[Batwulf]

I am receiving frequent BSOD, particularly when I try to watch a video, even on YouTube. I recently ran SpyBot, and it said that it cleaned up a whole bunch of stuff, but I'm still getting BSOD. Last summer, I took my computer in to a local shop for a hardware issue, and the computer shop guy said my hard-drive and motherboard are failing and wants me to buy a new computer. Can someone please help me check first if this is a malware issue? I am completely computer illiterate, and my computer frequently frustrates me, so I'll need very simple instructions.

I don't know if it's related, but I also can't look at Flickr at all -- I get sent to a Yahoo! error page every time I paste in a Flickr URL.

[Advertisements]

Hello Batwulf and welcome to my office here at G2G!

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTES:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
• Please DO NOT run any scans or fix on your own without my direction.
• Please read all of my response through at least once before attempting to follow the procedures described.
• If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste it to include the log in your reply.
• You must reply within 3 days or your topic will be closed

Let's check if this is virus related.

Step 1

Download OTL to your Desktop

• Double click on the icon to run it (If running Vista or Windows 7, right click on it and select "Run as an Administrator"). Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan/Fixes box paste this in
  
  

  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  services.exe
  /md5stop
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them here for me.

Step 2

Download GMER from Here. Note the file\'s name and save it to your root folder, such as C:.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
• Click on this link to see a list of programs that should be disabled.
• Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
• Allow the driver to load if asked.
• You may be prompted to scan immediately if it detects rootkit activity.
• If you are prompted to scan your system click "No", save the log and post back the results.
• If not prompted, click the "Rootkit/Malware" tab.
• On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
• Select all drives that are connected to your system to be scanned.
• Click the Scan button to begin. (Please be patient as it can take some time to complete)
• When the scan is finished, click Save to save the scan results to your Desktop.
• Save the file as Results.log and copy/paste the contents in your next reply.
• Exit the program and re-enable all active protection when done.

Step 3

Please don't forget to include these items in your reply:

• OTL log
• OTL Extras log
• GMER log

It would be helpful if you could post each log in separate post using "Add Reply" button

[maliprog]

Hello Batwulf and welcome to my office here at G2G!

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTES:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
• Please DO NOT run any scans or fix on your own without my direction.
• Please read all of my response through at least once before attempting to follow the procedures described.
• If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste it to include the log in your reply.
• You must reply within 3 days or your topic will be closed

Let's check if this is virus related.

Step 1

Download OTL to your Desktop

• Double click on the icon to run it (If running Vista or Windows 7, right click on it and select "Run as an Administrator"). Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan/Fixes box paste this in
  
  

  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  services.exe
  /md5stop
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them here for me.

Step 2

Download GMER from Here. Note the file\'s name and save it to your root folder, such as C:.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
• Click on this link to see a list of programs that should be disabled.
• Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
• Allow the driver to load if asked.
• You may be prompted to scan immediately if it detects rootkit activity.
• If you are prompted to scan your system click "No", save the log and post back the results.
• If not prompted, click the "Rootkit/Malware" tab.
• On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
• Select all drives that are connected to your system to be scanned.
• Click the Scan button to begin. (Please be patient as it can take some time to complete)
• When the scan is finished, click Save to save the scan results to your Desktop.
• Save the file as Results.log and copy/paste the contents in your next reply.
• Exit the program and re-enable all active protection when done.

Step 3

Please don't forget to include these items in your reply:

• OTL log
• OTL Extras log
• GMER log

It would be helpful if you could post each log in separate post using "Add Reply" button

[maliprog]

Hi Batwulf,

Please post your logs here for me now.

[Batwulf]

Here's the OTL logfile:

OTL logfile created on: 1/7/2013 3:23:30 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Wulf\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.16 Gb Available Physical Memory | 57.84% Memory free
3.35 Gb Paging File | 2.30 Gb Available in Paging File | 68.66% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 41.43 Gb Free Space | 27.79% Space Free | Partition Type: NTFS

Computer Name: MILLENNIUMFALCO | User Name: Wulf | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/01/07 15:21:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Wulf\My Documents\Downloads\OTL.exe
PRC - [2012/12/19 20:57:57 | 000,030,096 | ---- | M] (VER_COMPANY_NAME) -- C:\Program Files\WeatherBlink\bar\1.bin\gcbrmon.exe
PRC - [2012/12/13 14:26:20 | 003,290,896 | ---- | M] (Skype Technologies S.A.) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/12/10 15:14:39 | 000,969,104 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2012/12/03 15:43:58 | 001,354,736 | ---- | M] (Valve Corporation) -- C:\Program Files\Steam\Steam.exe
PRC - [2012/11/13 14:08:08 | 003,825,176 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
PRC - [2012/11/13 14:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2012/11/13 14:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2012/11/06 19:00:32 | 003,143,800 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgui.exe
PRC - [2012/11/06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgidsagent.exe
PRC - [2012/11/02 00:08:48 | 001,340,976 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgfws.exe
PRC - [2012/10/30 04:59:56 | 000,726,648 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgrsx.exe
PRC - [2012/10/22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe
PRC - [2012/10/22 13:04:32 | 001,116,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgnsx.exe
PRC - [2012/10/22 13:03:46 | 000,440,440 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgcsrvx.exe
PRC - [2012/10/18 19:49:12 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/07/20 15:39:50 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2012/07/02 09:25:14 | 002,232,504 | ---- | M] (Giraffic) -- C:\Program Files\Giraffic\Veoh_GirafficWatchdog.exe
PRC - [2012/07/02 09:24:54 | 003,790,504 | ---- | M] (Giraffic) -- C:\Program Files\Giraffic\Veoh_Giraffic.exe
PRC - [2012/06/19 12:44:22 | 002,784,256 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe
PRC - [2012/06/19 12:44:22 | 000,777,728 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
PRC - [2012/06/18 20:13:46 | 000,394,712 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe
PRC - [2012/06/05 21:35:04 | 000,397,848 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\IBUpdaterService\ibsvc.exe
PRC - [2012/06/05 21:35:02 | 000,773,624 | ---- | M] (bProtector) -- C:\Documents and Settings\All Users\Application Data\bProtector\bProtect.exe
PRC - [2010/11/12 09:38:54 | 000,221,144 | ---- | M] (Visicom Media Inc.) -- C:\Documents and Settings\All Users\Application Data\Antiphishing Domain Advisor\vmn3_5dn.exe
PRC - [2010/09/03 00:45:02 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe
PRC - [2009/07/08 01:53:36 | 000,472,112 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Pure Networks\Network Magic\nmapp.exe
PRC - [2009/07/07 13:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2008/08/14 17:54:53 | 000,611,664 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
PRC - [2008/04/13 18:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/05/31 13:16:05 | 000,819,352 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2006/04/21 15:03:34 | 000,094,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/01/02 17:41:22 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005/09/19 02:24:00 | 000,856,064 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
PRC - [2005/09/19 02:20:58 | 000,155,648 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
PRC - [2005/03/23 13:34:52 | 000,165,488 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
PRC - [2005/03/23 13:34:36 | 000,198,256 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
PRC - [2005/03/10 00:56:32 | 000,405,504 | ---- | M] (ALi Corporation) -- C:\Program Files\ULI5289\ALi5289.exe
PRC - [2004/12/22 03:09:44 | 000,077,824 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2004/11/22 15:04:14 | 001,273,856 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
PRC - [2004/08/22 15:05:02 | 000,081,920 | ---- | M] (DAEMON'S HOME) -- C:\Program Files\D-Tools\daemon.exe
PRC - [2004/07/29 00:53:58 | 000,053,248 | ---- | M] (GEAR Software) -- C:\WINDOWS\system32\gearsec.exe


========== Modules (No Company Name) ==========

MOD - [2012/12/21 04:28:26 | 000,647,168 | ---- | M] () -- C:\Program Files\Steam\sdl.dll
MOD - [2012/12/21 04:27:17 | 020,320,240 | ---- | M] () -- C:\Program Files\Steam\bin\libcef.dll
MOD - [2012/12/21 04:26:58 | 000,969,280 | ---- | M] () -- C:\Program Files\Steam\bin\chromehtml.dll
MOD - [2012/12/21 04:26:57 | 000,192,000 | ---- | M] () -- C:\Program Files\Steam\bin\avformat-53.dll
MOD - [2012/12/21 04:26:57 | 000,124,416 | ---- | M] () -- C:\Program Files\Steam\bin\avutil-51.dll
MOD - [2012/12/21 04:26:56 | 001,100,800 | ---- | M] () -- C:\Program Files\Steam\bin\avcodec-53.dll
MOD - [2012/11/16 04:37:28 | 000,169,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Automation\3f6b19a0213232589d46f26757354ddf\Inkjet.Automation.ni.dll
MOD - [2012/11/16 04:36:52 | 000,098,304 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.DeviceSettin#\db05a92be2b68ef0a1d0489557a15063\Inkjet.DeviceSettings.ni.dll
MOD - [2012/11/16 04:36:08 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d7ec47c4afad694faa491abd6b45928a\System.Runtime.Remoting.ni.dll
MOD - [2012/11/16 04:35:22 | 000,106,496 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Diagnostics\c2592c58b5d9d38bc6ed8b31be1b41e5\Inkjet.Diagnostics.ni.dll
MOD - [2012/11/16 04:35:10 | 000,237,056 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Localization\a1f70e04ddf82eae6ec4cab423bfb4e4\Inkjet.Localization.ni.dll
MOD - [2012/11/16 04:34:46 | 000,286,720 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Utilities\a5d8e058fb4d80472782d876403a2e01\Inkjet.Utilities.ni.dll
MOD - [2012/11/16 04:34:19 | 000,832,000 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Hardware\0bae389db8c5419c350dcbef9d3ff678\Inkjet.Hardware.ni.dll
MOD - [2012/11/16 04:34:12 | 000,080,896 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Configuration\c7a97ccf68c85912eec64b2401fe9bbe\Inkjet.Configuration.ni.dll
MOD - [2012/11/16 04:34:08 | 000,181,248 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Statistics\17dab39fb76367809659a5a584266306\Inkjet.Statistics.ni.dll
MOD - [2012/11/16 04:33:54 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\41cac4885974d07de06f0b4fec9883f0\System.Configuration.ni.dll
MOD - [2012/11/16 04:30:39 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\d35b50eb6bb7b1bfb6592419d9feba47\System.Xml.ni.dll
MOD - [2012/11/16 04:29:54 | 012,433,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6585a5fcaaa1b49b9a1bd9ca5c5c306e\System.Windows.Forms.ni.dll
MOD - [2012/11/16 04:28:12 | 001,592,320 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\da4bcb702feb770ce40cf1371b0c4d02\System.Drawing.ni.dll
MOD - [2012/11/16 04:16:46 | 007,977,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\90ad0c96693527ae685ff40019bb33b0\System.ni.dll
MOD - [2012/11/16 04:15:50 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\3add69b075f3da012fb97ce00cd795c0\mscorlib.ni.dll
MOD - [2012/11/13 14:06:32 | 000,158,624 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
MOD - [2012/11/13 14:06:30 | 000,108,960 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
MOD - [2012/11/13 14:06:28 | 000,554,400 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
MOD - [2012/11/13 14:06:28 | 000,528,288 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\JSDialogPack150.bpl
MOD - [2012/11/13 14:06:28 | 000,416,160 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
MOD - [2012/08/23 09:38:24 | 000,574,840 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll
MOD - [2012/06/05 21:35:04 | 000,397,848 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\IBUpdaterService\ibsvc.exe
MOD - [2012/06/05 21:35:01 | 000,790,520 | ---- | M] () -- C:\WINDOWS\system32\protector.dll
MOD - [2009/07/13 16:37:04 | 000,152,112 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/07/13 16:37:04 | 000,098,304 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2008/05/06 02:45:00 | 000,094,720 | ---- | M] () -- C:\Program Files\FileZilla Client\fzshellext.dll
MOD - [2006/06/08 20:13:28 | 001,257,472 | ---- | M] () -- c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll
MOD - [2006/06/08 15:23:08 | 003,379,200 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_f80bacd5\mscorlib.dll
MOD - [2006/06/08 15:23:06 | 000,835,584 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_17a634f5\system.drawing.dll
MOD - [2006/06/08 15:23:01 | 002,088,960 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_0d431487\system.xml.dll
MOD - [2006/06/08 15:22:57 | 003,014,656 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_1537bc20\system.windows.forms.dll
MOD - [2006/06/08 15:22:50 | 001,953,792 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_21de1c83\system.dll
MOD - [2006/06/08 15:22:44 | 001,224,704 | ---- | M] () -- c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll
MOD - [2006/06/08 15:22:40 | 001,339,392 | ---- | M] () -- c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll
MOD - [2006/06/08 15:22:40 | 000,372,736 | ---- | M] () -- c:\windows\assembly\gac\system.management\1.0.5000.0__b03f5f7f11d50a3a\system.management.dll
MOD - [2006/06/08 15:22:39 | 000,323,584 | ---- | M] () -- c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll
MOD - [2006/06/08 15:22:38 | 000,466,944 | ---- | M] () -- c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll
MOD - [2006/06/08 15:22:37 | 002,052,096 | ---- | M] () -- c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll
MOD - [2005/09/19 02:07:36 | 004,243,456 | R--- | M] () -- C:\Program Files\Common Files\Roxio Shared\DLLShared\ROXIPP4.dll
MOD - [2004/08/22 15:04:56 | 000,069,120 | ---- | M] () -- C:\WINDOWS\daemon.dll
MOD - [2003/12/30 19:52:00 | 000,007,168 | ---- | M] () -- C:\Program Files\D-Tools\Plugins\Images\bw5mount.dll


