This topic is locked
Edit - after reading some other threads my first question has been answered =) see logs below. (GMER rootkit log not included because when I ran it, it reported nothing except Mozy, an online backup service I know and trust.)
MBAM
Malwarebytes' Anti-Malware 1.44
Database version: 3564
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000
1/14/2010 12:26:32 PM
mbam-log-2010-01-14 (12-26-32).txt
Scan type: Quick Scan
Objects scanned: 113428
Time elapsed: 6 minute(s), 43 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\NordBull (Malware.Trace) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Users\Dan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
Extra.txt
OTL Extras logfile created on: 1/14/2010 12:43:58 PM - Run 1
OTL by OldTimer - Version 3.1.24.0 Folder = C:\Users\Dan\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 61.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 224.68 Gb Total Space | 130.08 Gb Free Space | 57.89% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 488.16 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: DAN-PC
Current User Name: Dan
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4040134827-1233584846-3129121331-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2276B78F-E2CD-46D9-842F-7692D6762956}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{286D6E3B-6F85-4C7C-B327-3321034B2CAF}" = rport=445 | protocol=6 | dir=out | app=system |
"{28BB46E7-14B8-4E6B-8127-771B47C2520A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{42A99E08-F718-4D18-A8D3-2050DCC185BB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4C78A1F0-E386-4F2E-B2E3-434D8AE89DB2}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{50690A89-6417-4EC5-8F7F-EFF6EFF1A603}" = rport=138 | protocol=17 | dir=out | app=system |
"{60CA1A10-38BB-4EBB-AF2A-4BEEF5A4ACE7}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{6941062E-ED31-4B92-9C7F-FD4327D35578}" = lport=445 | protocol=6 | dir=in | app=system |
"{70402963-B652-4980-A273-19EDC2DC44B1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{74795D58-1267-4D54-ACDF-A7B1561A8E1B}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{7E7C8FA5-58E2-4B14-8DAB-DA17BDBC10B0}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{81A066D0-0720-467F-A4AA-DA5FFB9CEE7F}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8375AF01-3C10-4004-A7A3-E10E8A754875}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{939EFE68-15A2-4982-9EFC-29C35E56BFAF}" = rport=139 | protocol=6 | dir=out | app=system |
"{957D1732-CC8C-4E95-9456-8F6A39AD4245}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9732A6FF-2392-4DDA-92F7-307FB856446D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9B06B78B-7D46-4529-9917-1B37EF734B4D}" = lport=137 | protocol=17 | dir=in | app=system |
"{9B5CF50B-7FF5-4098-AFA8-4A59D55B3079}" = lport=10243 | protocol=6 | dir=in | app=system |
"{A73E8FDE-3A91-4698-9A59-C672565A874F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AB49EE3B-A13A-468D-BC24-C4D28DD0A93A}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{B398FE0D-6DCE-4695-98C1-A5D9BDFDBFBE}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{B47DDA4A-433C-42F5-AAE6-E292CFCFB842}" = rport=10243 | protocol=6 | dir=out | app=system |
"{B688E0B3-191E-4B11-94E4-02CBF3116B27}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{BC71B997-AE9D-4C31-BCE1-7CB65B3A4EDE}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{C4E18C04-462A-43E4-B0B2-711F443C43A7}" = lport=139 | protocol=6 | dir=in | app=system |
"{D15E055A-0100-41FC-A27A-3FB94B69B1E8}" = rport=137 | protocol=17 | dir=out | app=system |
"{D970B9D1-DD9E-4376-836B-0437F4A5E46B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{DDE303CF-2C3C-4A4E-BA56-BF4ED5864C77}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E2AAD60F-C8BD-4941-A7D1-E4D66D98BC57}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EA55BF9A-F8E7-42F2-B32E-384CE0FC4C23}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F16DC273-FE14-4833-BCE5-7AF18A90A940}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{F986DA61-3A2D-4429-BF8D-19E1DEBCCBF3}" = lport=138 | protocol=17 | dir=in | app=system |
"{F9F515A9-F0CB-4A3B-8FA2-3E5A3BA5308E}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01F80699-0907-4A26-B405-8551587808F9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1A25A980-71AC-4557-A8B5-CE87FFB20E64}" = protocol=58 | dir=out | [email protected],-28546 |
"{1DB958E1-E273-46C2-AAD6-F0D1C5E94D03}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-enus-downloader.exe |
"{22664F83-54E1-4A7C-9D0E-7FF764ACE86E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2495DB83-61D2-4615-93DD-35FB818F7DF9}" = protocol=6 | dir=out | app=c:\program files\rosettastoneltdservices\support\bin\win\rosettastoneltdcontroller.exe |
"{2990C744-D9CC-4F48-9FDA-06E8B421379A}" = dir=in | app=c:\program files\rosettastoneltdservices\support\bin\win\rosettastoneltdserver.exe |
"{2DCADB83-0CE2-4B63-9FF8-C12A04412357}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{32616D64-FC73-4EC2-836F-19F7A3B86EEE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{35526F88-CBAD-4466-8191-391343E8F3C3}" = protocol=1 | dir=out | [email protected],-28544 |
"{44100622-628B-4736-ACDE-B87E352724C6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4599DCEE-7A7D-48A5-808F-65FDAD2058E6}" = protocol=17 | dir=in | app=c:\program files\curse\curseclient.exe |
"{474C1995-B4E8-4EFF-B523-084EC20361B9}" = protocol=1 | dir=in | [email protected],-28543 |
