Extreme
"SysInfo" = Creative System Information
"SystemRequirementsLab" = System Requirements Lab
"Terrorist Takedown - Conflict in Mogadishu" = Terrorist Takedown - Conflict in Mogadishu
"VLC media player" = VideoLAN VLC media player 0.8.6h
"WgaNotify" = Windows Genuine Advantage Notifications (KB905474)
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows Mobile Device Handbook" = Windows Mobile® Device Handbook
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========


[ Application Events ]
Error - 06.08.2008 14:57:40 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Error
Description = Faulting application iexplore.exe, version 7.0.6000.16674, faulting
module ieframe.dll, version 7.0.6000.16674, fault address 0x00095721.

Error - 06.08.2008 18:20:35 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Hang
Description = Hanging application ConvertXtoDvd.exe, version 3.0.0.9, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 06.08.2008 18:49:55 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Hang
Description = Hanging application Steam.exe, version 1.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 10.08.2008 11:53:26 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Error
Description = Faulting application ANIWZCSdS.exe, version 1.0.3.7034, faulting module
user32.dll, version 5.1.2600.3099, fault address 0x00015a48.

Error - 10.08.2008 12:25:34 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Error
Description = Faulting application nero.exe, version 7.8.5.0, faulting module nerofiledialog.dll,
version 2.0.5.0, fault address 0x00013a37.

Error - 13.08.2008 14:31:59 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Hang
Description = Hanging application ATF-Cleaner.exe, version 3.0.0.2, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 13.08.2008 15:46:20 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Application Hang
Description = Hanging application iTunes.exe, version 7.7.1.11, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 14.08.2008 14:03:30 - Computer Name = STASJONÆR - User Name = User SID not found - Source = ESENT
Description = wuauclt (4960) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb"
for read / write access failed with system error 32 (0x00000020): "The process
cannot access the file because it is being used by another process. ". The open
file operation will fail with error -1032 (0xfffffbf8).

Error - 14.08.2008 14:03:30 - Computer Name = STASJONÆR - User Name = User SID not found - Source = ESENT
Description = wuauclt (4960) Unable to write a shadowed header for file C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb.
Error -1032.

Error - 14.08.2008 14:03:36 - Computer Name = STASJONÆR - User Name = User SID not found - Source = ESENT
Description = wuauclt (4960) Database recovery/restore failed with unexpected error
-1032.


[ Internet Explorer Events ]

[ Security Events ]

[ System Events ]
Error - 17.08.2008 20:16:18 - Computer Name = STASJONÆR - User Name = NT AUTHORITY\SYSTEM - Source = DCOM
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 17.08.2008 20:57:54 - Computer Name = STASJONÆR - User Name = NT AUTHORITY\SYSTEM - Source = DCOM
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 17.08.2008 21:09:30 - Computer Name = STASJONÆR - User Name = NT AUTHORITY\SYSTEM - Source = DCOM
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 17.08.2008 21:10:19 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Service Control Manager
Description = The following boot-start or system-start driver(s) failed to load:
AmdK8 AsIO Fips kl1 klif

Error - 17.08.2008 21:10:31 - Computer Name = STASJONÆR - User Name = NT AUTHORITY\SYSTEM - Source = DCOM
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 17.08.2008 21:14:14 - Computer Name = STASJONÆR - User Name = User SID not found - Source = WinDefend
Description = %%827 has encountered an error trying to load signatures and will
attempt reverting back to a known-good set of signatures. Signatures Attempted: %%824

Error
Code: 0x8050a001 Error description: The program can't find definition files that
help detect unwanted software. Check for updates to the definition files, and then
try again. For information on installing updates, see Help and Support. Signatures
loading: %%825 Loading signature version: 1.41.172.0 Loading engine version: 1.1.3807.0

Error - 29.08.2008 09:19:48 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Cdrom
Description = The device, \Device\CdRom0, has a bad block.

Error - 29.08.2008 13:06:06 - Computer Name = STASJONÆR - User Name = User SID not found - Source = Service Control Manager
Description = The PnkBstrA service terminated unexpectedly. It has done this 1
time(s).

Error - 01.09.2008 07:48:38 - Computer Name = STASJONÆR - User Name = User SID not found - Source = AmdLLD
Description = AdjustCoreTSC() Node[ 0 ] Core[ 0 ] Cpu[ 0 ] Affinity[ 0x1 ] Error:
HalGetBusDataByOffset() failed reading north-bridge TSC.

Error - 01.09.2008 21:27:04 - Computer Name = STASJONÆR - User Name = User SID not found - Source = System Error
Description = Error code 100000d1, parameter1 00000000, parameter2 00000002, parameter3
00000008, parameter4 00000000.


< End of report >


OTViewIt logfile created on: 04.09.2008 17:19:54 - Run 1
OTViewIt by OldTimer - Version 1.0.1.8 Folder = C:\Documents and Settings\Øivind\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000414 | Country: Norway | Language: NOR | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 160,44 Gb Free Space | 68,89% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 280,89 Gb Free Space | 60,31% Space Free | Partition Type: NTFS
Drive E: | 698,64 Gb Total Space | 398,11 Gb Free Space | 56,98% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: STASJONÆR
Current User Name: Øivind
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Whitelist: On

===== Processes - Non-Microsoft Only =====

[08.20.2007 02:05 PM | 01,671,168 | ---- | M] (D-Link) - C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe
[11.20.2007 04:53 PM | 00,147,456 | ---- | M] (Razer USA Ltd.) - C:\Program Files\Razer\Lycosa\razerhid.exe
[02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
[04.28.2008 08:25 PM | 02,707,456 | ---- | M] () - C:\Program Files\RivaTuner v2.09\RivaTuner.exe
[08.29.2003 07:05 PM | 00,360,448 | ---- | M] () - C:\Program Files\SpywareGuard\sgmain.exe
[08.29.2003 11:14 AM | 00,233,472 | ---- | M] () - C:\Program Files\SpywareGuard\sgbhp.exe
[02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
[10.10.2005 09:58 AM | 01,617,920 | ---- | M] (Kerio Technologies) - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
[10.10.2005 09:56 AM | 02,887,680 | ---- | M] (Kerio Technologies) - C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
[08.08.2008 07:25 PM | 00,066,872 | ---- | M] () - C:\WINDOWS\system32\PnkBstrA.exe
[01.07.2008 01:28 PM | 00,143,360 | ---- | M] () - C:\Program Files\Razer\Lycosa\razertra.exe
[10.10.2005 09:56 AM | 02,887,680 | ---- | M] (Kerio Technologies) - C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
[08.22.2008 11:57 AM | 00,267,056 | ---- | M] (BitTorrent, Inc.) - C:\Program Files\uTorrent\uTorrent.exe

===== Win32 Services - Non-Microsoft Only =====

(ANIWZCSdService) ANIWZCSd Service [Auto | Stopped]
[01.19.2007 11:49 AM | 00,049,152 | ---- | M] (Wireless Service) - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

(AVP) Kaspersky Anti-Virus 7.0 [Auto | Running]
[02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

(Creative Audio Engine Licensing Service) Creative Audio Engine Licensing Service [On_Demand | Stopped]
[08.26.2008 07:10 PM | 00,079,360 | ---- | M] (Creative Labs) - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe

(KPF4) Kerio Personal Firewall 4 [Auto | Running]
[10.10.2005 09:58 AM | 01,617,920 | ---- | M] (Kerio Technologies) - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

(PnkBstrA) PnkBstrA [Auto | Running]
[08.08.2008 07:25 PM | 00,066,872 | ---- | M] () - C:\WINDOWS\system32\PnkBstrA.exe

===== Driver Services - Non-Microsoft Only =====

(AmdK8) AMD Processor Driver [System | Running]
[06.18.2006 11:37 PM | 00,036,864 | ---- | M] (Advanced Micro Devices) - C:\WINDOWS\system32\drivers\AmdK8.sys

(AmdLLD) AMD Low Level Device Driver [On_Demand | Running]
[06.29.2007 02:47 PM | 00,034,304 | ---- | M] (AMD, Inc.) - C:\WINDOWS\system32\drivers\AmdLLD.sys

(ANIO) ANIO Service [Auto | Running]
[12.11.2005 11:55 AM | 00,028,195 | ---- | M] (Alpha Networks Inc.) - C:\WINDOWS\system32\ANIO.sys

(AsIO) AsIO [System | Running]
[10.18.2006 09:12 PM | 00,012,664 | R--- | M] () - C:\WINDOWS\system32\drivers\AsIO.sys

(fwdrv) Firewall Driver [System | Running]
[09.26.2005 11:05 AM | 00,286,720 | ---- | M] (Kerio Technologies) - C:\WINDOWS\system32\drivers\fwdrv.sys

(khips) Kerio HIPS Driver [System | Running]
[09.26.2005 11:05 AM | 00,081,920 | ---- | M] () - C:\WINDOWS\system32\drivers\khips.sys

(kl1) kl1 [Boot | Running]
[08.03.2008 09:54 AM | 00,112,144 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\kl1.sys

(klif) klif [System | Running]
[12.28.2007 07:51 PM | 00,195,344 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\klif.sys

(klim5) Kaspersky Anti-Virus NDIS Filter [On_Demand | Running]
[12.13.2007 01:28 PM | 00,024,592 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\klim5.sys

(LycoFltr) Lycosa Keyboard [On_Demand | Running]
[01.18.2008 02:43 PM | 00,016,128 | ---- | M] (Razer USA Ltd.) - C:\WINDOWS\system32\drivers\Lycosa.sys

(MTsensor) ATK0110 ACPI UTILITY [On_Demand | Running]
[08.14.2004 04:56 AM | 00,005,810 | R--- | M] () - C:\WINDOWS\system32\drivers\ASACPI.sys

(mv61xx) mv61xx [Boot | Running]
[06.15.2007 09:52 AM | 00,143,256 | ---- | M] (Marvell Semiconductor, Inc.) - C:\WINDOWS\system32\drivers\mv61xx.sys

(pcouffin) VSO Software pcouffin [On_Demand | Running]
[06.25.2008 04:33 PM | 00,047,360 | ---- | M] (VSO Software) - C:\WINDOWS\system32\drivers\pcouffin.sys

(RivaTuner32) RivaTuner32 [On_Demand | Running]
[04.28.2008 08:25 PM | 00,009,088 | ---- | M] () - C:\Program Files\RivaTuner v2.09\RivaTuner32.sys

(rt2870) Ralink 802.11n USB Wireless LAN Card Driver [On_Demand | Running]
[07.28.2007 02:50 PM | 00,517,632 | ---- | M] (Ralink Technology, Corp.) - C:\WINDOWS\system32\drivers\rt2870.sys

(SASDIFSV) SASDIFSV [System | Running]
[08.28.2008 03:52 PM | 00,008,944 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS

(SASENUM) SASENUM [On_Demand | Stopped]
[02.16.2006 04:51 PM | 00,004,096 | R--- | M] (SuperAdBlocker, Inc.) - C:\Program Files\SUPERAntiSpyware\SASENUM.SYS

