I removed QW using Intuit's procedures and file to wipe things clean before reinstalling, but problem remains. Still happens in safe mode or using the selective startup from msconfig.
Followed your malware removal guide, but Mbam found nothing. Something is clearly wrong as I;ve never had these problems before and so suspect a virus of some sort.
TIA for any help you can give me! Reports follow.
Bob
Malwarebytes' Anti-Malware 1.40
Database version: 2741
Windows 6.0.6002 Service Pack 2
9/6/2009 6:05:14 PM
mbam-log-2009-09-06 (18-05-14).txt
Scan type: Quick Scan
Objects scanned: 96496
Time elapsed: 5 minute(s), 19 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
________________________________________________________
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/09/06 17:36
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP2
==================================================
Drivers
-------------------
Name: dump_iaStor.sys
Image Path: C:\Windows\System32\Drivers\dump_iaStor.sys
Address: 0x8DCA6000 Size: 753664 File Visible: No Signed: -
Status: -
Name: PROCEXP113.SYS
Image Path: C:\Windows\system32\Drivers\PROCEXP113.SYS
Address: 0xAB1FD000 Size: 9728 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0x8BE9A000 Size: 49152 File Visible: No Signed: -
Status: -
Processes
-------------------
Path: System
PID: 4 Status: Locked to the Windows API!
==EOF==
___________________________________________________________________________________________________
OTL logfile created on: 9/6/2009 5:41:15 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = E:\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18813)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.99 Gb Total Physical Memory | 1.29 Gb Available Physical Memory | 65.01% Memory free
4.00 Gb Paging File | 3.15 Gb Available in Paging File | 78.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 202.76 Gb Total Space | 129.93 Gb Free Space | 64.08% Space Free | Partition Type: NTFS
Drive D: | 9.71 Gb Total Space | 3.07 Gb Free Space | 31.56% Space Free | Partition Type: NTFS
Drive E: | 85.62 Gb Total Space | 69.36 Gb Free Space | 81.01% Space Free | Partition Type: NTFS
Drive F: | 195.31 Gb Total Space | 195.21 Gb Free Space | 99.95% Space Free | Partition Type: NTFS
Drive G: | 102.78 Gb Total Space | 97.47 Gb Free Space | 94.84% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: OFFICE
Current User Name: Bob
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Processes (SafeList) ==========
PRC - [2009/04/11 02:27:20 | 00,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\AUDIODG.EXE
PRC - [2009/04/11 02:27:36 | 02,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\Explorer.EXE
PRC - [2009/06/26 17:21:00 | 00,757,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX3000.exe
PRC - [2009/07/25 05:23:12 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009/01/11 20:41:36 | 03,918,856 | ---- | M] (RKS Software) -- C:\Program Files\RKS Fax\rksfax_control.exe
PRC - [2006/12/11 22:02:28 | 00,081,920 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxpers.exe
PRC - [2006/10/11 12:45:12 | 00,075,304 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
PRC - [2009/02/24 17:00:26 | 00,479,232 | ---- | M] (Nikon Corporation) -- C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
PRC - [2006/11/07 18:34:26 | 00,053,248 | ---- | M] (Chicony) -- C:\Windows\ModPS2Key.exe
PRC - [2007/11/01 18:12:38 | 00,582,992 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2009/07/13 14:03:10 | 00,292,128 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2006/12/11 22:02:38 | 00,098,304 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxtray.exe
PRC - [2006/11/15 20:58:26 | 00,151,552 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/12/11 22:03:58 | 00,106,496 | ---- | M] (Intel Corporation) -- C:\Windows\System32\hkcmd.exe
PRC - [2008/04/24 14:25:22 | 00,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
PRC - [2006/11/07 18:08:40 | 00,547,840 | ---- | M] () -- C:\Windows\zHotkey.exe
PRC - [2008/01/18 23:33:40 | 00,202,240 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe
PRC - [2009/04/11 02:28:03 | 01,233,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Sidebar\sidebar.exe
PRC - [2008/01/18 23:33:10 | 00,125,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehtray.exe
PRC - [2008/01/18 23:33:10 | 00,037,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehmsas.exe
PRC - [2009/04/20 14:19:34 | 02,162,688 | ---- | M] (SourceForge.net) -- C:\Program Files\Password Safe\pwsafe.exe
PRC - [2007/09/11 01:45:04 | 00,124,832 | ---- | M] () -- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
