11 replies to this topic

[ProblemsRBad]

my win 7 laptop is infected with win 7 antivirus 2012 roge ware it wont let anything run, I cant get malware to scan, i cant get gmer to scan and i cant get aswmbr to scan, only dds.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by Dan-LT at 10:38:24 on 2011-12-26
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3838.2410 [GMT -5:00]
.
AV: Panda Cloud Antivirus *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59}
SP: Panda Cloud Antivirus *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
C:\Users\Dan-LT\AppData\Local\csd.exe
c:\program files (x86)\real\realplayer\RealPlay.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\ping.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\taskeng.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page =
uStart Page = hxxp://www.google.com/
uSearch Bar =
mStart Page = hxxp://search.ChatVibes.com/
uInternet Settings,ProxyOverride = *.local
mSearchAssistant =
mWinlogon: Userinit=c:\windows\syswow64\userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: RoboForm BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
uRun: [Xvid] C:\Program Files (x86)\Xvid\CheckUpdate.exe
uRun: [DW6]
mRun: [PSUNMain] "C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
uPolicies-explorer: HideSCAHealth = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Dan-LT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
LSP: C:\Windows\system32\VilonguLSP.dll
LSP: mswsock.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: {1D082E71-DF20-4AAF-863B-596428C49874} - hxxp://www.worldwinner.com/games/v50/tpir/tpir.cab
DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3_instmodule.exe
DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} - hxxp://www.worldwinner.com/games/v48/brickout/brickout.cab
DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} - hxxp://www.worldwinner.com/games/v50/pool/pool.cab
DPF: {4AB16005-E995-4A60-89DE-8B8A3E6EB5B0} - hxxp://www.worldwinner.com/games/v56/trivialpursuit/trivialpursuit.cab
DPF: {61900274-3323-4446-BDCD-91548D32AF1B} - hxxp://www.worldwinner.com/games/v56/spidersolitaire/spidersolitaire.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} - hxxp://www.worldwinner.com/games/launcher/ie/v2.22.01.0/iewwload.cab
DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} - hxxp://www.worldwinner.com/games/v57/wof/wof.cab
DPF: {BB637307-92FA-47EC-B3F7-6969078673CC} - hxxp://www.worldwinner.com/games/v45/royal/royal.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://zone.msn.com/bingame/popcaploader_v10.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} - hxxp://www.worldwinner.com/games/v54/wwspades/wwspades.cab
DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} - hxxp://www.worldwinner.com/games/v53/h2hpool/h2hpool.cab
TCP: DhcpNameServer = 10.128.128.128
TCP: Interfaces\{03C2D23D-F1AB-4F69-B36B-0B2AF16868D5} : DhcpNameServer = 10.128.128.128
TCP: Interfaces\{03C2D23D-F1AB-4F69-B36B-0B2AF16868D5}\4444D2752747F56525 : DhcpNameServer = 192.168.69.1
TCP: Interfaces\{03C2D23D-F1AB-4F69-B36B-0B2AF16868D5}\458656025437375687021647028416D60747F6E6 : DhcpNameServer = 10.128.128.128
TCP: Interfaces\{03C2D23D-F1AB-4F69-B36B-0B2AF16868D5}\4646D2772747 : DhcpNameServer = 192.168.69.1
TCP: Interfaces\{03C2D23D-F1AB-4F69-B36B-0B2AF16868D5}\4646D2772747D2651405 : DhcpNameServer = 192.168.69.1
TCP: Interfaces\{03C2D23D-F1AB-4F69-B36B-0B2AF16868D5}\4646D2772747F56727 : DhcpNameServer = 192.168.69.1
TCP: Interfaces\{03C2D23D-F1AB-4F69-B36B-0B2AF16868D5}\C696E6B6379737 : DhcpNameServer = 75.75.76.76 75.75.75.75
TCP: Interfaces\{D4EC1F3B-3B3A-492A-8645-D97EBE93B95A} : DhcpNameServer = 192.168.69.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO-X64: Increase performance and video formats for your HTML5 <video> - No File
BHO-X64: DivX HiQ: {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO-X64: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - No File
C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
BHO-X64: RoboForm BHO - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun-x64: [PSUNMain] "C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRun-x64: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
IE-X64: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE-X64: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE-X64: {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE-X64: {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Dan-LT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Dan-LT\AppData\Roaming\Mozilla\Firefox\Profiles\ilvr329v.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://search.ChatVibes.com/?q=
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\Users\Dan-LT\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: C:\Users\Dan-LT\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Users\Dan-LT\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
FF - plugin: C:\Users\Dan-LT\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: C:\Windows\system32\TVUAx\npTVUAx.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys --> C:\Windows\system32\DRIVERS\Lbd.sys [?]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]
R1 PSINKNC;PSINKNC;C:\Windows\system32\DRIVERS\psinknc.sys --> C:\Windows\system32\DRIVERS\psinknc.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-9-18 366152]
R2 NanoServiceMain;Panda Cloud Antivirus Service;C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2011-4-28 140608]
R2 PSINAflt;PSINAflt;C:\Windows\system32\DRIVERS\PSINAflt.sys --> C:\Windows\system32\DRIVERS\PSINAflt.sys [?]
R2 PSINFile;PSINFile;C:\Windows\system32\DRIVERS\PSINFile.sys --> C:\Windows\system32\DRIVERS\PSINFile.sys [?]
R2 PSINProc;PSINProc;C:\Windows\system32\DRIVERS\PSINProc.sys --> C:\Windows\system32\DRIVERS\PSINProc.sys [?]
R2 PSINProt;PSINProt;C:\Windows\system32\DRIVERS\PSINProt.sys --> C:\Windows\system32\DRIVERS\PSINProt.sys [?]
R2 TeamViewer7;TeamViewer 7;C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]
R3 CAXHWAZL;CAXHWAZL;C:\Windows\system32\DRIVERS\CAXHWAZL.sys --> C:\Windows\system32\DRIVERS\CAXHWAZL.sys [?]
R3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);C:\Windows\system32\DRIVERS\vrtaucbl.sys --> C:\Windows\system32\DRIVERS\vrtaucbl.sys [?]
R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]
R3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\system32\drivers\LVUSBS64.sys --> C:\Windows\system32\drivers\LVUSBS64.sys [?]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\Windows\system32\DRIVERS\ManyCam_x64.sys --> C:\Windows\system32\DRIVERS\ManyCam_x64.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-2-3 136176]
S3 athrusb;Atheros Wireless LAN USB device driver;C:\Windows\system32\DRIVERS\athrxusb.sys --> C:\Windows\system32\DRIVERS\athrxusb.sys [?]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-2-3 136176]
S3 lvpepf64;Volume Adapter;C:\Windows\system32\DRIVERS\lv302a64.sys --> C:\Windows\system32\DRIVERS\lv302a64.sys [?]
S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\system32\DRIVERS\lvrs64.sys --> C:\Windows\system32\DRIVERS\lvrs64.sys [?]
S3 MotDev;Motorola Inc. USB Device;C:\Windows\system32\DRIVERS\motodrv.sys --> C:\Windows\system32\DRIVERS\motodrv.sys [?]
S3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2009-10-29 225280]
S3 SbieDrv;SbieDrv;C:\Program Files\Sandboxie\SbieDrv.sys [2011-3-24 148072]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
S4 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
S4 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
S4 ePowerSvc;Acer ePower Service;C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe [2010-1-27 844320]
S4 HsfXAudioService;HsfXAudioService;C:\Windows\system32\svchost.exe -k HsfXAudioService [2009-7-13 20992]
S4 HssWd;Hotspot Shield Monitoring Service;C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -product HSS --> C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -product HSS [?]
S4 MotoConnect Service;MotoConnect Service;C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-9-24 91392]
S4 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [2009-9-24 62720]
S4 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S4 Updater Service;Updater Service;C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe [2009-10-29 240160]
.
=============== File Associations ===============
.
.exe=Tg
.
=============== Created Last 30 ================
.
2011-12-26 05:54:05 -------- d-----we C:\Windows\system64
2011-12-26 05:53:27 299008 ----a-w- C:\Users\Dan-LT\AppData\Local\csd.exe
2011-12-26 04:54:36 -------- d-----w- C:\Users\Dan-LT\AppData\Local\Unity
2011-12-24 18:30:36 -------- d-----w- C:\Program Files (x86)\Inbox Toolbar
2011-12-24 15:59:21 -------- d-----w- C:\Users\Dan-LT\AppData\Roaming\Affilorama
2011-12-24 15:59:19 -------- d-----w- C:\Program Files (x86)\Traffic Travis v3
2011-12-24 15:58:27 -------- d-----w- C:\web traffic
2011-12-24 13:49:01 -------- d-----w- C:\Users\Dan-LT\AppData\Local\iMesh
2011-12-24 13:47:13 -------- d-----w- C:\Users\Dan-LT\AppData\Local\PackageAware
2011-12-24 03:32:23 8822856 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4FCAC9B9-7734-432E-B0F0-43FA88896ECC}\mpengine.dll
2011-12-21 16:07:52 -------- d-----w- C:\Program Files (x86)\HP
2011-12-21 16:07:23 -------- d-----w- C:\Program Files\HP
2011-12-21 16:07:08 -------- d-----w- C:\Users\Dan-LT\AppData\Local\HP
2011-12-21 00:51:39 -------- d-----w- C:\Users\Dan-LT\AppData\Local\SCE
2011-12-21 00:51:02 -------- d--h--w- C:\Windows\msdownld.tmp
2011-12-19 19:01:40 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{E3AAED47-4E0D-4C9E-AF82-482A384E5EE8}
2011-12-19 19:01:23 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{D77D0895-5FCA-4E91-A05F-0AE3294697DB}
2011-12-18 05:52:42 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{4FD04E8E-23CC-4A38-8641-28D4A556E5B8}
2011-12-18 05:52:28 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{8B994010-AF40-429E-9B5C-D309B445B986}
2011-12-17 17:02:13 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{56D915CC-BEBB-4128-A544-76A7CF4D3069}
2011-12-17 17:02:00 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{E4D1F684-B293-4B08-B628-6A08C28B6F91}
2011-12-15 05:09:40 -------- d-----w- C:\Users\Dan-LT\AppData\Roaming\IceOp
2011-12-14 20:43:10 43520 ----a-w- C:\Windows\System32\csrsrv.dll
2011-12-14 20:42:46 3145216 ----a-w- C:\Windows\System32\win32k.sys
2011-12-14 20:42:36 723456 ----a-w- C:\Windows\System32\EncDec.dll
2011-12-14 20:42:35 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
2011-12-14 20:42:12 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2011-12-14 20:42:12 2048 ----a-w- C:\Windows\System32\tzres.dll
2011-12-13 16:26:54 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{C8ACD018-6E33-4AB0-A35F-801B28CE74E6}
2011-12-13 04:26:24 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{0B910FB3-7179-49BE-9991-EB926CAA2C87}
2011-12-13 04:26:11 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{DB3370EC-5B97-4147-822D-FCA09E125C4A}
2011-12-12 15:01:23 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{5C489817-09EB-4C12-86CA-BC475168C813}
2011-12-12 15:01:11 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{276392E7-6316-4766-84CD-DBEC0B9DB53D}
2011-12-12 03:00:55 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{1AD040B0-B80C-488F-8706-EBA299433AE8}
2011-12-12 03:00:31 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{EEF04C48-03FF-4C79-ADA4-1BBD2334731D}
2011-12-11 15:00:03 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{C637A417-E7AE-4923-881B-89CC81DCEF26}
2011-12-11 01:58:48 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{F7622E2D-4521-420A-8447-9E356635C205}
2011-12-11 01:58:34 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{EF7BD4F7-2DA1-4EC1-AE24-988E09259B94}
2011-12-09 05:32:43 -------- d-----w- C:\Users\Dan-LT\.android
2011-12-09 04:33:08 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{6898A767-EFAA-4855-8455-A31AD313A31C}
2011-12-09 04:32:42 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{A2F4D418-4313-4AF2-8051-BC56C01D1EF0}
2011-12-08 16:32:12 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{80A45CC1-AAC6-4006-AD46-CA33948A9D49}
2011-12-08 16:31:57 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{2186A8FA-218D-447C-8FEA-7D5BB2223B34}
2011-12-08 04:31:30 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{EA405E3A-AEA6-40DF-B887-7DB0335A2B65}
2011-12-08 04:31:18 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{7F62A940-7D6A-419B-8384-8012946D273B}
2011-12-07 16:30:48 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{F15626C3-36D4-4B8E-8471-FE42BFCE660D}
2011-12-07 16:30:36 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{5C047B33-2FA5-414D-8B90-C74D61409411}
2011-12-06 23:08:51 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{F2558682-83B3-474F-876D-51013D29E11A}
2011-12-06 16:25:38 -------- d-----w- C:\Program Files (x86)\TeamViewer
2011-12-06 06:43:04 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{94F91635-97B4-4BCD-904A-4686067C28EA}
2011-12-06 06:42:52 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{4464184C-91BA-491B-8A5A-A770748D3337}
2011-12-05 15:22:28 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{FD8227D6-008D-4E05-A255-13333E700A1C}
2011-12-05 15:22:14 -------- d-----w- C:\Users\Dan-LT\AppData\Local\{0B3DF67C-6FD8-4358-8ACD-DA69D42495B5}
2011-12-05 01:34:52 -------- d-----w- C:\dvddrivers
2011-12-03 05:46:45 -------- d-----w- C:\My Drivers
2011-12-03 05:43:15 110592 ----a-w- C:\Windows\SysWow64\ccrpbds6.dll
2011-12-03 05:43:15 -------- d-----w- C:\Program Files (x86)\JerMar Software Corp
2011-12-03 05:23:40 456536 ----a-w- C:\Windows\SysWow64\XCEEDZIP.DLL
2011-12-03 05:23:40 1882104 ----a-w- C:\Windows\SysWow64\Codejock.Controls.v15.0.1.ocx
2011-12-03 05:23:40 152848 ----a-w- C:\Windows\SysWow64\Comdlg32.ocx
2011-12-03 05:23:40 132880 ----a-w- C:\Windows\SysWow64\Msinet.ocx
2011-12-03 05:23:40 110602 ----a-w- C:\Windows\SysWow64\xcdsfx32.bin
2011-12-03 04:59:02 -------- d-----w- C:\Users\Dan-LT\AppData\Local\Innovative Solutions
2011-12-03 04:59:02 -------- d-----w- C:\ProgramData\Innovative Solutions
2011-12-01 03:35:55 -------- d-----w- C:\Windows 98 FE
2011-11-29 22:38:45 -------- d-----w- C:\windows 98 se
2011-11-28 23:55:17 -------- d-----w- C:\Win98SEupgrade
2011-11-28 03:44:54 -------- d-----w- C:\bootdisk
.
==================== Find3M ====================
.
2011-11-16 07:56:18 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-15 03:50:14 125376 ----a-w- C:\Windows\System32\drivers\scdemu.sys
2011-11-11 14:49:07 499712 ----a-w- C:\Windows\SysWow64\msvcp71.dll
2011-11-11 14:49:07 348160 ----a-w- C:\Windows\SysWow64\msvcr71.dll
2011-11-04 01:53:39 2309120 ----a-w- C:\Windows\System32\jscript9.dll
2011-11-04 01:44:47 1390080 ----a-w- C:\Windows\System32\wininet.dll
2011-11-04 01:44:21 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl
2011-11-04 01:34:43 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2011-11-03 22:47:42 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll
2011-11-03 22:40:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2011-11-03 22:39:47 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-11-03 22:31:57 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-10-15 07:29:54 21073936 ----a-w- C:\vlc-1.1.11-win32.exe
2011-10-15 06:42:01 19416632 ----a-w- C:\wdm3516b_Cadenza.exe
2011-09-29 16:29:28 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys
.
============= FINISH: 10:41:05.55 ===============