(SASKUTIL) SASKUTIL [System | Running]
[08.28.2008 03:52 PM | 00,055,024 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

(sptd) sptd [Boot | Running]
[06.26.2008 10:29 AM | 00,685,816 | ---- | M] () - C:\WINDOWS\system32\drivers\sptd.sys

(yukonwxp) NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller [On_Demand | Stopped]
[06.08.2007 10:15 AM | 00,262,912 | ---- | M] (Marvell) - C:\WINDOWS\system32\drivers\yk51x86.sys

========== Run Keys ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt" = C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [07.23.2007 11:06 AM | 00,077,824 | ---- | M] (AMD)
"AudioDrvEmulator" = "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" [11.04.2005 06:07 PM | 00,049,152 | ---- | M] (Creative Technology Ltd.)
"AVP" = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [02.08.2008 06:36 PM | 00,227,856 | ---- | M] (Kaspersky Lab)
"Cpu Level Up help" = C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe [11.30.2007 08:03 PM | 00,881,152 | ---- | M] ()
"CPU Power Monitor" = "C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe" [10.16.2007 11:35 AM | 00,626,176 | ---- | M] ()
"CTDVDDET" = "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [06.18.2003 01:00 AM | 00,045,056 | ---- | M] (Creative Technology Ltd)
"CTHelper" = CTHELPER.EXE [02.20.2008 08:58 PM | 00,019,456 | ---- | M] (Creative Technology Ltd)
"CTxfiHlp" = CTXFIHLP.EXE [07.11.2008 03:50 PM | 00,019,968 | ---- | M] (Creative Technology Ltd)
"D-Link D-Link RangeBooster N DWA-140" = C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe [08.20.2007 02:05 PM | 01,671,168 | ---- | M] (D-Link)
"Lycosa" = "C:\Program Files\Razer\Lycosa\razerhid.exe" [11.20.2007 04:53 PM | 00,147,456 | ---- | M] (Razer USA Ltd.)
"NvCplDaemon" = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [05.16.2008 02:01 PM | 13,529,088 | ---- | M] (NVIDIA Corporation)
"NvMediaCenter" = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [05.16.2008 02:01 PM | 00,086,016 | ---- | M] (NVIDIA Corporation)
"nwiz" = nwiz.exe /install [05.16.2008 02:01 PM | 01,630,208 | ---- | M] ()
"RCSystem" = "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup [11.04.2005 06:07 PM | 00,049,152 | ---- | M] (Creative Technology Ltd.)
"RivaTuner" = "C:\Program Files\RivaTuner v2.09\RivaTuner.exe" /T [04.28.2008 08:25 PM | 02,707,456 | ---- | M] ()
"RivaTunerStartupDaemon" = "C:\Program Files\RivaTuner v2.09\RivaTuner.exe" /S [04.28.2008 08:25 PM | 02,707,456 | ---- | M] ()
"UpdReg" = C:\WINDOWS\UpdReg.EXE [05.11.2000 01:00 AM | 00,090,112 | ---- | M] (Creative Technology Ltd.)
"VolPanel" = "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r [07.28.2006 09:56 AM | 00,122,880 | ---- | M] (Creative Technology Ltd)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = Reg Error: Value load does not exist or could not be read.
"run" = Reg Error: Value run does not exist or could not be read.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" =
"run" = Reg Error: Value run does not exist or could not be read.

========== Startup Folders ==========

[All Users Startup Folder - C:\Documents and Settings\All Users\Start Menu\Programs\Startup]

[Øivind Startup Folder - C:\Documents and Settings\Øivind\Start Menu\Programs\Startup]
[08.29.2003 07:05 PM | 00,360,448 | ---- | M] () - C:\Documents and Settings\Øivind\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

========== BHO's ==========

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
HKLM CLSID: (Adobe PDF Reader Link Helper) - [10.22.2006 11:08 PM | 00,062,080 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41353F8B-78CE-48A5-BE44-153ED293D192}]
HKLM CLSID: (Control Popups in Internet Explorer) - [05.26.2003 11:41 PM | 00,109,568 | ---- | M] (Bayden Systems) C:\Program Files\PopupPopper\PopLib.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A368E80-174F-4872-96B5-0B27DDD11DB2}]
HKLM CLSID: (SpywareGuardDLBLOCK.CBrowserHelper) - [08.02.2003 11:24 PM | 00,192,512 | R--- | M] () C:\Program Files\SpywareGuard\dlprotect.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
HKLM CLSID: (Spybot-S&D IE Protection) - [01.28.2008 11:43 AM | 01,554,256 | ---- | M] (Safer Networking Limited) C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
HKLM CLSID: (SSVHelper Class) - [06.10.2008 04:27 AM | 00,509,328 | ---- | M] (Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

========== Toolbars ==========

========== AppInit_Dlls ==========

========== Shell Execute Hooks ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}" =
HKLM CLSID: (SABShellExecuteHook Class) - [08.28.2008 03:52 PM | 00,077,824 | ---- | M] (SuperAdBlocker.com) C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
"{81559C35-8464-49F7-BB0E-07A383BEF910}" =
HKLM CLSID: (SpywareGuard.Handler) - [08.02.2003 11:20 PM | 00,126,976 | R--- | M] () C:\Program Files\SpywareGuard\spywareguard.dll

========== HKLM Security Providers ==========

========== HKLM Winlogon Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell]
= Explorer.exe
>Explorer.exe - [06.13.2007 12:23 PM | 01,033,216 | ---- | M] (Microsoft Corporation) C:\WINDOWS\explorer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit]
= C:\WINDOWS\system32\userinit.exe,
>C:\WINDOWS\system32\userinit.exe - [08.04.2004 02:00 PM | 00,024,576 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\userinit.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost]
= logonui.exe
>logonui.exe - [08.04.2004 02:00 PM | 00,514,560 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\logonui.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet]
= rundll32 shell32,Control_RunDLL "sysdm.cpl"
>rundll32 shell32 - [10.26.2007 05:36 AM | 08,454,656 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
>Control_RunDLL "sysdm.cpl" - [08.04.2004 02:00 PM | 00,298,496 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\sysdm.cpl

========== User's Winlogon Settings ==========

========== Winlogon Notify Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
"DllName" = C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [08.28.2008 03:52 PM | 00,352,256 | ---- | M] (SUPERAntiSpyware.com)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
"DllName" = C:\WINDOWS\system32\klogon.dll [02.08.2008 06:37 PM | 00,219,664 | ---- | M] (Kaspersky Lab)

========== Policies ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
Unable to open key or key not present!


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"dontdisplaylastusername" = 0
"legalnoticecaption" =
"legalnoticetext" =
"shutdownwithoutlogon" = 1
"undockwithoutlogon" = 1

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun" = 145

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
Unable to open key or key not present!


========== Lsa Authentication Packages ==========

========== Lsa Security Packages ==========

========== Desktop Components ==========

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"FriendlyName" = "My Current Home Page"
"Source" = "About:Home"
"SubscribedURL" = "About:Home"

========== Safeboot Options ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]
"AlternateShell" = cmd.exe

========== Disabled MsConfig Items ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^Øivind^Start Menu^Programs^Startup^MarvellTrayStartup.lnk]
"path" = C:\Documents and Settings\Øivind\Start Menu\Programs\Startup\MarvellTrayStartup.lnk File not found
"backup" = C:\WINDOWS\pss\MarvellTrayStartup.lnk File not found
"location" = Startup
"command" = C:\PROGRA~1\Marvell\61xx\tray\RaidTray.bat File not found
"item" = MarvellTrayStartup

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = Reader_sl
"hkey" = HKLM
"command" = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [01.11.2008 10:16 PM | 00,039,792 | ---- | M] (Adobe Systems Incorporated)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Ai Nap]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = AiNap
"hkey" = HKLM
"command" = C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe [09.06.2007 11:19 AM | 01,426,432 | ---- | M] ()
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ANIWZCS2Service]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = WZCSLDR2
"hkey" = HKLM
"command" = C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe [01.19.2007 11:49 AM | 00,049,152 | ---- | M] (Wireless Service)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AppleSyncNotifier]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = AppleSyncNotifier
"hkey" = HKLM
"command" = C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [07.22.2008 08:42 PM | 00,116,040 | ---- | M] (Apple Inc.)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = NMBgMonitor
"hkey" = HKCU
"command" = C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [03.12.2007 01:49 PM | 00,153,136 | ---- | M] (Nero AG)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = iTunesHelper
"hkey" = HKLM
"command" = C:\Program Files\iTunes\iTunesHelper.exe [07.30.2008 10:47 AM | 00,289,064 | ---- | M] (Apple Inc.)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NeroFilterCheck]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = NeroCheck
"hkey" = HKLM
"command" = C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [03.09.2007 06:53 PM | 00,153,136 | ---- | M] (Nero AG)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = qttask
"hkey" = HKLM
"command" = C:\Program Files\QuickTime\QTTask.exe [05.27.2008 10:50 AM | 00,413,696 | ---- | M] (Apple Inc.)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunJavaUpdateSched]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = jusched
"hkey" = HKLM
"command" = C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [06.10.2008 04:27 AM | 00,144,784 | ---- | M] (Sun Microsystems, Inc.)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SUPERAntiSpyware]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = SUPERAntiSpyware
"hkey" = HKCU
"command" = C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE [08.28.2008 03:52 PM | 01,576,176 | ---- | M] (SUPERAntiSpyware.com)
"inimapping" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"system.ini" = 0
"win.ini" = 0
"bootini" = 0
"services" = 0
"startup" = 2

========== CDRom AutoRun Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun" = 1

========== Autorun Files on Drives ==========

AUTOEXEC.BAT []
[06.25.2008 03:59 PM | 00,000,000 | ---- | M] () C:\AUTOEXEC.BAT [ NTFS ]

AUTOEXEC.BAT []
[04.27.2008 08:13 PM | 00,000,000 | ---- | M] () D:\AUTOEXEC.BAT [ NTFS ]

========== MountPoints2 ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3082f0d3-5e1a-11dd-add1-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ec3f273-5514-11dd-adc7-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ec3f274-5514-11dd-adc7-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e0216ed2-482c-11dd-adaf-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e25-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e26-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e27-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e28-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e29-6882-11dd-ade0-001b111f2657}\Shell]
"" = None

========== DNS Name Servers ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{32815B77-6891-404B-A6CD-DA7926FFE6BB}]
Servers: 193.213.112.4,130.67.60.68 | Description: D-Link DWA-140 RangeBooster N USB Adapter

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{33BD519D-F9D1-461D-990E-5AE414EC6025}]
Servers: | Description: Windows Mobile-based Device

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{6ED0AA5B-9546-4B3E-8630-35C1D95ED623}]
Servers: | Description: Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{DB270EE0-F019-4276-B87F-93270A5E5F89}]
Servers: | Description: 1394 Net Adapter