PRC - [2009/05/29 13:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2006/11/15 20:57:58 | 00,081,920 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
PRC - [2007/08/15 12:36:04 | 00,359,248 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
PRC - [2009/03/22 08:29:55 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe
PRC - [2007/07/24 12:02:14 | 00,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\McShield.exe
PRC - [2003/06/19 23:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
PRC - [2007/07/18 12:54:42 | 00,856,864 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MPFSrv.exe
PRC - [2009/07/24 15:05:24 | 00,139,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2007/02/15 21:08:02 | 00,065,536 | ---- | M] (New Boundary Technologies, Inc.) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
PRC - [2008/04/24 14:26:18 | 00,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
PRC - [2007/06/29 09:11:16 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\DRIVERS\xaudio.exe
PRC - [2008/01/18 23:33:42 | 00,142,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WUDFHost.exe
PRC - [2008/01/09 15:50:22 | 00,767,976 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe
PRC - [2008/01/18 23:33:40 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe
PRC - [2009/07/13 14:02:50 | 00,542,496 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/04/11 02:28:08 | 00,037,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\unsecapp.exe
PRC - [2009/04/11 02:28:15 | 00,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\wmiprvse.exe
PRC - [2007/12/05 10:04:10 | 00,695,624 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe
PRC - [2008/01/25 01:38:12 | 02,458,128 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2009/08/23 16:18:01 | 00,908,280 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/09/06 17:39:22 | 00,514,048 | ---- | M] (OldTimer Tools) -- E:\Downloads\OTL.exe
========== Win32 Services (SafeList) ==========
SRV - [2007/09/11 01:45:04 | 00,124,832 | ---- | M] () -- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor6.0 [Auto | Running])
SRV - [2009/05/29 13:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running])
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running])
SRV - [2009/03/30 00:42:14 | 00,066,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2008/01/18 23:33:10 | 00,292,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehRecvr.exe -- (ehRecvr [On_Demand | Stopped])
SRV - [2006/11/02 08:35:29 | 00,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched [On_Demand | Stopped])
SRV - [2006/11/02 08:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart [Auto | Stopped])
SRV - [2009/04/11 02:28:25 | 01,017,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wevtsvc.dll -- (Eventlog [Auto | Running])
SRV - [2008/01/30 09:29:56 | 00,647,680 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand | Stopped])
SRV - [2009/02/18 14:39:20 | 00,043,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2009/03/22 08:29:55 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate1c9aae9f13cb030 [Auto | Stopped])
SRV - [2009/03/22 08:28:52 | 00,183,280 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [Auto | Stopped])
SRV - [2006/11/15 20:57:58 | 00,081,920 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe -- (IAANTMON [Auto | Running])
SRV - [2005/04/04 01:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2009/02/18 14:38:42 | 00,879,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped])
SRV - [2009/07/13 14:02:50 | 00,542,496 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running])
SRV - [2008/01/09 15:50:22 | 00,767,976 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc [Auto | Running])
SRV - [2008/01/25 01:38:12 | 02,458,128 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc [Auto | Running])
SRV - [2007/11/07 09:35:40 | 00,378,184 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS [On_Demand | Stopped])
SRV - [2007/08/15 12:36:04 | 00,359,248 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy [Auto | Running])
SRV - [2007/07/24 12:02:14 | 00,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\McShield.exe -- (McShield [Unknown | Running])
SRV - [2007/12/05 10:04:10 | 00,695,624 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon [On_Demand | Running])
SRV - [2003/06/19 23:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM [Auto | Running])
SRV - [2007/07/18 12:54:42 | 00,856,864 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService [Auto | Running])
SRV - [2009/07/24 15:05:24 | 00,139,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc [Auto | Running])