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE -- (Speed Disk service)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Spybot -- (SDWSCService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService)
SRV - File not found [Auto | Stopped] -- C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE -- (NProtectService)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2012/12/25 11:07:33 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/19 20:57:57 | 000,042,504 | ---- | M] (COMPANYVERS_NAME) [Auto | Stopped] -- C:\Program Files\WeatherBlink\bar\1.bin\gcbarsvc.exe -- (WeatherBlinkService)
SRV - [2012/12/13 14:26:20 | 003,290,896 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/12/05 17:07:49 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/11/06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/11/02 00:08:48 | 001,340,976 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2013\avgfws.exe -- (avgfws)
SRV - [2012/10/22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2012/10/18 19:49:12 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2012/07/20 15:39:50 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2012/07/13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/07/02 09:25:14 | 002,232,504 | ---- | M] (Giraffic) [Auto | Running] -- C:\Program Files\Giraffic\Veoh_GirafficWatchdog.exe -- (Giraffic)
SRV - [2012/06/19 12:44:22 | 000,777,728 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe -- (Kodak AiO Status Monitor Service)
SRV - [2012/06/18 20:13:46 | 000,394,712 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe -- (Kodak AiO Network Discovery Service)
SRV - [2012/06/05 21:35:04 | 000,397,848 | ---- | M] () [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\IBUpdaterService\ibsvc.exe -- (IBUpdaterService)
SRV - [2012/06/05 21:35:02 | 000,773,624 | ---- | M] (bProtector) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\bProtector\bProtect.exe -- (bProtector)
SRV - [2010/09/03 00:45:02 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.1.121\McCHSvc.exe -- (McComponentHostService)
SRV - [2008/08/14 17:54:53 | 000,611,664 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice)
SRV - [2008/04/13 18:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (W3SVC)
SRV - [2008/04/13 18:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (SMTPSVC)
SRV - [2008/04/13 18:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (IISADMIN)
SRV - [2006/05/31 13:16:05 | 000,819,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2005/09/19 02:25:20 | 000,229,376 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe -- (RoxLiveShare)
SRV - [2005/09/19 02:24:00 | 000,856,064 | ---- | M] (Sonic Solutions) [On_Demand | Running] -- C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe -- (RoxMediaDB)
SRV - [2005/09/19 02:20:58 | 000,155,648 | ---- | M] (Sonic Solutions) [Auto | Running] -- C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe -- (RoxWatch)
SRV - [2005/09/19 01:57:14 | 000,045,056 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe -- (RoxUPnPRenderer)
SRV - [2005/09/19 01:56:32 | 000,401,408 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe -- (RoxUpnpServer)
SRV - [2005/03/23 13:34:52 | 000,165,488 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE -- (ccSetMgr)
SRV - [2005/03/23 13:34:48 | 000,079,472 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\CCPWDSVC.EXE -- (ccPwdSvc)
SRV - [2005/03/23 13:34:36 | 000,198,256 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE -- (ccEvtMgr)
SRV - [2004/11/22 15:04:14 | 001,273,856 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe -- (Norton Ghost)
SRV - [2004/07/29 00:53:58 | 000,053,248 | ---- | M] (GEAR Software) [Auto | Running] -- C:\WINDOWS\system32\gearsec.exe -- (GEARSecurity)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\RimUsb.sys -- (RimUsb)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (MarkFun_NT)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\LUsbKbd.Sys -- (LUsbKbd)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\LMouKE.sys -- (LMouKE)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\LHidUsbK.Sys -- (LHidUsbK)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\LHidFlt2.sys -- (LHidFlt2)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\ctdvda2k.sys -- (ctdvda2k)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\bcgame.sys -- (bcgame)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\amdtools.sys -- (amdtools)
DRV - File not found [Kernel | Boot | Stopped] -- system32\DRIVERS\AmdAcpi.sys -- (AmdAcpi)
DRV - [2012/10/22 13:02:46 | 000,179,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2012/10/15 03:48:52 | 000,055,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/10/05 03:32:50 | 000,093,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2012/10/02 03:30:38 | 000,159,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012/09/21 03:46:06 | 000,164,832 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/09/21 03:46:00 | 000,177,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\avglogx.sys -- (Avglogx)
DRV - [2012/09/21 03:45:54 | 000,019,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2012/09/14 03:05:20 | 000,035,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2012/01/12 19:52:06 | 000,030,944 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwfd)
DRV - [2012/01/12 19:52:06 | 000,030,944 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwdx)
DRV - [2009/07/07 13:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\purendis.sys -- (purendis)
DRV - [2009/07/07 13:48:44 | 000,025,392 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pnarp.sys -- (pnarp)
DRV - [2009/03/02 17:20:18 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2008/04/13 12:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2008/04/13 12:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2007/07/13 09:44:22 | 000,043,008 | ---- | M] (D-Link ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dlkfet5b.sys -- (FETNDISB)
DRV - [2006/11/08 17:00:10 | 000,989,696 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2006/08/09 13:40:58 | 000,009,600 | R--- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV - [2006/07/18 20:58:14 | 001,621,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006/07/02 14:09:10 | 000,005,318 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\huadio.tmp -- (huadio)
DRV - [2006/06/12 15:29:38 | 000,642,560 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2006/06/12 15:29:35 | 000,223,128 | ---- | M] (DT Soft Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\dtscsi.sys -- (dtscsi)
DRV - [2006/06/06 20:09:01 | 000,168,448 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atinavt2.sys -- (ATIAVAIW)
DRV - [2006/06/01 21:46:14 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt)
DRV - [2006/05/31 13:16:06 | 000,004,608 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd)
DRV - [2005/11/03 08:52:38 | 000,035,200 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SaiBus.sys -- (SaiNtBus)
DRV - [2005/11/03 08:52:34 | 000,013,824 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SaiMini.sys -- (SaiMini)
DRV - [2005/09/19 09:05:00 | 000,309,632 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\Cdudf_xp.sys -- (cdudf_xp)
DRV - [2005/09/19 09:05:00 | 000,119,168 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\Pwd_2k.sys -- (pwd_2k)
DRV - [2005/09/19 09:05:00 | 000,027,264 | ---- | M] (Sonic Solutions) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\dvd_2k.sys -- (dvd_2K)
DRV - [2005/09/19 09:05:00 | 000,027,136 | ---- | M] (Sonic Solutions) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mmc_2k.sys -- (mmc_2K)
DRV - [2005/09/19 04:08:50 | 000,050,176 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\RxFilter.sys -- (RxFilter)
DRV - [2005/08/10 08:06:28 | 000,019,968 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfsync02.sys -- (sfsync02)
DRV - [2005/08/10 06:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01)
DRV - [2005/06/17 16:41:04 | 000,173,568 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SaiH0255.sys -- (SaiH0255)
DRV - [2005/05/16 07:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02)
DRV - [2005/05/03 15:31:56 | 000,045,056 | ---- | M] (ULi Electronics Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\AGPKX.SYS -- (uliagpkx)
DRV - [2005/03/09 13:53:00 | 000,036,352 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/12/22 03:07:12 | 002,304,320 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM)
DRV - [2004/12/02 02:36:08 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2004/11/30 20:49:18 | 000,051,840 | ---- | M] (ULi Electronics Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\m5289.sys -- (m5289)
DRV - [2004/11/22 15:08:54 | 000,046,800 | ---- | M] (PowerQuest Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\PQIMount.sys -- (PQIMount)
DRV - [2004/11/22 14:51:58 | 000,138,801 | ---- | M] (StorageCraft) [File_System | Boot | Running] -- C:\WINDOWS\System32\drivers\PQV2i.sys -- (PQV2i)
DRV - [2004/08/30 21:38:36 | 000,081,748 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NPDRIVER.SYS -- (NPDriver)
DRV - [2004/08/30 21:23:22 | 000,090,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SdDriver.SYS -- (SDdriver)
DRV - [2004/08/22 14:31:48 | 000,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\d347prt.sys -- (d347prt)
DRV - [2004/08/22 14:31:10 | 000,155,136 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\d347bus.sys -- (d347bus)
DRV - [2004/08/03 16:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)
DRV - [2004/07/14 10:54:42 | 000,676,864 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2003/10/14 19:53:20 | 000,186,100 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CTAC32K.SYS -- (ctac32k)
DRV - [2003/09/18 19:47:22 | 000,496,800 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctaud2k.sys -- (ctaud2k)
DRV - [2003/08/28 02:24:36 | 000,145,504 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EMUPIA2K.SYS -- (emupia)
DRV - [2003/08/28 02:24:24 | 000,136,448 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CTSFM2K.SYS -- (ctsfm2k)
DRV - [2003/08/28 02:24:08 | 000,006,144 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CTPRXY2K.SYS -- (ctprxy2k)
DRV - [2003/08/28 02:24:06 | 000,113,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2003/08/28 02:22:20 | 000,135,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HAP16V2K.SYS -- (hap16v2k)
DRV - [2003/08/28 02:22:04 | 000,823,456 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ha10kx2k.sys -- (ha10kx2k)
DRV - [2003/03/05 10:19:28 | 000,015,840 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PFMODNT.SYS -- (PfModNT)
DRV - [2001/08/17 06:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}: "URL" = http://search.mywebs...r={searchTerms}
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search...p={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.condui...&ctid=CT2418376
IE - HKCU\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {8ba2cfef-a1bc-4964-aadc-33be1ae5a33c} - No CLSID value found
IE - HKCU\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylo...00000265a766618
IE - HKCU\..\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}: "URL" = http://search.mywebs...r={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.condui...&ctid=CT3072253
IE - HKCU\..\SearchScopes\{C54D0E65-925E-C233-ABA8-CF4488D74761}: "URL" = http://www.bing.com/...UGO&form=ZGAIDF
IE - HKCU\..\SearchScopes\{CB9FC763-B52D-4CA5-8649-A8E608784142}: "URL" = http://www.google.co...age={startPage}
IE - HKCU\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://search.avg.co...e}&iy=&ychte=us
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incre...6PQw65mY9n&i=26
IE - HKCU\..\SearchScopes\{D0885C92-B80E-4610-B841-795C23D1D9DB}: "URL" = http://search.yahoo....p={searchTerms}
IE - HKCU\..\SearchScopes\{EF7DF992-B21D-4836-B668-7D8515BCB676}: "URL" = http://www.google.co...age={startPage}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "search the web (babylon)"
FF - prefs.js..browser.search.defaultthis.enginename: "pagerage customized web search"
FF - prefs.js..browser.search.defaulturl: "http://search.condui...={searchterms}"
FF - prefs.js..browser.search.order.1: "search the web (babylon)"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811&ilc=12"
FF - prefs.js..browser.search.selectedengine: "google"
FF - prefs.js..browser.startup.homepage: "http://thereachmux.org/wiki/colt"
FF - prefs.js..extensions.enabledAddons: %7b000f1ea4-5e08-4564-a29b-29076f63a37a%7d:1.0.3.126
FF - prefs.js..extensions.enabledAddons: %7b972ce4c6-7e08-4474-a285-3208198ce6fd%7d:17.0.1
FF - prefs.js..extensions.enabledItems: {cafeefac-0016-0000-0021-abcdeffedcba}:6.0.21
FF - prefs.js..extensions.enabledItems: {000f1ea4-5e08-4564-a29b-29076f63a37a}:1.0.3.126
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {abde892b-13a8-4d1b-88e6-365a6e755758}:14.0.1
FF - prefs.js..extensions.enabledItems: [email protected]:1.2
FF - prefs.js..extensions.enabledItems: {cafeefac-0016-0000-0023-abcdeffedcba}:6.0.23
FF - prefs.js..extensions.enabledItems: {cafeefac-0016-0000-0024-abcdeffedcba}:6.0.24
FF - prefs.js..extensions.enabledItems: {de9265d8-d55d-4286-9dc4-f8d8a0ca2f64}:1.0
FF - prefs.js..extensions.enabledItems: {1e73965b-8b48-48be-9c8d-68b920abc1c4}:10.0.0.1319
FF - prefs.js..extensions.enabledItems: avg@igeared:6.103.018.001
FF - prefs.js..keyword.url: "http://search.babylo...0265a766618&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50370
FF - prefs.js..network.proxy.type: 4