========== Hosts File ==========

HOSTS File = (250769 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
First 25 entries...
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.1001-search.info
127.0.0.1 1001-search.info
127.0.0.1 www.100888290cs.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.10sek.com
127.0.0.1 10sek.com
127.0.0.1 www.123topsearch.com
127.0.0.1 123topsearch.com
127.0.0.1 www.132.com
127.0.0.1 132.com
127.0.0.1 www.136136.net
127.0.0.1 136136.net



========== Files/Folders - Created Within 30 days ==========

[08.17.2008 11:11 PM | ---D | C] - C:\Config.Msi
[08.26.2008 07:14 PM | ---D | C] - C:\Guru3D.com
[09.02.2008 03:59 PM | 00,813,056 | ---- | C] () - C:\pbsetup.exe
[09.02.2008 04:11 PM | 00,000,054 | ---- | C] () - C:\pbuser.htm
[09.02.2008 04:11 PM | 00,009,678 | ---- | C] () - C:\pbgame.htm
[08.29.2008 11:04 AM | 00,010,880 | ---- | C] (Aureal, Inc.) - C:\WINDOWS\System32\dllcache\admjoy.sys
[08.29.2008 11:04 AM | 00,020,160 | ---- | C] (ADMtek Incorporated) - C:\WINDOWS\System32\dllcache\adm8511.sys
[08.29.2008 11:04 AM | 00,046,112 | ---- | C] (Adaptec, Inc ) - C:\WINDOWS\System32\dllcache\adptsf50.sys
[08.29.2008 11:04 AM | 00,061,440 | ---- | C] (Color Flatbed Scanner) - C:\WINDOWS\System32\dllcache\acerscad.dll
[08.29.2008 11:04 AM | 00,084,480 | ---- | C] (VIA Technologies, Inc.) - C:\WINDOWS\System32\dllcache\ac97via.sys
[08.29.2008 11:04 AM | 00,148,352 | ---- | C] (3dfx Interactive, Inc.) - C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[08.29.2008 11:04 AM | 00,297,728 | ---- | C] (Silicon Integrated Systems Corp.) - C:\WINDOWS\System32\dllcache\ac97sis.sys
[08.29.2008 11:04 AM | 00,462,848 | ---- | C] (Aureal Inc.) - C:\WINDOWS\System32\dllcache\a3dapi.dll
[08.29.2008 11:04 AM | 00,553,984 | ---- | C] (Aureal, Inc.) - C:\WINDOWS\System32\dllcache\adm8820.sys
[08.29.2008 11:04 AM | 00,584,448 | ---- | C] (Aureal, Inc.) - C:\WINDOWS\System32\dllcache\adm8810.sys
[08.29.2008 11:04 AM | 00,689,216 | ---- | C] (3dfx Interactive, Inc.) - C:\WINDOWS\System32\dllcache\3dfxvs.dll
[08.29.2008 11:04 AM | 00,747,392 | ---- | C] (Aureal, Inc.) - C:\WINDOWS\System32\dllcache\adm8830.sys
[08.29.2008 11:04 AM | 00,762,780 | ---- | C] (3Com, Inc.) - C:\WINDOWS\System32\dllcache\3cwmcru.sys
[08.29.2008 11:05 AM | 00,002,944 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brfilt.sys
[08.29.2008 11:05 AM | 00,003,168 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brparimg.sys
[08.29.2008 11:05 AM | 00,003,968 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brfiltup.sys
[08.29.2008 11:05 AM | 00,009,472 | ---- | C] () - C:\WINDOWS\System32\dllcache\ativmdcd.sys
[08.29.2008 11:05 AM | 00,009,728 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brcoinst.dll
[08.29.2008 11:05 AM | 00,010,240 | ---- | C] () - C:\WINDOWS\System32\dllcache\atipcxxx.sys
[08.29.2008 11:05 AM | 00,012,160 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brfiltlo.sys
[08.29.2008 11:05 AM | 00,012,800 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brevif.dll
[08.29.2008 11:05 AM | 00,015,360 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brmfbidi.dll
[08.29.2008 11:05 AM | 00,016,969 | ---- | C] (AmbiCom, Inc.) - C:\WINDOWS\System32\dllcache\amb8002.sys
[08.29.2008 11:05 AM | 00,017,152 | ---- | C] () - C:\WINDOWS\System32\dllcache\atitunep.sys
[08.29.2008 11:05 AM | 00,017,152 | ---- | C] () - C:\WINDOWS\System32\dllcache\atitvsnd.sys
[08.29.2008 11:05 AM | 00,019,456 | ---- | C] () - C:\WINDOWS\System32\dllcache\ativttxx.sys
[08.29.2008 11:05 AM | 00,019,456 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brbidiif.dll
[08.29.2008 11:05 AM | 00,023,552 | ---- | C] () - C:\WINDOWS\System32\dllcache\atixbar.sys
[08.29.2008 11:05 AM | 00,026,624 | ---- | C] () - C:\WINDOWS\System32\dllcache\ativxbar.sys
[08.29.2008 11:05 AM | 00,026,880 | ---- | C] () - C:\WINDOWS\System32\dllcache\atirtsnd.sys
[08.29.2008 11:05 AM | 00,029,696 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brmflpt.dll
[08.29.2008 11:05 AM | 00,032,256 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brmfrsmg.exe
[08.29.2008 11:05 AM | 00,036,128 | ---- | C] (3Dfx Interactive, Inc.) - C:\WINDOWS\System32\dllcache\banshee.sys
[08.29.2008 11:05 AM | 00,036,992 | ---- | C] (Aztech Systems Ltd) - C:\WINDOWS\System32\dllcache\aztw2320.sys
[08.29.2008 11:05 AM | 00,037,568 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\avmwan.sys
[08.29.2008 11:05 AM | 00,039,552 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brparwdm.sys
[08.29.2008 11:05 AM | 00,041,472 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brmfusb.dll
[08.29.2008 11:05 AM | 00,046,464 | ---- | C] () - C:\WINDOWS\System32\dllcache\atibt829.sys
[08.29.2008 11:05 AM | 00,049,920 | ---- | C] () - C:\WINDOWS\System32\dllcache\atirtcap.sys
[08.29.2008 11:05 AM | 00,077,568 | ---- | C] (ATI Technologies, Inc.) - C:\WINDOWS\System32\dllcache\ati.sys
[08.29.2008 11:05 AM | 00,087,552 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\avmcoxp.dll
[08.29.2008 11:05 AM | 00,089,952 |

[Conkey]

heres the rest of the OTViewlt.Txt file:


[08.29.2008 11:05 AM | 00,097,354 | ---- | C] (Bay Networks, Inc.) - C:\WINDOWS\System32\dllcache\aspndis3.sys
[08.29.2008 11:05 AM | 00,144,384 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\avmenum.dll
[08.29.2008 11:05 AM | 00,342,336 | ---- | C] (3Dfx Interactive, Inc.) - C:\WINDOWS\System32\dllcache\banshee.dll
[08.29.2008 11:05 AM | 00,871,388 | ---- | C] (BCM) - C:\WINDOWS\System32\dllcache\bcmdm.sys
[08.29.2008 11:06 AM | 00,005,120 | ---- | C] (Brother Industries,Ltd.) - C:\WINDOWS\System32\dllcache\brscnrsm.dll
[08.29.2008 11:06 AM | 00,009,728 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\brserif.dll
[08.29.2008 11:06 AM | 00,010,368 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brusbscn.sys
[08.29.2008 11:06 AM | 00,011,008 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brusbmdm.sys
[08.29.2008 11:06 AM | 00,020,736 | ---- | C] (OMNIKEY AG) - C:\WINDOWS\System32\dllcache\cmbp0wdm.sys
[08.29.2008 11:06 AM | 00,021,530 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\ce2n5.sys
[08.29.2008 11:06 AM | 00,021,533 | ---- | C] (Compaq Computer Corporation) - C:\WINDOWS\System32\dllcache\cpqndis5.sys
[08.29.2008 11:06 AM | 00,022,044 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\cem28n5.sys
[08.29.2008 11:06 AM | 00,022,044 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\cem33n5.sys
[08.29.2008 11:06 AM | 00,027,164 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\ce3n5.sys
[08.29.2008 11:06 AM | 00,031,529 | ---- | C] (BreezeCOM) - C:\WINDOWS\System32\dllcache\brzwlan.sys
[08.29.2008 11:06 AM | 00,032,256 | ---- | C] (Eicon Technology Corporation) - C:\WINDOWS\System32\dllcache\diapi2NT.dll
[08.29.2008 11:06 AM | 00,037,916 | ---- | C] (Fast Ethernet Controller Provider) - C:\WINDOWS\System32\dllcache\cb102.sys
[08.29.2008 11:06 AM | 00,039,680 | ---- | C] (Silicom Ltd.) - C:\WINDOWS\System32\dllcache\cb325.sys
[08.29.2008 11:06 AM | 00,046,108 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\cben5.sys
[08.29.2008 11:06 AM | 00,049,182 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\cem56n5.sys
[08.29.2008 11:06 AM | 00,060,416 | ---- | C] (Brother Industries Ltd.) - C:\WINDOWS\System32\dllcache\brserwdm.sys
[08.29.2008 11:06 AM | 00,060,970 | ---- | C] (Compaq Computer Corp.) - C:\WINDOWS\System32\dllcache\cpqtrnd5.sys
[08.29.2008 11:06 AM | 00,164,923 | ---- | C] (Eicon Technology) - C:\WINDOWS\System32\dllcache\diapi2.sys
[08.29.2008 11:06 AM | 00,216,064 | ---- | C] (COMPAQ Inc.) - C:\WINDOWS\System32\dllcache\cpscan.dll
[08.29.2008 11:06 AM | 00,272,640 | ---- | C] (RAVISENT Technologies Inc.) - C:\WINDOWS\System32\dllcache\cinemclc.sys
[08.29.2008 11:06 AM | 00,714,698 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\cbmdmkxx.sys
[08.29.2008 11:06 AM | 00,980,034 | ---- | C] (Xircom) - C:\WINDOWS\System32\dllcache\cicap.sys
[08.29.2008 11:07 AM | 00,003,072 | ---- | C] (Crystal Semiconductor Corp.) - C:\WINDOWS\System32\dllcache\cwbase.sys
[08.29.2008 11:07 AM | 00,003,072 | ---- | C] (Crystal Semiconductor Corp.) - C:\WINDOWS\System32\dllcache\cwbmidi.sys
[08.29.2008 11:07 AM | 00,003,584 | ---- | C] (Crystal Semiconductor Corp.) - C:\WINDOWS\System32\dllcache\cwcosnt5.sys
[08.29.2008 11:07 AM | 00,006,216 | ---- | C] () - C:\WINDOWS\System32\dllcache\divaci.dll
[08.29.2008 11:07 AM | 00,006,729 | ---- | C] (Eicon Technology) - C:\WINDOWS\System32\dllcache\disrvci.dll
[08.29.2008 11:07 AM | 00,020,928 | ---- | C] (Digital Networks, LLC) - C:\WINDOWS\System32\dllcache\defpa.sys
[08.29.2008 11:07 AM | 00,024,648 | ---- | C] (D-Link) - C:\WINDOWS\System32\dllcache\dfe650.sys
[08.29.2008 11:07 AM | 00,024,649 | ---- | C] (D-Link) - C:\WINDOWS\System32\dllcache\dfe650d.sys
[08.29.2008 11:07 AM | 00,026,698 | ---- | C] (D-Link Corporation) - C:\WINDOWS\System32\dllcache\dlh5xnd5.sys
[08.29.2008 11:07 AM | 00,029,696 | ---- | C] (CNet Technology, Inc. ) - C:\WINDOWS\System32\dllcache\dm9pci5.sys
[08.29.2008 11:07 AM | 00,029,768 | ---- | C] () - C:\WINDOWS\System32\dllcache\divasu.dll
[08.29.2008 11:07 AM | 00,031,305 | ---- | C] (Eicon Technology) - C:\WINDOWS\System32\dllcache\disrvpp.dll
[08.29.2008 11:07 AM | 00,037,962 | ---- | C] () - C:\WINDOWS\System32\dllcache\divaprop.dll
[08.29.2008 11:07 AM | 00,038,985 | ---- | C] (Eicon Technology) - C:\WINDOWS\System32\dllcache\disrvsu.dll
[08.29.2008 11:07 AM | 00,048,640 | ---- | C] (Crystal Semiconductor Corp.) - C:\WINDOWS\System32\dllcache\cwrwdm.sys
[08.29.2008 11:07 AM | 00,072,832 | ---- | C] (Crystal Semiconductor Corp.) - C:\WINDOWS\System32\dllcache\cwbwdm.sys
[08.29.2008 11:07 AM | 00,091,305 | ---- | C] (Eicon Technology) - C:\WINDOWS\System32\dllcache\dimaint.sys
[08.29.2008 11:07 AM | 00,093,952 | ---- | C] (Crystal Semiconductor Corp.) - C:\WINDOWS\System32\dllcache\cwcwdm.sys
[08.29.2008 11:07 AM | 00,111,872 | ---- | C] (Crystal Semiconductor Corp.) - C:\WINDOWS\System32\dllcache\cwcspud.sys
[08.29.2008 11:07 AM | 00,236,060 | ---- | C] (Eicon Technology) - C:\WINDOWS\System32\dllcache\ditrace.exe
[08.29.2008 11:07 AM | 00,249,856 | ---- | C] (Comtrol® Corporation) - C:\WINDOWS\System32\dllcache\ctmasetp.dll
[08.29.2008 11:07 AM | 00,952,007 | ---- | C] (Eicon Technology) - C:\WINDOWS\System32\dllcache\diwan.sys
[08.29.2008 11:08 AM | 00,028,062 | ---- | C] (National Semiconductor Coproration) - C:\WINDOWS\System32\dllcache\dp83820.sys
[08.29.2008 11:08 AM | 00,043,008 | ---- | C] (SEIKO EPSON CORP.) - C:\WINDOWS\System32\dllcache\esucm.dll
[08.29.2008 11:08 AM | 00,072,192 | ---- | C] (ESS Technology Inc.) - C:\WINDOWS\System32\dllcache\es1969.sys
[08.29.2008 11:08 AM | 00,334,208 | ---- | C] (Yamaha Corp.) - C:\WINDOWS\System32\dllcache\ds1wdm.sys
[08.29.2008 11:09 AM | 00,011,850 | ---- | C] (FUJITSU LIMITED) - C:\WINDOWS\System32\dllcache\f3ab18xj.sys
[08.29.2008 11:09 AM | 00,012,362 | ---- | C] (FUJITSU LIMITED) - C:\WINDOWS\System32\dllcache\f3ab18xi.sys
[08.29.2008 11:09 AM | 00,017,408 | ---- | C] (Gemplus) - C:\WINDOWS\System32\dllcache\gpr400.sys
[08.29.2008 11:09 AM | 00,024,618 | ---- | C] (NETGEAR) - C:\WINDOWS\System32\dllcache\fa410nd5.sys
[08.29.2008 11:09 AM | 00,027,165 | ---- | C] (VIA Technologies, Inc. ) - C:\WINDOWS\System32\dllcache\fetnd5.sys
[08.29.2008 11:09 AM | 00,028,288 | ---- | C] (Gemplus) - C:\WINDOWS\System32\dllcache\grserial.sys
[08.29.2008 11:09 AM | 00,034,173 | ---- | C] (Marconi Communications, Inc.) - C:\WINDOWS\System32\dllcache\forehe.sys
[08.29.2008 11:09 AM | 00,034,816 | ---- | C] (SEIKO EPSON CORP.) - C:\WINDOWS\System32\dllcache\esuimg.dll
[08.29.2008 11:09 AM | 00,045,568 | ---- | C] (SEIKO EPSON CORP.) - C:\WINDOWS\System32\dllcache\esuni.dll
[08.29.2008 11:09 AM | 00,045,568 | ---- | C] (SEIKO EPSON CORP.) - C:\WINDOWS\System32\dllcache\esunib.dll
[08.29.2008 11:09 AM | 00,082,304 | ---- | C] (Gemplus) - C:\WINDOWS\System32\dllcache\grclass.sys
[08.29.2008 11:09 AM | 00,441,728 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\fpcmbase.sys
[08.29.2008 11:09 AM | 00,442,240 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\fpnpbase.sys
[08.29.2008 11:09 AM | 00,444,416 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\fpcibase.sys
[08.29.2008 11:09 AM | 00,454,912 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\fxusbase.sys
[08.29.2008 11:09 AM | 00,455,296 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\fusbbase.sys
[08.29.2008 11:09 AM | 00,455,680 | ---- | C] (AVM GmbH) - C:\WINDOWS\System32\dllcache\fus2base.sys
[08.29.2008 11:10 AM | 00,068,608 | ---- | C] (Avisioin) - C:\WINDOWS\System32\dllcache\hpgt53tk.dll
[08.29.2008 11:10 AM | 00,083,968 | ---- | C] () - C:\WINDOWS\System32\dllcache\hpgt21.dll
[08.29.2008 11:10 AM | 00,089,088 | ---- | C] () - C:\WINDOWS\System32\dllcache\hpgt33.dll
[08.29.2008 11:10 AM | 00,093,696 | ---- | C] () - C:\WINDOWS\System32\dllcache\hpgt42.dll
[08.29.2008 11:10 AM | 00,101,376 | ---- | C] () - C:\WINDOWS\System32\dllcache\hpgt34.dll
[08.29.2008 11:10 AM | 00,126,976 | ---- | C] (Hewlett Packard) - C:\WINDOWS\System32\dllcache\hpgt34tk.dll