SRV - [2008/02/28 11:53:18 | 00,043,520 | ---- | M] (Hewlett-Packard) -- C:\Windows\System32\HPZinw12.dll -- (Net Driver HPZ12 [Auto | Running])
SRV - [2009/02/18 14:38:43 | 00,129,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])
SRV - [2008/11/04 01:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped])
SRV - [2007/08/22 19:22:00 | 00,147,824 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2008/02/28 11:53:18 | 00,053,248 | ---- | M] (Hewlett-Packard) -- C:\Windows\System32\HPZipm12.dll -- (Pml Driver HPZ12 [Auto | Running])
SRV - [2007/02/15 21:08:02 | 00,065,536 | ---- | M] (New Boundary Technologies, Inc.) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- (PrismXL [Auto | Running])
SRV - [2008/04/24 14:26:18 | 00,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe -- (sprtsvc_ddoctorv2 [Auto | Running])
SRV - [2008/01/18 23:38:26 | 00,272,952 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend [Auto | Running])
SRV - [2008/01/18 23:33:40 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc [On_Demand | Running])
SRV - [2007/06/29 09:11:16 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\DRIVERS\xaudio.exe -- (XAudioService [Auto | Running])
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...h...TP&M=GT5438
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.c...h...TP&M=GT5438
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SE...S01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,AutoSearch = http://ie.search.msn...autosearch.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Comcast Search"
FF - prefs.js..browser.search.openintab: true
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://my.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}:0.6.0.0
FF - prefs.js..extensions.enabledItems: {446c03e0-2c35-11db-a98b-0800200c9a67}:0.5
FF - prefs.js..extensions.enabledItems: {3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}:0.9.6
FF - prefs.js..extensions.enabledItems: {FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3}:1.3.4
FF - prefs.js..extensions.enabledItems: {5546F97E-11A5-46b0-9082-32AD74AAA920}:0.5.5.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
FF - prefs.js..extensions.enabledItems: {398e77b8-2304-11dc-8314-0800200c9a66}:0.3.13
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.8.8
FF - prefs.js..extensions.enabledItems: {aba3f5c2-35d5-4960-bdfc-de9c162e39ce}:2.0.1.1
FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:2.2.0.2
FF - prefs.js..extensions.enabledItems: [email protected]:1.2.2
FF - prefs.js..extensions.enabledItems: {19EB90DC-A456-458b-8AAC-616D91AAFCE1}:0.6
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.2
FF - prefs.js..keyword.URL: "http://errorpage.com...=dc&safe=on&q="
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/06/30 19:08:02 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/08/23 16:18:10 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/08/31 10:37:25 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.19\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/06/03 15:00:11 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.19\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2009/08/31 10:37:25 | 00,000,000 | ---D | M]
[2008/07/05 12:01:53 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Extensions
[2008/07/05 12:01:53 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/09/06 16:57:48 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions
[2008/05/05 11:10:06 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{19EB90DC-A456-458b-8AAC-616D91AAFCE1}
[2009/06/30 19:12:20 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/05/27 16:59:33 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
[2009/07/22 08:15:58 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{398e77b8-2304-11dc-8314-0800200c9a66}
[2008/05/21 11:37:45 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}
[2009/02/21 15:20:41 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{446c03e0-2c35-11db-a98b-0800200c9a67}
[2009/02/10 13:57:43 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}(47)
[2008/06/28 10:52:12 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{5359A5B3-9AFD-49ee-8C39-0A8F97A2A2D6}
[2009/01/16 15:31:59 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{5546F97E-11A5-46b0-9082-32AD74AAA920}
[2009/09/03 13:09:46 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2008/07/20 21:32:48 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
[2009/08/13 18:57:29 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}
[2008/08/29 08:34:23 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{aba3f5c2-35d5-4960-bdfc-de9c162e39ce}