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/01 14:41:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/01 14:41:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/05 17:07:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/18 19:47:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.22\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/10/18 19:47:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.22\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012/10/18 19:47:12 | 000,000,000 | ---D | M]

[2008/08/26 19:27:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Wulf\Application Data\Mozilla\Extensions
[2012/11/19 00:51:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\extensions
[2010/09/18 15:08:51 | 000,000,000 | ---D | M] () -- C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}
[2012/02/02 14:32:20 | 000,020,591 | ---- | M] () (No name found) -- C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2012/11/19 00:51:18 | 000,741,958 | ---- | M] () (No name found) -- C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011/03/08 06:41:18 | 000,001,919 | ---- | M] () -- C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\searchplugins\bing-zugo.xml
[2010/09/15 23:25:02 | 000,000,919 | ---- | M] () -- C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\searchplugins\conduit.xml
[2012/05/01 15:01:09 | 000,002,203 | ---- | M] () -- C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\searchplugins\MyStart Search.xml
[2013/01/02 12:19:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/12/13 13:25:04 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/23 22:25:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2011/04/13 19:47:16 | 000,000,000 | ---D | M] (ScanQuery) -- C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}
[2012/12/05 17:07:50 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/06/18 00:43:04 | 000,086,016 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2012/06/01 14:40:48 | 000,129,144 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/08/30 12:55:14 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/10/12 13:03:06 | 000,002,058 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://search.babylo...00000265a766618
CHR - Extension: No name found = C:\Documents and Settings\Wulf\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.1.0.10441\
CHR - Extension: No name found = C:\Documents and Settings\Wulf\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.2.0.10687\
CHR - Extension: No name found = C:\Documents and Settings\Wulf\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.4.0.11328\
CHR - Extension: No name found = C:\Documents and Settings\Wulf\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.5.0.11422\

O1 HOSTS File: ([2006/08/15 12:44:07 | 000,000,783 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 q4master.idsoftware.com #block q4server
O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files\PriceGong\2.6.4\PriceGongIE.dll (PriceGong)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (uTorrentControl2 Toolbar) - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll (Conduit Ltd.)
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\prxtbPag0.dll (Conduit Ltd.)
O2 - BHO: (Search Assistant BHO) - {9b9dcae3-be34-424c-8d73-75e305a9e091} - C:\Program Files\WeatherBlink\bar\1.bin\gcSrcAs.dll (MindSpark)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (WeCareReminder Class) - {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\Documents and Settings\All Users\Application Data\WeCareReminder\IEHelperv2.5.0.dll (We-Care.com)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Toolbar BHO) - {dc9051c2-8f55-479a-97a4-747980d9047f} - C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll (MindSpark)
O2 - BHO: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (uTorrentControl2 Toolbar) - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\prxtbPag0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (WeatherBlink) - {f20de5e0-2a6e-4c54-985f-1cf59551ce39} - C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentControl2 Toolbar) - {687578B9-7132-4A7A-80E4-30EE31099E03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (PageRage Toolbar) - {9565115D-C7D6-46D3-BD63-B67B481A4368} - C:\Program Files\PageRage\prxtbPag0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (WeatherBlink) - {F20DE5E0-2A6E-4C54-985F-1CF59551CE39} - C:\Program Files\WeatherBlink\bar\1.bin\gcbar.dll (MindSpark)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe (ALi Corporation)
O4 - HKLM..\Run: [Antiphishing Domain Advisor] C:\Documents and Settings\All Users\Application Data\Antiphishing Domain Advisor\vmn3_5dn.exe (Visicom Media Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Conime] C:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DAEMON Tools-1033] C:\Program Files\D-Tools\daemon.exe (DAEMON'S HOME)
O4 - HKLM..\Run: [EKStatusMonitor] C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe ()
O4 - HKLM..\Run: [nmapp] C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [WeatherBlink Browser Plugin Loader] C:\Program Files\WeatherBlink\bar\1.bin\gcbrmon.exe (VER_COMPANY_NAME)
O4 - HKLM..\Run: [WeatherBlink Search Scope Monitor] C:\Program Files\WeatherBlink\bar\1.bin\gcSrchMn.exe (MindSpark)
O4 - HKLM..\Run: [Windows Media Connect 2] C:\Program Files\Windows Media Connect 2\WMCCFG.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe (McAfee, Inc.)
F3 - HKCU WinNT: Load - (C:\DOCUME~1\Wulf\LOCALS~1\Temp\dwm.exe) - File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search - http://tbedits.weath...2012121921&cv=3 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebo...toUploader5.cab (Facebook Photo Uploader 5)
O16 - DPF: {3334504D-9980-0010-8000-00AA00389B71} http://download.micr...C4D/mp43dmo.CAB (Reg Error: Key error.)
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.micr...D0C/wmv9dmo.cab (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1149093388656 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1346833301171 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{240D1C64-513B-4781-B165-15840CB97981}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (protector.dll) - C:\WINDOWS\System32\protector.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\Wulf\Application Data\Microsoft\Windows\shell.exe) - File not found
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Wulf\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Wulf\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/05/31 10:01:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2013/01/06 21:24:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center944488616
[2013/01/05 21:21:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1431628960
[2013/01/04 21:20:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center693273701
[2013/01/03 21:17:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1859058996
[2013/01/02 21:13:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1418159032
[2013/01/02 09:21:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2013/01/02 09:21:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy 2
[2013/01/02 09:21:40 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\WINDOWS\System32\sdnclean.exe
[2013/01/02 09:21:35 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2
[2013/01/01 21:13:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center865296496
[2012/12/31 21:10:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center472316610
[2012/12/30 21:09:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center237105329
[2012/12/29 21:07:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center118834139
[2012/12/29 21:03:07 | 000,000,000 | -H-D | C] -- C:\Config.Msi
[2012/12/29 20:55:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HP
[2012/12/29 20:54:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Wulf\Local Settings\Application Data\HP
[2012/12/28 21:06:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1635959185
[2012/12/27 21:05:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center278490861
[2012/12/26 21:00:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center250104576
[2012/12/25 21:00:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1161623510
[2012/12/24 20:56:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1185706461
[2012/12/23 20:52:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center298714247
[2012/12/23 18:06:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Wulf\My Documents\DeadIsland
[2012/12/23 18:03:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2012/12/22 20:51:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center933997400
[2012/12/21 20:50:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1566837316
[2012/12/20 20:45:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1828869731
[2012/12/19 20:58:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Wulf\Local Settings\Application Data\IAC
[2012/12/19 20:58:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Wulf\Application Data\WeatherBlink
[2012/12/19 20:57:56 | 000,000,000 | ---D | C] -- C:\Program Files\WeatherBlink
[2012/12/19 20:44:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center669586291
[2012/12/18 20:40:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1851912764
[2012/12/17 20:36:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1360564373
[2012/12/16 20:33:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center759423678
[2012/12/15 20:32:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1515950611
[2012/12/14 20:32:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1859896898
[2012/12/13 20:30:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center108113836
[2012/12/12 20:28:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1618268042
[2012/12/11 18:35:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Wulf\Application Data\AVG2013
[2012/12/11 18:32:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Avg2013
[2012/12/11 18:32:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Wulf\Application Data\TuneUp Software
[2012/12/11 18:29:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG2013
[2012/12/11 17:50:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Wulf\Local Settings\Application Data\MFAData
[2012/12/11 17:50:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Wulf\Local Settings\Application Data\Avg2013
[2012/12/10 20:24:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1858983354
[2012/12/09 20:23:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center398282145
[2012/12/08 20:19:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\KODAK AiO Home Center1461394903
[2008/07/31 12:14:54 | 000,364,544 | ---- | C] (Ranfo.com) -- C:\Program Files\IcnEd01p.exe
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/01/07 15:26:00 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{99F9C85C-C0AA-4F39-9FCF-D96FDFD75838}.job
[2013/01/07 15:21:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/01/07 15:05:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/07 15:01:00 | 000,000,262 | ---- | M] () -- C:\WINDOWS\tasks\PC Performer_DEFAULT.job
[2013/01/07 13:25:00 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\Symantec NetDetect.job
[2013/01/07 13:16:38 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/01/07 13:13:24 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/07 13:13:24 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2013/01/07 13:13:23 | 000,000,620 | ---- | M] () -- C:\WINDOWS\tasks\Check for updates (Spybot - Search & Destroy).job
[2013/01/07 13:13:23 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1004336348-1979792683-1801674531-1020.job
[2013/01/07 13:13:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/01/07 08:27:03 | 000,024,144 | ---- | M] () -- C:\WINDOWS\System32\BMXCtrlState-{00000002-00000000-00000007-00001102-00000002-80661102}.rfx
[2013/01/07 08:27:03 | 000,024,144 | ---- | M] () -- C:\WINDOWS\System32\BMXBkpCtrlState-{00000002-00000000-00000007-00001102-00000002-80661102}.rfx
[2013/01/07 08:27:03 | 000,016,376 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000002-00000000-00000007-00001102-00000002-80661102}.rfx
[2013/01/07 08:27:03 | 000,016,376 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000002-00000000-00000007-00001102-00000002-80661102}.rfx
[2013/01/07 08:27:03 | 000,002,064 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm
[2013/01/07 08:27:03 | 000,002,064 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm
[2013/01/07 08:27:03 | 000,000,288 | ---- | M] () -- C:\WINDOWS\System32\DVCStateBkp-{00000002-00000000-00000007-00001102-00000002-80661102}.dat
[2013/01/07 08:27:03 | 000,000,288 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000002-00000000-00000007-00001102-00000002-80661102}.dat
[2013/01/07 02:00:00 | 000,000,822 | ---- | M] () -- C:\WINDOWS\tasks\Docs and Desktop Backup.job
[2013/01/07 00:00:00 | 000,000,308 | ---- | M] () -- C:\WINDOWS\tasks\Symantec Drmc.job
[2013/01/06 18:00:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for Wulf.job
[2013/01/06 02:04:00 | 000,000,748 | ---- | M] () -- C:\WINDOWS\tasks\Media Backup.job
[2013/01/05 02:00:00 | 000,000,748 | ---- | M] () -- C:\WINDOWS\tasks\Music Backup.job
[2013/01/04 15:42:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1004336348-1979792683-1801674531-1020.job
[2013/01/02 22:36:00 | 000,000,270 | ---- | M] () -- C:\WINDOWS\tasks\PC Performer_UPDATES.job
[2013/01/02 16:28:13 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Wulf\Local Settings\Application Data\prvlcl.dat
[2013/01/02 12:49:34 | 000,003,492 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2013/01/02 09:22:00 | 000,000,616 | ---- | M] () -- C:\WINDOWS\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2013/01/02 09:22:00 | 000,000,446 | ---- | M] () -- C:\WINDOWS\tasks\Scan the system (Spybot - Search & Destroy).job
[2013/01/02 09:21:45 | 000,001,844 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Spybot-S&D Start Center.lnk
[2012/12/31 17:59:11 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\Wulf\Application Data\winscp.rnd
[2012/12/29 21:20:18 | 000,001,883 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Catalyst Control Center.lnk
[2012/12/29 21:05:26 | 000,035,239 | ---- | M] () -- C:\Documents and Settings\Wulf\Desktop\Troubleshoot HP Installation Failure - MSI.hta
[2012/12/29 21:01:27 | 000,000,057 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2012/12/25 12:17:11 | 000,218,826 | ---- | M] () -- C:\Documents and Settings\Wulf\My Documents\han-solo-hanukkah.jpg
[2012/12/23 15:15:33 | 000,000,215 | ---- | M] () -- C:\Documents and Settings\Wulf\Desktop\Dead Island.url
[2012/12/21 04:07:21 | 000,318,432 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/12/12 04:07:17 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/12/11 18:32:15 | 000,000,710 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2013.lnk
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/01/02 09:22:00 | 000,000,620 | ---- | C] () -- C:\WINDOWS\tasks\Check for updates (Spybot - Search & Destroy).job
[2013/01/02 09:22:00 | 000,000,616 | ---- | C] () -- C:\WINDOWS\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2013/01/02 09:22:00 | 000,000,446 | ---- | C] () -- C:\WINDOWS\tasks\Scan the system (Spybot - Search & Destroy).job
[2013/01/02 09:21:45 | 000,001,850 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2013/01/02 09:21:45 | 000,001,844 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Spybot-S&D Start Center.lnk
[2012/12/29 21:20:18 | 000,001,883 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Catalyst Control Center.lnk
[2012/12/29 21:05:26 | 000,035,239 | ---- | C] () -- C:\Documents and Settings\Wulf\Desktop\Troubleshoot HP Installation Failure - MSI.hta
[2012/12/29 21:01:27 | 000,000,057 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2012/12/25 12:17:09 | 000,218,826 | ---- | C] () -- C:\Documents and Settings\Wulf\My Documents\han-solo-hanukkah.jpg
[2012/12/23 15:15:33 | 000,000,215 | ---- | C] () -- C:\Documents and Settings\Wulf\Desktop\Dead Island.url
[2012/12/11 18:32:15 | 000,000,710 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG 2013.lnk
[2012/06/05 21:35:02 | 000,790,520 | ---- | C] () -- C:\WINDOWS\System32\protector.dll
[2012/02/14 16:08:02 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/02/10 17:43:59 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Wulf\Local Settings\Application Data\prvlcl.dat
[2010/07/04 08:48:11 | 000,043,520 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/22 08:27:06 | 008,892,928 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\atscie.msi
[2008/05/15 17:02:56 | 000,019,633 | ---- | C] () -- C:\Documents and Settings\Wulf\Start Menu.rar
[2008/05/15 15:53:14 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Wulf\Application Data\winscp.rnd
[2007/08/10 22:21:46 | 000,000,411 | ---- | C] () -- C:\Program Files\Shortcut to Frontpg.lnk
[2007/07/16 13:19:10 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Wulf\Local Settings\Application Data\fusioncache.dat
[2007/07/16 11:05:16 | 000,158,720 | ---- | C] () -- C:\Documents and Settings\Wulf\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/05/31 10:45:44 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/13 18:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 06:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/13 18:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2010/12/24 22:13:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Antiphishing Domain Advisor
[2012/12/11 18:32:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG2013
[2011/04/21 08:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2012/06/05 21:35:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\bProtector
[2011/03/14 11:58:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/04/13 21:00:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Giraffic
[2012/11/12 18:49:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Graboid Inc
[2012/06/05 21:37:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IBUpdaterService
[2011/09/30 06:05:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iDownloader Limited
[2013/01/07 14:22:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2012/11/12 18:34:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Package Cache
[2010/12/24 22:10:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ReviverSoft
[2011/04/23 05:31:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanQuery
[2011/02/08 16:47:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Smith Micro
[2012/08/02 06:11:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/08/30 17:19:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/09/30 06:04:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Web Installer
[2012/05/01 16:09:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WeCareReminder
[2012/05/01 14:39:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YouTube Downloader
[2012/05/01 14:40:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YTD YouTube Downloader & Converter
[2010/09/03 01:59:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/04/27 22:27:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2007/08/30 17:19:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\acccore
[2011/06/13 08:36:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Amazon
[2012/03/06 19:05:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\AVG
[2012/12/11 18:35:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\AVG2013
[2011/05/14 11:20:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\eTeks
[2008/05/30 00:18:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\FileZilla
[2010/08/03 09:31:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\GetRightToGo
[2007/07/16 10:20:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\IsolatedStorage
[2011/06/07 16:50:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\MailWasherPro
[2012/05/19 17:35:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Nico Mak Computing
[2012/05/01 15:01:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\OpenCandy
[2007/07/23 16:57:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Opera
[2012/06/05 21:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\PerformerSoft
[2013/01/01 01:17:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\PriceGong
[2011/01/02 20:21:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Reviversoft
[2008/05/03 08:11:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\SecondLife
[2007/07/16 10:12:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Seven Zip
[2010/12/23 21:03:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Smith Micro
[2011/07/04 16:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Sony Online Entertainment
[2010/06/27 01:34:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\SystemRequirementsLab
[2011/12/17 18:41:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Temp
[2007/07/16 11:15:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Thunderbird
[2012/12/11 18:32:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\TuneUp Software
[2010/09/15 23:51:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Unity
[2010/07/08 08:00:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\Utherverse
[2013/01/07 15:27:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\uTorrent
[2012/12/19 20:58:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\WeatherBlink
[2011/10/14 11:49:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Wulf\Application Data\YouTube Downloader