[08.29.2008 11:10 AM | 00,165,888 | ---- | C] () - C:\WINDOWS\System32\dllcache\hpgt53.dll
[08.29.2008 11:11 AM | 00,372,824 | ---- | C] (Xircom) - C:\WINDOWS\System32\dllcache\iconf32.dll
[08.29.2008 11:12 AM | 00,015,744 | ---- | C] (Litronic Industries) - C:\WINDOWS\System32\dllcache\lit220p.sys
[08.29.2008 11:12 AM | 00,019,016 | ---- | C] (Kingston Technology Company ) - C:\WINDOWS\System32\dllcache\ktc111.sys
[08.29.2008 11:12 AM | 00,023,552 | ---- | C] (MKNet Corporation) - C:\WINDOWS\System32\dllcache\irmk7.sys
[08.29.2008 11:12 AM | 00,025,065 | ---- | C] (D-Link) - C:\WINDOWS\System32\dllcache\lmndis3.sys
[08.29.2008 11:12 AM | 00,026,442 | ---- | C] (SMSC) - C:\WINDOWS\System32\dllcache\lanepic5.sys
[08.29.2008 11:12 AM | 00,034,688 | ---- | C] (Toshiba Corp.) - C:\WINDOWS\System32\dllcache\lbrtfdc.sys
[08.29.2008 11:12 AM | 00,038,784 | ---- | C] (Perle Systems Ltd. ) - C:\WINDOWS\System32\dllcache\io8.sys
[08.29.2008 11:12 AM | 00,045,632 | ---- | C] (Interphase ® Corporation a Windows ® 2000 DDK Driver Provider) - C:\WINDOWS\System32\dllcache\ip5515.sys
[08.29.2008 11:12 AM | 00,090,200 | ---- | C] (Perle Systems Ltd. ) - C:\WINDOWS\System32\dllcache\io8ports.dll
[08.29.2008 11:13 AM | 00,020,573 | ---- | C] (The Linksts Group ) - C:\WINDOWS\System32\dllcache\lne100.sys
[08.29.2008 11:13 AM | 00,020,864 | ---- | C] (Logitech Inc.) - C:\WINDOWS\System32\dllcache\lwadihid.sys
[08.29.2008 11:13 AM | 00,022,848 | ---- | C] (Logitech Inc.) - C:\WINDOWS\System32\dllcache\lwusbhid.sys
[08.29.2008 11:13 AM | 00,070,730 | ---- | C] (Linksys Group, Inc.) - C:\WINDOWS\System32\dllcache\lne100tx.sys
[08.29.2008 11:13 AM | 00,164,586 | ---- | C] (Madge Networks Ltd) - C:\WINDOWS\System32\dllcache\mdgndis5.sys
[08.29.2008 11:13 AM | 00,420,992 | ---- | C] (LT) - C:\WINDOWS\System32\dllcache\ltmdmntt.sys
[08.29.2008 11:13 AM | 00,576,746 | ---- | C] (LT) - C:\WINDOWS\System32\dllcache\ltmdmntl.sys
[08.29.2008 11:13 AM | 00,606,684 | ---- | C] (LT) - C:\WINDOWS\System32\dllcache\ltmdmnt.sys
[08.29.2008 11:13 AM | 00,727,786 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\ltck000c.sys
[08.29.2008 11:13 AM | 00,797,500 | ---- | C] (LT) - C:\WINDOWS\System32\dllcache\ltsmt.sys
[08.29.2008 11:13 AM | 00,802,683 | ---- | C] (Lucent Technologies) - C:\WINDOWS\System32\dllcache\ltsm.sys
[08.29.2008 11:14 AM | 00,007,168 | ---- | C] (Moxa Technologies Co., Ltd) - C:\WINDOWS\System32\dllcache\mxport.dll
[08.29.2008 11:14 AM | 00,013,664 | ---- | C] (Number Nine Visual Technology Corp.) - C:\WINDOWS\System32\dllcache\n9i128.sys
[08.29.2008 11:14 AM | 00,017,280 | ---- | C] (American Megatrends Inc.) - C:\WINDOWS\System32\dllcache\mraid35x.sys
[08.29.2008 11:14 AM | 00,019,968 | ---- | C] (Macronix International Co., Ltd. ) - C:\WINDOWS\System32\dllcache\mxnic.sys
[08.29.2008 11:14 AM | 00,019,968 | ---- | C] (Moxa Technologies Co., Ltd) - C:\WINDOWS\System32\dllcache\mxicfg.dll
[08.29.2008 11:14 AM | 00,021,888 | ---- | C] (Moxa Technologies Co., Ltd.) - C:\WINDOWS\System32\dllcache\mxcard.sys
[08.29.2008 11:14 AM | 00,035,392 | ---- | C] (Number Nine Visual Technology Corp.) - C:\WINDOWS\System32\dllcache\n9i128.dll
[08.29.2008 11:14 AM | 00,052,255 | ---- | C] (Compaq Computer Corporation) - C:\WINDOWS\System32\dllcache\n1000nt5.sys
[08.29.2008 11:14 AM | 00,056,832 | ---- | C] () - C:\WINDOWS\System32\dllcache\msdvbnp.ax
[08.29.2008 11:14 AM | 00,059,104 | ---- | C] (Number Nine Visual Technology Corp.) - C:\WINDOWS\System32\dllcache\n9i128v2.dll
[08.29.2008 11:14 AM | 00,075,520 | ---- | C] (Moxa Technologies Co., Ltd.) - C:\WINDOWS\System32\dllcache\mxport.sys
[08.29.2008 11:14 AM | 00,103,296 | ---- | C] (Matrox Graphics Inc) - C:\WINDOWS\System32\dllcache\mtxvideo.sys
[08.29.2008 11:14 AM | 00,128,000 | ---- | C] (Compaq Computer Corporation) - C:\WINDOWS\System32\dllcache\n100325.sys
[08.29.2008 11:15 AM | 00,027,209 | ---- | C] (Ositech Communications, Inc.) - C:\WINDOWS\System32\dllcache\otc06x5.sys
[08.29.2008 11:15 AM | 00,027,936 | ---- | C] (Number Nine Visual Technology Corp.) - C:\WINDOWS\System32\dllcache\n9i3d.sys
[08.29.2008 11:15 AM | 00,032,840 | ---- | C] (NETGEAR Corporation.) - C:\WINDOWS\System32\dllcache\ngrpci.sys
[08.29.2008 11:15 AM | 00,033,088 | ---- | C] (Number Nine Visual Technology Corp.) - C:\WINDOWS\System32\dllcache\n9i128v2.sys
[08.29.2008 11:15 AM | 00,039,264 | ---- | C] (NeoMagic Corporation) - C:\WINDOWS\System32\dllcache\neo20xx.sys
[08.29.2008 11:15 AM | 00,043,689 | ---- | C] (Ositech Communications, Inc.) - C:\WINDOWS\System32\dllcache\otceth5.sys
[08.29.2008 11:15 AM | 00,051,552 | ---- | C] (Kensington Technology Group) - C:\WINDOWS\System32\dllcache\ntgrip.sys
[08.29.2008 11:15 AM | 00,054,528 | ---- | C] (Yamaha Corp.) - C:\WINDOWS\System32\dllcache\opl3sax.sys
[08.29.2008 11:15 AM | 00,060,480 | ---- | C] (NeoMagic Corporation) - C:\WINDOWS\System32\dllcache\neo20xx.dll
[08.29.2008 11:15 AM | 00,065,278 | ---- | C] (Compaq Computer Corporation) - C:\WINDOWS\System32\dllcache\netflx3.sys
[08.29.2008 11:15 AM | 00,087,040 | ---- | C] (NeoMagic Corporation) - C:\WINDOWS\System32\dllcache\nm6wdm.sys
[08.29.2008 11:15 AM | 00,091,488 | ---- | C] (Number Nine Visual Technology Corp.) - C:\WINDOWS\System32\dllcache\n9i3disp.dll
[08.29.2008 11:15 AM | 00,126,080 | ---- | C] (NeoMagic Corporation) - C:\WINDOWS\System32\dllcache\nm5a2wdm.sys
[08.29.2008 11:15 AM | 00,132,695 | ---- | C] (802.11b) - C:\WINDOWS\System32\dllcache\netwlan5.sys
[08.29.2008 11:16 AM | 00,026,153 | ---- | C] (Linksys) - C:\WINDOWS\System32\dllcache\pcmlm56.sys
[08.29.2008 11:16 AM | 00,027,904 | ---- | C] (Microsoft Corp., 3Dlabs Inc. Ltd.) - C:\WINDOWS\System32\dllcache\perm2.sys
[08.29.2008 11:16 AM | 00,028,032 | ---- | C] (Microsoft Corp., 3Dlabs Inc. Ltd.) - C:\WINDOWS\System32\dllcache\perm3.sys
[08.29.2008 11:16 AM | 00,029,502 | ---- | C] (Marconi Communications, Inc.) - C:\WINDOWS\System32\dllcache\pca200e.sys
[08.29.2008 11:16 AM | 00,029,769 | ---- | C] (AMD Inc.) - C:\WINDOWS\System32\dllcache\pcntn5m.sys
[08.29.2008 11:16 AM | 00,030,282 | ---- | C] (AMD Inc.) - C:\WINDOWS\System32\dllcache\pcntn5hl.sys
[08.29.2008 11:16 AM | 00,030,495 | ---- | C] (Linksys) - C:\WINDOWS\System32\dllcache\pc100nds.sys
[08.29.2008 11:16 AM | 00,035,328 | ---- | C] (AMD Inc.) - C:\WINDOWS\System32\dllcache\pcntpci5.sys
[08.29.2008 11:16 AM | 00,054,186 | ---- | C] (Ositech Communications, Inc.) - C:\WINDOWS\System32\dllcache\otcsercb.sys
[08.29.2008 11:16 AM | 00,086,016 | ---- | C] (PCtel, Inc.) - C:\WINDOWS\System32\dllcache\pctspk.exe
[08.29.2008 11:16 AM | 00,169,984 | ---- | C] (Cisco Systems) - C:\WINDOWS\System32\dllcache\pcx500.sys
[08.29.2008 11:16 AM | 00,211,712 | ---- | C] (Microsoft Corp., 3Dlabs Inc. Ltd.) - C:\WINDOWS\System32\dllcache\perm2dll.dll
[08.29.2008 11:16 AM | 00,259,328 | ---- | C] (Microsoft Corp., 3Dlabs Inc. Ltd.) - C:\WINDOWS\System32\dllcache\perm3dd.dll
[08.29.2008 11:17 AM | 00,016,128 | ---- | C] (SCM Microsystems, Inc.) - C:\WINDOWS\System32\dllcache\pscr.sys
[08.29.2008 11:17 AM | 00,033,280 | ---- | C] () - C:\WINDOWS\System32\dllcache\psisrndr.ax
[08.29.2008 11:17 AM | 00,112,574 | ---- | C] (PCTEL, INC.) - C:\WINDOWS\System32\dllcache\ptserlp.sys
[08.29.2008 11:17 AM | 00,128,286 | ---- | C] (PCTEL, INC.) - C:\WINDOWS\System32\dllcache\ptserli.sys
[08.29.2008 11:17 AM | 00,130,942 | ---- | C] (PCTEL, INC.) - C:\WINDOWS\System32\dllcache\ptserlv.sys
[08.29.2008 11:17 AM | 00,363,520 | ---- | C] () - C:\WINDOWS\System32\dllcache\psisdecd.dll
[08.29.2008 11:17 AM | 00,714,762 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\r2mdmkxx.sys
[08.29.2008 11:17 AM | 00,899,146 | ---- | C] (Xircom, Inc.) - C:\WINDOWS\System32\dllcache\r2mdkxga.sys
[08.29.2008 11:18 AM | 00,009,216 | ---- | C] (Brother Industries, Ltd.) - C:\WINDOWS\System32\dllcache\rsmgrstr.dll
[08.29.2008 11:18 AM | 00,019,017 | ---- | C] (Realtek Semiconductor Corporation) - C:\WINDOWS\System32\dllcache\rtl8029.sys
[08.29.2008 11:18 AM | 00,020,992 | ---- | C] (Realtek Semiconductor Corporation) - C:\WINDOWS\System32\dllcache\rtl8139.sys