[2009/09/03 13:09:46 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2009/06/30 14:37:50 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\{FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3}
[2009/06/21 20:16:42 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\[email protected]
[2009/08/28 10:53:07 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\[email protected]
[2009/08/11 10:38:24 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\mozilla\Firefox\Profiles\ko5yrols.default\extensions\[email protected]
[2008/06/18 19:34:41 | 00,001,712 | ---- | M] () -- C:\Users\Bob\AppData\Roaming\Mozilla\FireFox\Profiles\ko5yrols.default\searchplugins\askcom.xml
[2009/07/14 12:55:37 | 00,002,164 | ---- | M] () -- C:\Users\Bob\AppData\Roaming\Mozilla\FireFox\Profiles\ko5yrols.default\searchplugins\bing.xml
[2007/10/25 10:46:32 | 00,004,946 | ---- | M] () -- C:\Users\Bob\AppData\Roaming\Mozilla\FireFox\Profiles\ko5yrols.default\searchplugins\comcast.xml
[2009/02/13 17:00:04 | 00,000,705 | ---- | M] () -- C:\Users\Bob\AppData\Roaming\Mozilla\FireFox\Profiles\ko5yrols.default\searchplugins\webster.xml
[2009/08/31 12:11:43 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/08/23 16:18:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/07/31 15:36:54 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/05 15:37:34 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009/08/23 16:17:57 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/08/23 16:17:58 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2007/04/10 17:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\np-mswmp.dll
[2009/07/25 05:23:01 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2009/02/06 12:44:28 | 01,447,296 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll
[2009/08/23 16:18:03 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2007/08/23 21:37:52 | 00,018,832 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL
[2008/02/04 18:49:18 | 00,663,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\npOGAPlugin.dll
[2009/02/27 12:13:42 | 00,103,792 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2009/06/03 15:00:10 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2009/06/03 15:00:10 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2009/06/03 15:00:11 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2009/06/03 15:00:11 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2009/06/03 15:00:11 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2009/06/03 15:00:11 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2009/06/03 15:00:11 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2009/08/23 16:18:05 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/08/23 16:18:05 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/12/01 12:50:26 | 00,004,946 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\comcast.xml
[2009/08/23 16:18:05 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/08/23 16:18:05 | 00,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/08/23 16:18:05 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/08/23 16:18:05 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/08/23 16:18:05 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml
O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll (Gateway Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CHotkey] C:\Windows\zHotkey.exe ()
O4 - HKLM..\Run: [ddoctorv2] C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [ModPS2] C:\Windows\ModPS2Key.exe (Chicony)
O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RKS Fax Print Controller] C:\Program Files\RKS Fax\rksfax_control.exe (RKS Software)
O4 - HKLM..\Run: [ShowWnd] C:\Windows\ShowWnd.exe ()
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [VX3000] C:\Windows\vVX3000.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Power2GoExpress] File not found
O4 - HKCU..\Run: [Sidebar] C:\Program Files\windows sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk = C:\Program Files\Password Safe\pwsafe.exe (SourceForge.net)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.73.246 68.87.71.230
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2004/04/30 04:01:00 | 00,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{14fa96ad-d1e7-11dd-8022-0019d14d011a}\Shell\AutoRun\command - "" = I:\WDSetup.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
NetSvcs: FastUserSwitchingCompatibility - Service key not found. File not found
NetSvcs: Ias - Service key not found. File not found
NetSvcs: Irmon - Service key not found. File not found
NetSvcs: Nla - Service key not found. File not found
NetSvcs: Ntmssvc - Service key not found. File not found
NetSvcs: NWCWorkstation - Service key not found. File not found
NetSvcs: Nwsapagent - Service key not found. File not found