----------------------------------------------------------------------------------------------------------------------------------

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 3/2/2010 1:12:27 PM
System Uptime: 12/26/2011 10:19:26 AM (0 hours ago)
.
Motherboard: Gateway | | SJV50TR
Processor: AMD Athlon™ II Dual-Core M300 | Socket S1G3 | 2000/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 286 GiB total, 13.346 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description:
Device ID: USB\VID_046D&PID_08B0&MI_00\6&3856684&0&0000
Manufacturer:
Name:
PNP Device ID: USB\VID_046D&PID_08B0&MI_00\6&3856684&0&0000
Service:
.
==== System Restore Points ===================
.
RP418: 12/23/2011 10:31:44 PM - Windows Update
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
ABBYY FineReader 6.0 Sprint
Acoustica Effects Pack
Acoustica Mixcraft 5
Acrobat.com
ActivePerl 5.10.1 Build 1006
Adobe AIR
Adobe Community Help
Adobe Flash Player 10 ActiveX
Adobe Photoshop CS5
Adobe Reader X (10.1.1)
Adobe Shockwave Player 11.6
AIM 7
AMD USB Filter Driver
ASCOM Platform 5.0b
Atheros Driver Installation Program
Backup Manager Basic
Cake Poker
Cake Poker 2.0
Camfrog Video Chat 6.1
CamfrogWEB Advanced ActiveX Plugin (remove only)
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
ClubWPT
Compatibility Pack for the 2007 Office system
D3DX10
DAEMON Tools Lite
Dark Age of Camelot
Darkfall US
DC Universe Online Live
Directory Submitter 1.0.29
DivX Setup
Epson Easy Photo Print 2
ESET Online Scanner v3
FLVTube Player
Foxit Reader
FrostWire 5.1.4
Full Tilt Poker
Gateway Games
Gateway MyBackup
Gateway Power Management
Gateway Recovery Management
Gateway Updater
GearBunnyX and Classic 1.102
Google Earth
Google Talk (remove only)
Google Talk Plugin
Google Update Helper
Graboid Video 2.3
Hotspot Shield 1.57
HP Deskjet 1000 J110 series Help
iCall
IceOp 6.3
iDEN Carrier RSS
Identity Card
ImgBurn
Java Auto Updater
Java™ 6 Update 26
Junk Mail filter update
Kort's Spellcraft Calculator
Launch Manager
Logitech QuickCam
Logitech Vid HD
LOKI2
Malwarebytes' Anti-Malware version 1.51.2.1300
ManyCam 2.6.65 (remove only)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office File Validation Add-In
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Works
Microsoft WorldWide Telescope
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Motorola Driver Installation
Mozilla Firefox 8.0 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
OpenOffice.org 3.3
OUGO Messenger
Panda Cloud Antivirus
PDF Settings CS5
PicPick
Port Detective
PowerISO
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek USB 2.0 Card Reader
RealUpgrade 1.1
RoboForm 7-4-2 (All Users)
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skype™ 5.5
Smilebox
Snagit 10.0.1
Software for Scanners
SpywareBlaster 4.4
Steam
swMSM
TeamViewer 7
The Weather Channel Desktop 6
Tor 0.2.2.34
Traffic Travis 3.3.0
Tube Toolbox
TVAnts 1.0
Unity Web Player
Universal Document Converter (Demo)
Unlocker 1.9.0
Update for 2007 Microsoft Office System (KB2284654)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.4053
Veo Advanced Connect
Vidalia 0.2.15
Video Web Camera
Vilongu HTTP SOCKS tunneler 1.0.0
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
Voxox 2.6.3
Vuze
webDOMinator 3.0.0
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
WinDriversBackup
Xvid Video Codec
Y!Supra version 1.0.0.67
Yahoo! Messenger
Yazak Chat 8.92.2
.
==== Event Viewer Messages From Past Week ========
.
12/26/2011 9:04:29 AM, Error: amdsata [11] - The driver detected a controller error on \Device\RaidPort0.
12/26/2011 12:56:36 AM, Error: Service Control Manager [7031] - The TeamViewer 7 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 2000 milliseconds: Restart the service.
12/26/2011 10:20:15 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
12/26/2011 10:20:07 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
12/26/2011 10:20:07 AM, Error: Service Control Manager [7003] - The Internet Connection Sharing (ICS) service depends the following service: BFE. This service might not be installed.
12/26/2011 10:20:07 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
12/26/2011 10:20:07 AM, Error: Service Control Manager [7000] - The X4HSX32 service failed to start due to the following error: The system cannot find the path specified.
12/26/2011 10:20:07 AM, Error: Service Control Manager [7000] - The Hotspot Shield Service service failed to start due to the following error: The system cannot find the file specified.
12/26/2011 10:20:05 AM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
12/26/2011 10:19:44 AM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter
12/26/2011 10:19:44 AM, Error: atikmdag [43029] - Display is not active
12/26/2011 10:19:40 AM, Error: volmgr [46] - Crash dump initialization failed!
12/25/2011 10:19:17 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
12/24/2011 12:15:58 AM, Error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 3 time(s).
12/24/2011 12:13:48 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/24/2011 12:13:10 AM, Error: Service Control Manager [7034] - The TeamViewer 7 service terminated unexpectedly. It has done this 3 time(s).
12/24/2011 12:13:03 AM, Error: Service Control Manager [7031] - The TeamViewer 7 service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 2000 milliseconds: Restart the service.
12/24/2011 12:12:28 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/24/2011 11:31:34 PM, Error: Service Control Manager [7031] - The WLAN AutoConfig service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/24/2011 11:31:34 PM, Error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/24/2011 11:31:34 PM, Error: Service Control Manager [7031] - The Windows Audio Endpoint Builder service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/24/2011 11:31:34 PM, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/24/2011 11:31:34 PM, Error: Service Control Manager [7031] - The Program Compatibility Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/24/2011 11:31:34 PM, Error: Service Control Manager [7031] - The Network Connections service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
12/24/2011 11:31:34 PM, Error: Service Control Manager [7031] - The Human Interface Device Access service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/24/2011 11:31:34 PM, Error: Service Control Manager [7031] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/24/2011 11:31:34 PM, Error: Service Control Manager [7031] - The Desktop Window Manager Session Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/21/2011 8:18:41 PM, Error: volsnap [35] - The shadow copies of volume C: were aborted because the shadow copy storage failed to grow.
.
==== End Of File ===========================

[Broni]

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
  
• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.
  