"{5C50183E-1842-40F7-AAC8-49A82CCC3C29}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{6277D6E0-DF7C-4694-9FA4-0265C0C93E42}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{6417C392-6828-4934-A55F-9E6F45D93915}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{687262CA-CC05-4703-AB2F-8EDDC980FD1F}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\hp1006mc.exe |
"{69F2DF26-AE81-499B-B58B-B5B315E67056}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6C9E3336-9218-4135-BEFA-C4F1F98F18E1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{6F644DF5-534C-4A2B-AA5D-282CA9375B87}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{7083CEAE-FCDA-42E2-9A4E-08AFEF5CDC3F}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\civilization iv colonization\colonization.exe |
"{72A3821C-AD73-4687-98ED-A7A95A1C0BE7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7419E0AB-295E-4712-9E29-BE02583D7B43}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\hp1006mc.exe |
"{77E8D3F1-FCB8-43D8-AD2F-708826F9A9D3}" = dir=in | app=c:\program files\rosettastoneltdservices\support\bin\win\rosettastoneltdcontroller.exe |
"{80CA3035-12C7-435E-BFE1-AAC6B68DD798}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{816F4054-B35F-4915-99C9-092017F7E6A7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{896B220A-D8B5-4916-993C-6E1E9BF12A37}" = protocol=6 | dir=in | app=c:\program files\curse\curseclient.exe |
"{90AA39F5-19DA-4F86-8FE4-B8314D3CB01A}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{90F2ECF6-BF14-4678-A682-4D384DD209A5}" = dir=in | app=c:\program files\rosettastoneltdservices\support\bin\win\rosettastoneltdservices.exe |
"{91FF242B-1895-4407-8FB8-618578BD5D8E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{95864933-472B-4FCE-9329-1A5D9990A713}" = protocol=6 | dir=out | app=system |
"{962E4648-D23F-4656-A639-784A6F74A340}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{9E1380C1-CB99-459D-A0BA-5E008F4B41D1}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{9F2FE184-35DE-4A2E-9D83-BD3B90E8963A}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{A6E60115-723C-41E8-87F1-D33A7773370A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A755DD49-5396-429F-96B4-4C8CDA06813A}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{B20A1ED2-4783-42C2-BCE2-50B0F0117349}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B90F48D4-0884-40DC-95E4-DBB585B56C9B}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{BCC386C8-1DA4-41FC-B0D3-F647278375A7}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{BD4A7336-7BF8-42B0-B449-FB635BC70AD2}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{C5D943EE-2E07-464A-939B-0A5367536A6C}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-enus-downloader.exe |
"{CA8B01D0-E1CA-4073-A636-D3BAE391E152}" = protocol=6 | dir=out | app=c:\program files\rosettastoneltdservices\support\bin\win\rosettastoneltdservices.exe |
"{D0844D55-9BD6-49FE-B365-3259D752E134}" = protocol=6 | dir=out | app=c:\program files\rosettastoneltdservices\support\bin\win\rosettastoneltdserver.exe |
"{D1D01378-888E-4817-A932-FA854234025E}" = protocol=58 | dir=in | [email protected],-28545 |
"{D2FFCBEA-FBC3-43FE-9022-69964F1B04AB}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D54053A6-7238-4BF8-8774-5D6EB7AABEB0}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{EA7432F7-02F0-41BC-8A04-4320EF07D4CD}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{F52D909C-AADD-414F-9126-080AB02E8633}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\civilization iv colonization\colonization.exe |
"{FE428FE2-58DA-4CE7-80B8-3B4A98FE8658}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{FFD8DB25-1B69-4B83-A4C2-CA62377EEA8E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{078CDE74-2918-469F-89C1-B8BC800787C5}C:\program files\microsoft games\age of mythology\aomx.exe" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of mythology\aomx.exe |
"TCP Query User{33727499-47BA-4A14-976A-9F57CD232B52}C:\users\guest\appdata\local\temp\blizzard launcher temporary - a579d090\launcher.exe" = protocol=6 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - a579d090\launcher.exe |
"TCP Query User{421C96FC-6E7F-4E71-9601-2F1C9E442CA5}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 93d91f90\launcher.exe" = protocol=6 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 93d91f90\launcher.exe |
"TCP Query User{9193AD16-CCF4-4C37-B319-8B2E47DF9FD8}C:\program files\curse\curseclient.exe" = protocol=6 | dir=in | app=c:\program files\curse\curseclient.exe |
"TCP Query User{9B370C20-64A9-46FB-B4A6-A399BBB47959}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 9296cfd8\launcher.exe" = protocol=6 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 9296cfd8\launcher.exe |
"TCP Query User{A5179056-35D6-4A43-A372-4DB7C82FCC6C}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 6b0967b0\launcher.exe" = protocol=6 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 6b0967b0\launcher.exe |
"TCP Query User{C63D725C-8EE8-4B1A-B7EA-B73759A24816}C:\program files\microsoft games\age of mythology\aom.exe" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of mythology\aom.exe |
"TCP Query User{C9C41C89-FA0F-4B53-8766-0A594101ED85}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 6cb775d8\launcher.exe" = protocol=6 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 6cb775d8\launcher.exe |
"TCP Query User{DAD6C24F-B6B8-4F63-918A-B0BF47380ED6}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe |
"TCP Query User{DE97D5E9-F2EC-4C7C-A310-167792958A31}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 6b56ebd8\launcher.exe" = protocol=6 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 6b56ebd8\launcher.exe |