[08.29.2008 11:18 AM | 00,023,936 | ---- | C] (OMNIKEY AG) - C:\WINDOWS\System32\dllcache\sccmn50m.sys
[08.29.2008 11:18 AM | 00,024,576 | ---- | C] (Ricoh Co., Ltd.) - C:\WINDOWS\System32\dllcache\rw430ext.dll
[08.29.2008 11:18 AM | 00,026,624 | ---- | C] (Ricoh Co., Ltd.) - C:\WINDOWS\System32\dllcache\rw450ext.dll
[08.29.2008 11:18 AM | 00,037,563 | ---- | C] (RadioLAN) - C:\WINDOWS\System32\dllcache\rlnet5.sys
[08.29.2008 11:18 AM | 00,041,216 | ---- | C] (S3 Incorporated) - C:\WINDOWS\System32\dllcache\s3mt3d.sys
[08.29.2008 11:18 AM | 00,061,504 | ---- | C] (S3 Incorporated) - C:\WINDOWS\System32\dllcache\s3sav3dm.sys
[08.29.2008 11:18 AM | 00,062,496 | ---- | C] (S3 Incorporated) - C:\WINDOWS\System32\dllcache\s3mtrio.dll
[08.29.2008 11:18 AM | 00,077,824 | ---- | C] (S3 Incorporated) - C:\WINDOWS\System32\dllcache\s3sav4m.sys
[08.29.2008 11:18 AM | 00,079,104 | ---- | C] (Comtrol Corporation) - C:\WINDOWS\System32\dllcache\rocket.sys
[08.29.2008 11:18 AM | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) - C:\WINDOWS\System32\dllcache\rwia430.dll
[08.29.2008 11:18 AM | 00,082,432 | ---- | C] (Ricoh Co., Ltd.) - C:\WINDOWS\System32\dllcache\rwia450.dll
[08.29.2008 11:18 AM | 00,086,097 | ---- | C] (Xircom) - C:\WINDOWS\System32\dllcache\reslog32.dll
[08.29.2008 11:18 AM | 00,166,720 | ---- | C] (S3 Incorporated) - C:\WINDOWS\System32\dllcache\s3m.sys
[08.29.2008 11:18 AM | 00,179,264 | ---- | C] (S3 Incorporated) - C:\WINDOWS\System32\dllcache\s3sav3d.dll
[08.29.2008 11:18 AM | 00,182,272 | ---- | C] (S3 Incorporated) - C:\WINDOWS\System32\dllcache\s3mt3d.dll
[08.29.2008 11:18 AM | 00,198,400 | ---- | C] (S3 Incorporated) - C:\WINDOWS\System32\dllcache\s3sav4.dll
[08.29.2008 11:18 AM | 00,210,496 | ---- | C] (S3 Incorporated) - C:\WINDOWS\System32\dllcache\s3mvirge.dll
[08.29.2008 11:19 AM | 00,017,280 | ---- | C] (SCM Microsystems) - C:\WINDOWS\System32\dllcache\scr111.sys
[08.29.2008 11:19 AM | 00,018,400 | ---- | C] (Micro Systemation) - C:\WINDOWS\System32\dllcache\sgsmld.sys
[08.29.2008 11:19 AM | 00,023,936 | ---- | C] (OMNIKEY AG) - C:\WINDOWS\System32\dllcache\sccmusbm.sys
[08.29.2008 11:19 AM | 00,098,080 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\sgiulnt5.sys
[08.29.2008 11:19 AM | 00,161,568 | ---- | C] (Micro Systemation) - C:\WINDOWS\System32\dllcache\sgsmusb.sys
[08.29.2008 11:19 AM | 00,386,560 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\sgiul50.dll
[08.29.2008 11:20 AM | 00,024,576 | ---- | C] (SMC Networks, Inc.) - C:\WINDOWS\System32\dllcache\smc8000n.sys
[08.29.2008 11:20 AM | 00,025,034 | ---- | C] (SMC Networks, Inc.) - C:\WINDOWS\System32\dllcache\smcpwr2n.sys
[08.29.2008 11:20 AM | 00,032,768 | ---- | C] (SiS Corporation) - C:\WINDOWS\System32\dllcache\sisnic.sys
[08.29.2008 11:20 AM | 00,035,913 | ---- | C] (SMC) - C:\WINDOWS\System32\dllcache\smcirda.sys
[08.29.2008 11:20 AM | 00,058,368 | ---- | C] (Silicon Motion Inc.) - C:\WINDOWS\System32\dllcache\smiminib.sys
[08.29.2008 11:20 AM | 00,063,547 | ---- | C] (Symbol Technologies) - C:\WINDOWS\System32\dllcache\sla30nd5.sys
[08.29.2008 11:20 AM | 00,091,294 | ---- | C] (SysKonnect, a business unit of Schneider & Koch & Co. Datensysteme GmbH.) - C:\WINDOWS\System32\dllcache\skfpwin.sys
[08.29.2008 11:20 AM | 00,094,698 | ---- | C] (SysKonnect GmbH.) - C:\WINDOWS\System32\dllcache\sk98xwin.sys
[08.29.2008 11:20 AM | 00,147,200 | ---- | C] (Silicon Motion Inc.) - C:\WINDOWS\System32\dllcache\smidispb.dll
[08.29.2008 11:21 AM | 00,016,896 | ---- | C] (SCM Microsystems, Inc.) - C:\WINDOWS\System32\dllcache\stcusb.sys
[08.29.2008 11:21 AM | 00,019,072 | ---- | C] (Adaptec, Inc.) - C:\WINDOWS\System32\dllcache\sparrow.sys
[08.29.2008 11:21 AM | 00,024,660 | ---- | C] (Perle Systems Ltd.) - C:\WINDOWS\System32\dllcache\spxupchk.dll
[08.29.2008 11:21 AM | 00,048,736 | ---- | C] (3Com) - C:\WINDOWS\System32\dllcache\srwlnd5.sys
[08.29.2008 11:21 AM | 00,053,248 | ---- | C] (Stallion Technologies) - C:\WINDOWS\System32\dllcache\stlncoin.dll
[08.29.2008 11:21 AM | 00,061,824 | ---- | C] (Perle Systems Ltd.) - C:\WINDOWS\System32\dllcache\speed.sys
[08.29.2008 11:21 AM | 00,094,293 | ---- | C] (Perle Systems Ltd. ) - C:\WINDOWS\System32\dllcache\sxports.dll
[08.29.2008 11:21 AM | 00,103,936 | ---- | C] (Perle Systems Ltd. ) - C:\WINDOWS\System32\dllcache\sx.sys
[08.29.2008 11:21 AM | 00,106,584 | ---- | C] (Perle Systems Ltd.) - C:\WINDOWS\System32\dllcache\spdports.dll
[08.29.2008 11:21 AM | 00,155,648 | ---- | C] (Stallion Technologies) - C:\WINDOWS\System32\dllcache\stlnprop.dll
[08.29.2008 11:21 AM | 00,285,760 | ---- | C] (Stallion Technologies) - C:\WINDOWS\System32\dllcache\stlnata.sys
[08.29.2008 11:22 AM | 00,017,129 | ---- | C] (TDK Corporation) - C:\WINDOWS\System32\dllcache\tdkcd31.sys
[08.29.2008 11:22 AM | 00,028,232 | ---- | C] (TOSHIBA Corporation) - C:\WINDOWS\System32\dllcache\tos4mo.sys
[08.29.2008 11:22 AM | 00,030,464 | ---- | C] (Toshiba Corporation) - C:\WINDOWS\System32\dllcache\tbatm155.sys
[08.29.2008 11:22 AM | 00,036,640 | ---- | C] (Number Nine Visual Technology Corp.) - C:\WINDOWS\System32\dllcache\t2r4mini.sys
[08.29.2008 11:22 AM | 00,037,961 | ---- | C] (TDK Corporation) - C:\WINDOWS\System32\dllcache\tdk100b.sys
[08.29.2008 11:22 AM | 00,081,408 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\tgiul50.dll
[08.29.2008 11:22 AM | 00,123,995 | ---- | C] (Tiger Jet Network) - C:\WINDOWS\System32\dllcache\tjisdn.sys
[08.29.2008 11:22 AM | 00,138,528 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\tgiulnt5.sys
[08.29.2008 11:22 AM | 00,149,376 | ---- | C] (M-Systems) - C:\WINDOWS\System32\dllcache\tffsport.sys
[08.29.2008 11:22 AM | 00,172,768 | ---- | C] (Number Nine Visual Technology) - C:\WINDOWS\System32\dllcache\t2r4disp.dll
[08.29.2008 11:22 AM | 00,222,336 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\trid3dm.sys
[08.29.2008 11:22 AM | 00,230,912 | ---- | C] (Toshiba Corporation) - C:\WINDOWS\System32\dllcache\tosdvd03.sys
[08.29.2008 11:22 AM | 00,241,664 | ---- | C] (Toshiba Corporation) - C:\WINDOWS\System32\dllcache\tosdvd02.sys
[08.29.2008 11:22 AM | 00,315,520 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\trid3d.dll
[08.29.2008 11:22 AM | 00,440,576 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\tridkb.dll
[08.29.2008 11:23 AM | 00,032,384 | ---- | C] (KLSI USA, Inc.) - C:\WINDOWS\System32\dllcache\usb101et.sys
[08.29.2008 11:23 AM | 00,050,688 | ---- | C] (UMAX DATA SYSTEMS INC.) - C:\WINDOWS\System32\dllcache\umaxscan.dll
[08.29.2008 11:23 AM | 00,159,232 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\tridkbm.sys
[08.29.2008 11:23 AM | 00,166,784 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\tridxpm.sys
[08.29.2008 11:23 AM | 00,211,968 | ---- | C] (UMAX Data Systems Inc.) - C:\WINDOWS\System32\dllcache\um54scan.dll
[08.29.2008 11:23 AM | 00,216,064 | ---- | C] (UMAX Data Systems Inc.) - C:\WINDOWS\System32\dllcache\um34scan.dll
[08.29.2008 11:23 AM | 00,525,568 | ---- | C] (Trident Microsystems Inc.) - C:\WINDOWS\System32\dllcache\tridxp.dll
[08.29.2008 11:23 AM | 00,793,598 | ---- | C] (U.S. Robotics, Inc.) - C:\WINDOWS\System32\dllcache\usr1806.sys
[08.29.2008 11:23 AM | 00,794,399 | ---- | C] (U.S. Robotics, Inc.) - C:\WINDOWS\System32\dllcache\usr1806v.sys
[08.29.2008 11:23 AM | 00,794,654 | ---- | C] (U.S. Robotics, Inc.) - C:\WINDOWS\System32\dllcache\usr1801.sys
[08.29.2008 11:24 AM | 00,007,556 | ---- | C] (U.S. Robotics Corporation) - C:\WINDOWS\System32\dllcache\usroslba.sys
[08.29.2008 11:24 AM | 00,016,925 | ---- | C] (Winbond Electronics Corporation) - C:\WINDOWS\System32\dllcache\w940nd.sys
[08.29.2008 11:24 AM | 00,019,016 | ---- | C] (Winbond Electronics Corporation) - C:\WINDOWS\System32\dllcache\w926nd.sys
[08.29.2008 11:24 AM | 00,019,528 | ---- | C] (Winbond Electronics Corporation) - C:\WINDOWS\System32\dllcache\w840nd.sys
[08.29.2008 11:24 AM | 00,024,576 | ---- | C] (VIA Technologies, Inc.) - C:\WINDOWS\System32\dllcache\viairda.sys
[08.29.2008 11:24 AM | 00,035,871 | ---- | C] (Winbond Electronics Corp.) - C:\WINDOWS\System32\dllcache\wbfirdma.sys