NetSvcs: SRService - Service key not found. File not found
NetSvcs: Wmi - Service key not found. File not found
NetSvcs: WmdmPmSp - Service key not found. File not found
NetSvcs: LogonHours - Service key not found. File not found
NetSvcs: PCAudit - Service key not found. File not found
NetSvcs: helpsvc - Service key not found. File not found
NetSvcs: uploadmgr - Service key not found. File not found
========== Files/Folders - Created Within 14 Days ==========
[1 C:\Windows\*.tmp files]
[2009/09/06 12:51:20 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2009/09/05 12:18:25 | 03,107,909 | -H-- | C] () -- C:\Users\Bob\AppData\Local\IconCache.db
[2009/09/05 09:00:26 | 00,000,000 | ---D | C] -- E:\Documents\SysinternalsSuite
[2009/09/04 17:57:33 | 21,369,73312 | -HS- | C] () -- C:\hiberfil.sys
[2009/09/04 13:41:28 | 00,000,892 | ---- | C] () -- C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk
[2009/09/04 13:35:30 | 00,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\Adobe
[2009/09/04 13:32:07 | 00,000,000 | ---D | C] -- C:\Windows\pss
[2009/09/04 12:59:47 | 00,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\Malwarebytes
[2009/09/04 12:59:45 | 00,000,841 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/04 12:59:42 | 00,038,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2009/09/04 12:59:40 | 00,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2009/09/04 12:59:40 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2009/09/04 12:59:39 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/04 12:57:51 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT
[2009/09/04 12:57:15 | 00,000,737 | ---- | C] () -- C:\Users\Bob\Desktop\ERUNT.lnk
[2009/09/04 12:57:14 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/09/04 10:37:25 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\AnswerWorks 5.0
[2009/09/04 10:37:15 | 03,523,872 | ---- | C] (Amyuni Technologies
http://www.amyuni.com) -- C:\Windows\System32\cdintf300.dll
[2009/09/04 10:37:14 | 00,001,646 | ---- | C] () -- C:\Users\Public\Desktop\Quicken Deluxe 2009.lnk
[2009/09/04 10:37:13 | 00,000,425 | ---- | C] () -- C:\Users\Public\Desktop\Best Card for Quicken Users - low APR, optional rewards program.url
[2009/09/04 10:37:13 | 00,000,389 | ---- | C] () -- C:\Users\Public\Desktop\One Month FREE - pay bills right from Quicken.url
[2009/09/04 10:37:13 | 00,000,357 | ---- | C] () -- C:\Users\Public\Desktop\Free Credit Report and Score.url
[2009/09/04 10:36:25 | 00,000,000 | ---D | C] -- C:\Program Files\Quicken
[2009/09/04 09:17:46 | 00,001,469 | ---- | C] () -- C:\Users\Bob\Desktop\procexp.exe - Shortcut.lnk
[2009/09/03 12:17:24 | 03,162,128 | ---- | C] () -- C:\Users\Bob\Desktop\test_20090903.QDF
[2009/08/31 11:41:55 | 00,000,000 | ---D | C] -- C:\ProgramData\XoftSpySE
[2009/08/31 10:37:25 | 00,001,910 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2009/08/28 13:20:21 | 00,008,893 | ---- | C] () -- E:\Documents\MyQuicken.QIF
[2009/08/25 09:39:20 | 00,000,000 | ---D | C] -- E:\Documents\iMacros
========== Files - Modified Within 14 Days ==========
[1 C:\Windows\*.tmp files]
[2009/09/06 16:36:07 | 00,694,964 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2009/09/06 16:36:07 | 00,598,350 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2009/09/06 16:36:07 | 00,101,988 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2009/09/06 16:34:16 | 00,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2009/09/06 16:32:11 | 00,019,961 | ---- | M] () -- C:\Windows\System32\Config.MPF
[2009/09/06 16:31:35 | 00,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/09/06 16:31:35 | 00,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/09/06 16:31:29 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2009/09/06 16:31:24 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2009/09/06 16:31:22 | 21,369,73312 | -HS- | M] () -- C:\hiberfil.sys
[2009/09/06 16:18:15 | 03,107,909 | -H-- | M] () -- C:\Users\Bob\AppData\Local\IconCache.db
[2009/09/06 03:00:47 | 03,297,280 | -H-- | M] () -- E:\Documents\SyncToy_3950677c-1b52-4fae-ad2f-25f63771e5ad.dat
[2009/09/05 20:20:04 | 00,001,693 | ---- | M] () -- C:\Users\Bob\Desktop\CCleaner.lnk
[2009/09/04 15:33:36 | 00,000,038 | ---- | M] () -- E:\Documents\Bob's Safe.plk
[2009/09/04 12:59:45 | 00,000,841 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/04 12:57:15 | 00,000,737 | ---- | M] () -- C:\Users\Bob\Desktop\ERUNT.lnk
[2009/09/04 10:41:12 | 00,000,165 | ---- | M] () -- C:\Windows\QUICKEN.INI
[2009/09/04 10:37:14 | 00,001,646 | ---- | M] () -- C:\Users\Public\Desktop\Quicken Deluxe 2009.lnk