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 05:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 04:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2012/11/13 14:07:52 | 003,906,584 | ---- | M] (Safer-Networking Ltd.) MD5=E4A0900CF535888DDD85B10040CA3E34 -- C:\Program Files\Spybot - Search & Destroy 2\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/02/06 05:06:24 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2008/04/13 18:12:34 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\ServicePackFiles\i386\services.exe
[2009/02/06 05:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 05:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\services.exe
[2004/08/04 06:00:00 | 000,108,032 | ---- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 -- C:\WINDOWS\$NtServicePackUninstall$\services.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 18:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 18:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
[2004/08/04 06:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 06:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 18:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 18:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 06:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 18:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 18:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /mp /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\CTHELPER.EXE: SummaryInformation
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Z Fobok Stories:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Yaoi:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\worlds:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\World of Darkness:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Visual Studio 2005:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\vadersdayoff.gif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Updater:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\TV Tome Animated Guides:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Taxes 2007:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\TAS Pics:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Star Wars Blooper Guides:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Sound Effects:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\sleepingsuperboy2.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\sleepingsuperboy.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\seal.gif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Science vs. Norse.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\ReligionFlowChart.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\RebelBass.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Original Animation:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\newsclips.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\New Character Templates:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\My Videos:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\My Kindle Content:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Mushes:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\MosEisleyMap.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Messenger Letters:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Medical - Rachel:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Medical - Mom:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Medical - Me:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\maythefourth.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Maps:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\LIVE.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\lightsaberduel.gif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Lawyers:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Hero Novel:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\han-solo-hanukkah.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Graboid:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Glee:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Genesis Stories:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\gayscarred.png:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Gamecube Walkthroughs:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Game Guides:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Gaia Online Tektek:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\funny-newspaper-ads-mistakes-and-bloopers.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Downloaded Comics:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\downloadcensored.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\DidI[bleep]ingStutter.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Desktop Images:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\DeathStarryNight.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\DeadIsland:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\cuteearth.gif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Comic HTML:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Comic Data:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\codpieceofdoom.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Clone Wars Animated Character Guide:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Christianity.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Celtic Images:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\batmobilelostawheel.gif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\batmanthebeginning.gif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Bank Statements:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Bank - Mom:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Arthurian Graphics:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Arthuriad:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Alert Sounds:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\alderaan_fullpic.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\AdobeStockPhotos:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\adarknight.gif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\Action Figures:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\A Novel:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\24hourclock.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\2.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\10CanineCommandments.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\My Documents\1.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\Desktop\Unused Desktop Shortcuts:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\Desktop\RP Logs:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\Desktop\Photos:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\Desktop\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Wulf\Desktop\Common Ground.mp4:Roxio EMC Stream
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >

[Batwulf]

The OTL Extras logfile:

OTL Extras logfile created on: 1/7/2013 3:23:30 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Wulf\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.16 Gb Available Physical Memory | 57.84% Memory free
3.35 Gb Paging File | 2.30 Gb Available in Paging File | 68.66% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 41.43 Gb Free Space | 27.79% Space Free | Partition Type: NTFS