  • Close any open browsers.
    
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
• Double click on combofix.exe & follow the prompts.
  
• When finished, it will produce a report for you.
  
• Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.

**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode (How to...)

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

• Double-click on the Rkill desktop icon to run the tool.
  
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  
• If not, delete the file, then download and use the one provided in Link 2.
  
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  
• Do not reboot until instructed.
  
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
v

[ProblemsRBad]

ComboFix 11-12-25.03 - Dan-LT 12/26/2011 11:38:37.5.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3838.2633 [GMT -5:00]
Running from: c:\users\Dan-LT\Desktop\ComboFix.exe
AV: Panda Cloud Antivirus *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59}
SP: Panda Cloud Antivirus *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Dan-LT\AppData\Local\csd.exe
c:\windows\system32\consrv.dll
c:\windows\system32\drivers\tcpip.copy
c:\windows\System64
.
.
((((((((((((((((((((((((( Files Created from 2011-11-26 to 2011-12-26 )))))))))))))))))))))))))))))))
.
.
2011-12-26 16:56 . 2011-12-26 16:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-26 04:54 . 2011-12-26 04:54 -------- d-----w- c:\users\Dan-LT\AppData\Local\Unity
2011-12-24 18:30 . 2011-12-26 05:55 -------- d-----w- c:\program files (x86)\Inbox Toolbar
2011-12-24 15:59 . 2011-12-24 15:59 -------- d-----w- c:\users\Dan-LT\AppData\Roaming\Affilorama
2011-12-24 15:59 . 2011-12-24 15:59 -------- d-----w- c:\program files (x86)\Traffic Travis v3
2011-12-24 15:58 . 2011-12-24 15:58 -------- d-----w- C:\web traffic
2011-12-24 13:49 . 2011-12-24 13:49 -------- d-----w- c:\users\Dan-LT\AppData\Local\iMesh
2011-12-24 13:47 . 2011-12-24 13:47 -------- d-----w- c:\users\Dan-LT\AppData\Local\PackageAware
2011-12-21 16:08 . 2011-12-21 16:15 -------- d-----w- c:\programdata\HP
2011-12-21 16:07 . 2011-12-21 16:07 -------- d-----w- c:\program files (x86)\HP
2011-12-21 16:07 . 2011-12-21 16:07 -------- d-----w- c:\program files\HP
2011-12-21 16:07 . 2011-12-21 16:07 -------- d-----w- c:\users\Dan-LT\AppData\Local\HP
2011-12-21 00:51 . 2011-12-21 00:51 -------- d-----w- c:\users\Dan-LT\AppData\Local\SCE
2011-12-21 00:51 . 2011-12-21 00:51 -------- d--h--w- c:\windows\msdownld.tmp
2011-12-21 00:27 . 2011-12-21 00:27 -------- d-----w- c:\users\Public\Sony Online Entertainment
2011-12-15 05:09 . 2011-12-15 05:55 -------- d-----w- c:\users\Dan-LT\AppData\Roaming\IceOp
2011-12-14 20:43 . 2011-10-26 05:21 43520 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-14 20:42 . 2011-11-24 04:52 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-12-14 20:42 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
2011-12-14 20:42 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-12-14 20:42 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-14 20:42 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-12-09 05:32 . 2011-12-21 07:01 -------- d-----w- c:\users\Dan-LT\.android
2011-12-06 16:25 . 2011-12-06 16:25 -------- d-----w- c:\program files (x86)\TeamViewer
2011-12-05 01:34 . 2011-12-05 01:38 -------- d-----w- C:\dvddrivers
2011-12-03 05:46 . 2011-12-03 05:47 -------- d-----w- C:\My Drivers
2011-12-03 05:43 . 2011-12-03 05:43 -------- d-----w- c:\program files (x86)\JerMar Software Corp
2011-12-03 05:43 . 2001-11-29 14:57 110592 ----a-w- c:\windows\SysWow64\ccrpbds6.dll
2011-12-03 05:23 . 2011-02-08 19:58 1882104 ----a-w- c:\windows\SysWow64\Codejock.Controls.v15.0.1.ocx
2011-12-03 05:23 . 2005-01-12 16:19 456536 ----a-w- c:\windows\SysWow64\XCEEDZIP.DLL
2011-12-03 05:23 . 2004-08-11 20:55 110602 ----a-w- c:\windows\SysWow64\xcdsfx32.bin
2011-12-03 05:23 . 2004-03-09 05:00 152848 ----a-w- c:\windows\SysWow64\Comdlg32.ocx
2011-12-03 05:23 . 2004-03-09 05:00 132880 ----a-w- c:\windows\SysWow64\Msinet.ocx
2011-12-03 04:59 . 2011-12-03 04:59 -------- d-----w- c:\users\Dan-LT\AppData\Local\Innovative Solutions
2011-12-03 04:59 . 2011-12-03 04:59 -------- d-----w- c:\programdata\Innovative Solutions
2011-12-01 03:35 . 2011-12-01 03:39 -------- d-----w- C:\Windows 98 FE
2011-11-29 22:38 . 2011-11-29 22:42 -------- d-----w- C:\windows 98 se
2011-11-28 23:55 . 2011-11-29 13:46 -------- d-----w- C:\Win98SEupgrade
2011-11-28 03:44 . 2011-11-29 00:27 -------- d-----w- C:\bootdisk
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-21 11:40 . 2011-12-24 03:32 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4FCAC9B9-7734-432E-B0F0-43FA88896ECC}\mpengine.dll
2011-11-16 07:56 . 2011-06-13 01:01 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-15 03:50 . 2011-11-22 01:42 125376 ----a-w- c:\windows\system32\drivers\scdemu.sys
2011-11-11 14:49 . 2011-11-11 14:49 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2011-11-11 14:49 . 2011-11-11 14:49 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2011-10-15 07:29 . 2011-10-15 07:29 21073936 ----a-w- C:\vlc-1.1.11-win32.exe
2011-10-15 06:42 . 2011-10-15 06:41 19416632 ----a-w- C:\wdm3516b_Cadenza.exe
2011-09-29 16:29 . 2011-11-09 18:55 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-10-28_21.52.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-06-11 06:58 . 2011-06-11 06:58 51024 c:\windows\SysWOW64\vcomp100.dll
- 2011-10-13 00:57 . 2011-09-01 02:23 72704 c:\windows\SysWOW64\mshtmled.dll
+ 2011-12-15 07:13 . 2011-11-03 22:32 72704 c:\windows\SysWOW64\mshtmled.dll
- 2011-10-13 00:57 . 2011-09-01 02:26 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll
+ 2011-12-15 07:13 . 2011-11-03 22:37 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 81744 c:\windows\SysWOW64\mfcm100u.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 81744 c:\windows\SysWOW64\mfcm100.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 60752 c:\windows\SysWOW64\mfc100rus.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 43344 c:\windows\SysWOW64\mfc100kor.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 43856 c:\windows\SysWOW64\mfc100jpn.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 62288 c:\windows\SysWOW64\mfc100ita.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 64336 c:\windows\SysWOW64\mfc100fra.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 63824 c:\windows\SysWOW64\mfc100esn.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 55120 c:\windows\SysWOW64\mfc100enu.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 64336 c:\windows\SysWOW64\mfc100deu.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 36176 c:\windows\SysWOW64\mfc100cht.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 36176 c:\windows\SysWOW64\mfc100chs.dll
+ 2011-12-15 07:13 . 2011-11-03 22:37 65024 c:\windows\SysWOW64\jsproxy.dll
- 2011-10-13 00:57 . 2011-09-01 02:26 65024 c:\windows\SysWOW64\jsproxy.dll
+ 2011-12-26 06:08 . 2011-12-26 11:36 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat
+ 2011-12-26 06:26 . 2011-12-26 13:09 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012011122620111227\index.dat
+ 2011-12-26 06:08 . 2011-12-26 06:08 49120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
+ 2011-12-26 06:08 . 2011-12-26 16:16 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
+ 2011-07-22 21:47 . 2011-07-22 21:47 67072 c:\windows\system32\ZuneTcp2Udp.dll
- 2010-07-13 15:29 . 2010-07-13 15:29 67072 c:\windows\system32\ZuneTcp2Udp.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 60928 c:\windows\system32\ZuneRegUtil.dll
- 2010-07-13 15:29 . 2010-07-13 15:29 60928 c:\windows\system32\ZuneRegUtil.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 45568 c:\windows\system32\ZunePTDNS.dll
- 2010-07-13 15:29 . 2010-07-13 15:29 45568 c:\windows\system32\ZunePTDNS.dll
+ 2009-10-29 20:15 . 2011-12-26 15:22 86934 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-12-26 17:04 54816 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-03-02 18:17 . 2011-12-26 17:04 24640 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3767059194-2169123214-450175519-1001_UserData.bin
+ 2010-10-07 18:05 . 2010-10-07 18:05 42344 c:\windows\system32\spool\drivers\x64\3\hpvplui04.dll
+ 2011-12-15 07:13 . 2011-11-04 01:35 96256 c:\windows\system32\mshtmled.dll
- 2011-10-13 00:57 . 2011-09-01 05:12 96256 c:\windows\system32\mshtmled.dll
- 2011-10-13 00:57 . 2011-09-01 05:15 86528 c:\windows\system32\migration\WininetPlugin.dll
+ 2011-12-15 07:13 . 2011-11-04 01:41 86528 c:\windows\system32\migration\WininetPlugin.dll
- 2011-01-11 01:50 . 2011-09-28 00:46 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
+ 2011-01-11 01:50 . 2011-12-21 03:39 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
- 2011-10-13 00:57 . 2011-09-01 05:15 85504 c:\windows\system32\jsproxy.dll
+ 2011-12-15 07:13 . 2011-11-04 01:41 85504 c:\windows\system32\jsproxy.dll
- 2009-07-14 05:30 . 2011-10-24 21:27 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2009-07-14 05:30 . 2011-12-26 01:58 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2011-07-22 21:47 . 2011-07-22 21:47 67072 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\ZuneTcp2Udp.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 60928 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\ZuneRegUtil.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 45568 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\ZunePTDNS.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 42344 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\hpvplui04.dll
+ 2011-07-13 08:04 . 2011-04-28 03:54 80384 c:\windows\system32\drivers\BTHUSB.SYS
+ 2009-07-14 00:06 . 2009-07-14 00:06 41984 c:\windows\system32\drivers\bthenum.sys
- 2010-01-27 20:39 . 2011-10-20 13:10 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-01-27 20:39 . 2011-12-26 15:19 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-04-14 00:05 . 2011-12-26 15:19 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-04-14 00:05 . 2011-10-20 13:10 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-10-20 13:10 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-12-26 15:19 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:46 . 2011-12-21 16:03 96016 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2011-09-15 07:13 . 2011-09-15 07:13 34632 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2011-12-15 07:18 . 2011-12-15 07:18 34632 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
- 2011-08-09 00:13 . 2011-09-15 07:13 35088 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\oisicon.exe
+ 2011-08-09 00:13 . 2011-12-15 07:14 35088 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\oisicon.exe
+ 2011-08-09 00:13 . 2011-12-15 07:14 18704 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\mspicons.exe
- 2011-08-09 00:13 . 2011-09-15 07:13 18704 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\mspicons.exe
- 2011-08-09 00:13 . 2011-09-15 07:13 20240 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\cagicon.exe
+ 2011-08-09 00:13 . 2011-12-15 07:14 20240 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\cagicon.exe
+ 2011-12-21 16:08 . 2011-12-21 16:08 58859 c:\windows\Installer\{883B114D-BD3E-498F-9DAD-5E4A8E1C43BA}\SCLite_Icon.exe
+ 2011-12-15 05:09 . 2011-12-15 05:09 14534 c:\windows\Installer\{13D9B9B4-DEDE-4C52-A4FA-D954E9C29EF3}\SystemFolder_msiexec.exe