[2009/09/04 10:37:14 | 00,000,425 | ---- | M] () -- C:\Users\Public\Desktop\Best Card for Quicken Users - low APR, optional rewards program.url
[2009/09/04 10:37:13 | 00,000,389 | ---- | M] () -- C:\Users\Public\Desktop\One Month FREE - pay bills right from Quicken.url
[2009/09/04 10:37:13 | 00,000,357 | ---- | M] () -- C:\Users\Public\Desktop\Free Credit Report and Score.url
[2009/09/04 09:26:44 | 00,001,469 | ---- | M] () -- C:\Users\Bob\Desktop\procexp.exe - Shortcut.lnk
[2009/09/03 17:57:14 | 00,025,608 | ---- | M] () -- E:\Documents\Bob's Safe.psafe3
[2009/09/03 12:17:26 | 03,162,128 | ---- | M] () -- C:\Users\Bob\Desktop\test_20090903.QDF
[2009/08/31 10:37:25 | 00,001,910 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2009/08/28 13:20:21 | 00,008,893 | ---- | M] () -- E:\Documents\MyQuicken.QIF
[2009/08/27 19:18:33 | 00,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLdu.DAT
[2009/08/25 21:04:18 | 00,001,918 | ---- | M] () -- C:\Users\Public\Desktop\Nikon Transfer.lnk
========== LOP Check ==========
[2009/09/04 12:59:47 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming
[2007/09/10 20:50:00 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ArcSoft
[2009/09/05 11:05:44 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\CallingID
[2007/09/10 20:53:25 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Canon
[2007/09/17 13:06:31 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\CyberLink
[2008/05/02 07:11:45 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\firstobject
[2009/03/22 08:19:41 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GARMIN
[2009/07/15 11:23:14 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\hm8platform
[2009/09/04 10:36:52 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Intuit
[2006/11/02 08:37:34 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Media Center Programs
[2008/04/09 13:42:34 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\MZTools Software
[2009/02/07 11:55:52 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Nikon
[2007/05/10 10:09:28 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Opera
[2007/04/27 15:25:59 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\SampleView
[2007/09/10 20:05:09 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ScanSoft
[2007/04/27 21:54:54 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Thunderbird
[2009/04/01 13:40:37 | 00,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Windows Sidebar Styler
[2009/09/06 16:34:16 | 00,000,868 | ---- | M] () -- C:\Windows\Tasks\Google Software Updater.job
[2009/06/30 06:21:34 | 00,000,882 | ---- | M] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2009/04/18 17:37:51 | 00,000,336 | ---- | M] () -- C:\Windows\Tasks\McDefragTask.job
[2009/04/18 17:37:50 | 00,000,328 | ---- | M] () -- C:\Windows\Tasks\McQcTask.job
[2009/09/06 16:31:29 | 00,000,006 | -H-- | M] () -- C:\Windows\Tasks\SA.DAT
[2009/09/06 16:18:28 | 00,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
< %systemroot%\system32\eventlog.dll >
< %systemroot%\system32\scecli.dll >
[2009/04/11 02:28:24 | 00,177,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\scecli.dll
< %systemroot%\netlogon.dll >
< %systemroot%\system32\cngaudit.dll >
[2006/11/02 05:46:03 | 00,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cngaudit.dll
< %systemroot%\system32\sceclt.dll >
< %systemroot%\ntelogon.dll >
< %systemroot%\system32\logevent.dll >
< End of report >
_______________________________________________________________________________________________
OTL Extras logfile created on: 9/6/2009 5:41:15 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = E:\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18813)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.99 Gb Total Physical Memory | 1.29 Gb Available Physical Memory | 65.01% Memory free
4.00 Gb Paging File | 3.15 Gb Available in Paging File | 78.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 202.76 Gb Total Space | 129.93 Gb Free Space | 64.08% Space Free | Partition Type: NTFS
Drive D: | 9.71 Gb Total Space | 3.07 Gb Free Space | 31.56% Space Free | Partition Type: NTFS
Drive E: | 85.62 Gb Total Space | 69.36 Gb Free Space | 81.01% Space Free | Partition Type: NTFS
Drive F: | 195.31 Gb Total Space | 195.21 Gb Free Space | 99.95% Space Free | Partition Type: NTFS
Drive G: | 102.78 Gb Total Space | 97.47 Gb Free Space | 94.84% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: OFFICE
Current User Name: Bob
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-336559941-1480386105-577895080-1001]
"EnableNotificationsRef" = 2
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-336559941-1480386105-577895080-500]
"EnableNotificationsRef" = 2