"TCP Query User{F14197AA-21FD-4980-AE23-3DA01CBD1153}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{F5604092-5BE1-4893-8E38-929225002943}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{20622C79-4315-4DF8-81AC-628FAC20619B}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe |
"UDP Query User{337038B6-BD2C-42FD-8D75-5C92CA72EE10}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 93d91f90\launcher.exe" = protocol=17 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 93d91f90\launcher.exe |
"UDP Query User{38B97FD0-12D2-4BBC-8872-EF00193E7366}C:\program files\microsoft games\age of mythology\aom.exe" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of mythology\aom.exe |
"UDP Query User{3AAAC8A7-2250-423A-9CAC-332C8A995C4E}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 9296cfd8\launcher.exe" = protocol=17 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 9296cfd8\launcher.exe |
"UDP Query User{49475216-3275-4530-B4EC-7475EA84E88D}C:\program files\curse\curseclient.exe" = protocol=17 | dir=in | app=c:\program files\curse\curseclient.exe |
"UDP Query User{818B976C-E0CB-4C31-8252-96F99936D8E4}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 6cb775d8\launcher.exe" = protocol=17 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 6cb775d8\launcher.exe |
"UDP Query User{A0D57C1C-7FC7-4E52-A60C-05863BF3B764}C:\program files\microsoft games\age of mythology\aomx.exe" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of mythology\aomx.exe |
"UDP Query User{BE6EA541-3D9D-4A11-94C5-0CDA3F351662}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{DE86F8BF-AD83-429D-9CB1-1365C0CD0221}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 6b0967b0\launcher.exe" = protocol=17 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 6b0967b0\launcher.exe |
"UDP Query User{E4C7110B-EC90-447A-A080-D0C45668575B}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"UDP Query User{F41E4BE5-4B51-498B-A38E-58BDA3DA4677}C:\users\guest\appdata\local\temp\blizzard launcher temporary - a579d090\launcher.exe" = protocol=17 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - a579d090\launcher.exe |
"UDP Query User{FEAD1098-F218-419D-828C-1452610E3834}C:\users\guest\appdata\local\temp\blizzard launcher temporary - 6b56ebd8\launcher.exe" = protocol=17 | dir=in | app=c:\users\guest\appdata\local\temp\blizzard launcher temporary - 6b56ebd8\launcher.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}" = Sony Video Shared Library
"{02C85EC5-E864-4847-AF55-42730861004C}" = MrvlUsgTracking
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.1.0.2200
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support
"{1316AEF2-E086-46C7-B1FB-8C9A39A2ABF9}" = VAIO Media plus
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{15D5C238-4C2E-4AEA-A66D-D6989A4C586B}" = VAIO Launcher
"{1B500D37-E7CF-480B-8054-8A563594EC4E}" = VAIO OOBE and Welcome Center
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{2018C019-30D9-4240-8C01-0865C10DCF5A}" = VAIO Presentation Support
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"{2110AF8F-F6E9-4712-A185-1B839C60822E}" = Rosetta Stone Ltd Services
"{23825B69-36DF-4DAD-9CFD-118D11D80F16}" = VAIO Content Folder Setting
"{24aab420-4e30-4496-9739-3e216f3de6ae}" = Python 2.6.2
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26921B2E-3E62-47F9-A514-1FC4A83BD738}" = Intel® PROSet/Wireless WiFi Software
"{2767DEDE-EA9D-4FCE-A06A-40F4DD293330}" = hppusgP1000
"{27A2ABE9-E4C4-45DD-B9A8-CEEEE380E7E1}" = VAIO Content Metadata Intelligent Analyzing Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{34B37A74-125E-4406-87BA-E4BD3D097AE5}" = VAIO Survey
"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
"{3EB90211-5E1E-42A6-9C27-E42C4771F7DC}" = MozyHome Remote Backup
"{48820099-ED7D-424B-890C-9A82EF00656D}" = VAIO Update 3
"{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}" = Click to Disc Editor
"{4EA55D20-27FB-45D7-8726-147E8A5F6C62}" = VAIO MusicBox
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{58ECE031-9AAD-4011-B34A-BC78E77527E2}" = hppMSRedist
"{596BED91-A1D8-4DF1-8CD1-1C777F7588AC}" = VAIO DVD Menu Data Basic
"{5A3F6A80-7913-475E-8B96-477A952CFA43}" = SupportSoft Assisted Service
"{5C5EE8F2-0B38-4C13-AE4E-A87A237FE718}" =
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5F5867F0-2D23-4338-A206-01A76C823924}" = VAIO Power Management
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{68A69CFF-130D-4CDE-AB0E-7374ECB144C8}" = Click to Disc
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B1F20F2-6321-4669-A58C-33DF8E7517FF}" = VAIO Entertainment Platform
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}" = VAIO Movie Story Template Data
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{757CC5BA-BF08-46A5-8D10-64C6FDF659C6}" = VAIO Content Metadata Manager Setting
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7902E313-FF0F-4493-ACB1-A8147B78DCD0}" = HPSSupply
"{7B02BF60-796D-4616-908B-B31A63CFDEFB}" = HPCarePackCore
"{7BB90344-0647-468E-925A-7F69F7983421}" = ArcSoft Magic-i Visual Effects
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ED3A392-28F1-4375-97AC-BF275B5855F9}" = OpenMG Secure Module 5.0.00
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0054-0409-0000-0000000FF1CE}" = Microsoft Office Visio MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{96D0B6C6-5A72-4B47-8583-A87E55F5FE81}" =
"{98FC7A64-774B-49B5-B046-4B4EBC053FA9}" = VAIO MusicBox Sample Music