+ 2011-11-15 01:59 . 2011-11-15 01:59 11264 c:\windows\assembly\GAC_MSIL\cli_basetypes\1.0.18.0__ce2cb7e279207b9e\cli_basetypes.dll
+ 2011-11-15 02:00 . 2011-11-15 02:00 64000 c:\windows\assembly\GAC_32\cli_cppuhelper\1.0.21.0__ce2cb7e279207b9e\cli_cppuhelper.dll
+ 2011-11-11 14:49 . 2011-11-11 14:49 5632 c:\windows\SysWOW64\pndx5032.dll
- 2010-11-07 08:54 . 2010-11-07 08:54 5632 c:\windows\SysWOW64\pndx5032.dll
- 2010-11-07 08:54 . 2010-11-07 08:54 6656 c:\windows\SysWOW64\pndx5016.dll
+ 2011-11-11 14:49 . 2011-11-11 14:49 6656 c:\windows\SysWOW64\pndx5016.dll
+ 2011-10-24 15:36 . 2011-11-02 21:08 9560 c:\windows\system32\NetworkList\Icons\{D8CA0C88-A255-4C47-B853-D45A5DB604EB}_48.bin
- 2011-10-24 15:36 . 2011-10-24 15:36 9560 c:\windows\system32\NetworkList\Icons\{D8CA0C88-A255-4C47-B853-D45A5DB604EB}_48.bin
- 2011-10-24 15:36 . 2011-10-24 15:36 4280 c:\windows\system32\NetworkList\Icons\{D8CA0C88-A255-4C47-B853-D45A5DB604EB}_32.bin
+ 2011-10-24 15:36 . 2011-11-02 21:08 4280 c:\windows\system32\NetworkList\Icons\{D8CA0C88-A255-4C47-B853-D45A5DB604EB}_32.bin
- 2011-10-24 15:36 . 2011-10-24 15:36 2456 c:\windows\system32\NetworkList\Icons\{D8CA0C88-A255-4C47-B853-D45A5DB604EB}_24.bin
+ 2011-10-24 15:36 . 2011-11-02 21:08 2456 c:\windows\system32\NetworkList\Icons\{D8CA0C88-A255-4C47-B853-D45A5DB604EB}_24.bin
+ 2011-11-08 20:43 . 2011-11-08 20:43 9560 c:\windows\system32\NetworkList\Icons\{AC285E93-145F-47F4-A102-3B9922749308}_48.bin
+ 2011-11-08 20:43 . 2011-11-08 20:43 4280 c:\windows\system32\NetworkList\Icons\{AC285E93-145F-47F4-A102-3B9922749308}_32.bin
+ 2011-11-08 20:43 . 2011-11-08 20:43 2456 c:\windows\system32\NetworkList\Icons\{AC285E93-145F-47F4-A102-3B9922749308}_24.bin
+ 2011-11-08 16:45 . 2011-11-08 16:45 9560 c:\windows\system32\NetworkList\Icons\{9BCFF874-E837-4F78-99AA-83F02962CBF6}_48.bin
+ 2011-11-08 16:45 . 2011-11-08 16:45 4280 c:\windows\system32\NetworkList\Icons\{9BCFF874-E837-4F78-99AA-83F02962CBF6}_32.bin
+ 2011-11-08 16:45 . 2011-11-08 16:45 2456 c:\windows\system32\NetworkList\Icons\{9BCFF874-E837-4F78-99AA-83F02962CBF6}_24.bin
+ 2011-11-08 18:48 . 2011-11-08 18:48 9560 c:\windows\system32\NetworkList\Icons\{8CDCF851-6D7F-4F87-B957-B4B1241333B6}_48.bin
+ 2011-11-08 18:48 . 2011-11-08 18:48 4280 c:\windows\system32\NetworkList\Icons\{8CDCF851-6D7F-4F87-B957-B4B1241333B6}_32.bin
+ 2011-11-08 18:48 . 2011-11-08 18:48 2456 c:\windows\system32\NetworkList\Icons\{8CDCF851-6D7F-4F87-B957-B4B1241333B6}_24.bin
+ 2011-11-02 19:25 . 2011-11-02 19:25 9560 c:\windows\system32\NetworkList\Icons\{7E708A52-7F2D-4A1B-9457-01CBDA9832E0}_48.bin
+ 2011-11-02 19:25 . 2011-11-02 19:25 4280 c:\windows\system32\NetworkList\Icons\{7E708A52-7F2D-4A1B-9457-01CBDA9832E0}_32.bin
+ 2011-11-02 19:25 . 2011-11-02 19:25 2456 c:\windows\system32\NetworkList\Icons\{7E708A52-7F2D-4A1B-9457-01CBDA9832E0}_24.bin
+ 2011-10-31 03:49 . 2011-10-31 03:49 9560 c:\windows\system32\NetworkList\Icons\{47219BF4-939C-4A47-A715-E2021101B367}_48.bin
+ 2011-10-31 03:49 . 2011-10-31 03:49 4280 c:\windows\system32\NetworkList\Icons\{47219BF4-939C-4A47-A715-E2021101B367}_32.bin
+ 2011-10-31 03:49 . 2011-10-31 03:49 2456 c:\windows\system32\NetworkList\Icons\{47219BF4-939C-4A47-A715-E2021101B367}_24.bin
+ 2011-11-04 20:52 . 2011-11-04 20:52 9560 c:\windows\system32\NetworkList\Icons\{226B1665-5260-4FD1-AF9A-9F9E4F6D54AC}_48.bin
+ 2011-11-04 20:52 . 2011-11-04 20:52 4280 c:\windows\system32\NetworkList\Icons\{226B1665-5260-4FD1-AF9A-9F9E4F6D54AC}_32.bin
+ 2011-11-04 20:52 . 2011-11-04 20:52 2456 c:\windows\system32\NetworkList\Icons\{226B1665-5260-4FD1-AF9A-9F9E4F6D54AC}_24.bin
+ 2011-11-08 21:15 . 2011-11-19 01:53 9560 c:\windows\system32\NetworkList\Icons\{0CAF2CB5-2973-408B-BCA1-5D4EFE940EC5}_48.bin
+ 2011-11-08 21:15 . 2011-11-19 01:53 4280 c:\windows\system32\NetworkList\Icons\{0CAF2CB5-2973-408B-BCA1-5D4EFE940EC5}_32.bin
+ 2011-11-08 21:15 . 2011-11-19 01:53 2456 c:\windows\system32\NetworkList\Icons\{0CAF2CB5-2973-408B-BCA1-5D4EFE940EC5}_24.bin
+ 2010-03-05 02:21 . 2011-11-02 15:45 1703 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
+ 2011-12-26 16:58 . 2011-12-26 16:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-10-28 21:23 . 2011-10-28 21:23 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-12-26 16:58 . 2011-12-26 16:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-10-28 21:23 . 2011-10-28 21:23 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-11-15 01:59 . 2011-11-15 01:59 3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_uretypes\7.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_uretypes.dll
+ 2011-11-15 01:59 . 2011-11-15 01:59 3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_ure\21.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_ure.dll
+ 2011-11-15 02:00 . 2011-11-15 02:00 3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_oootypes\7.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_oootypes.dll
+ 2011-11-15 01:59 . 2011-11-15 01:59 3072 c:\windows\assembly\GAC_MSIL\policy.1.0.cli_basetypes\18.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_basetypes.dll
+ 2011-11-15 01:59 . 2011-11-15 01:59 7680 c:\windows\assembly\GAC_MSIL\cli_ure\1.0.21.0__ce2cb7e279207b9e\cli_ure.dll
+ 2011-11-15 02:00 . 2011-11-15 02:00 3072 c:\windows\assembly\GAC_32\policy.1.0.cli_cppuhelper\21.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_cppuhelper.dll
+ 2011-11-12 21:55 . 2011-05-30 13:42 240640 c:\windows\SysWOW64\xvidvfw.dll
+ 2011-11-12 21:55 . 2011-05-23 07:46 645632 c:\windows\SysWOW64\xvidcore.dll
+ 2008-05-16 18:51 . 2004-09-28 16:13 526184 c:\windows\SysWOW64\XceedCry.dll
- 2011-10-13 00:57 . 2011-09-01 02:27 231936 c:\windows\SysWOW64\url.dll
+ 2011-12-15 07:13 . 2011-11-03 22:38 231936 c:\windows\SysWOW64\url.dll
+ 2011-11-19 03:29 . 2007-05-09 06:10 237552 c:\windows\SysWOW64\tpuninst.exe
+ 2011-11-11 14:49 . 2011-11-11 14:49 198832 c:\windows\SysWOW64\rmoc3260.dll
+ 2011-11-11 14:49 . 2011-11-11 14:49 272896 c:\windows\SysWOW64\pncrt.dll
- 2010-11-07 08:54 . 2010-11-07 08:54 272896 c:\windows\SysWOW64\pncrt.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 773968 c:\windows\SysWOW64\msvcr100.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 421200 c:\windows\SysWOW64\msvcp100.dll
+ 2011-11-16 07:56 . 2011-11-16 07:56 247968 c:\windows\SysWOW64\Macromed\Flash\FlashUtil11e_Plugin.exe
+ 2011-11-08 08:10 . 2011-11-08 08:10 247968 c:\windows\SysWOW64\Macromed\Flash\FlashUtil11c_Plugin.exe
- 2011-10-13 00:57 . 2011-09-01 02:24 716800 c:\windows\SysWOW64\jscript.dll
+ 2011-12-15 07:13 . 2011-11-03 22:34 716800 c:\windows\SysWOW64\jscript.dll
- 2011-06-12 17:38 . 2011-05-04 08:52 157472 c:\windows\SysWOW64\javaws.exe
+ 2011-11-15 01:58 . 2011-05-04 08:52 157472 c:\windows\SysWOW64\javaws.exe
- 2011-06-12 17:38 . 2011-05-04 08:52 145184 c:\windows\SysWOW64\javaw.exe
+ 2011-11-15 01:58 . 2011-05-04 08:52 145184 c:\windows\SysWOW64\javaw.exe
+ 2011-11-15 01:58 . 2011-05-04 08:52 145184 c:\windows\SysWOW64\java.exe
- 2011-06-12 17:38 . 2011-05-04 08:52 145184 c:\windows\SysWOW64\java.exe
- 2011-10-13 00:57 . 2011-09-01 02:21 176640 c:\windows\SysWOW64\ieui.dll
+ 2011-12-15 07:13 . 2011-11-03 22:28 176640 c:\windows\SysWOW64\ieui.dll
+ 2010-08-11 22:07 . 2011-12-26 16:16 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2010-08-11 22:07 . 2011-04-16 23:27 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 04:54 . 2011-12-26 16:58 229376 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-06-11 06:58 . 2011-06-11 06:58 138056 c:\windows\SysWOW64\atl100.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 149504 c:\windows\system32\ZuneUsbTransport.dll
- 2010-07-13 15:29 . 2010-07-13 15:29 149504 c:\windows\system32\ZuneUsbTransport.dll
- 2010-07-13 15:29 . 2010-07-13 15:29 405504 c:\windows\system32\ZuneNetProxy.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 405504 c:\windows\system32\ZuneNetProxy.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 249344 c:\windows\system32\ZuneMTPZ.dll
- 2010-07-13 15:29 . 2010-07-13 15:29 249344 c:\windows\system32\ZuneMTPZ.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 354304 c:\windows\system32\ZuneCoInst.dll
+ 2011-11-12 21:55 . 2011-05-30 13:42 255488 c:\windows\system32\xvidvfw.dll
+ 2011-11-12 21:55 . 2011-05-23 07:45 696832 c:\windows\system32\xvidcore.dll
+ 2010-06-06 04:51 . 2011-11-05 22:09 252796 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2010-03-02 19:35 . 2011-12-25 21:37 458296 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2011-12-15 07:13 . 2011-11-04 01:43 237056 c:\windows\system32\url.dll
- 2011-10-13 00:57 . 2011-09-01 05:16 237056 c:\windows\system32\url.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 220520 c:\windows\system32\spool\drivers\x64\3\hpvplres04.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 538472 c:\windows\system32\spool\drivers\x64\3\hpvpldrv04.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 349032 c:\windows\system32\spool\drivers\x64\3\hpinksts8811LM.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 306024 c:\windows\system32\spool\drivers\x64\3\hpinksts8811.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 518504 c:\windows\system32\spool\drivers\x64\3\hpfime51.dll
- 2009-07-14 02:36 . 2011-10-13 01:00 624178 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-12-17 05:44 624178 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-12-17 05:44 106522 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-10-13 01:00 106522 c:\windows\system32\perfc009.dat
+ 2011-11-16 07:56 . 2011-11-16 07:56 461984 c:\windows\system32\Macromed\Flash\FlashUtil64_11_1_102_Plugin.exe
+ 2011-12-15 07:13 . 2011-11-04 01:39 818688 c:\windows\system32\jscript.dll
- 2011-10-13 00:57 . 2011-09-01 05:08 248320 c:\windows\system32\ieui.dll
+ 2011-12-15 07:13 . 2011-11-04 01:30 248320 c:\windows\system32\ieui.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 349032 c:\windows\system32\hpinksts8811LM.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 274792 c:\windows\system32\hpinkcoi8811.dll
+ 2011-06-20 22:16 . 2010-11-20 13:24 229376 c:\windows\system32\fsquirt.exe
+ 2009-07-14 05:30 . 2011-12-26 01:58 143360 c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2011-10-24 21:27 143360 c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2011-10-24 21:27 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2009-07-14 05:30 . 2011-12-26 01:58 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2011-07-22 21:47 . 2011-07-22 21:47 149504 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\ZuneUsbTransport.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 405504 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\ZuneNetProxy.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 249344 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\ZuneMTPZ.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 128000 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\ZuneIPTransport.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 354304 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\ZuneCoInst.dll
+ 2011-06-06 18:49 . 2011-06-06 18:49 708168 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\WinUSBCoInstaller.dll
+ 2011-06-06 18:49 . 2011-06-06 18:49 708168 c:\windows\system32\DriverStore\FileRepository\wmzuneserusb.inf_amd64_neutral_0612991c2e85953e\WinUSBCoInstaller.dll
+ 2010-10-06 22:23 . 2010-10-06 22:23 761344 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\unires.dll