Computer Name: MILLENNIUMFALCO | User Name: Wulf | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
jsfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" %*
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
"5353:UDP" = 5353:UDP:*:Enabled:Bonjour Port 5353
"9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\BitLord\BitLord.exe" = C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord -- (www.BitLord.com)
"C:\Program Files\SmartFTP Client\SmartFTP.exe" = C:\Program Files\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 2.5 -- (SmartSoft Ltd.)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\WinSCP\WinSCP.exe" = C:\Program Files\WinSCP\WinSCP.exe:*:Enabled:WinSCP -- (Martin Prikryl)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service -- (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Steam\steamapps\common\swkotor\swkotor.exe" = C:\Program Files\Steam\steamapps\common\swkotor\swkotor.exe:*:Enabled:Star Wars: Knights of the Old Republic -- (BioWare Corp.)
"C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe" = C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe:*:Enabled:Roxio Upnp Service -- (Sonic Solutions)
"C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" = C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player
"C:\Program Files\Giraffic\Veoh_Giraffic.exe" = C:\Program Files\Giraffic\Veoh_Giraffic.exe:*:Enabled:Veoh Giraffic (Agent) -- (Giraffic)
"C:\Program Files\Giraffic\Veoh_GirafficWatchdog.exe" = C:\Program Files\Giraffic\Veoh_GirafficWatchdog.exe:*:Enabled:Veoh Giraffic (Watchdog) -- (Giraffic)
"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer
"C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe" = C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter -- (Eastman Kodak Company)
"C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe" = C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics -- (Eastman Kodak Company)
"C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility -- (Eastman Kodak Company)
"C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater -- (Eastman Kodak Company)
"C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe" = C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer -- (Eastman Kodak Company)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"C:\Program Files\AVG\AVG2013\avgnsx.exe" = C:\Program Files\AVG\AVG2013\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2013\avgdiagex.exe" = C:\Program Files\AVG\AVG2013\avgdiagex.exe:*:Enabled:AVG Diagnostics 2013 -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2013\avgmfapx.exe" = C:\Program Files\AVG\AVG2013\avgmfapx.exe:*:Enabled:AVG Installer -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Steam\steamapps\common\Dead Island\DeadIslandGame.exe" = C:\Program Files\Steam\steamapps\common\Dead Island\DeadIslandGame.exe:*:Enabled:Dead Island -- (Techland)
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)
"C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe" = C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet,0.0.0.0/255.255.255.255:Enabled:Pure Networks Platform Service -- (Cisco Systems, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0D9E1F52-CE29-B03B-D79F-8EC434821033}" = Nero 7 Demo
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{11DE2361-9F73-47B3-B638-2F267927E307}" = Ipswitch WS_FTP Home 2007
"{1A15507A-8551-4626-915D-3D5FA095CC1B}" = Corel Paint Shop Pro X
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YTD YouTube Downloader & Converter 3.6
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java™ 6 Update 33
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2BD5C305-1B27-4D41-B690-7A61172D2FEB}" = Macromedia Flash 8
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{3256C48C-78D0-4FC6-A0F5-81ADF3A9D7D4}" = AVG 2013
"{34E9641A-7DB3-4F08-961E-5069F533A0C1}" = Brother MFL-Pro Suite
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
"{372D8F96-A62B-457A-B968-7B7C06E6BD05}" = BlackBerry v4.1.0 for the 7100 Series Wireless Device
"{37C39957-B0B3-40DC-8BA4-2363241159ED}" = LightScribe 1.4.44.1
"{3C759736-8347-4031-BB9C-D75ADFE6B101}" = Norton Ghost 9.0
"{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}" = DAEMON Tools
"{3F2B3914-A927-4D1E-8417-E7B7C3339434}" = YouTube Downloader Toolbar v4.7
"{3FADAA19-E595-44CA-A072-58B6B0851768}" = Norton Security Scan
"{44D4AF75-6870-41F5-9181-662EA05507E1}" = Microsoft Document Explorer 2005
"{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D}" = Macromedia Fireworks 8
"{55051074-8E32-428F-BBA5-A29070D3E89E}" = BlackBerry v4.1.0 for the 8700 Series Wireless Handheld
"{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}" = Macromedia Extension Manager
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{5D412B61-F3A7-42C6-9C07-29BBD3D442B1}" = AVG 2013
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A7867BA-B7CA-4CC9-ACAB-85BA46865EE5}" = Norton Utilities
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7AC0886A-CE48-4EB6-9CC3-4C56D427F2E1}" = Cisco Network Magic
"{7FCC4EDC-6EE2-4309-ABD7-85F2667A7B90}" = WebEx Support Manager for Internet Explorer
"{868901EE-7807-4F89-A134-7C705D34F91F}" = Roxio Easy Media Creator 8 Suite
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{885A63EA-382B-4DD4-A755-14809B8557D6}" = Macromedia Flash Player 8
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}" = Macromedia Flash 8 Video Encoder
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{900B1884-2D6F-4a70-A3C7-C3F4DA873FDB}" = NSW_DRM_COLLECTION
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91057632-CA70-413C-B628-2D3CDBBB906B}" = Macromedia Flash Player 8 Plugin
"{9115E7DB-3B29-445A-802D-11E0AA945B7F}" = Sound Blaster Live!
"{9170B2A2-FC44-4ec2-AEB6-9052626B2A2E}_is1" = Driver Reviver
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{96009644-514C-47DD-BE49-6D93C7FCFFA3}" = BlackBerry Desktop Software 4.1.1
"{987F1753-1F42-4DF2-A5EA-0CCB777F3EB0}" = COTM Reminder by We-Care.com v4.0.19.2
"{98E3252E-3CE5-4B15-929D-D18F7BE6EED4}" = D-Link DFE-530TX+
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E1BAB75-EB78-440D-94C0-A3857BE2E733}" = System Requirements Lab
"{9E23C48E-5483-4971-BA50-089F2FABCD66}" = Norton SystemWorks
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A7050037-F0EA-4BAB-BCD5-FC05507D6147}" = Alt-Tab Task Switcher Powertoy for Windows XP
"{A7E19604-93AF-4611-8C9F-CE509C2B286F}_is1" = Free YouTube Downloader 3.5.126
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-1033-0000-7760-100000000002}" = Adobe Acrobat 7.0 Professional
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
"{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}" = Norton SystemWorks 2005 Premier
"{bcb1ff51-51a4-4048-b534-3a9b3aa4acce}" = Graboid Video 3.58 Setup
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C169D3BB-9A27-43F5-9979-09A0D65FE95C}" = SmartFTP Client
"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1725BDB-BA2B-4503-A8CB-F5C835D743FA}" = MSRedist
"{D84E40A2-380A-46E9-A750-6F55D398D973}" = ATI Catalyst Control Center
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DC367608-64A7-4BF7-92F4-8BAA25BA02DB}" = ccCommon
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK AiO Software
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EC16B64A-38A7-4D7D-BA2E-671ED441304F}" = ULi PCI to AGP Controller Driver
"{EE0D5DCD-2B97-4473-98DF-E93C0BD92F7A}" = Adobe Stock Photos 1.0
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FC467B61-F890-4E29-8585-365DAB66F13E}" = Pure Networks Platform
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"Adobe Acrobat 7.0 Professional - V" = Adobe Acrobat 7.1.0 Professional
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe FrameMaker 7.0" = Adobe FrameMaker v7.0
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"All ATI Software" = ATI - Software Uninstall Utility
"ALUpdate_is1" = ALTools Update
"ALZip_is1" = ALZip
"Amazon Kindle" = Amazon Kindle
"Anime Studio Pro_is1" = Anime Studio Pro 6.0
"ATI Display Driver" = ATI Display Driver
"AVG" = AVG 2013
"BitLord" = BitLord 1.1
"BlackBerry_{96009644-514C-47DD-BE49-6D93C7FCFFA3}" = BlackBerry Desktop Software 4.1.1
"Campaign Cartographer 2" = Campaign Cartographer 2
"CDisplay_is1" = CDisplay 1.8
"CDisplayEx_is1" = CDisplayEx 1.4
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200314F1" = SoftV92 Voice Modem with SmartCP
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F50&SUBSYS_207C14F1" = Soft Voice SoftRing Modem with SmartSP
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2010-10-10
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"FastCAD" = FastCAD
"FileZilla Client" = FileZilla Client 3.0.9.3
"Giraffic" = Veoh Giraffic Video Accelerator
"Google Chrome" = Google Chrome
"GoogleVideoPlayer" = Google Video Player
"Graboid Video" = Graboid Video 3.58
"HTMLKit_is1" = HTML-Kit
"Icon Suite_is1" = Icon Suite 2.1.12
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"incredibar" = Incredibar Toolbar on IE
"InstallShield_{98E3252E-3CE5-4B15-929D-D18F7BE6EED4}" = D-Link DFE-530TX+
"LiveReg" = LiveReg (Symantec Corporation)
"MailWasher Free_is1" = MailWasher Free
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Document Explorer 2005" = Microsoft Document Explorer 2005
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox 17.0.1 (x86 en-US)" = Mozilla Firefox 17.0.1 (x86 en-US)
"Mozilla Thunderbird (2.0.0.22)" = Mozilla Thunderbird (2.0.0.22)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"MUSHclient" = MUSHclient (remove only)
"Network MagicUninstall" = Network Magic
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NSSSetup.{3FADAA19-E595-44CA-A072-58B6B0851768}" = Norton Security Scan (Symantec Corporation)
"PageRage Toolbar" = PageRage Toolbar
"PriceGong" = PriceGong 2.6.4
"RealPlayer 15.0" = RealPlayer
"Red Light Center 3D Client" = Red Light Center 3D Client
"ScanQuery" = ScanQuery 1.0 build 121 powered by FIRST SEARCHBAR
"SimpleMU MUD Client" = SimpleMU MUD Client
"SmartFTP Client 2.5 Setup Files" = SmartFTP Client 2.5 Setup Files (remove only)
"Steam App 32370" = Star Wars: Knights of the Old Republic
"Steam App 91310" = Dead Island
"SymSetup.{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}" = Norton SystemWorks 2005 Premier (Symantec Corporation)
"SystemRequirementsLab" = System Requirements Lab
"Tweak UI 2.10" = Tweak UI
"ULi M5289 SATA Controller Driver" = ULi M5289 SATA Controller Driver
"Updater Service" = Updater Service
"uTorrent" = µTorrent
"uTorrentControl2 Toolbar" = uTorrentControl2 Toolbar
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 1.0.1
"vmn3_5dn" = Antiphishing Domain Advisor
"VN_VUIns_Rhine_D-Link" = D-Link PCI Fast Ethernet Adapter
"WeatherBlinkbar Uninstall" = WeatherBlink Toolbar
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"winscp3_is1" = WinSCP 4.1.2 beta
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"SOE-Clone Wars" = Clone Wars

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 1/5/2013 1:50:20 PM | Computer Name = MILLENNIUMFALCO | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Received from 192.168.1.2:5353 26 2.1.168.192.in-addr.arpa.
PTR MillenniumFalcon-2.local.

Error - 1/5/2013 1:50:20 PM | Computer Name = MILLENNIUMFALCO | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Unexpected conflict discarding 24 2.1.168.192.in-addr.arpa.
PTR MillenniumFalcon.local.

Error - 1/6/2013 6:00:32 AM | Computer Name = MILLENNIUMFALCO | Source = NativeWrapper | ID = 5000
Description =

Error - 1/6/2013 6:00:45 AM | Computer Name = MILLENNIUMFALCO | Source = NativeWrapper | ID = 5000
Description =

Error - 1/6/2013 9:08:52 AM | Computer Name = MILLENNIUMFALCO | Source = NativeWrapper | ID = 5000
Description =

Error - 1/6/2013 9:09:04 AM | Computer Name = MILLENNIUMFALCO | Source = NativeWrapper | ID = 5000
Description =

Error - 1/7/2013 6:00:27 AM | Computer Name = MILLENNIUMFALCO | Source = NativeWrapper | ID = 5000
Description =

Error - 1/7/2013 6:00:38 AM | Computer Name = MILLENNIUMFALCO | Source = NativeWrapper | ID = 5000
Description =

Error - 1/7/2013 10:26:14 AM | Computer Name = MILLENNIUMFALCO | Source = NativeWrapper | ID = 5000
Description =

Error - 1/7/2013 10:26:26 AM | Computer Name = MILLENNIUMFALCO | Source = NativeWrapper | ID = 5000
Description =

[ Spybot - Search and Destroy Events ]
Error - 1/2/2013 3:39:37 PM | Computer Name = MILLENNIUMFALCO | Source = SDCleaner | ID = 100
Description = LoadCleaningInstructions

Error - 1/2/2013 3:40:24 PM | Computer Name = MILLENNIUMFALCO | Source = SDCleaner | ID = 100
Description = LoadCleaningInstructions

[ System Events ]
Error - 1/7/2013 6:01:33 AM | Computer Name = MILLENNIUMFALCO | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Microsoft .NET Framework 1.1 SP1 on
Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2698023).

Error - 1/7/2013 10:26:05 AM | Computer Name = MILLENNIUMFALCO | Source = DCOM | ID = 10010
Description = The server {121BC3CF-7F8A-4CFF-80DB-3853231BE619} did not register
with DCOM within the required timeout.

Error - 1/7/2013 10:26:15 AM | Computer Name = MILLENNIUMFALCO | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Microsoft .NET Framework 1.1 SP1 on
Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656370).

Error - 1/7/2013 10:26:26 AM | Computer Name = MILLENNIUMFALCO | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Microsoft .NET Framework 1.1 SP1 on
Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2698023).

Error - 1/7/2013 3:14:28 PM | Computer Name = MILLENNIUMFALCO | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 1/7/2013 3:14:28 PM | Computer Name = MILLENNIUMFALCO | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 1/7/2013 3:14:28 PM | Computer Name = MILLENNIUMFALCO | Source = Service Control Manager | ID = 7000
Description = The Norton Unerase Protection service failed to start due to the following
error: %%3

Error - 1/7/2013 3:14:28 PM | Computer Name = MILLENNIUMFALCO | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Spybot-S&D 2 Security
Center Service service to connect.

Error - 1/7/2013 3:14:28 PM | Computer Name = MILLENNIUMFALCO | Source = Service Control Manager | ID = 7000
Description = The Spybot-S&D 2 Security Center Service service failed to start due
to the following error: %%1053

Error - 1/7/2013 3:16:32 PM | Computer Name = MILLENNIUMFALCO | Source = Service Control Manager | ID = 7022
Description = The Norton Ghost service hung on starting.


< End of report >

[Batwulf]

I ran into trouble in Step 2. I tried to temporarily disable AVG Internet Security 2013 twice, and each time, shortly after disabling, I got the BSOD. Also, I'm not sure how to disconnect from the internet, other than unplugging the modem from the router.

[maliprog]

OK. Let's try to clean your system a little.

Step 1

We need to disable Spybot S&D's "TeaTimer".

TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can re-enable it when we're done if you like.

• Open Spybot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
• If prompted with a legal dialog, accept the warning.
• Click Mode and then on "Advanced Mode".
  
• You may be presented with a warning dialog. If so, press Yes.
• Click on
• Click on
• Uncheck these checkboxes:
  
• Close/Exit Spybot Search and Destroy.

Step 2

We need to remove AVG from your system. Please download AVG Remover and run it in order to remove AVG. After we finish cleaning of your system you can install AVG again.

Step 3

Download the adwCleaner

• Run the Tool
  (Windows Vista and Windows 7 users: right click in the adwCleaner.exe and select the Run as Administrator option)
• Select the Delete button.
• When the scan completes, it will open a notepad windows.
• Please, copy the content of this file in your next reply.

Step 4

NOTE: This fix is custom made for this system only and for current system state! Don't try to run it on another system!

Please close all running programs and Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370
  FF - prefs.js..network.proxy.http: "127.0.0.1"
  FF - prefs.js..network.proxy.http_port: 50370
  FF - prefs.js..network.proxy.type: 4
  O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll File not found
  O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll File not found
  F3 - HKCU WinNT: Load - (C:\DOCUME~1\Wulf\LOCALS~1\Temp\dwm.exe) - File not found
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Post the fix log it produces in your next reply or you can find it in C:\_OTL\MovedFiles

Step 5

• Go to Start -> My Computer
• Right click on C: disk and clik on Properties
• Click on tab Tools and click on Check now... button
• Check Automatically fix system errors and Scan for and attempt recovery of bad sectors
• Click Start button
• Confirm schedule disk check next time computer starts with Yes button
• Restart your system and wait while system checks your disk for errors

This step usually fix some errors related to BSOD.

Did check disk repair anything?

Step 6

Please don't forget to include these items in your reply:

• adwCleaner log
• OTL fix log

It would be helpful if you could post each log in separate post using "Add Reply" button

[Batwulf]

Hi again. I'm having trouble with step 1: "Start -> All Programs -> Spybot Search and Destroy" works fine, but the next part: "-> Spybot Search and Destroy isn't there." Here's a screenshot I managed to grab.



Should I just uninstall and download it again later?

Edited by Batwulf, 08 January 2013 - 07:20 AM.

[maliprog]

Can you please uninstall it in this case. You can install it again later when we clean your system.

[Batwulf]

Posting the Step 3 log before shutting everything down to run Step 4.