"{9973498D-EA29-4A68-BE0B-C88D6E03E928}" = ArcSoft WebCam Companion 2
"{9B5F85CA-90D4-4AFC-BB37-32477FD0D2B9}" = SmartWi Connection Utility
"{9C71059E-6DDD-4958-9251-7A5F865B6BA0}" = VAIO Content Metadata Intelligent Analyzing Manager
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{A1D14FC8-FF6E-4700-A501-BCAFD22B7D15}" = ActiveState ActivePython 2.6.1.1
"{A33E457B-5369-481F-8B53-71108AE2EB5B}" = Roxio Easy Media Creator 10 LJ
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A4399CF4-7A3F-4E84-B763-AD352640203D}" = VAIO Content Metadata XML Interface Library
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A63E7492-A0BC-4BB9-89A7-352965222380}" = VAIO Original Function Setting
"{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}" = Setting Utility Series
"{A82D052A-0806-42DF-80CD-1730A1AC0ED3}" = MrvlUsgTracking
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC194855-F7AC-4D04-B4C9-07BA46FCB697}" = ActivClient CAC 6.1 x86
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.3
"{AFD9E698-03C2-4E88-80A6-1496562D4304}" = Google SketchUp 7.1
"{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}" = VAIO Movie Story
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{BCED773C-99EE-48DD-8915-25733F69F0A8}" = VAIO Wireless Wizard
"{C7477742-DDB4-43E5-AC8D-0259E1E661B1}" = VAIO Event Service
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC56A2CB-EC09-4175-B8BD-93E2440D410B}" = VAIO Content Metadata Manager Setting
"{D06F5884-B439-440B-A58D-6C057C2FF8EB}" = Click to Disc
"{D0AE373E-C276-432B-9A95-F8DD356A8242}" = VAIO Movie Story
"{D47FE987-EA3D-424B-9886-B752501D7CE7}" = VAIO Help and Support
"{D90507A2-6183-497D-9075-951DC80362DA}" = VAIO Media plus
"{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}" = iTunes
"{DEBA60A3-7CDE-48D7-993D-7C68663AEE68}" = VAIO Content Metadata Intelligent Analyzing Manager
"{DFD0E9A9-F24A-492B-8975-8C938E32408F}" = VAIO Startup Assistant
"{E1D25278-B51A-4163-BC3D-20A4D2D09F98}" = VAIO My Memory Center
"{ECA31632-C2AD-4774-A3CA-2813D47E4DD0}" = HPCarePackProducts
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F485E43D-18B1-4B40-AF4B-EDA78E91DA80}" = Dolby Control Center
"{F570A6CC-53ED-4AA9-8B08-551CD3E38D8B}" =
"{FACD3674-FC12-4B6C-A923-E1D687704E9B}" = VAIO Content Metadata XML Interface Library
"{FE51662F-D8F6-43B5-99D9-D4894AF00F83}" = Roxio Easy Media Creator Home
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Age of Mythology 1.0" = Age of Mythology
"Age of Mythology Expansion Pack 1.0" = Age of Mythology - The Titans Expansion
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.3
"Aspell English Dictionary_is1" = Aspell English Dictionary-0.50-2
"Bookworm Adventures Vol. 2" = Bookworm Adventures Vol. 2
"Close Combat 3.00" = Microsoft Close Combat III
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"ColorPic" = ColorPic
"Convert Image To PDF_is1" = Convert Image To PDF
"CurseClient" = Curse Client
"CutePDF Writer Installation" = CutePDF Writer 2.8
"ENTERPRISER" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"FileZilla Client" = FileZilla Client 3.1.1.1
"Flickr Uploadr" = Flickr Uploadr 3.0.5
"GNU Aspell_is1" = GNU Aspell 0.50-3
"GTK 2.0" = GTK+ Runtime 2.14.7 rev a (remove only)
"HDMI" = Intel® Graphics Media Accelerator Driver
"HP LaserJet P1000 series" = HP LaserJet P1000 series
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"InstallShield_{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}" = Click to Disc Editor
"InstallShield_{8ED3A392-28F1-4375-97AC-BF275B5855F9}" = OpenMG Secure Module 5.0.00
"Maltego v2.0.2CE" = Maltego v2.0.2CE
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"MUSHclient" = MUSHclient (remove only)
"Pidgin" = Pidgin
"ProInst" = Intel PROSet Wireless
"RapidSVN-0.12.0_is1" = RapidSVN-0.12.0
"RealVNC_is1" = VNC Free Edition 4.1.3
"Steam App 16810" = Sid Meier's Civilization IV: Colonization
"Steam App 400" = Portal
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Vim 7.2" = Vim 7.2 (self-installing)
"VISPROR" = Microsoft Office Visio Professional 2007
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"World of Warcraft" = World of Warcraft
"wxWidgets_is1" = wxWidgets 2.8.10
"XviD_is1" = XviD 1.1 final uninstall
"Yahoo! Messenger" = Yahoo! Messenger
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 9/22/2009 9:28:20 PM | Computer Name = Dan-PC | Source = Application Hang | ID = 1002
Description = The program iTunes.exe version 8.1.0.52 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 1160 Start Time: 01ca3a5e06489f80 Termination Time: 37
Error - 10/3/2009 12:40:12 PM | Computer Name = Dan-PC | Source = VzCdbSvc | ID = 7
Description = Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error
code = 0x80042019)
Error - 10/3/2009 12:40:19 PM | Computer Name = Dan-PC | Source = WinMgmt | ID = 10
Description =
Error - 10/5/2009 10:06:10 PM | Computer Name = Dan-PC | Source = Application Error | ID = 1000
Description = Faulting application pidgin.exe, version 2.5.7.0, time stamp 0x4a3d9caf,
faulting module pidgin.dll, version 2.5.7.0, time stamp 0x4a3d9cae, exception code
0xc0000005, fault offset 0x0002e3c8, process id 0x1134, application start time 0x01ca46298506a890.
Error - 10/18/2009 10:03:14 PM | Computer Name = Dan-PC | Source = Application Error | ID = 1000
Description = Faulting application Colonization.exe, version 1.0.0.1, time stamp
0x49a88196, faulting module kernel32.dll, version 6.0.6001.18000, time stamp 0x4791a76d,
exception code 0xc06d007f, fault offset 0x000442eb, process id 0x1c5c, application
start time 0x01ca505faf1aba00.