[08.29.2008 11:24 AM | 00,064,605 | ---- | C] (PCtel, Inc.) - C:\WINDOWS\System32\dllcache\vvoice.sys
[08.29.2008 11:24 AM | 00,113,762 | ---- | C] (U.S. Robotics Corporation) - C:\WINDOWS\System32\dllcache\usrpda.sys
[08.29.2008 11:24 AM | 00,224,802 | ---- | C] (U.S. Robotics Corporation) - C:\WINDOWS\System32\dllcache\usr1807a.sys
[08.29.2008 11:24 AM | 00,249,402 | ---- | C] (Xircom) - C:\WINDOWS\System32\dllcache\vinwm.sys
[08.29.2008 11:24 AM | 00,397,502 | ---- | C] (PCtel, Inc.) - C:\WINDOWS\System32\dllcache\vpctcom.sys
[08.29.2008 11:24 AM | 00,604,253 | ---- | C] (PCTEL, INC.) - C:\WINDOWS\System32\dllcache\vmodem.sys
[08.29.2008 11:24 AM | 00,687,999 | ---- | C] (U.S. Robotics Corporation) - C:\WINDOWS\System32\dllcache\usrwdxjs.sys
[08.29.2008 11:24 AM | 00,765,884 | ---- | C] (U.S. Robotics, Inc.) - C:\WINDOWS\System32\dllcache\usrti.sys
[08.29.2008 11:25 AM | 00,016,970 | ---- | C] (US Robotics MCD (Megahertz)) - C:\WINDOWS\System32\dllcache\xem336n5.sys
[08.29.2008 11:25 AM | 00,034,890 | ---- | C] (Raytheon Corp.) - C:\WINDOWS\System32\dllcache\wlandrv2.sys
[08.29.2008 11:25 AM | 00,099,865 | ---- | C] (Eicon Technology) - C:\WINDOWS\System32\dllcache\xlog.exe
[08.29.2008 11:25 AM | 00,154,624 | ---- | C] (Lucent Technologies) - C:\WINDOWS\System32\dllcache\wlluc48.sys
[08.29.2008 11:25 AM | 00,771,581 | ---- | C] (Rockwell) - C:\WINDOWS\System32\dllcache\winacisa.sys
[08.29.2008 11:26 AM | 00,017,408 | ---- | C] () - C:\WINDOWS\System32\dllcache\xrxscnui.dll
[08.29.2008 11:26 AM | 00,023,040 | ---- | C] (Xerox Corporation) - C:\WINDOWS\System32\dllcache\xrxwbtmp.dll
[08.29.2008 11:26 AM | 00,027,648 | ---- | C] () - C:\WINDOWS\System32\dllcache\xrxftplt.exe
[08.29.2008 11:26 AM | 00,116,224 | ---- | C] (Xerox) - C:\WINDOWS\System32\dllcache\xrxwiadr.dll
[08.08.2008 07:25 PM | 00,022,328 | ---- | C] () - C:\WINDOWS\System32\drivers\PnkBstrK.sys
[09.02.2008 03:29 PM | 00,044,052 | ---- | C] () - C:\WINDOWS\System32\drivers\fwdrv.err
[7 C:\WINDOWS\System32\*.tmp files]
[08.08.2008 07:25 PM | 00,066,872 | ---- | C] () - C:\WINDOWS\System32\PnkBstrA.exe
[08.08.2008 07:25 PM | 00,107,832 | ---- | C] () - C:\WINDOWS\System32\PnkBstrB.exe
[08.12.2008 05:53 PM | ---D | C] - C:\WINDOWS\System32\appmgmt
[08.16.2008 11:19 AM | 00,186,407 | ---- | C] () - C:\WINDOWS\System32\nvapps.nvb
[08.17.2008 11:41 PM | 00,000,000 | ---- | C] () - C:\WINDOWS\System32\CMMGR32.EXE
[08.26.2008 07:22 PM | 00,000,788 | ---- | C] () - C:\WINDOWS\System32\DVCState-{00000005-00000000-00000006-00001102-00000005-002C1102}.rfx
[08.26.2008 07:22 PM | 00,054,472 | ---- | C] () - C:\WINDOWS\System32\BMXState-{00000005-00000000-00000006-00001102-00000005-002C1102}.rfx
[4 C:\WINDOWS\*.tmp files]
[08.06.2008 04:23 PM | 00,000,038 | ---- | C] () - C:\WINDOWS\avisplitter.INI
[08.16.2008 11:30 AM | ---D | C] - C:\WINDOWS\LastGood(2)
[08.17.2008 08:50 PM | ---D | C] - C:\WINDOWS\Minidump
[08.17.2008 10:14 PM | -HSD | C] - C:\WINDOWS\CSC
[08.29.2008 06:37 PM | 00,000,023 | ---- | C] () - C:\WINDOWS\popcinfot.dat
[08.07.2008 08:47 PM | ---D | C] - C:\Documents and Settings\All Users\Application Data\Apple
[08.07.2008 08:47 PM | ---D | C] - C:\Documents and Settings\All Users\Application Data\Apple Computer
[08.16.2008 03:32 PM | ---D | C] - C:\Documents and Settings\All Users\Application Data\Malwarebytes
[08.17.2008 11:34 PM | ---D | C] - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[08.29.2008 10:21 AM | ---D | C] - C:\Documents and Settings\All Users\Application Data\comodo
[08.06.2008 05:04 PM | 00,000,668 | ---- | C] () - C:\Documents and Settings\Øivind\Application Data\vso_ts_preview.xml
[08.07.2008 08:49 PM | ---D | C] - C:\Documents and Settings\Øivind\Application Data\Apple Computer
[08.12.2008 05:32 PM | 00,002,528 | ---- | C] () - C:\Documents and Settings\Øivind\Application Data\$_hpcst$.hpc
[08.14.2008 04:20 PM | ---D | C] - C:\Documents and Settings\Øivind\Application Data\uTorrent
[08.16.2008 03:32 PM | ---D | C] - C:\Documents and Settings\Øivind\Application Data\Malwarebytes
[08.17.2008 11:34 PM | ---D | C] - C:\Documents and Settings\Øivind\Application Data\SUPERAntiSpyware.com
[08.29.2008 10:21 AM | ---D | C] - C:\Documents and Settings\Øivind\Application Data\Comodo
[08.07.2008 08:45 PM | ---D | C] - C:\Documents and Settings\Øivind\Local Settings\Application Data\Apple Computer
[08.07.2008 08:47 PM | ---D | C] - C:\Documents and Settings\Øivind\Local Settings\Application Data\Apple
[08.25.2008 08:07 PM | ---D | C] - C:\Documents and Settings\Øivind\Local Settings\Application Data\Runscanner.net
[09.01.2008 09:58 AM | ---D | C] - C:\Documents and Settings\Øivind\Local Settings\Application Data\Boss Media
[08.06.2008 05:15 PM | ---D | C] - C:\Documents and Settings\Øivind\My Documents\ConvertXtoDVD
[08.14.2008 04:46 PM | ---D | C] - C:\Documents and Settings\Øivind\My Documents\ringe
[08.15.2008 07:07 PM | ---D | C] - C:\Documents and Settings\Øivind\My Documents\My Skype Content
[08.15.2008 07:47 PM | R--D | C] - C:\Documents and Settings\Øivind\My Documents\My Videos
[08.26.2008 04:47 PM | 00,207,023 | ---- | C] () - C:\Documents and Settings\Øivind\My Documents\runscanner.run
[09.03.2008 05:51 PM | 00,074,240 | ---- | C] () - C:\Documents and Settings\Øivind\My Documents\soknad_forehandskonferanse.doc
[09.03.2008 05:51 PM | 00,090,676 | ---- | C] () - C:\Documents and Settings\Øivind\My Documents\5154.pdf
[09.03.2008 06:07 PM | 01,838,080 | ---- | C] () - C:\Documents and Settings\Øivind\My Documents\tilbygg_til_eksisterande_byggverk.doc
[08.07.2008 08:49 PM | 00,002,137 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[08.17.2008 11:25 PM | 00,000,696 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[08.17.2008 11:34 PM | 00,000,780 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[09.01.2008 04:46 PM | 00,001,829 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\America's Army.lnk
[09.01.2008 10:28 AM | 00,000,736 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\PokerStars.lnk
[09.02.2008 01:08 AM | 00,000,793 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[09.02.2008 01:08 AM | 00,000,793 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\Ad-Watch.lnk
[08.17.2008 11:17 PM | 00,002,549 | ---- | C] () - C:\Documents and Settings\Øivind\Desktop\Microsoft Office Outlook 2003.lnk
[08.17.2008 11:33 PM | 00,001,734 | ---- | C] () - C:\Documents and Settings\Øivind\Desktop\HijackThis.lnk
[08.22.2008 11:57 AM | 00,000,630 | ---- | C] () - C:\Documents and Settings\Øivind\Desktop\µTorrent.lnk
[08.25.2008 08:10 PM | 00,209,773 | ---- | C] () - C:\Documents and Settings\Øivind\Desktop\runscanner.run
[09.02.2008 01:08 AM | 22,379,886 | ---- | C] () - C:\Documents and Settings\Øivind\Desktop\setup_v10.64.2.3.zip
[08.07.2008 08:47 PM | ---D | C] - C:\Program Files\Common Files\Apple
[08.16.2008 03:31 PM | ---D | C] - C:\Program Files\Common Files\Download Manager
[08.26.2008 07:10 PM | ---D | C] - C:\Program Files\Common Files\Creative Labs Shared
[08.07.2008 08:47 PM | ---D | C] - C:\Program Files\Apple Software Update
[08.07.2008 08:48 PM | ---D | C] - C:\Program Files\QuickTime
[08.07.2008 08:49 PM | ---D | C] - C:\Program Files\Bonjour
[08.07.2008 08:49 PM | ---D | C] - C:\Program Files\iPod
[08.07.2008 08:49 PM | ---D | C] - C:\Program Files\iTunes
[08.12.2008 05:31 PM | ---D | C] - C:\Program Files\Microsoft ActiveSync
[08.16.2008 03:32 PM | ---D | C] - C:\Program Files\Malwarebytes' Anti-Malware
[08.16.2008 03:45 PM | ---D | C] - C:\Program Files\Trend Micro
[08.16.2008 11:30 AM | ---D | C] - C:\Program Files\Panda Security
[08.17.2008 11:11 PM | ---D | C] - C:\Program Files\Windows Mobile Device Handbook
[08.17.2008 11:34 PM | ---D | C] - C:\Program Files\SUPERAntiSpyware
[08.26.2008 05:27 PM | ---D | C] - C:\Program Files\SystemRequirementsLab
[09.01.2008 04:33 PM | ---D | C] - C:\Program Files\America's Army
[09.01.2008 10:28 AM | ---D | C] - C:\Program Files\PokerStars
[09.01.2008 11:48 PM | ---D | C] - C:\Program Files\Kerio