# AdwCleaner v2.105 - Logfile created 01/08/2013 at 16:01:36
# Updated 08/01/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Wulf - MILLENNIUMFALCO
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Wulf\My Documents\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : Application Updater
Stopped & Deleted : bProtector
Stopped & Deleted : IBUpdaterService

***** [Files / Folders] *****

Deleted on reboot : C:\Documents and Settings\All Users\Application Data\bProtector
File Deleted : C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\bprotector_prefs.js
File Deleted : C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\searchplugins\Conduit.xml
File Deleted : C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\searchplugins\MyStart Search.xml
File Deleted : C:\user.js
File Deleted : C:\WINDOWS\system32\conduitEngine.tmp
Folder Deleted : C:\Documents and Settings\All Users\Application Data\IBUpdaterService
Folder Deleted : C:\Documents and Settings\All Users\Application Data\ScanQuery
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Trymedia
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Viewpoint
Folder Deleted : C:\Documents and Settings\All Users\Application Data\WeCareReminder
Folder Deleted : C:\Documents and Settings\All Users\Start Menu\Programs\PriceGong
Folder Deleted : C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\Conduit
Folder Deleted : C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\ConduitCommon
Folder Deleted : C:\Documents and Settings\Wulf\Application Data\OpenCandy
Folder Deleted : C:\Documents and Settings\Wulf\Application Data\PerformerSoft
Folder Deleted : C:\Documents and Settings\Wulf\Application Data\PriceGong
Folder Deleted : C:\Documents and Settings\Wulf\Local Settings\Application Data\Babylon
Folder Deleted : C:\Documents and Settings\Wulf\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\Wulf\Local Settings\Application Data\OpenCandy
Folder Deleted : C:\Documents and Settings\Wulf\Local Settings\Application Data\PageRage
Folder Deleted : C:\Documents and Settings\Wulf\Local Settings\Application Data\uTorrentControl2
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Mozilla Firefox\Extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}
Folder Deleted : C:\Program Files\PageRage
Folder Deleted : C:\Program Files\PriceGong
Folder Deleted : C:\Program Files\ScanQuery
Folder Deleted : C:\Program Files\Search Toolbar
Folder Deleted : C:\Program Files\uTorrentControl2
Folder Deleted : C:\Program Files\Viewpoint
Folder Deleted : C:\Program Files\YouTube Downloader Toolbar

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\PageRage
Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKCU\Software\bProtector
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\incredibar.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{100EB1FD-D03E-47FD-81F3-EE91287F9465}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1631550F-191D-4826-B069-D9439253D926}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9565115D-C7D6-46D3-BD63-B67B481A4368}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D425283-D487-4337-BAB6-AB8354A81457}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FC5C2E70-17D9-46C5-9683-B82481EF4F6A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1631550F-191D-4826-B069-D9439253D926}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7D75EC94-90AC-4BE5-B062-E6855F800D00}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9565115D-C7D6-46D3-BD63-B67B481A4368}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D425283-D487-4337-BAB6-AB8354A81457}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC5C2E70-17D9-46C5-9683-B82481EF4F6A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\PageRage
Key Deleted : HKCU\Software\PriceGong
Key Deleted : HKCU\Software\SmartBar
Key Deleted : HKCU\Software\uTorrentControl2
Key Deleted : HKCU\Software\wecarereminder
Key Deleted : HKCU\Software\Zugo
Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\Software\Application Updater
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7025E484-D4B0-441A-9F0B-69063BD679CE}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{8258B35C-05B8-4C0E-9525-9BCCC70F8F2D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{A89256AD-EC17-4A83-BEF5-4B8BC4F39306}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\PriceGongIE.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Key Deleted : HKLM\SOFTWARE\Classes\b
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{13119113-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1631550F-191D-4826-B069-D9439253D926}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{33119133-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7D75EC94-90AC-4BE5-B062-E6855F800D00}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9565115D-C7D6-46D3-BD63-B67B481A4368}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D2A2595C-4FE4-4315-AA9B-19DBD6271B71}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FC5C2E70-17D9-46C5-9683-B82481EF4F6A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Key Deleted : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc.1
Key Deleted : HKLM\SOFTWARE\Classes\I
Key Deleted : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder
Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.dskBnd
Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.dskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr
Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr.1
Key Deleted : HKLM\SOFTWARE\Classes\IncredibarApp.appCore
Key Deleted : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Key Deleted : HKLM\SOFTWARE\Classes\PriceFactorIE.PriceGongBHO
Key Deleted : HKLM\SOFTWARE\Classes\PriceFactorIE.PriceGongBHO.1
Key Deleted : HKLM\SOFTWARE\Classes\PriceGongIE.PriceGongCtrl
Key Deleted : HKLM\SOFTWARE\Classes\PriceGongIE.PriceGongCtrl.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2418376
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3072253
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{8B3372D0-09F0-41A5-8D9B-134E148672FB}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok
Key Deleted : HKLM\Software\incredibar.com
Key Deleted : HKLM\Software\MetaStream
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2C5E2432-1135-41DE-A1DF-B06620E1A4E4}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44198D6A-177C-425C-848B-C5891682D35D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49D2BDE6-FD76-474F-9C44-77B40F6DEAEE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{710A2466-F5BD-47D8-AF56-05E22E78AFE3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C-28AC5D3C73FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\incredibar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PageRage Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PriceGong
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ScanQuery
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Updater Service
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\uTorrentControl2 Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9565115D-C7D6-46D3-BD63-B67B481A4368}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7D75EC94-90AC-4BE5-B062-E6855F800D00}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\incredibar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PageRage Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PriceGong
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ScanQuery
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl2 Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
Key Deleted : HKLM\Software\PageRage
Key Deleted : HKLM\Software\ScanQuery
Key Deleted : HKLM\Software\Search Settings
Key Deleted : HKLM\Software\uTorrentControl2
Key Deleted : HKLM\Software\Viewpoint
Key Deleted : HKU\S-1-5-21-1004336348-1979792683-1801674531-1020\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{9565115D-C7D6-46D3-BD63-B67B481A4368}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{F3FEE66E-E034-436A-86E4-9690573BEE8A}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{9565115D-C7D6-46D3-BD63-B67B481A4368}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F3FEE66E-E034-436A-86E4-9690573BEE8A}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F9639E4A-801B-4843-AEE3-03D9DA199E77}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page Restore] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2418376 --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?AF=111917&babsrc=NT_ss&mntrId=549de3f000000000000000265a766618 --> hxxp://www.google.com

-\\ Mozilla Firefox v17.0.1 (en-US)

File : C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\5wxnyjno.default\prefs.js

[OK] File is clean.

File : C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\prefs.js

C:\Documents and Settings\Wulf\Application Data\Mozilla\Firefox\Profiles\hryurhpv.default\user.js ... Deleted !