+ 2010-10-06 22:23 . 2010-10-06 22:23 879104 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\unidrvui.dll
+ 2010-10-06 22:23 . 2010-10-06 22:23 472064 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\unidrv.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 220520 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\hpvplres04.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 538472 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\hpvpldrv04.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 349032 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\hpinksts8811LM.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 306024 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\hpinksts8811.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 274792 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\hpinkcoi8811.dll
+ 2010-10-07 18:05 . 2010-10-07 18:05 518504 c:\windows\system32\DriverStore\FileRepository\hpvpl04.inf_amd64_neutral_6ec62691a67fe79a\amd64\hpfime51.dll
+ 2009-07-14 00:06 . 2009-07-14 00:06 158720 c:\windows\system32\drivers\rfcomm.sys
+ 2011-07-13 08:04 . 2011-04-28 03:55 552960 c:\windows\system32\drivers\bthport.sys
+ 2009-07-14 00:07 . 2009-07-14 00:07 118784 c:\windows\system32\drivers\bthpan.sys
+ 2009-07-14 05:38 . 2011-12-21 07:01 262144 c:\windows\system32\config\systemprofile\ntuser.dat
- 2009-07-14 05:38 . 2011-10-01 23:27 262144 c:\windows\system32\config\systemprofile\ntuser.dat
+ 2009-07-14 05:01 . 2011-12-26 16:57 441256 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-10-31 22:28 . 2011-10-31 22:28 394624 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3767059194-2169123214-450175519-1001-8192.dat
+ 2011-10-24 07:33 . 2011-12-12 15:30 835600 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3767059194-2169123214-450175519-1001-4096.dat
+ 2011-11-11 14:48 . 2011-11-11 14:48 386497 c:\windows\Installer\fcf27.msi
+ 2011-02-20 04:08 . 2011-02-20 04:08 163840 c:\windows\Installer\51b1765.msi
+ 2010-08-10 21:44 . 2010-08-10 21:44 131584 c:\windows\Installer\2078e4e.msi
+ 2009-07-12 12:43 . 2009-07-12 12:43 231936 c:\windows\Installer\1e7756b.msi
- 2011-08-09 00:13 . 2011-09-15 07:13 888080 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\wordicon.exe
+ 2011-08-09 00:13 . 2011-12-15 07:14 888080 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\wordicon.exe
- 2011-08-09 00:13 . 2011-09-15 07:13 217864 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\misc.exe
+ 2011-08-09 00:13 . 2011-12-15 07:14 217864 c:\windows\Installer\{90120000-001B-0000-0000-0000000FF1CE}\misc.exe
+ 2011-12-15 05:09 . 2011-12-15 05:09 128366 c:\windows\Installer\{13D9B9B4-DEDE-4C52-A4FA-D954E9C29EF3}\IceOp.exe
+ 2011-12-26 05:55 . 2011-12-26 15:19 223744 c:\windows\assembly\temp\kwrd.dll
+ 2011-11-15 01:59 . 2011-11-15 01:59 118784 c:\windows\assembly\GAC_MSIL\cli_uretypes\1.0.7.0__ce2cb7e279207b9e\cli_uretypes.dll
+ 2011-11-15 02:00 . 2011-11-15 02:00 892928 c:\windows\assembly\GAC_MSIL\cli_oootypes\1.0.7.0__ce2cb7e279207b9e\cli_oootypes.dll
+ 2011-12-15 07:13 . 2011-11-03 22:39 1127424 c:\windows\SysWOW64\wininet.dll
+ 2011-12-15 07:13 . 2011-11-03 22:40 1103360 c:\windows\SysWOW64\urlmon.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 4422992 c:\windows\SysWOW64\mfc100u.dll
+ 2011-06-11 06:58 . 2011-06-11 06:58 4397384 c:\windows\SysWOW64\mfc100.dll
+ 2011-06-20 14:07 . 2011-11-16 07:56 8527008 c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
- 2011-10-13 00:57 . 2011-09-01 02:35 1798144 c:\windows\SysWOW64\jscript9.dll
+ 2011-12-15 07:13 . 2011-11-03 22:47 1798144 c:\windows\SysWOW64\jscript9.dll
+ 2011-12-15 07:13 . 2011-11-03 22:32 1792000 c:\windows\SysWOW64\iertutil.dll
+ 2011-12-15 07:13 . 2011-11-03 22:46 9705472 c:\windows\SysWOW64\ieframe.dll
+ 2009-07-14 04:54 . 2011-12-26 16:58 2555904 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-12-26 16:58 5144576 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-12-15 07:13 . 2011-11-04 01:44 1390080 c:\windows\system32\wininet.dll
+ 2011-12-15 07:13 . 2011-11-04 01:46 1345536 c:\windows\system32\urlmon.dll
+ 2011-12-15 07:13 . 2011-11-04 01:53 2309120 c:\windows\system32\jscript9.dll
- 2011-10-13 00:57 . 2011-09-01 05:24 2309120 c:\windows\system32\jscript9.dll
+ 2011-12-15 07:13 . 2011-11-04 01:36 2144256 c:\windows\system32\iertutil.dll
+ 2009-07-14 04:45 . 2011-12-15 14:15 4923408 c:\windows\system32\FNTCACHE.DAT
+ 2011-07-22 21:47 . 2011-07-22 21:47 1093632 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\ZuneDriver.dll
+ 2011-06-06 18:49 . 2011-06-06 18:49 2152176 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\WUDFUpdate_01009.dll
+ 2011-06-06 18:49 . 2011-06-06 18:49 1721576 c:\windows\system32\DriverStore\FileRepository\zune.inf_amd64_neutral_bae1a2a65e3c2cfb\WdfCoInstaller01009.dll
+ 2011-06-06 18:49 . 2011-06-06 18:49 1721576 c:\windows\system32\DriverStore\FileRepository\wmzuneserusb.inf_amd64_neutral_0612991c2e85953e\WdfCoInstaller01009.dll
+ 2008-07-29 09:47 . 2008-07-29 09:47 1075712 c:\windows\system32\DriverStore\FileRepository\netathrxusb.inf_amd64_neutral_1161acde4444b397\athrxusb.sys
- 2010-07-13 15:29 . 2010-07-13 15:29 1093632 c:\windows\system32\drivers\UMDF\ZuneDriver.dll
+ 2011-07-22 21:47 . 2011-07-22 21:47 1093632 c:\windows\system32\drivers\UMDF\ZuneDriver.dll
+ 2008-07-29 09:47 . 2008-07-29 09:47 1075712 c:\windows\system32\drivers\athrxusb.sys
- 2009-07-14 04:45 . 2011-10-26 12:56 7162691 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2009-07-14 04:45 . 2011-12-21 05:33 7162691 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2010-10-08 08:08 . 2011-12-26 16:57 7392782 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3767059194-2169123214-450175519-1001-12288.dat
+ 2011-12-26 15:18 . 2011-12-26 16:57 2221688 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
+ 2011-11-11 14:48 . 2011-11-11 14:48 1412096 c:\windows\Installer\fcf1e.msi
+ 2011-11-01 18:34 . 2011-11-01 18:34 1552384 c:\windows\Installer\834f84b.msp
+ 2011-11-01 18:34 . 2011-11-01 18:34 2531840 c:\windows\Installer\834f837.msp
+ 2011-11-11 21:15 . 2011-11-11 21:15 1795584 c:\windows\Installer\834f82f.msp
+ 2011-11-11 21:16 . 2011-11-11 21:16 8458240 c:\windows\Installer\834f815.msp
+ 2011-10-23 07:43 . 2011-10-23 07:43 7882752 c:\windows\Installer\7c44c29.msi
+ 2011-06-29 02:27 . 2011-06-29 02:27 4028928 c:\windows\Installer\73fa012.msp
+ 2011-11-23 18:40 . 2011-11-23 18:40 7714816 c:\windows\Installer\2379398.msi
+ 2010-11-17 08:53 . 2010-11-17 08:53 3054592 c:\windows\Installer\2078e49.msi
+ 2011-01-18 08:53 . 2011-01-18 08:53 2994688 c:\windows\Installer\1e7757b.msi
+ 2009-04-03 01:44 . 2009-04-03 01:44 2532224 c:\windows\Installer\$PatchCache$\Managed\00002109B10000000000000000F01FEC\12.0.6425\GRAPH.EXE
+ 2011-12-15 07:13 . 2011-11-03 23:02 12279808 c:\windows\SysWOW64\mshtml.dll
- 2009-07-14 02:34 . 2011-10-13 01:11 10747904 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2009-07-14 02:34 . 2011-12-21 07:02 10747904 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2011-12-15 07:13 . 2011-11-04 02:38 17786368 c:\windows\system32\mshtml.dll
+ 2010-03-02 20:13 . 2011-12-15 07:15 54867776 c:\windows\system32\MRT.exe
+ 2011-11-16 07:56 . 2011-11-16 07:56 11336864 c:\windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll
+ 2011-12-15 07:13 . 2011-11-04 01:59 10886656 c:\windows\system32\ieframe.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2011-09-02 107000]
"Xvid"="c:\program files (x86)\Xvid\CheckUpdate.exe" [2011-01-17 8192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PSUNMain"="c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2011-04-28 439616]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2011-11-11 273528]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux6"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-03 136176]
R3 ALSysIO;ALSysIO;c:\users\Dan-LT\AppData\Local\Temp\ALSysIO64.sys [x]
R3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\system32\DRIVERS\athrxusb.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-03 136176]
R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [x]
R3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-02 225280]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
R4 ePowerSvc;Acer ePower Service;c:\program files\Gateway\Gateway Power Management\ePowerSvc.exe [2009-09-30 844320]
R4 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136]
R4 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2010-10-15 326704]
R4 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-01-27 91392]
R4 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [2009-09-24 62720]
R4 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R4 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 240160]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2011-04-28 140608]
S2 PSINAflt;PSINAflt;c:\windows\system32\DRIVERS\PSINAflt.sys [x]
S2 PSINFile;PSINFile;c:\windows\system32\DRIVERS\PSINFile.sys [x]
S2 PSINProc;PSINProc;c:\windows\system32\DRIVERS\PSINProc.sys [x]
S2 PSINProt;PSINProt;c:\windows\system32\DRIVERS\PSINProt.sys [x]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]
S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [x]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [x]
S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [x]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-03 23:44]
.
2011-12-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-03 23:44]
.
2011-12-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3767059194-2169123214-450175519-1001Core.job
- c:\users\Dan-LT\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-31 02:13]
.
2011-12-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3767059194-2169123214-450175519-1001UA.job
- c:\users\Dan-LT\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-31 02:13]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Malware Icon]
@="{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}"
[HKEY_CLASSES_ROOT\CLSID\{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}]
2011-05-09 10:45 436040 ----a-w- c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Suspect Icon]
@="{9AE343CB-BA45-4618-AF6A-0230EE6FC793}"
[HKEY_CLASSES_ROOT\CLSID\{9AE343CB-BA45-4618-AF6A-0230EE6FC793}]
2011-05-09 10:45 436040 ----a-w- c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-10-09 508472]
"combofix"="c:\combofix\CF1177.3XE" [2010-11-20 345088]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://search.ChatVibes.com/
mLocal Page = c:\windows\SYSTEM32\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\Dan-LT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
LSP: c:\windows\system32\VilonguLSP.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 10.128.128.128
FF - ProfilePath - c:\users\Dan-LT\AppData\Roaming\Mozilla\Firefox\Profiles\ilvr329v.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://search.ChatVibes.com/?q=
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-DW6 - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3767059194-2169123214-450175519-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3767059194-2169123214-450175519-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\06\06\19\03'5_"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-12-26 12:23:13 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-26 17:23
ComboFix2.txt 2011-10-28 21:55
.
Pre-Run: 14,173,757,440 bytes free
Post-Run: 14,520,623,104 bytes free
.
- - End Of File - - 0B021A92FCA2BEF414046FFE1761C828