Error - 10/20/2009 8:43:38 PM | Computer Name = Dan-PC | Source = Application Hang | ID = 1002
Description = The program AcroRd32.exe version 8.1.0.137 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 17dc Start Time: 01ca51e74a002860 Termination Time: 0
Error - 10/20/2009 8:54:19 PM | Computer Name = Dan-PC | Source = WinMgmt | ID = 10
Description =
Error - 10/20/2009 8:54:21 PM | Computer Name = Dan-PC | Source = VzCdbSvc | ID = 7
Description = Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error
code = 0x80042019)
Error - 10/20/2009 9:37:55 PM | Computer Name = Dan-PC | Source = EventSystem | ID = 4609
Description =
Error - 10/20/2009 9:38:44 PM | Computer Name = Dan-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 8/17/2009 1:18:12 AM | Computer Name = Dan-PC | Source = HTTP | ID = 15016
Description =
Error - 8/17/2009 1:18:22 AM | Computer Name = Dan-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 8/20/2009 2:39:02 AM | Computer Name = Dan-PC | Source = SCardSvr | ID = 610
Description =
Error - 8/20/2009 1:59:02 PM | Computer Name = Dan-PC | Source = PlugPlayManager | ID = 12
Description = The device 'USB Mass Storage Device' (USB\VID_054C&PID_0377\F76000021865)
disappeared from the system without first being prepared for removal.
Error - 8/20/2009 1:59:02 PM | Computer Name = Dan-PC | Source = PlugPlayManager | ID = 12
Description = The device 'Optiarc DVD RW AD-7560A USB Device' (USBSTOR\CdRom&Ven_Optiarc&Prod_DVD_RW_AD-7560A&Rev_DS03\F76000021865&0)
disappeared from the system without first being prepared for removal.
Error - 8/20/2009 4:42:19 PM | Computer Name = Dan-PC | Source = SCardSvr | ID = 610
Description =
Error - 8/22/2009 10:05:20 PM | Computer Name = Dan-PC | Source = SCardSvr | ID = 610
Description =
Error - 8/23/2009 3:16:25 AM | Computer Name = Dan-PC | Source = SCardSvr | ID = 610
Description =
Error - 8/23/2009 3:16:25 AM | Computer Name = Dan-PC | Source = SCardSvr | ID = 610
Description =
Error - 8/26/2009 8:21:40 PM | Computer Name = Dan-PC | Source = HTTP | ID = 15016
Description =
< End of report >
OTL.txt
OTL logfile created on: 1/14/2010 12:43:58 PM - Run 1
OTL by OldTimer - Version 3.1.24.0 Folder = C:\Users\Dan\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 61.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 224.68 Gb Total Space | 130.08 Gb Free Space | 57.89% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 488.16 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: DAN-PC
Current User Name: Dan
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Processes (SafeList) ==========
PRC - [2010/01/14 12:43:12 | 00,544,256 | ---- | M] (OldTimer Tools) -- C:\Users\Dan\Downloads\OTL.exe
PRC - [2009/09/22 11:50:36 | 00,073,728 | ---- | M] (Software 2000 Limited) -- C:\Windows\System32\spool\drivers\w32x86\3\HP1006MC.EXE
PRC - [2009/09/21 16:36:12 | 00,305,440 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/09/21 16:36:02 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/08/28 19:48:20 | 00,518,120 | ---- | M] () -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\SyncServer.exe
PRC - [2009/08/28 19:48:08 | 00,015,376 | ---- | M] () -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
PRC - [2009/08/28 19:42:54 | 00,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/10/28 23:29:41 | 02,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/10/06 10:45:34 | 00,087,344 | ---- | M] () -- C:\Program Files\MozyHome\mozybackup.exe
PRC - [2008/09/16 11:02:42 | 00,352,312 | ---- | M] (Rosetta Stone Ltd.) -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdController.exe
PRC - [2008/09/16 11:02:42 | 00,013,368 | ---- | M] (Rosetta Stone Ltd.) -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdServer.exe
PRC - [2008/06/23 12:22:58 | 00,040,960 | ---- | M] () -- C:\Program Files\Sony Corporation\SmartWi Connection Utility\PowerManager.exe
PRC - [2008/06/23 12:22:58 | 00,028,672 | ---- | M] () -- C:\Program Files\Sony Corporation\SmartWi Connection Utility\ThirdPartyAppMgr.exe
PRC - [2008/06/12 01:23:02 | 00,256,536 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxsrvc.exe
PRC - [2008/06/12 01:22:44 | 00,174,616 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxext.exe
PRC - [2008/06/12 01:22:44 | 00,141,848 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxpers.exe
PRC - [2008/06/12 01:22:23 | 00,170,520 | ---- | M] (Intel Corporation) -- C:\Windows\System32\hkcmd.exe
PRC - [2008/06/02 12:37:52 | 00,028,672 | ---- | M] () -- C:\Program Files\Sony Corporation\SmartWi Connection Utility\CCP.exe
PRC - [2008/06/02 12:37:50 | 00,065,536 | ---- | M] (Sony Electronics, Inc.) -- C:\Program Files\Sony Corporation\SmartWi Connection Utility\UIManager.exe
PRC - [2008/05/27 17:57:02 | 01,771,360 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
PRC - [2008/05/27 17:57:02 | 00,411,488 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Power Management\SPMService.exe
PRC - [2008/05/15 17:20:06 | 00,182,112 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
PRC - [2008/05/15 17:20:06 | 00,100,472 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2008/04/30 19:41:12 | 00,815,104 | ---- | M] (Intel® Corporation) -- C:\Program Files\intel\WiFi\bin\EvtEng.exe
PRC - [2008/04/30 19:10:10 | 00,466,944 | ---- | M] (Intel® Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
PRC - [2008/04/28 21:48:08 | 00,098,304 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RTKAUDIOSERVICE.EXE
PRC - [2008/04/03 20:03:38 | 00,317,280 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\ISB Utility\ISBMgr.exe
PRC - [2008/04/02 11:07:56 | 00,147,456 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
PRC - [2008/04/02 11:07:54 | 00,184,320 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
PRC - [2008/04/02 11:07:38 | 00,279,848 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
PRC - [2008/01/24 19:14:25 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\XAudio.exe
PRC - [2008/01/20 19:25:33 | 00,202,240 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe
PRC - [2008/01/20 19:24:59 | 00,142,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WUDFHost.exe