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0EE94E72-8D2B-4256-ACA8-F13C94E12A04}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{2D476080-067C-4210-9A0A-48C0708227B5}" = lport=1900 | protocol=17 | dir=in | name=intel® viiv™ media server upnp discovery |
"{61DF4212-EE58-4EF4-8306-DEA4605B593E}" = lport=1900 | protocol=17 | dir=in | name=intel® viiv™ media server upnp discovery |
"{A0CD1AB0-F9DD-4390-AFE1-B4715194F710}" = lport=9442 | protocol=17 | dir=in | name=intel® viiv™ media server discovery |
"{BD502291-660D-4BAE-9CAD-76DD53ECD753}" = lport=9442 | protocol=17 | dir=in | name=intel® viiv™ media server discovery |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{065DA534-A2F3-4473-A00D-184897F49C29}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg free\avgamsvr.exe |
"{06CD2123-BCD3-45E2-A99D-3692A73990D0}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{08A99DE5-B9A5-4A9E-8103-9899F4C9CF6A}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg free\avgamsvr.exe |
"{0C5A8A48-6C97-4F31-87D9-2C7A47630E91}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{1C27EE66-92C7-49F8-84BE-76DA0518127F}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{1D9B3154-C622-4AF5-A238-39A6FD1DBF77}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg free\avginet.exe |
"{29C893FD-B32F-4A1B-96C4-4BEA12646E99}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{3755315D-0653-4180-B3C0-C53B1DDD1B0B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{3AAD3BB7-6EDF-4C32-A6D5-CBA6974B7D29}" = protocol=17 | dir=in | app=c:\program files\avg\avg8\avgtray.exe |
"{3E83B936-3F4D-49BB-B945-0255EE9D576E}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg free\avgcc.exe |
"{459E047C-E0E7-4C8E-8944-E640A8DCEFFE}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg7\avgw.exe |
"{5170E124-21C7-4BA4-A2BE-E960BD7DA14E}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{5531E143-48EE-46A0-BAB2-1ED1206B8DB7}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{56389D45-5F35-4596-A3B5-F87DEA954718}" = protocol=6 | dir=in | app=c:\program files\avg\avg8\avgui.exe |
"{58ECD381-4A19-4B85-A5D9-C8AA4519AD5B}" = protocol=17 | dir=in | app=c:\program files\avg\avg8\avgwdsvc.exe |
"{5AE13809-FA1D-45EA-944B-84FCAD308CAE}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{5E842958-C0D7-4825-80A7-567C0C7D6F5C}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{61922E9A-FFF7-4F9E-9CD2-342B610D95EA}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{66EF09EE-E74F-4202-A1D4-BDB3B6637D12}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{6875ED0B-843F-45B3-A771-35AF18488F09}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{6CB6003C-E57C-4296-B567-527ED16E8715}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg7\avgcc.exe |
"{6FF99C5C-6782-46FC-BC06-E15F83A5E986}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{725C93B0-BD06-4D42-933A-9021A845F2FD}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{740CE9D8-F7AC-4A76-8781-6B1C4E41EAE7}" = protocol=6 | dir=in | app=c:\program files\avg\avg8\avgtray.exe |
"{7BE514AC-AB9D-43F8-BE49-D893B60CACB9}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{807A4A8A-C524-4FE2-8D61-00CBA77F4DFA}" = protocol=17 | dir=in | app=c:\program files\avg\avg8\avgui.exe |
"{85C428C5-96EF-4465-A058-4916485A5EFF}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{8BD51B33-E522-4072-B292-714C6D8D3E50}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg free\avgcc.exe |
"{939EA104-3BA8-486E-8871-3B26D59424CE}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{9589B98E-3CB3-40D9-A926-B3BB03C7B822}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{96A7DD1B-BADC-4469-9E82-48C4A651D559}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{9A7959E3-8235-466F-8A89-9851D379D243}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{9C558454-9FA7-4186-B1F5-E7AC64EDD58A}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{9E77216F-ACEF-4221-BB7B-455EC9099F94}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{A296E2DE-2366-443E-B791-3DA51DD27B85}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{AA315D9C-A48B-4464-8C08-7E1D7676208D}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{B3D4C29A-9FC1-4696-A043-A69F9BCFDA51}" = protocol=17 | dir=in | app=c:\program files\avg\avg8\avgwsc.exe |
"{B48FD3A1-F9EF-4A61-BEE9-14F6A73D1055}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{C0A91B9C-0000-4909-BBAA-13460747D384}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C301C1BF-9E30-430F-B90B-6137BA22E933}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C3A92059-7B6A-4418-A1CD-297CDFE42714}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{D6F3B21D-0204-4CF9-99EF-B663F1DF59B8}" = protocol=6 | dir=in | app=c:\program files\avg\avg8\avgwdsvc.exe |