========== Files - Modified Within 30 days ==========

[09.02.2008 03:29 PM | 00,000,223 | RHS- | M] () - C:\boot.ini
[09.02.2008 04:11 PM | 00,000,054 | ---- | M] () - C:\pbuser.htm
[09.02.2008 04:11 PM | 00,009,678 | ---- | M] () - C:\pbgame.htm
[08.06.2008 08:29 PM | 00,096,976 | ---- | M] () - C:\WINDOWS\System32\drivers\klin.dat
[09.03.2008 06:08 PM | 00,022,328 | ---- | M] () - C:\WINDOWS\System32\drivers\PnkBstrK.sys
[09.04.2008 04:09 PM | 00,038,864 | -HS- | M] () - C:\WINDOWS\System32\drivers\fidbox2.idx
[09.04.2008 04:09 PM | 00,294,608 | -HS- | M] () - C:\WINDOWS\System32\drivers\fidbox.idx
[09.04.2008 05:16 PM | 00,044,052 | ---- | M] () - C:\WINDOWS\System32\drivers\fwdrv.err
[09.04.2008 05:18 PM | 21,378,592 | -HS- | M] () - C:\WINDOWS\System32\drivers\fidbox.dat
[09.04.2008 05:19 PM | 00,348,448 | -HS- | M] () - C:\WINDOWS\System32\drivers\fidbox2.dat
[7 C:\WINDOWS\System32\*.tmp files]
[08.08.2008 07:25 PM | 00,066,872 | ---- | M] () - C:\WINDOWS\System32\PnkBstrA.exe
[08.17.2008 11:41 PM | 00,000,000 | ---- | M] () - C:\WINDOWS\System32\CMMGR32.EXE
[08.29.2008 11:30 AM | 00,110,992 | ---- | M] () - C:\WINDOWS\System32\FNTCACHE.DAT
[08.31.2008 05:31 PM | 00,000,283 | ---- | M] () - C:\WINDOWS\System32\61xx.xml
[09.03.2008 06:08 PM | 00,107,832 | ---- | M] () - C:\WINDOWS\System32\PnkBstrB.exe
[09.04.2008 04:09 PM | 00,000,788 | ---- | M] () - C:\WINDOWS\System32\DVCState-{00000005-00000000-00000006-00001102-00000005-002C1102}.rfx
[09.04.2008 04:09 PM | 00,054,472 | ---- | M] () - C:\WINDOWS\System32\BMXState-{00000005-00000000-00000006-00001102-00000005-002C1102}.rfx
[09.04.2008 04:09 PM | 00,054,472 | ---- | M] () - C:\WINDOWS\System32\BMXStateBkp-{00000005-00000000-00000006-00001102-00000005-002C1102}.rfx
[09.04.2008 04:59 PM | 00,000,007 | ---- | M] () - C:\WINDOWS\System32\ANIWZCSUSERNAME{32815B77-6891-404B-A6CD-DA7926FFE6BB}
[09.04.2008 04:59 PM | 00,181,104 | ---- | M] () - C:\WINDOWS\System32\nvapps.xml
[09.04.2008 05:00 PM | 00,002,206 | ---- | M] () - C:\WINDOWS\System32\wpa.dbl
[09.04.2008 05:03 PM | 00,040,952 | ---- | M] () - C:\WINDOWS\System32\perfc009.dat
[09.04.2008 05:03 PM | 00,314,816 | ---- | M] () - C:\WINDOWS\System32\perfh009.dat
[09.04.2008 05:03 PM | 00,360,560 | ---- | M] () - C:\WINDOWS\System32\PerfStringBackup.INI
[4 C:\WINDOWS\*.tmp files]
[08.06.2008 04:23 PM | 00,000,038 | ---- | M] () - C:\WINDOWS\avisplitter.INI
[08.22.2008 11:28 AM | 00,001,374 | ---- | M] () - C:\WINDOWS\imsins.BAK
[09.01.2008 03:43 PM | 00,000,023 | ---- | M] () - C:\WINDOWS\popcinfot.dat
[09.02.2008 01:51 AM | 00,000,069 | ---- | M] () - C:\WINDOWS\NeroDigital.ini
[09.02.2008 03:29 PM | 00,000,277 | ---- | M] () - C:\WINDOWS\system.ini
[09.02.2008 03:29 PM | 00,000,603 | ---- | M] () - C:\WINDOWS\win.ini
[09.04.2008 04:59 PM | 00,002,048 | --S- | M] () - C:\WINDOWS\bootstat.dat
[09.04.2008 04:59 PM | 00,000,006 | -H-- | M] () - C:\WINDOWS\tasks\SA.DAT
[09.04.2008 05:20 PM | 00,000,330 | -H-- | M] () - C:\WINDOWS\tasks\MP Scheduled Scan.job
[08.06.2008 08:19 PM | 00,000,668 | ---- | M] () - C:\Documents and Settings\Øivind\Application Data\vso_ts_preview.xml
[08.12.2008 05:32 PM | 00,002,528 | ---- | M] () - C:\Documents and Settings\Øivind\Application Data\$_hpcst$.hpc
[09.02.2008 01:13 AM | 00,179,712 | ---- | M] () - C:\Documents and Settings\Øivind\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[08.26.2008 04:46 PM | 00,207,023 | ---- | M] () - C:\Documents and Settings\Øivind\My Documents\runscanner.run
[09.01.2008 10:40 AM | 00,003,792 | ---- | M] () - C:\Documents and Settings\Øivind\My Documents\Hovedoppgave.enl
[09.03.2008 05:51 PM | 00,074,240 | ---- | M] () - C:\Documents and Settings\Øivind\My Documents\soknad_forehandskonferanse.doc
[09.03.2008 05:51 PM | 00,090,676 | ---- | M] () - C:\Documents and Settings\Øivind\My Documents\5154.pdf
[09.03.2008 06:07 PM | 01,838,080 | ---- | M] () - C:\Documents and Settings\Øivind\My Documents\tilbygg_til_eksisterande_byggverk.doc
[08.17.2008 11:25 PM | 00,000,696 | ---- | M] () - C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[08.17.2008 11:34 PM | 00,000,780 | ---- | M] () - C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[09.01.2008 04:46 PM | 00,001,829 | ---- | M] () - C:\Documents and Settings\All Users\Desktop\America's Army.lnk
[09.01.2008 10:28 AM | 00,000,736 | ---- | M] () - C:\Documents and Settings\All Users\Desktop\PokerStars.lnk
[09.01.2008 11:51 PM | 00,002,137 | ---- | M] () - C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[09.02.2008 01:08 AM | 00,000,793 | ---- | M] () - C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[09.02.2008 01:08 AM | 00,000,793 | ---- | M] () - C:\Documents and Settings\All Users\Desktop\Ad-Watch.lnk
[08.17.2008 11:17 PM | 00,002,549 | ---- | M] () - C:\Documents and Settings\Øivind\Desktop\Microsoft Office Outlook 2003.lnk
[08.17.2008 11:33 PM | 00,001,734 | ---- | M] () - C:\Documents and Settings\Øivind\Desktop\HijackThis.lnk
[08.22.2008 11:57 AM | 00,000,630 | ---- | M] () - C:\Documents and Settings\Øivind\Desktop\µTorrent.lnk
[08.26.2008 04:48 PM | 00,209,773 | ---- | M] () - C:\Documents and Settings\Øivind\Desktop\runscanner.run
[09.02.2008 01:08 AM | 22,379,886 | ---- | M] () - C:\Documents and Settings\Øivind\Desktop\setup_v10.64.2.3.zip

< End of report >

[sage5]

Hi Conkey,

Just some last clean-ups.

Did you perform a System Restore or System File Check on the 29th August at about 11:00 am?

Clean up Registry with a Reg file:

• Please open a new Notepad file by clicking Start\All Programs\Accessories\Notepad
• Copy the text from the following Code box, by highlighting all the text and right click, Select Copy. (or use the Ctrl+C keyboard shortcut)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" =-

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3082f0d3-5e1a-11dd-add1-001b111f2657}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ec3f273-5514-11dd-adc7-001b111f2657}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ec3f274-5514-11dd-adc7-001b111f2657}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e0216ed2-482c-11dd-adaf-001b111f2657}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e25-6882-11dd-ade0-001b111f2657}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e26-6882-11dd-ade0-001b111f2657}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e27-6882-11dd-ade0-001b111f2657}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e28-6882-11dd-ade0-001b111f2657}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f22f7e29-6882-11dd-ade0-001b111f2657}]

• Paste it into Notepad. Right click in the window and select Paste. (or use Ctrl+V)
• Save the file to the Desktop, make sure Type is All Files, and name it Fixreg.reg
• Double click on the file created and click Yes when asked to merge the information into the Registry

Remove folders & files:

• Please go to Start > Control Panel > Add/Remove Programs and remove the following, (if present):
  PokerStars --> These are quite often loaded with popups etc, but it is your decision to remove it or not
  Please take note of any other programs that you don't recognise in that list, and include them in your next response
• Using Windows Explorer, (to get there right-click your Start button and go to "Explore"), delete these folders, (if present):
  C:\Program Files\uTorrent
• Delete these files, (if present):
  C:\Documents and Settings\Øivind\Desktop\µTorrent.lnk

Shut down & Reboot normally:

Run HijackThis again:

• Select the Run a system scan and save a logfile button. The logfile will open in Notepad.
• Start your Web browser and navigate back to this thread.
• Click the Add Reply button
• Copy and Paste the text into the Reply window.

Please include a note to tell me how your PC is running now.

Cheers,

sage5

[Conkey]

Did a system restore after a driverupdate (sound) went wrong. Installed the driver again without a problem. Cant say I've had freezes like before lately, think you might have helped me clean out some old [bleep] on my cimputer. Thank you so muck for this

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:08:57, on 05.09.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe
C:\Program Files\Razer\Lycosa\razerhid.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\RivaTuner v2.09\RivaTuner.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Razer\Lycosa\razertra.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://vg.no/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.bayden.co...?l=en&v=1.6.1.5
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Control Popups in Internet Explorer - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\PROGRA~1\POPUPP~1\PopLib.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [D-Link D-Link RangeBooster N DWA-140] C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe
O4 - HKLM\..\Run: [Lycosa] "C:\Program Files\Razer\Lycosa\razerhid.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.09\RivaTuner.exe" /S
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.09\RivaTuner.exe" /T
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: PopupPopper Control Panel - {3E94F358-9537-4BBA-8D12-D7F8A0136973} - C:\Program Files\PopupPopper\SiteList.exe
O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus....ek_sys_ctrl.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...t/PCPitStop.CAB
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.co.../sysreqlab3.cab
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative....101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1214420172312
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.co...iaSmartScan.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com...obat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative....15105/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{32815B77-6891-404B-A6CD-DA7926FFE6BB}: NameServer = 193.213.112.4,130.67.60.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{32815B77-6891-404B-A6CD-DA7926FFE6BB}: NameServer = 193.213.112.4,130.67.60.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{32815B77-6891-404B-A6CD-DA7926FFE6BB}: NameServer = 193.213.112.4,130.67.60.68
O20 - AppInit_DLLs:
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 10341 bytes

[sage5]

Hi Conkey

Congratulations, your new log looks clear, so we can now deal with some final clean up jobs.
To make the final clean easier, please download the latest version of OTViewIt from Here


Clean out cookies, temp files etc:
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.
  
  If you use Firefox browser
  
  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
• Click Exit on the Main menu to close the program.

For Technical Support, double-click the e-mail address located at the bottom of each menu.


Cleanup with OTViewIt:

• Please double-click OTViewIt_beta.exe to run it.
• Click the Clean up button
• Click NO at the restart prompt (We will do that in a moment.)

To Clear Restore points, please do the following:

• Go to Start > Control Panel.
• Double-click the System icon.
  
  • NOTE: If the System icon is not visible, click "View all Control Panel options" to display it.
• Click the System Restore tab.
• Put a check by Disable System Restore.
• Click Apply, OK, OK. Click Yes when you are prompted to restart Windows.

After reboot, you must turn System Restore back on:

• Go back to the Troubleshooting tab.
• UNcheck Disable System Restore.
• Click Apply, OK, OK. Click Yes when you are prompted to restart Windows.

Lastly, some extra or better security for your PC:

The programs recommended below are freeware alternatives to some of your security software & might reduce the potential for spyware infection in the future:-

Spyware Prevention:
Spyware Blaster by JavaCool Software, prevents spyware installing and consumes no system resources.
IE/SpyAd, stops suspect sites loading ActiveX, popups etc onto your PC. An excellent tutorial is Here

Spyware Detection:
[url="http://"http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.htm"]Malwarebytes Anti-Malware[/url] is my favourite here.

Anti-Virus:
The first line of defence, especially since some will now detect trojans as well.
Avira's Antivir PersonalEdition Classic and Grisoft's Avast! Free Edition are among the best freebies.
*Please note* You should never install more than one anti-virus program on a PC, as it will cause conflicts.

Firewall:
A Firewall is an essential tool in the security of any PC connected to the Internet.
Sunbelt Personal Firewall and Comodo are both excellent freeware.

Alternate Browsers:
Thankfully, there are now some excellent alternatives to MS Internet Explorer. They offer better security, more stability, and better speed.
A couple of good examples are: Firefox and Opera

Other Updates:
Vital security patches and updates are available for Microsoft Windows and Internet Explorer at the Windows Update Site
It is equally important to update the other security software you use, on a regular basis.

Further reading about these issues is available in a very good article: How did I get infected in the first place ? (by Tony Klein and dvk01)

All the best & safe surfing in the future,

sage5

Edited by sage5, 05 September 2008 - 04:02 PM.

[sage5]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.