PRC - [2008/01/20 19:23:32 | 01,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007/11/09 17:34:28 | 00,104,960 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe
PRC - [2007/08/24 06:00:48 | 00,033,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2007/06/05 13:20:32 | 00,177,704 | ---- | M] () -- C:\Windows\System32\PSIService.exe
PRC - [2007/05/15 16:08:40 | 00,182,576 | ---- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\accoca.exe
PRC - [2007/05/15 16:08:38 | 00,095,024 | ---- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\acevents.exe
PRC - [2007/05/15 16:08:08 | 00,293,168 | ---- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
PRC - [2007/05/15 16:08:00 | 00,130,864 | ---- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\acsagent.exe
PRC - [2007/01/04 19:48:52 | 00,112,152 | R--- | M] (InterVideo) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
========== Modules (SafeList) ==========
MOD - [2010/01/14 12:43:12 | 00,544,256 | ---- | M] (OldTimer Tools) -- C:\Users\Dan\Downloads\OTL.exe
MOD - [2008/01/20 19:23:44 | 01,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
========== Win32 Services (SafeList) ==========
SRV - [2009/09/21 16:36:02 | 00,545,568 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/08/28 19:42:54 | 00,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/07/14 12:11:26 | 00,316,664 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/10/06 10:45:34 | 00,087,344 | ---- | M] () [Auto | Running] -- C:\Program Files\MozyHome\mozybackup.exe -- (mozybackup)
SRV - [2008/09/16 11:02:42 | 00,352,312 | ---- | M] (Rosetta Stone Ltd.) [Auto | Running] -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdController.exe -- (RosettaStoneLtdController)
SRV - [2008/05/27 17:57:02 | 00,411,488 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management)
SRV - [2008/05/15 17:20:06 | 00,182,112 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)
SRV - [2008/04/30 19:41:12 | 00,815,104 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008/04/30 19:10:10 | 00,466,944 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008/04/28 21:48:08 | 00,098,304 | ---- | M] (Realtek Semiconductor) [Auto | Running] -- C:\Windows\RTKAUDIOSERVICE.EXE -- (RtkHDMIService)
SRV - [2008/04/02 11:07:58 | 00,073,728 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe -- (VAIO Entertainment TV Device Arbitration Service)
SRV - [2008/04/02 11:07:56 | 00,147,456 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe -- (VzFw)
SRV - [2008/04/02 11:07:54 | 00,184,320 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe -- (VzCdbSvc)
SRV - [2008/04/02 11:07:38 | 00,279,848 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -- (Vcsw)
SRV - [2008/03/04 20:58:30 | 00,063,328 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media plus\SOHDs.exe -- (SOHDs)
SRV - [2008/03/04 20:56:42 | 00,350,048 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media plus\SOHDms.exe -- (SOHDms)
SRV - [2008/03/04 20:54:50 | 00,104,288 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe -- (SOHCImp)
SRV - [2008/03/03 14:45:48 | 00,333,088 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe -- (VcmIAlzMgr)
SRV - [2008/03/03 13:27:14 | 00,087,328 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe -- (VcmXmlIfHelper)
SRV - [2008/01/24 19:14:25 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\drivers\XAudio.exe -- (XAudioService)
SRV - [2008/01/20 19:23:32 | 00,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/28 02:08:02 | 00,077,824 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)
SRV - [2007/11/28 02:02:20 | 00,053,248 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV)
SRV - [2007/11/28 01:43:44 | 00,053,248 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR)
SRV - [2007/11/09 17:34:28 | 00,104,960 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Program Files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe -- (uCamMonitor)
SRV - [2007/08/24 05:59:20 | 00,068,464 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2007/08/24 00:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2007/06/05 13:20:32 | 00,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)
SRV - [2007/05/15 16:08:40 | 00,182,576 | ---- | M] (ActivIdentity) [Auto | Running] -- C:\Program Files\ActivIdentity\ActivClient\accoca.exe -- (accoca)
SRV - [2007/01/04 19:48:52 | 00,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2006/11/02 05:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\ehome\ehstart.dll -- (ehstart)
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:2.1
FF - prefs.js..extensions.enabledItems: [email protected]:1.4.5
FF - prefs.js..extensions.enabledItems: {89736E8E-4B14-4042-8C75-AD00B6BD3900}:1.0.5
FF - prefs.js..extensions.enabledItems: {F6CF31A0-AE3D-4990-94B3-ED759D7FCCA7}:1.9.1
FF - prefs.js..extensions.enabledItems: [email protected]:1.4
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 11:30:31 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/07 11:30:31 | 00,000,000 | ---D | M]
[2010/01/03 10:12:10 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Mozilla\Extensions
[2010/01/03 10:12:10 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Mozilla\Extensions\[email protected]
[2010/01/14 01:34:28 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\8g2o5puw.default\extensions
[2009/11/22 12:22:54 | 00,000,000 | ---D | M] (No name found) -- C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\8g2o5puw.default\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
[2009/12/24 23:35:36 | 00,000,000 | ---D | M] (Easy Youtube Video Downloader) -- C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\8g2o5puw.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
[2009/03/03 09:17:32 | 00,000,000 | ---D | M] (DoD Configuration) -- C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\8g2o5puw.default\extensions\{d15c1608-ba3e-4aa0-aa6f-aa9337226087}
[2009/12/24 23:35:41 | 00,000,000 | ---D | M] (Torbutton) -- C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\8g2o5puw.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2009/11/07 15:02:19 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\8g2o5puw.default\extensions\[email protected]