Deleted : user_pref("ct2418376.aboutprivacyurl", "hxxp://www.conduit.com/privacy/default.aspx");
Deleted : user_pref("ct2418376.ctid", "ct2418376");
Deleted : user_pref("ct2418376.currentserverdate", "25-12-2010");
Deleted : user_pref("ct2418376.dialogsalignmode", "ltr");
Deleted : user_pref("ct2418376.downloadreferralcookiedata", "");
Deleted : user_pref("ct2418376.enableclicktosearchbox", false);
Deleted : user_pref("ct2418376.enablesearchhistory", false);
Deleted : user_pref("ct2418376.enablesearchsuggest", false);
Deleted : user_pref("ct2418376.enableusage", false);
Deleted : user_pref("ct2418376.externalcomponentpolldate5694225620172914022", "sat sep 18 2010 15:11:03 gmt-05[...]
Deleted : user_pref("ct2418376.firstserverdate", "18-9-2010");
Deleted : user_pref("ct2418376.firsttime", true);
Deleted : user_pref("ct2418376.firsttimeff3", true);
Deleted : user_pref("ct2418376.firsttimesettingsdone", true);
Deleted : user_pref("ct2418376.fixpagenotfounderrors", true);
Deleted : user_pref("ct2418376.groupingservercheckinterval", 1440);
Deleted : user_pref("ct2418376.groupingserviceurl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("ct2418376.initialize", true);
Deleted : user_pref("ct2418376.initializecommonprefs", true);
Deleted : user_pref("ct2418376.installationandcookiedatasentcount", 3);
Deleted : user_pref("ct2418376.installationtype", "unknownintegration");
Deleted : user_pref("ct2418376.installeddate", "sat sep 18 2010 15:11:02 gmt-0500 (central daylight time)");
Deleted : user_pref("ct2418376.isgrouping", false);
Deleted : user_pref("ct2418376.ismulticommunity", false);
Deleted : user_pref("ct2418376.isopenthankyoupage", false);
Deleted : user_pref("ct2418376.isopenuninstallpage", true);
Deleted : user_pref("ct2418376.languagepacklastchecktime", "fri dec 24 2010 22:14:04 gmt-0600 (central standar[...]
Deleted : user_pref("ct2418376.languagepackreloadintervalmm", 1440);
Deleted : user_pref("ct2418376.languagepackserviceurl", "hxxp://translation.users.conduit.com/translation.ashx[...]
Deleted : user_pref("ct2418376.lastlogin_2.7.2.0", "sat dec 25 2010 06:14:04 gmt-0600 (central standard time)"[...]
Deleted : user_pref("ct2418376.latestversion", "2.7.2.0");
Deleted : user_pref("ct2418376.locale", "en");
Deleted : user_pref("ct2418376.logincache", 4);
Deleted : user_pref("ct2418376.mcdetecttooltipheight", "83");
Deleted : user_pref("ct2418376.mcdetecttooltipshow", false);
Deleted : user_pref("ct2418376.mcdetecttooltipurl", "hxxp://@eb_install_link@/rank/tooltip/?version=1");
Deleted : user_pref("ct2418376.mcdetecttooltipwidth", "295");
Deleted : user_pref("ct2418376.publishercontainerwidth", 986);
Deleted : user_pref("ct2418376.shrink_toolbar", 1);
Deleted : user_pref("ct2418376.savedhomepage", "hxxp://www.sitnbullcafe.com/enchanted/");
Deleted : user_pref("ct2418376.searchbacktodefaultengine", false);
Deleted : user_pref("ct2418376.searchboxwidth", 207);
Deleted : user_pref("ct2418376.searchengine", "search||hxxp://search.conduit.com/results.aspx?q=ucm_search_ter[...]
Deleted : user_pref("ct2418376.searchfromaddressbarisinit", true);
Deleted : user_pref("ct2418376.searchfromaddressbarurl", "hxxp://search.conduit.com/resultsext.aspx?ctid=ct241[...]
Deleted : user_pref("ct2418376.searchinnewtabenabled", true);
Deleted : user_pref("ct2418376.searchinnewtabintervalmm", 1440);
Deleted : user_pref("ct2418376.searchinnewtablastchecktime", "fri dec 24 2010 22:13:59 gmt-0600 (central stand[...]
Deleted : user_pref("ct2418376.searchinnewtabserviceurl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=eb_t[...]
Deleted : user_pref("ct2418376.searchinnewtabusageurl", "hxxp://usage.hosting.conduit-services.com/usageservic[...]
Deleted : user_pref("ct2418376.searchinnewtabuserenabled", false);
Deleted : user_pref("ct2418376.settingscheckintervalmin", 120);
Deleted : user_pref("ct2418376.settingslastchecktime", "fri dec 24 2010 22:13:58 gmt-0600 (central standard ti[...]
Deleted : user_pref("ct2418376.settingslastupdate", "1290091392");
Deleted : user_pref("ct2418376.thirdpartycomponentsinterval", 504);
Deleted : user_pref("ct2418376.thirdpartycomponentslastcheck", "tue dec 14 2010 09:10:04 gmt-0600 (central sta[...]
Deleted : user_pref("ct2418376.thirdpartycomponentslastupdate", "1246790578");
Deleted : user_pref("ct2418376.trustelinkurl", "hxxp://www.truste.org/pvr.php?page=validate&softwareprogramid=[...]
Deleted : user_pref("ct2418376.userid", "un92745814059761414");
Deleted : user_pref("ct2418376.validationdata_search", 2);
Deleted : user_pref("ct2418376.validationdata_toolbar", 2);
Deleted : user_pref("ct2418376.alertchannelid", "812740");
Deleted : user_pref("ct2418376.clientlogisenabled", true);
Deleted : user_pref("ct2418376.clientlogserviceurl", "hxxp://clientlog.users.conduit.com/clientdiagnostics.asm[...]
Deleted : user_pref("ct2418376.components.128994496340319350", false);
Deleted : user_pref("ct2418376.components.128994498539382126", false);
Deleted : user_pref("ct2418376.components.129017823262156499", false);
Deleted : user_pref("ct2418376.components.129286228624188493", false);
Deleted : user_pref("ct2418376.components.5694225620172914022", false);
Deleted : user_pref("ct2418376.components.6532855160543298897", false);
Deleted : user_pref("ct2418376.components.7496640646864546743", false);
Deleted : user_pref("ct2418376.components.7997623359991201723", false);
Deleted : user_pref("ct2418376.mystuffenabled", true);
Deleted : user_pref("ct2418376.mystuffpublihserminwidth", 400);
Deleted : user_pref("ct2418376.mystuffsearchurl", "hxxp://apps.conduit.com/search?q=search_term&searchsourceor[...]
Deleted : user_pref("ct2418376.mystuffserviceintervalmm", 1440);
Deleted : user_pref("ct2418376.mystuffserviceurl", "hxxp://mystuff.conduit-services.com/mystuffservice.ashx?co[...]
Deleted : user_pref("ct2418376.uninstalllogserviceurl", "hxxp://uninstall.users.conduit.com/uninstall.asmx/reg[...]
Deleted : user_pref("ct2438727.aboutprivacyurl", "hxxp://www.conduit.com/privacy/default.aspx");
Deleted : user_pref("ct2438727.ctid", "ct2438727");
Deleted : user_pref("ct2438727.communitieschangeslastchecktime", "0");
Deleted : user_pref("ct2438727.currentserverdate", "10-2-2011");
Deleted : user_pref("ct2438727.dialogsalignmode", "ltr");
Deleted : user_pref("ct2438727.downloadreferralcookiedata", "");
Deleted : user_pref("ct2438727.firstserverdate", "2-10-2010");
Deleted : user_pref("ct2438727.firsttime", true);
Deleted : user_pref("ct2438727.firsttimeff3", true);
Deleted : user_pref("ct2438727.firsttimesettingsdone", true);
Deleted : user_pref("ct2438727.fixpagenotfounderrors", true);
Deleted : user_pref("ct2438727.groupinginvalidatecache", false);
Deleted : user_pref("ct2438727.groupinglastchecktime", "0");
Deleted : user_pref("ct2438727.groupinglastserverupdatetime", "0");
Deleted : user_pref("ct2438727.groupingservercheckinterval", 1440);
Deleted : user_pref("ct2438727.groupingserviceurl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("ct2438727.initialize", true);
Deleted : user_pref("ct2438727.initializecommonprefs", true);
Deleted : user_pref("ct2438727.installationandcookiedatasentcount", 3);
Deleted : user_pref("ct2438727.installeddate", "sat oct 02 2010 10:23:45 gmt-0500 (central daylight time)");
Deleted : user_pref("ct2438727.invalidatecache", false);
Deleted : user_pref("ct2438727.isgrouping", false);
Deleted : user_pref("ct2438727.ismulticommunity", false);
Deleted : user_pref("ct2438727.isopenthankyoupage", true);
Deleted : user_pref("ct2438727.isopenuninstallpage", true);
Deleted : user_pref("ct2438727.languagepacklastchecktime", "wed feb 09 2011 15:03:59 gmt-0600 (central standar[...]
Deleted : user_pref("ct2438727.languagepackreloadintervalmm", 1440);
Deleted : user_pref("ct2438727.languagepackserviceurl", "hxxp://translation.users.conduit.com/translation.ashx[...]
Deleted : user_pref("ct2438727.lastlogin_2.7.2.0", "wed feb 09 2011 18:41:19 gmt-0600 (central standard time)"[...]
Deleted : user_pref("ct2438727.latestversion", "2.7.1.3");
Deleted : user_pref("ct2438727.locale", "en");
Deleted : user_pref("ct2438727.logincache", 4);
Deleted : user_pref("ct2438727.mcdetecttooltipheight", "83");
Deleted : user_pref("ct2438727.mcdetecttooltipurl", "hxxp://@eb_install_link@/rank/tooltip/?version=1");
Deleted : user_pref("ct2438727.mcdetecttooltipwidth", "295");
Deleted : user_pref("ct2438727.radiolastchecktime", "0");
Deleted : user_pref("ct2438727.radiolastupdateipserver", "0");
Deleted : user_pref("ct2438727.radiolastupdateserver", "0");
Deleted : user_pref("ct2438727.searchboxwidth", 171);
Deleted : user_pref("ct2438727.searchengine", "search||hxxp://search.conduit.com/results.aspx?q=ucm_search_ter[...]
Deleted : user_pref("ct2438727.searchfromaddressbarisinit", true);
Deleted : user_pref("ct2438727.searchfromaddressbarurl", "hxxp://search.conduit.com/resultsext.aspx?ctid=ct243[...]
Deleted : user_pref("ct2438727.searchinnewtabenabled", true);
Deleted : user_pref("ct2438727.searchinnewtabintervalmm", 1440);
Deleted : user_pref("ct2438727.searchinnewtablastchecktime", "wed feb 09 2011 14:46:57 gmt-0600 (central stand[...]
Deleted : user_pref("ct2438727.searchinnewtabserviceurl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=eb_t[...]
Deleted : user_pref("ct2438727.searchinnewtabusageurl", "hxxp://usage.hosting.conduit-services.com/usageservic[...]
Deleted : user_pref("ct2438727.settingscheckintervalmin", 120);
Deleted : user_pref("ct2438727.settingslastchecktime", "wed feb 09 2011 14:41:13 gmt-0600 (central standard ti[...]
Deleted : user_pref("ct2438727.settingslastupdate", "1297181872");
Deleted : user_pref("ct2438727.thirdpartycomponentsinterval", 504);
Deleted : user_pref("ct2438727.thirdpartycomponentslastcheck", "wed jan 19 2011 21:32:51 gmt-0600 (central sta[...]
Deleted : user_pref("ct2438727.thirdpartycomponentslastupdate", "1246790578");
Deleted : user_pref("ct2438727.trustelinkurl", "hxxp://trust.conduit.com/eb_original_ctid");
Deleted : user_pref("ct2438727.userid", "un35071617956426994");
Deleted : user_pref("ct2438727.validationdata_toolbar", 2);
Deleted : user_pref("ct2438727.alertchannelid", "832836");
Deleted : user_pref("ct2438727.backendstorage.currentgame", "796f76696c6c65");
Deleted : user_pref("ct2438727.clientlogisenabled", false);
Deleted : user_pref("ct2438727.clientlogserviceurl", "hxxp://clientlog.users.conduit.com/clientdiagnostics.asm[...]
Deleted : user_pref("ct2438727.mystuffenabled", true);
Deleted : user_pref("ct2438727.mystuffpublihserminwidth", 400);
Deleted : user_pref("ct2438727.mystuffsearchurl", "hxxp://apps.conduit.com/search?q=search_term&searchsourceor[...]
Deleted : user_pref("ct2438727.mystuffserviceintervalmm", 1440);
Deleted : user_pref("ct2438727.mystuffserviceurl", "hxxp://mystuff.conduit-services.com/mystuffservice.ashx?co[...]
Deleted : user_pref("ct2438727.uninstalllogserviceurl", "hxxp://uninstall.users.conduit.com/uninstall.asmx/reg[...]
Deleted : user_pref("ct3072253..clientlogisenabled", false);
Deleted : user_pref("ct3072253..clientlogserviceurl", "hxxp://clientlog.users.conduit.com/clientdiagnostics.as[...]
Deleted : user_pref("ct3072253..uninstalllogserviceurl", "hxxp://uninstall.users.conduit.com/uninstall.asmx/re[...]
Deleted : user_pref("ct3072253.allow_showing_hidden_toolbar", false);
Deleted : user_pref("ct3072253.aboutprivacyurl", "hxxp://www.conduit.com/privacy/default.aspx");
Deleted : user_pref("ct3072253.apptrackinglastchecktime", "sat may 19 2012 18:48:54 gmt-0500 (central daylight[...]
Deleted : user_pref("ct3072253.browsercompstateisopen_129573915102477663", true);
Deleted : user_pref("ct3072253.browsercompstateisopen_129749445881800338", true);
Deleted : user_pref("ct3072253.browsercompstateisopen_129805375651312503", true);
Deleted : user_pref("ct3072253.ctid", "ct3072253");
Deleted : user_pref("ct3072253.currentserverdate", "5-6-2012");
Deleted : user_pref("ct3072253.dsinstall", false);
Deleted : user_pref("ct3072253.dialogsalignmode", "ltr");
Deleted : user_pref("ct3072253.dialogsgetterlastchecktime", "fri jun 15 2012 18:34:58 gmt-0500 (central daylig[...]
Deleted : user_pref("ct3072253.downloadreferralcookiedata", "");
Deleted : user_pref("ct3072253.enableclicktosearchbox", false);
Deleted : user_pref("ct3072253.enablesearchhistory", false);
Deleted : user_pref("ct3072253.enablesearchsuggest", false);
Deleted : user_pref("ct3072253.firstserverdate", "20-5-2012");
Deleted : user_pref("ct3072253.firsttime", true);
Deleted : user_pref("ct3072253.firsttimeff3", true);
Deleted : user_pref("ct3072253.fixpagenotfounderrors", true);
Deleted : user_pref("ct3072253.groupingservercheckinterval", 1440);
Deleted : user_pref("ct3072253.groupingserviceurl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("ct3072253.hpinstall", false);
Deleted : user_pref("ct3072253.hasuserglobalkeys", true);
Deleted : user_pref("ct3072253.initialize", true);
Deleted : user_pref("ct3072253.initializecommonprefs", true);
Deleted : user_pref("ct3072253.installationandcookiedatasentcount", 3);
Deleted : user_pref("ct3072253.installationid", "fft5e.tmp.exe");
Deleted : user_pref("ct3072253.installationtype", "xpe");
Deleted : user_pref("ct3072253.installeddate", "sat may 19 2012 18:35:08 gmt-0500 (central daylight time)");
Deleted : user_pref("ct3072253.isgrouping", false);
Deleted : user_pref("ct3072253.isinitsetupini", true);
Deleted : user_pref("ct3072253.ismulticommunity", false);
Deleted : user_pref("ct3072253.isopenthankyoupage", true);
Deleted : user_pref("ct3072253.isopenuninstallpage", false);
Deleted : user_pref("ct3072253.languagepacklastchecktime", "sat jun 16 2012 20:58:14 gmt-0500 (central dayligh[...]
Deleted : user_pref("ct3072253.languagepackreloadintervalmm", 1440);
Deleted : user_pref("ct3072253.languagepackserviceurl", "hxxp://translation.users.conduit.com/translation.ashx[...]
Deleted : user_pref("ct3072253.lastlogin_3.12.0.8", "sun jun 17 2012 04:57:05 gmt-0500 (central daylight time)[...]
Deleted : user_pref("ct3072253.latestversion", "3.13.0.6");
Deleted : user_pref("ct3072253.locale", "en");
Deleted : user_pref("ct3072253.mcdetecttooltipheight", "83");
Deleted : user_pref("ct3072253.mcdetecttooltipshow", false);
Deleted : user_pref("ct3072253.mcdetecttooltipurl", "hxxp://@eb_install_link@/rank/tooltip/?version=1");
Deleted : user_pref("ct3072253.mcdetecttooltipwidth", "295");
Deleted : user_pref("ct3072253.mystuffenabledatinstallation", false);
Deleted : user_pref("ct3072253.originalfirstversion", "3.12.0.8");
Deleted : user_pref("ct3072253.radioshrinked", "shrinked");
Deleted : user_pref("ct3072253.radioshrinkedfromsetup", true);
Deleted : user_pref("ct3072253.shrink_toolbar", 0);
Deleted : user_pref("ct3072253.searchbacktodefaultengine", false);
Deleted : user_pref("ct3072253.searchcaption", "utorrentcontrol2 customized web search");
Deleted : user_pref("ct3072253.searchfromaddressbarisinit", true);
Deleted : user_pref("ct3072253.searchfromaddressbarurl", "hxxp://search.conduit.com/resultsext.aspx?ctid=ct307[...]
Deleted : user_pref("ct3072253.searchinnewtabenabled", true);
Deleted : user_pref("ct3072253.searchinnewtabintervalmm", 1440);
Deleted : user_pref("ct3072253.searchinnewtablastchecktime", "sat jun 16 2012 20:57:06 gmt-0500 (central dayli[...]
Deleted : user_pref("ct3072253.searchinnewtabserviceurl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=eb_t[...]
Deleted : user_pref("ct3072253.sendprotectordatavialogin", true);
Deleted : user_pref("ct3072253.servicemaplastchecktime", "sat jun 16 2012 20:58:14 gmt-0500 (central daylight [...]
Deleted : user_pref("ct3072253.settingslastchecktime", "sat jun 16 2012 20:57:06 gmt-0500 (central daylight ti[...]
Deleted : user_pref("ct3072253.settingslastupdate", "1339665152");
Deleted : user_pref("ct3072253.tbhomepageurl", "hxxp://search.conduit.com/?ctid=ct3072253&searchsource=13");
Deleted : user_pref("ct3072253.thirdpartycomponentsinterval", 504);
Deleted : user_pref("ct3072253.thirdpartycomponentslastcheck", "sat may 19 2012 18:35:08 gmt-0500 (central day[...]
Deleted : user_pref("ct3072253.thirdpartycomponentslastupdate", "1331805997");
Deleted : user_pref("ct3072253.toolbarshrinkedfromsetup", true);
Deleted : user_pref("ct3072253.trustelinkurl", "hxxp://trust.conduit.com/ct3072253");
Deleted : user_pref("ct3072253.trustedapidomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("ct3072253.userid", "un65987817060957736");
Deleted : user_pref("ct3072253.validationdata_toolbar", 2);
Deleted : user_pref("ct3072253.alertchannelid", "1463702");
Deleted : user_pref("ct3072253.approveuntrustedapps", true);
Deleted : user_pref("ct3072253.autodisablescopes", -1);
Deleted : user_pref("ct3072253.backendstorage.cbfirsttime", "536174204d617920313920323031322031383a33353a31302[...]
Deleted : user_pref("ct3072253.components.129573915102477663", false);
Deleted : user_pref("ct3072253.components.129593762370823811", false);
Deleted : user_pref("ct3072253.components.129749445881800338", false);
Deleted : user_pref("ct3072253.components.129805375651312503", false);
Deleted : user_pref("ct3072253.generalconfigfromlogin", "{\"apimaxalerts\":\"12\",\"socialdomains\":\"social.c[...]
Deleted : user_pref("ct3072253.globalfirsttimeinfolastchecktime", "sat may 19 2012 18:35:08 gmt-0500 (central [...]
Deleted : user_pref("ct3072253.homepageprotectorenablebylogin", true);
Deleted : user_pref("ct3072253.initdone", true);
Deleted : user_pref("ct3072253.isapptrackingmanageron", true);
Deleted : user_pref("ct3072253.isfirstradioinstallation", false);
Deleted : user_pref("ct3072253.issearchprotectornotifychanges", false);
Deleted : user_pref("ct3072253.mystuffenabled", true);
Deleted : user_pref("ct3072253.mystuffpublihserminwidth", 400);
Deleted : user_pref("ct3072253.mystuffsearchurl", "hxxp://apps.conduit.com/search?q=search_term&searchsourceor[...]
Deleted : user_pref("ct3072253.mystuffserviceintervalmm", 1440);
Deleted : user_pref("ct3072253.mystuffserviceurl", "hxxp://mystuff.conduit-services.com/mystuffservice.ashx?co[...]
Deleted : user_pref("ct3072253.navigatetourlonsearch", false);
Deleted : user_pref("ct3072253.revertsettingsenabled", false);
Deleted : user_pref("ct3072253.searchprotectordialogdelayinsec", 10);
Deleted : user_pref("ct3072253.searchprotectorenablebylogin", true);
Deleted : user_pref("ct3072253.testingctid", "");
Deleted : user_pref("ct3072253.toolbarappmetadatalastchecktime", "sat jun 16 2012 20:58:14 gmt-0500 (central d[...]
Deleted : user_pref("ct3072253.toolbarcontextmenulastchecktime", "sat may 19 2012 18:35:10 gmt-0500 (central d[...]
Deleted : user_pref("ct3072253.usageenabled", false);
Deleted : user_pref("ct3072253.usagesflag", 2);
Deleted : user_pref("communitytoolbar.etag.hxxp://settings.toolbar.search.conduit.com/root/ct3072253/ct3072253[...]
Deleted : user_pref("communitytoolbar.etag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct3072253", [...]
Deleted : user_pref("communitytoolbar.etag.hxxp://contextmenu.toolbar.conduit-services.com/?name=gottenapps&lo[...]
Deleted : user_pref("communitytoolbar.etag.hxxp://contextmenu.toolbar.conduit-services.com/?name=otherapps&loc[...]
Deleted : user_pref("communitytoolbar.etag.hxxp://contextmenu.toolbar.conduit-services.com/?name=sharedapps&lo[...]
Deleted : user_pref("communitytoolbar.etag.hxxp://contextmenu.toolbar.conduit-services.com/?name=toolbar&local[...]
Deleted : user_pref("communitytoolbar.etag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("communitytoolbar.etag.hxxp://dynamicdialogs.toolbar.conduit-services.com/dlg.pkg?ver=3.12[...]
Deleted : user_pref("communitytoolbar.etag.hxxp://servicemap.conduit-services.com/toolbar/?ownerid=ct3072253",[...]
Deleted : user_pref("communitytoolbar.etag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"21b[...]
Deleted : user_pref("communitytoolbar.latestlibspath", "file:///c:\\documents and settings\\wulf\\application [...]
Deleted : user_pref("communitytoolbar.latesttoolbarversioninstalled", "3.12.0.8");
Deleted : user_pref("communitytoolbar.searchfromaddressbarsavedurl", "chrome://browser-region/locale/region.pr[...]
Deleted : user_pref("communitytoolbar.toolbarslist", "ct2418376,ct2438727,ct3072253");
Deleted : user_pref("communitytoolbar.toolbarslist2", "ct2418376,ct2438727,ct3072253");
Deleted : user_pref("communitytoolbar.toolbarslist4", "ct3072253");
Deleted : user_pref("communitytoolbar.globaluserid", "499f3e9c-5a71-4a12-8bfc-0791963bd611");
Deleted : user_pref("communitytoolbar.isalerturladdedtofeeditemtable", true);
Deleted : user_pref("communitytoolbar.isclickactionaddedtofeeditemtable", true);
Deleted : user_pref("communitytoolbar.notifications.alertdialogsgetterlastchecktime", "sat may 19 2012 18:35:0[...]
Deleted : user_pref("communitytoolbar.notifications.alertenabled", false);
Deleted : user_pref("communitytoolbar.notifications.clientsserverurl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("communitytoolbar.notifications.locale", "en");
Deleted : user_pref("communitytoolbar.notifications.loginintervalmin", 1440);
Deleted : user_pref("communitytoolbar.notifications.loginlastchecktime", "sat may 19 2012 18:34:01 gmt-0500 (c[...]
Deleted : user_pref("communitytoolbar.notifications.loginlastupdatetime", "1313487611");
Deleted : user_pref("communitytoolbar.notifications.messageshowtimesec", 20);
Deleted : user_pref("communitytoolbar.notifications.servicesserverurl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("communitytoolbar.notifications.showtrayicon", false);
Deleted : user_pref("communitytoolbar.notifications.usercloseintervalmin", 300);
Deleted : user_pref("communitytoolbar.notifications.userid", "7dc23442-f7fe-4a96-be0b-7c7c75666401");
Deleted : user_pref("communitytoolbar.originalhomepage", "hxxp://mystart.incredibar.com/mb143?a=6pqw65my9n&i=2[...]
Deleted : user_pref("communitytoolbar.originalsearchengine", "google");
Deleted : user_pref("browser.babylon.hponnewtab", "search.babylon.com");
Deleted : user_pref("browser.search.defaultenginename", "search the web (babylon)");
Deleted : user_pref("browser.search.defaultthis.enginename", "pagerage customized web search");
Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/resultsext.aspx?ctid=ct2418376&sea[...]
Deleted : user_pref("browser.search.order.1", "search the web (babylon)");
Deleted : user_pref("extensions.babylontoolbar_i.aflt", "babsst");
Deleted : user_pref("extensions.babylontoolbar_i.babext", "");
Deleted : user_pref("extensions.babylontoolbar_i.babtrack", "affid=111917");
Deleted : user_pref("extensions.babylontoolbar_i.hardid", "549de3f000000000000000265a766618");
Deleted : user_pref("extensions.babylontoolbar_i.id", "549de3f000000000000000265a766618");
Deleted : user_pref("extensions.babylontoolbar_i.instlday", "15497");
Deleted : user_pref("extensions.babylontoolbar_i.instlref", "sst");
Deleted : user_pref("extensions.babylontoolbar_i.newtab", true);
Deleted : user_pref("extensions.babylontoolbar_i.newtaburl", "hxxp://search.babylon.com/?af=111917&babsrc=nt_s[...]
Deleted : user_pref("extensions.babylontoolbar_i.prdct", "babylontoolbar");
Deleted : user_pref("extensions.babylontoolbar_i.prtnrid", "babylon");
Deleted : user_pref("extensions.babylontoolbar_i.smplgrp", "none");
Deleted : user_pref("extensions.babylontoolbar_i.srcext", "ss");
Deleted : user_pref("extensions.babylontoolbar_i.tlbrid", "base");
Deleted : user_pref("extensions.babylontoolbar_i.vrsn", "1.5.3.17");
Deleted : user_pref("extensions.babylontoolbar_i.vrsnts", "1.5.3.1722:36:04");
Deleted : user_pref("extensions.babylontoolbar_i.vrsni", "1.5.3.17");
Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar_i.dfltlng", "");
Deleted : user_pref("extensions.incredibar_i.did", "10643");
Deleted : user_pref("extensions.incredibar_i.exctlbr", false);
Deleted : user_pref("extensions.incredibar_i.id", "549de3f000000000000000265a766618");
Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");
Deleted : user_pref("extensions.incredibar_i.instlday", "15461");
Deleted : user_pref("extensions.incredibar_i.instlref", "");
Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");
Deleted : user_pref("extensions.incredibar_i.newtab", false);
Deleted : user_pref("extensions.incredibar_i.ppd", "26");
Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar_i.productid", "26");
Deleted : user_pref("extensions.incredibar_i.prtnrid", "incredibar");
Deleted : user_pref("extensions.incredibar_i.smplgrp", "none");
Deleted : user_pref("extensions.incredibar_i.tlbrid", "base");
Deleted : user_pref("extensions.incredibar_i.tlbrsrchurl", "hxxp://mystart.incredibar.com/?a=6pqw65my9n&loc=ib[...]
Deleted : user_pref("extensions.incredibar_i.upn2", "6pqw65my9n");
Deleted : user_pref("extensions.incredibar_i.upn2n", "92542811805625621");
Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.vrsnts", "1.5.11.1416:01:27");
Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Deleted : user_pref("keyword.url", "hxxp://search.babylon.com/?af=111917&babsrc=adbartrp&mntrid=549de3f0000000[...]