[Broni]

See if you can update and run MBAM now.
Check also GMER and aswMBR.

[ProblemsRBad]

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 911122603

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

12/26/2011 12:38:59 PM
mbam-log-2011-12-26 (12-38-59).txt

Scan type: Quick scan
Objects scanned: 198276
Time elapsed: 2 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Dan-LT\AppData\Local\csd.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-12-26 14:22:00
Windows 6.1.7601 Service Pack 1
Running: 7b8mkzlm.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0018e40bc2d0
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0018e40bc2d0@4c5499091212 0x2D 0xFC 0x6A 0x2A ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0018e40bc2d0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0018e40bc2d0@4c5499091212 0x2D 0xFC 0x6A 0x2A ...

---- EOF - GMER 1.0.15 ----


----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software
Run date: 2011-12-26 14:22:09
-----------------------------
14:22:09.912 OS Version: Windows x64 6.1.7601 Service Pack 1
14:22:09.913 Number of processors: 2 586 0x602
14:22:09.914 ComputerName: DANLT UserName:
14:22:11.760 Initialize success
14:36:10.199 AVAST engine defs: 11122601
14:36:59.979 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000064
14:36:59.982 Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 11
14:37:02.009 Disk 0 MBR read successfully
14:37:02.012 Disk 0 MBR scan
14:37:02.017 Disk 0 Windows VISTA default MBR code
14:37:02.083 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12000 MB offset 2048
14:37:02.103 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 24578048
14:37:02.126 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 293143 MB offset 24782848
14:37:02.133 Service scanning
14:37:03.830 Modules scanning
14:37:03.835 Disk 0 trace - called modules:
14:37:03.840 ntoskrnl.exe CLASSPNP.SYS disk.sys amdxata.sys ACPI.sys storport.sys hal.dll amdsata.sys
14:37:03.844 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80049205d0]
14:37:03.851 3 CLASSPNP.SYS[fffff8800199a43f] -> nt!IofCallDriver -> [0xfffffa80048cd040]
14:37:03.858 5 amdxata.sys[fffff8800113d8b9] -> nt!IofCallDriver -> [0xfffffa80048cba30]
14:37:03.865 7 ACPI.sys[fffff88000f1b7a1] -> nt!IofCallDriver -> \Device\00000064[0xfffffa80048c9060]
14:37:05.213 AVAST engine scan C:\Windows
14:37:10.676 AVAST engine scan C:\Windows\system32
14:39:34.720 AVAST engine scan C:\Windows\system32\drivers
14:39:51.619 AVAST engine scan C:\Users\Dan-LT
15:19:40.675 Disk 0 MBR has been saved successfully to "C:\Users\Dan-LT\Desktop\MBR.dat"
15:19:40.683 The log file has been saved successfully to "C:\Users\Dan-LT\Desktop\aswMBR.txt"

[Broni]

All looks good :)

Any current issues?

Download OTL to your Desktop.

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Click the Scan All Users checkbox.
  
• Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

[ProblemsRBad]

Its running better, rogue ware seems to be gone now. Thanks!