"{DC1C68AF-293D-4FB5-93CB-5D8301826081}" = protocol=6 | dir=in | app=c:\program files\avg\avg8\avgwsc.exe |
"{DD8C086B-ACA4-41BA-870A-F93A8F1C3FED}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg7\avgw.exe |
"{DE5EFA4A-AB03-43E2-861E-306277294047}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{E9DBF758-357A-46C1-8550-62B7B1A55B28}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg free\avginet.exe |
"{FDC28C28-370E-4DD0-A80F-EDBBA0BB642B}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{FE0C9EA8-BA66-4077-BF92-9ADACC8A04FF}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{FEA88B57-556E-4772-8AE6-107C8EED9E1C}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg7\avgcc.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{07B3B42B-18C1-4CA7-AFFB-2B0313BBFB7C}_is1" = Vizacc HelpMaker 7.4.4 (remove only)
"{107254A0-0ADF-11D4-9397-00D0B7020B38}" =
"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter
"{1F5075FE-3294-4EDB-9DFF-9ACFBFCDD769}" = City Navigator North America NT v7
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{237CD223-1B9D-47E8-A76C-E478B83CCEA2}" = File Uploader
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 15
"{2B69AD59-FA30-47fc-B950-FA27E7D16A73}_is1" = MZ-Tools 3.0 for VBA
"{2FD94FBC-07AE-475C-B522-BFE899B9048E}" = Garmin WebUpdater
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types
"{36C97B5B-5593-45B8-B50E-DAD87036BD9D}" = Microsoft LifeCam
"{3CCB26F5-E2A7-4C91-8340-9149D7B7C2BE}" = Virtual Earth 3D (Beta)
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{44C05309-60F4-410B-BC32-31733CFF1A41}" = Microsoft Digital Image Starter Edition 2006 Editor
"{4FE542EB-FF0B-4739-94DD-25C8AE0AB251}" = Microsoft Digital Image Starter Edition 2006 Library
"{5301C483-40FB-4F94-B56E-D7D5A114D2F6}" = Garmin City Navigator North America NT v8
"{54AE3C08-D7D8-45FF-9348-0B4BE0D5A6CB}" = Comcast Universal Installer v1.2
"{64D3F439-6BB0-4F9A-B51B-DE30B6F38243}" = Liquid XML Studio 2008
"{661CFD1B-9450-4997-8FF8-E9A902D626AF}" = Liquid XML Data Binder 2008
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7D25A304-C82D-41C3-85A8-3BEF84E04887}" = Garmin WebUpdater
"{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718}" = Gateway Recovery Center Installer
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00D0-0409-0000-0000000FF1CE}" = Microsoft Office Access Developer Extensions (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{BE2CC4A5-2128-4EA2-941D-14F7A6A1AB61}" = Digital Media Reader
"{C1E693A4-B1D5-4DCD-B68D-2087835B7184}" = ScanSoft OmniPage SE 4.0
"{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}" = Apple Mobile Device Support
"{C45EB9E5-7165-4FB0-8C31-77FC4743362F}" = Manual CanoScan LiDE 25
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = CanoScan Toolbox Ver4.9
"{CC016F21-3970-11DE-B878-005056806466}" = Google Earth
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D87149B3-7A1D-4548-9CBF-032B791E5908}" = Desktop Doctor
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{EA6EB7D0-C920-4434-B43D-0DDD0AF8F497}" = Garmin MapSource
"{ED2A3C11-3EA8-4380-B59C-F2C1832731B0}" = Quicken 2009
"{F3666943-0411-41D1-8015-8B572B6E91A7}" = SyncToy 2.0 Beta
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F6B2ED65-7378-4065-802D-F2E5689F3A4E}" = Photo Viewer
"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
"{FCC07EEA-FA18-4A21-9105-9666603C6885}" = McAfee Virtual Technician
"{FF262740-C85A-11D5-BBEC-00D0B740900A}" = PS2 Multimedia Keyboard Driver
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"CCleaner" = CCleaner (remove only)
"CNXT_MODEM_PCI_HSF" = Soft Data Fax Modem with SmartCP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ERUNT_is1" = ERUNT 1.1j
"Foxit PDF Creator" = Foxit PDF Creator
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"IconEdit32" = IconEdit32
"IconJack32" = IconJack32
"InstallShield_{BE2CC4A5-2128-4EA2-941D-14F7A6A1AB61}" = Digital Media Reader
"IsoBuster_is1" = IsoBuster 1.2
"Liquid XML Data Binder 2008" = Liquid XML Data Binder 2008
"Liquid XML Studio 2008" = Liquid XML Studio 2008
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.2)" = Mozilla Firefox (3.5.2)
"Mozilla Thunderbird (2.0.0.19)" = Mozilla Thunderbird (2.0.0.19)
"MSC" = McAfee SecurityCenter
"Password Safe" = Password Safe
"PictureItSuiteTrial_v12" = Microsoft Digital Image Starter Edition 2006
"PROR" = Microsoft Office Professional 2007
"PROSet" = Intel® PRO Network Connections Drivers
"RKSFaxVersion1_is1" = RKS Fax
"Smart Indenter v3.5 for Office 2000-2003" = Smart Indenter v3.5 for Office 2000-2003
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
Sign In
Create Account