File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\6da8wipi.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v23.0.1271.97

File : C:\Documents and Settings\Wulf\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

Deleted [l.21] : homepage = "hxxp://search.babylon.com/?AF=111917&babsrc=HP_ss&mntrId=549de3f000000000000000265a7666[...]

*************************

AdwCleaner[S1].txt - [48593 octets] - [08/01/2013 16:01:36]

########## EOF - C:\AdwCleaner[S1].txt - [48654 octets] ##########

[Batwulf]

Step 4 (OTL) log.

All processes killed
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: "127.0.0.1" removed from network.proxy.http
Prefs.js: 50370 removed from network.proxy.http_port
Prefs.js: 4 removed from network.proxy.type
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{F9639E4A-801B-4843-AEE3-03D9DA199E77} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\Load:C:\DOCUME~1\Wulf\LOCALS~1\Temp\dwm.exe deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 9531365 bytes
->Temporary Internet Files folder emptied: 7874479 bytes
->FireFox cache emptied: 4660388 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 101187 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 45830499 bytes
->FireFox cache emptied: 3907221 bytes

User: MILLENNIUMFALCO

User: NetworkService
->Temp folder emptied: 737760 bytes
->Temporary Internet Files folder emptied: 47425884 bytes

User: Wulf
->Temp folder emptied: 232519138 bytes
->Temporary Internet Files folder emptied: 226647581 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 76143435 bytes
->Google Chrome cache emptied: 6099312 bytes
->Flash cache emptied: 215080432 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2162283 bytes
%systemroot%\System32 .tmp files removed: 1168087 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 222339 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 421857966 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,242.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 01082013_161848

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[Batwulf]

I've finished step 5, which took a couple of hours, but I don't know if anything was repaired. Should I try to watch a video or two to see what happens?

[maliprog]

Hi Batwulf,

Yes. Please test your system now and let me know results before we continue.

[Batwulf]

This GMER log is 398 pages in Word -- this board won't let me paste all of it. I tried breaking it up into 100 page chunks, even that is too long. Should it really be that long? Should I just break it up further?

[maliprog]

You can ZIP it and attach it for me.

• Right-click that file, point to Send To, and then click Compressed (zipped) Folder.
• A new compressed file is created.
• Please attach that file in your next reply.

How to add an attachment to a new topic or reply

Test your system and let me know results before we continue.