[2010/01/12 14:21:28 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\8g2o5puw.default\extensions\[email protected]
[2009/10/20 18:40:03 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/02/21 07:24:52 | 00,660,872 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\npOGAPlugin.dll
O1 HOSTS File: (811 bytes) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: ::1 localhost
O1 - Hosts: 209.90.101.4 yellowstoneimax.com
O1 - Hosts: 209.90.101.4 www.yellowstoneimax.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [accrdsub] C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe (ActivIdentity)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SmartWiHelper] C:\Program Files\Sony Corporation\SmartWi Connection Utility\SmartWiHelper.exe (Sony Electronics Corporation)
O4 - HKLM..\Run: [VAIOMyMemCenter] C:\Program Files\Sony\VAIO My Memory Center\VAIO MyMemCenter.exe ()
O4 - HKLM..\Run: [VWLASU] C:\Program Files\Sony\VAIO Wireless Wizard\AutoLaunchWLASU.exe (Sony Electronics, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [googletalk] C:\Users\Dan\AppData\Roaming\Google\Google Talk\googletalk.exe (Google)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Dan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: army.mil ([akocac.us] https in Trusted sites)
O15 - HKCU\..Trusted Domains: army.mil ([www.us] https in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.85.102 68.87.69.150
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - VESWinlogon.dll - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2002/10/07 17:07:28 | 00,000,112 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{1b91e892-7300-11dd-83a4-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{1b91e892-7300-11dd-83a4-806e6f6e6963}\Shell\AutoRun\command - "" = F:\SETUP.EXE -- [2002/10/07 17:35:23 | 01,020,000 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{1b91e892-7300-11dd-83a4-806e6f6e6963}\Shell\setup\command - "" = F:\SETUP.EXE -- [2002/10/07 17:35:23 | 01,020,000 | R--- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2008/01/20 19:34:27 | 00,000,000 | ---D | M]
NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
OTL cannot create restorepoints on Vista OSs!
========== Files/Folders - Created Within 14 Days ==========
[2010/01/14 12:05:43 | 00,000,000 | ---D | C] -- C:\Users\Dan\AppData\Roaming\Malwarebytes
[2010/01/14 12:05:39 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/01/14 12:05:36 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/01/14 12:05:36 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/14 12:05:36 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/01/14 12:04:51 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/01/14 12:04:04 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[1 C:\Users\Dan\*.tmp files -> C:\Users\Dan\*.tmp -> ]
========== Files - Modified Within 14 Days ==========
[2010/01/14 12:44:18 | 03,407,872 | -HS- | M] () -- C:\Users\Dan\NTUSER.DAT
[2010/01/14 12:36:05 | 00,704,434 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/01/14 12:36:05 | 00,604,452 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/01/14 12:36:05 | 00,105,376 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/01/14 12:29:43 | 00,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/01/14 12:29:43 | 00,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/01/14 12:29:30 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/01/14 12:29:23 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/01/14 12:29:21 | 30,828,50304 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/14 12:28:19 | 00,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010/01/14 12:28:05 | 00,524,288 | -HS- | M] () -- C:\Users\Dan\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/01/14 12:28:05 | 00,065,536 | -HS- | M] () -- C:\Users\Dan\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/01/14 12:28:03 | 06,291,456 | -H-- | M] () -- C:\Users\Dan\AppData\Local\IconCache.db
[2010/01/14 12:04:20 | 00,000,913 | ---- | M] () -- C:\Users\Dan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/01/14 00:00:28 | 00,002,608 | ---- | M] () -- C:\Windows\mozy.blk
[2010/01/14 00:00:28 | 00,000,588 | ---- | M] () -- C:\Windows\mozy.flt
[2010/01/13 22:19:20 | 08,077,312 | ---- | M] () -- C:\Users\Dan\Desktop\Modest Mouse - Parting of the Sensory.mp3
[2010/01/12 20:46:10 | 00,009,428 | ---- | M] () -- C:\Users\Dan\Documents\Folder Tabs.xlsx
[2010/01/10 19:42:29 | 00,082,996 | ---- | M] () -- C:\Users\Dan\Desktop\Order Confirmation.pdf
[2010/01/07 16:07:14 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/01/07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/01/05 17:34:24 | 00,000,600 | ---- | M] () -- C:\Users\Dan\AppData\Local\PUTTY.RND
[2010/01/05 10:50:10 | 00,012,871 | ---- | M] () -- C:\Users\Dan\Documents\Hospital Letter.docx
[1 C:\Users\Dan\*.tmp files -> C:\Users\Dan\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/01/14 12:41:03 | 00,293,376 | ---- | C] () -- C:\Users\Dan\Desktop\gmer.exe
[2010/01/14 12:04:20 | 00,000,913 | ---- | C] () -- C:\Users\Dan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/01/13 22:08:54 | 08,077,312 | ---- | C] () -- C:\Users\Dan\Desktop\Modest Mouse - Parting of the Sensory.mp3
[2010/01/10 19:43:33 | 00,082,996 | ---- | C] () -- C:\Users\Dan\Desktop\Order Confirmation.pdf
[2009/10/20 17:47:37 | 00,000,120 | ---- | C] () -- C:\Users\Dan\AppData\Local\Nmuxuvupoqox.dat
[2009/10/20 17:47:37 | 00,000,000 | ---- | C] () -- C:\Users\Dan\AppData\Local\Qzitaror.bin
[2009/10/04 18:22:12 | 00,023,888 | ---- | C] () -- C:\Users\Dan\AppData\Roaming\UserTile.png
[2009/09/10 20:14:13 | 00,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
[2009/07/12 17:04:46 | 00,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
[2009/03/26 09:01:50 | 00,000,025 | ---- | C] () -- C:\Windows\SW_Win2000X24.DLL
[2009/03/26 09:00:42 | 00,001,470 | ---- | C] () -- C:\Windows\CITP_SearchHistory.INI
[2009/03/26 09:00:35 | 00,761,856 | ---- | C] () -- C:\Windows\System32\FreeImage3.dll
[2009/03/26 09:00:35 | 00,761,856 | ---- | C] () -- C:\Windows\System32\FreeImage.dll