OTL logfile created on: 12/26/2011 4:00:58 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Dan-LT\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.17 Gb Available Physical Memory | 57.88% Memory free
7.50 Gb Paging File | 5.91 Gb Available in Paging File | 78.84% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 286.27 Gb Total Space | 13.49 Gb Free Space | 4.71% Space Free | Partition Type: NTFS

Computer Name: DANLT | User Name: Dan-LT | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/26 15:58:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dan-LT\Desktop\OTL.exe
PRC - [2011/12/14 06:59:20 | 002,984,832 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2011/11/11 09:49:08 | 000,273,528 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2011/11/09 13:53:25 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2011/09/02 12:55:26 | 000,107,000 | ---- | M] (Siber Systems) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
PRC - [2011/08/31 16:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/08/31 16:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/04/28 07:01:20 | 000,439,616 | ---- | M] (Panda Security, S.L.) -- C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe
PRC - [2011/04/28 06:58:54 | 000,140,608 | ---- | M] (Panda Security, S.L.) -- C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/16 02:56:17 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
MOD - [2011/11/09 13:53:25 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/03/24 06:24:58 | 000,095,976 | ---- | M] (SANDBOXIE L.T.D) [Disabled | Stopped] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV:64bit: - [2009/09/30 17:44:58 | 000,844,320 | ---- | M] (Acer Incorporated) [Disabled | Stopped] -- C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2009/07/30 02:03:42 | 000,203,264 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/03 20:47:12 | 000,240,160 | ---- | M] (Acer) [Disabled | Stopped] -- C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe -- (Updater Service)
SRV - [2011/12/14 06:59:20 | 002,984,832 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2011/08/31 16:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/06/06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/04/28 06:58:54 | 000,140,608 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe -- (NanoServiceMain)
SRV - [2011/01/07 17:48:18 | 000,057,640 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2011/01/05 13:30:36 | 000,352,304 | ---- | M] (AnchorFree Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2010/10/15 13:42:14 | 000,326,704 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010/01/27 10:37:22 | 000,091,392 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe -- (MotoConnect Service)
SRV - [2009/09/24 17:42:28 | 000,062,720 | ---- | M] (NewTech Infosystems, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009/07/16 17:04:16 | 000,316,664 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/05/22 13:02:20 | 000,250,616 | ---- | M] (WildTangent, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009/04/29 14:21:18 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Disabled | Stopped] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService)
SRV - [2007/12/16 22:00:00 | 000,163,840 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled | Stopped] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE -- (EPSON_EB_RPCV4_01) EPSON V5 Service4(01)
SRV - [2007/01/10 22:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled | Stopped] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/11/14 22:50:14 | 000,125,376 | ---- | M] (Power Software Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)
DRV:64bit: - [2011/08/31 16:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011/08/01 06:23:26 | 000,160,520 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\PSINAflt.sys -- (PSINAflt)
DRV:64bit: - [2011/07/26 04:37:24 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011/04/28 06:57:43 | 000,128,072 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\PSINProt.sys -- (PSINProt)
DRV:64bit: - [2011/04/28 06:57:43 | 000,121,928 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\PSINProc.sys -- (PSINProc)
DRV:64bit: - [2011/04/28 06:57:42 | 000,149,576 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\PSINKNC.sys -- (PSINKNC)
DRV:64bit: - [2011/04/28 06:57:42 | 000,114,760 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\PSINFile.sys -- (PSINFile)
DRV:64bit: - [2011/04/13 14:04:38 | 000,045,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011/04/13 14:04:38 | 000,023,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)
DRV:64bit: - [2011/03/24 06:24:54 | 000,148,072 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Stopped] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV:64bit: - [2011/03/18 12:46:20 | 000,074,376 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftdibus.sys -- (FTDIBUS)
DRV:64bit: - [2011/03/18 12:46:06 | 000,085,384 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftser2k.sys -- (FTSER2K)
DRV:64bit: - [2010/12/03 04:05:34 | 000,069,152 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/09/22 14:19:02 | 000,056,832 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HssDrv.sys -- (HssDrv)
DRV:64bit: - [2010/09/22 14:19:02 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2010/09/06 18:36:06 | 000,066,728 | ---- | M] (Eugene V. Muzychenko) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vrtaucbl.sys -- (EuMusDesignVirtualAudioCableWdm) Virtual Audio Cable (WDM)
DRV:64bit: - [2009/10/27 04:10:18 | 000,030,208 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\motmodem.sys -- (motmodem)
DRV:64bit: - [2009/10/05 15:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/09/02 12:58:08 | 000,225,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/08/13 22:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009/08/11 15:59:50 | 000,686,080 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009/07/30 12:11:24 | 006,038,016 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009/07/24 05:49:00 | 000,119,312 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/06/20 06:35:00 | 000,317,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink ™
DRV:64bit: - [2009/06/19 21:09:57 | 000,054,272 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)
DRV:64bit: - [2009/06/10 16:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009/06/10 16:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009/06/10 16:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009/06/10 15:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/06/10 15:35:35 | 000,620,544 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x)
DRV:64bit: - [2009/06/10 15:34:38 | 001,311,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/05/08 03:56:26 | 000,053,632 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\motodrv.sys -- (MotDev)
DRV:64bit: - [2009/05/05 18:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009/05/05 18:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2009/05/05 03:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009/04/29 14:21:08 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio)
DRV:64bit: - [2009/04/28 12:03:42 | 000,067,128 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009/04/28 12:03:42 | 000,028,216 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009/04/03 09:39:58 | 000,034,872 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2009/02/13 01:24:56 | 001,485,824 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2009/02/13 01:20:56 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2009/02/13 01:19:34 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2008/07/29 04:47:00 | 001,075,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrxusb.sys -- (athrusb)
DRV:64bit: - [2008/07/26 14:26:34 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)
DRV:64bit: - [2008/07/26 14:25:48 | 000,790,424 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2008/07/26 14:22:34 | 002,624,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV:64bit: - [2008/07/26 14:22:22 | 000,015,768 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64)
DRV:64bit: - [2008/03/13 02:46:00 | 000,027,136 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ManyCam_x64.sys -- (ManyCam)
DRV:64bit: - [2006/06/18 09:27:24 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk)
DRV - [2009/09/02 12:58:08 | 000,225,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.ChatVibes.com/


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C6 E2 57 9C 49 BA CA 01 [binary data]
IE - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://google.com"
FF - prefs.js..keyword.URL: "http://search.ChatVibes.com/?q="

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: File not found
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Dan-LT\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Dan-LT\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Dan-LT\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Dan-LT\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Dan-LT\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011/01/22 02:22:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011/01/22 02:22:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2011/09/02 13:03:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/12/21 02:01:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/11/11 09:27:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/12/21 02:01:04 | 000,000,000 | ---D | M]