[2009/03/26 09:00:35 | 00,098,304 | ---- | C] () -- C:\Windows\System32\DVM.dll
[2009/03/15 11:35:20 | 00,000,162 | ---- | C] () -- C:\Windows\ODBC.INI
[2009/02/18 14:54:22 | 00,000,000 | ---- | C] () -- C:\Users\Dan\AppData\Roaming\wklnhst.dat
[2009/01/25 16:49:11 | 00,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/12/12 14:09:18 | 00,000,262 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/12/05 13:33:28 | 00,353,792 | ---- | C] () -- C:\Windows\System32\pythoncom26.dll
[2008/12/05 13:33:28 | 00,107,520 | ---- | C] () -- C:\Windows\System32\pywintypes26.dll
[2008/10/21 13:01:07 | 00,034,308 | ---- | C] () -- C:\Windows\System32\BASSMOD.dll
[2008/09/29 05:26:27 | 00,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[2008/09/26 09:17:09 | 00,761,856 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/09/26 09:17:08 | 00,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008/09/12 06:09:51 | 00,000,600 | ---- | C] () -- C:\Users\Dan\AppData\Local\PUTTY.RND
[2008/09/12 06:06:39 | 00,000,126 | ---- | C] () -- C:\Users\Dan\AppData\Roaming\.slime-history.eld
[2008/09/03 06:51:43 | 00,053,248 | ---- | C] () -- C:\Users\Dan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/09/02 22:42:39 | 00,000,680 | ---- | C] () -- C:\Users\Dan\AppData\Local\d3d9caps.dat
[2008/06/18 13:19:13 | 00,000,000 | ---- | C] () -- C:\Windows\VAIOUpdt.INI
[2008/06/18 10:48:50 | 00,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008/06/18 10:48:30 | 00,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2008/06/18 10:48:29 | 00,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1493.dll
[2008/02/07 10:05:18 | 00,163,840 | ---- | C] () -- C:\Windows\System32\hppatusg01.dll
[2007/10/30 10:44:52 | 00,393,216 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2007/05/31 07:13:14 | 00,065,536 | ---- | C] () -- C:\Windows\System32\HPPLVS.dll
[2006/11/02 05:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:33:01 | 00,704,434 | ---- | C] () -- C:\Windows\System32\PerfStringBackup_bak.INI
[2006/11/02 00:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2002/10/07 17:07:38 | 00,011,376 | R--- | C] () -- C:\Windows\System32\drivers\SECDRV.SYS
[2001/11/14 13:56:00 | 01,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
========== LOP Check ==========
[2009/07/10 15:32:21 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\.maltego
[2010/01/14 11:57:54 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\.purple
[2009/01/10 17:45:20 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Amazon
[2008/09/08 11:42:06 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\EVEMon
[2010/01/07 08:57:23 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\FileZilla
[2008/09/05 16:11:27 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Flickr
[2009/10/31 17:10:30 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\gtk-2.0
[2008/10/05 18:49:11 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Mount&Blade
[2009/10/04 18:22:11 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\PeerNetworking
[2009/04/02 12:50:23 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Subversion
[2009/02/18 14:54:23 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Template
[2008/11/20 08:34:02 | 00,000,000 | ---D | M] -- C:\Users\Dan\AppData\Roaming\Three Rings Design
[2010/01/14 12:28:23 | 00,032,566 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
[2009/11/17 12:03:49 | 01,268,347 | ---- | M] ( ) -- C:\ipcollect.exe
< MD5 for: AGP440.SYS >
[2008/01/20 19:23:01 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008/01/20 19:23:01 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/20 19:23:01 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006/11/02 02:49:52 | 00,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
< MD5 for: ATAPI.SYS >
[2008/01/20 19:23:00 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008/01/20 19:23:00 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/20 19:23:00 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 02:49:36 | 00,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
< MD5 for: CNGAUDIT.DLL >
[2006/11/02 02:46:03 | 00,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006/11/02 02:46:03 | 00,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
< MD5 for: IASTOR.SYS >
[2008/04/21 17:20:41 | 00,312,344 | R--- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\DRIVERS\INF\SATA Driver (Intel) (Non-RAID) 8.0A - 8.0.0.1039\IaStor.sys
[2008/04/21 17:20:41 | 00,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\drivers\iaStor.sys
[2008/04/21 17:20:41 | 00,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_77c04a30\iaStor.sys
[2008/04/21 17:20:41 | 00,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_054cd65f\iaStor.sys
< MD5 for: IASTORV.SYS >
[2008/01/20 19:23:23 | 00,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008/01/20 19:23:23 | 00,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/20 19:23:23 | 00,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 02:51:25 | 00,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
< MD5 for: NETLOGON.DLL >
[2008/01/20 19:24:05 | 00,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008/01/20 19:24:05 | 00,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
< MD5 for: NVSTOR.SYS >
[2006/11/02 02:50:13 | 00,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/20 19:23:21 | 00,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008/01/20 19:23:21 | 00,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/20 19:23:21 | 00,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
< MD5 for: SCECLI.DLL >
[2008/01/20 19:24:50 | 00,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008/01/20 19:24:50 | 00,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
[2008/01/20 19:24:42 | 00,242,744 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2008/01/20 19:24:38 | 00,225,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
< %systemroot%\Tasks\*.job /lockedfiles >
< End of report >
Hopefully I didn't miss any. For antivirus I'm running Windows Defender - is this adequate?
Edited by dcrookston, 14 January 2010 - 02:20 PM.
Sign In
Create Account