[2011/06/28 19:16:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dan-LT\AppData\Roaming\Mozilla\Extensions
[2010/11/07 04:28:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dan-LT\AppData\Roaming\Mozilla\Extensions\IMVUClientXUL@imvu.com
[2011/12/26 00:59:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dan-LT\AppData\Roaming\Mozilla\Firefox\Profiles\ilvr329v.default\extensions
[2011/11/12 17:05:38 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Dan-LT\AppData\Roaming\Mozilla\Firefox\Profiles\ilvr329v.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/08/14 22:48:42 | 000,002,572 | ---- | M] () -- C:\Users\Dan-LT\AppData\Roaming\Mozilla\Firefox\Profiles\ilvr329v.default\searchplugins\askcom.xml
[2011/12/21 02:01:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/11/09 13:53:26 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/05/04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/09/28 19:26:50 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/11/09 13:53:26 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2011/12/26 12:02:47 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Reg Error: Value error.) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PSUNMain] C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe (Panda Security, S.L.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001..\Run: [Xvid] C:\Program Files (x86)\Xvid\CheckUpdate.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8:64bit: - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8:64bit: - Extra context menu item: RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8:64bit: - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Dan-LT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWow64\VilonguLSP.dll (Crow Soft)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWow64\VilonguLSP.dll (Crow Soft)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWow64\VilonguLSP.dll (Crow Soft)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWow64\VilonguLSP.dll (Crow Soft)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\SysWow64\VilonguLSP.dll (Crow Soft)
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} http://www.worldwinn...0/tpir/tpir.cab (TPIR Control)
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} http://activex.camfr..._instmodule.exe (CamfrogWEB Advanced Unicode Control)
O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} http://www.worldwinn...ut/brickout.cab (Brickout Control)
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} http://www.worldwinn...0/pool/pool.cab (Pool Control)
O16 - DPF: {4AB16005-E995-4A60-89DE-8B8A3E6EB5B0} http://www.worldwinn...vialpursuit.cab (TrivialPursuit Control)
O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} http://www.worldwinn...ersolitaire.cab (SpiderSolitaire Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx...owserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} http://www.worldwinn....0/iewwload.cab (WorldWinner ActiveX Launcher Control)
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} http://www.worldwinn...v57/wof/wof.cab (WoF Control)
O16 - DPF: {BB637307-92FA-47EC-B3F7-6969078673CC} http://www.worldwinn...royal/royal.cab (Royal Control)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/...ploader_v10.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} http://www.worldwinn...es/wwspades.cab (WWSpades Control)
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} http://www.worldwinn...ool/h2hpool.cab (H2hPool Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.128.128.128
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{03C2D23D-F1AB-4F69-B36B-0B2AF16868D5}: DhcpNameServer = 10.128.128.128
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4EC1F3B-3B3A-492A-8645-D97EBE93B95A}: DhcpNameServer = 192.168.69.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)
Drivers32:64bit: vidc.XVID - xvidvfw.dll ()
Drivers32: msacm.l3acm - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.trspch - C:\Windows\SysWow64\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\Windows\SysWow64\vct3216.acm (Voxware, Inc.)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.D263 - C:\Windows\SysWow64\xl_x263dec.dll (Xirlink, Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.i420 - C:\Windows\SysWow64\Xl_I420.dll (Xirlink, Inc.)
Drivers32: vidc.iv50 - C:\Windows\SysWow64\ir50_32.dll (Intel Corporation)
Drivers32: vidc.uyvy - C:\Windows\SysWow64\xl_uyvy.dll (Xirlink, Inc.)
Drivers32: VIDC.XJPG - C:\Windows\SysWow64\camfc.dll (Xirlink)
Drivers32: vidc.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yuy2 - C:\Windows\SysWow64\xl_yuy2.dll (Xirlink, Inc.)
Drivers32: VIDC.YV12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/26 15:58:26 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Dan-LT\Desktop\OTL.exe
[2011/12/26 12:41:57 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/12/26 12:23:33 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/12/26 11:31:27 | 004,352,130 | R--- | C] (Swearware) -- C:\Users\Dan-LT\Desktop\ComboFix.exe
[2011/12/26 10:28:21 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Dan-LT\Desktop\dds(1).scr
[2011/12/26 10:28:13 | 001,918,464 | ---- | C] (AVAST Software) -- C:\Users\Dan-LT\Desktop\aswMBR(1).exe
[2011/12/25 23:54:36 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\Unity
[2011/12/24 13:30:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Inbox Toolbar
[2011/12/24 10:59:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Traffic Travis v3
[2011/12/24 10:59:21 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Roaming\Affilorama
[2011/12/24 10:59:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Traffic Travis v3
[2011/12/24 10:58:27 | 000,000,000 | ---D | C] -- C:\web traffic
[2011/12/24 08:49:01 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\iMesh
[2011/12/24 08:47:13 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\PackageAware
[2011/12/22 08:55:03 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\Documents\My Games
[2011/12/21 11:08:14 | 000,000,000 | ---D | C] -- C:\ProgramData\HP
[2011/12/21 11:08:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2011/12/21 11:07:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HP
[2011/12/21 11:07:23 | 000,000,000 | ---D | C] -- C:\Program Files\HP
[2011/12/21 11:07:08 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\HP
[2011/12/20 19:51:39 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\SCE
[2011/12/19 14:01:40 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{E3AAED47-4E0D-4C9E-AF82-482A384E5EE8}
[2011/12/19 14:01:23 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{D77D0895-5FCA-4E91-A05F-0AE3294697DB}
[2011/12/19 13:04:08 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ManyCam
[2011/12/18 00:52:42 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{4FD04E8E-23CC-4A38-8641-28D4A556E5B8}
[2011/12/18 00:52:28 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{8B994010-AF40-429E-9B5C-D309B445B986}
[2011/12/17 12:02:13 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{56D915CC-BEBB-4128-A544-76A7CF4D3069}
[2011/12/17 12:02:00 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{E4D1F684-B293-4B08-B628-6A08C28B6F91}
[2011/12/15 00:09:40 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Roaming\IceOp
[2011/12/15 00:09:38 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\Documents\IceOp Data
[2011/12/15 00:09:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IceOp
[2011/12/13 11:26:54 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{C8ACD018-6E33-4AB0-A35F-801B28CE74E6}
[2011/12/12 23:26:24 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{0B910FB3-7179-49BE-9991-EB926CAA2C87}
[2011/12/12 23:26:11 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{DB3370EC-5B97-4147-822D-FCA09E125C4A}
[2011/12/12 10:01:23 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{5C489817-09EB-4C12-86CA-BC475168C813}
[2011/12/12 10:01:11 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{276392E7-6316-4766-84CD-DBEC0B9DB53D}
[2011/12/11 22:00:55 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{1AD040B0-B80C-488F-8706-EBA299433AE8}
[2011/12/11 22:00:31 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{EEF04C48-03FF-4C79-ADA4-1BBD2334731D}
[2011/12/11 10:00:03 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{C637A417-E7AE-4923-881B-89CC81DCEF26}
[2011/12/10 20:58:48 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{F7622E2D-4521-420A-8447-9E356635C205}
[2011/12/10 20:58:34 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{EF7BD4F7-2DA1-4EC1-AE24-988E09259B94}
[2011/12/09 00:32:43 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\.android
[2011/12/09 00:31:48 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\Desktop\android-sdk_r15-windows
[2011/12/08 23:33:08 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{6898A767-EFAA-4855-8455-A31AD313A31C}
[2011/12/08 23:32:42 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{A2F4D418-4313-4AF2-8051-BC56C01D1EF0}
[2011/12/08 11:32:12 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{80A45CC1-AAC6-4006-AD46-CA33948A9D49}
[2011/12/08 11:31:57 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{2186A8FA-218D-447C-8FEA-7D5BB2223B34}
[2011/12/07 23:31:30 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{EA405E3A-AEA6-40DF-B887-7DB0335A2B65}
[2011/12/07 23:31:18 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{7F62A940-7D6A-419B-8384-8012946D273B}
[2011/12/07 11:30:48 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{F15626C3-36D4-4B8E-8471-FE42BFCE660D}
[2011/12/07 11:30:36 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{5C047B33-2FA5-414D-8B90-C74D61409411}
[2011/12/06 18:08:51 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{F2558682-83B3-474F-876D-51013D29E11A}
[2011/12/06 11:25:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer
[2011/12/06 01:43:04 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{94F91635-97B4-4BCD-904A-4686067C28EA}
[2011/12/06 01:42:52 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{4464184C-91BA-491B-8A5A-A770748D3337}
[2011/12/05 10:22:28 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{FD8227D6-008D-4E05-A255-13333E700A1C}
[2011/12/05 10:22:14 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\{0B3DF67C-6FD8-4358-8ACD-DA69D42495B5}
[2011/12/04 20:34:52 | 000,000,000 | ---D | C] -- C:\dvddrivers
[2011/12/03 00:46:45 | 000,000,000 | ---D | C] -- C:\My Drivers
[2011/12/03 00:43:15 | 000,110,592 | ---- | C] (Common Controls Replacement Project (CCRP)) -- C:\Windows\SysWow64\ccrpbds6.dll
[2011/12/03 00:43:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDriversBackup
[2011/12/03 00:43:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JerMar Software Corp
[2011/12/03 00:23:40 | 001,882,104 | ---- | C] (Codejock Software) -- C:\Windows\SysWow64\Codejock.Controls.v15.0.1.ocx
[2011/12/03 00:23:40 | 000,456,536 | ---- | C] (Xceed Software Inc (450) 442-2626 support@xceedsoft.com www.xceedsoft.com) -- C:\Windows\SysWow64\XCEEDZIP.DLL
[2011/12/02 23:59:02 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\Documents\My Drivers
[2011/12/02 23:59:02 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\AppData\Local\Innovative Solutions
[2011/12/02 23:59:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Innovative Solutions
[2011/12/02 23:21:55 | 000,000,000 | ---D | C] -- C:\Users\Dan-LT\Documents\DriverGenius
[2011/11/30 22:35:55 | 000,000,000 | ---D | C] -- C:\Windows 98 FE
[2011/11/29 17:38:45 | 000,000,000 | ---D | C] -- C:\windows 98 se
[2011/11/28 18:55:17 | 000,000,000 | ---D | C] -- C:\Win98SEupgrade
[2011/11/27 22:44:54 | 000,000,000 | ---D | C] -- C:\bootdisk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/26 15:58:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dan-LT\Desktop\OTL.exe
[2011/12/26 15:53:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/26 15:44:00 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3767059194-2169123214-450175519-1001UA.job
[2011/12/26 15:19:40 | 000,000,512 | ---- | M] () -- C:\Users\Dan-LT\Desktop\MBR.dat
[2011/12/26 12:48:32 | 000,017,600 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/26 12:48:32 | 000,017,600 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/26 12:41:51 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/26 12:40:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/12/26 12:40:36 | 3018,608,640 | -HS- | M] () -- C:\hiberfil.sys
[2011/12/26 12:02:47 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2011/12/26 11:32:35 | 004,352,130 | R--- | M] (Swearware) -- C:\Users\Dan-LT\Desktop\ComboFix.exe
[2011/12/26 11:20:40 | 000,010,770 | -HS- | M] () -- C:\ProgramData\ut13yihf2ll5685fm4753sm2ex4kh5h3
[2011/12/26 11:20:39 | 000,010,770 | -HS- | M] () -- C:\Users\Dan-LT\AppData\Local\ut13yihf2ll5685fm4753sm2ex4kh5h3
[2011/12/26 10:29:01 | 001,918,464 | ---- | M] (AVAST Software) -- C:\Users\Dan-LT\Desktop\aswMBR(1).exe
[2011/12/26 10:28:39 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Dan-LT\Desktop\dds(1).scr
[2011/12/26 10:27:34 | 000,302,592 | ---- | M] () -- C:\Users\Dan-LT\Desktop\7b8mkzlm.exe
[2011/12/26 09:44:00 | 000,000,860 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3767059194-2169123214-450175519-1001Core.job
[2011/12/25 03:17:10 | 010,900,665 | ---- | M] () -- C:\Users\Dan-LT\Desktop\Malwarebytes’ Anti-Malware PRO 1.60.0.1400 + keygen [TIMETRAVEL].rar
[2011/12/24 10:59:23 | 000,001,034 | ---- | M] () -- C:\Users\Dan-LT\Application Data\Microsoft\Internet Explorer\Quick Launch\Traffic Travis.lnk
[2011/12/24 10:59:23 | 000,001,010 | ---- | M] () -- C:\Users\Dan-LT\Desktop\Traffic Travis.lnk
[2011/12/24 08:49:00 | 000,000,132 | ---- | M] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url
[2011/12/22 08:51:53 | 000,002,627 | ---- | M] () -- C:\Users\Dan-LT\Desktop\DC Universe Online Live.lnk
[2011/12/21 13:02:29 | 000,000,318 | ---- | M] () -- C:\Windows\WPE PRO - modified.INI
[2011/12/21 11:08:08 | 000,002,273 | ---- | M] () -- C:\Users\Public\Desktop\HP Deskjet 1000 J110 series.lnk
[2011/12/21 11:08:08 | 000,001,231 | ---- | M] () -- C:\Users\Public\Desktop\Shop for Supplies - HP Deskjet 1000 J110 series.lnk
[2011/12/20 20:20:43 | 000,007,610 | ---- | M] () -- C:\Users\Dan-LT\AppData\Local\Resmon.ResmonCfg
[2011/12/19 13:04:08 | 000,001,104 | ---- | M] () -- C:\Users\Dan-LT\Desktop\ManyCam.lnk
[2011/12/19 13:04:07 | 000,001,128 | ---- | M] () -- C:\Users\Dan-LT\Application Data\Microsoft\Internet Explorer\Quick Launch\ManyCam.lnk
[2011/12/18 16:56:09 | 000,001,333 | ---- | M] () -- C:\Users\Dan-LT\Desktop\Sandboxed Web Browser.lnk
[2011/12/17 00:44:09 | 000,726,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/12/17 00:44:09 | 000,624,178 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/12/17 00:44:09 | 000,106,522 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/12/15 09:15:23 | 004,923,408 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/12/15 00:09:47 | 000,001,189 | ---- | M] () -- C:\Users\Public\Desktop\IceOp (for Cloud).lnk
[2011/12/15 00:09:47 | 000,001,175 | ---- | M] () -- C:\Users\Public\Desktop\IceOp.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/26 15:19:40 | 000,000,512 | ---- | C] () -- C:\Users\Dan-LT\Desktop\MBR.dat
[2011/12/26 10:27:32 | 000,302,592 | ---- | C] () -- C:\Users\Dan-LT\Desktop\7b8mkzlm.exe
[2011/12/26 00:53:34 | 000,010,770 | -HS- | C] () -- C:\Users\Dan-LT\AppData\Local\ut13yihf2ll5685fm4753sm2ex4kh5h3
[2011/12/26 00:53:34 | 000,010,770 | -HS- | C] () -- C:\ProgramData\ut13yihf2ll5685fm4753sm2ex4kh5h3
[2011/12/25 03:08:46 | 010,900,665 | ---- | C] () -- C:\Users\Dan-LT\Desktop\Malwarebytes’ Anti-Malware PRO 1.60.0.1400 + keygen [TIMETRAVEL].rar
[2011/12/24 10:59:23 | 000,001,034 | ---- | C] () -- C:\Users\Dan-LT\Application Data\Microsoft\Internet Explorer\Quick Launch\Traffic Travis.lnk
[2011/12/24 10:59:23 | 000,001,010 | ---- | C] () -- C:\Users\Dan-LT\Desktop\Traffic Travis.lnk
[2011/12/24 08:49:00 | 000,000,132 | ---- | C] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url
[2011/12/21 12:22:56 | 000,002,627 | ---- | C] () -- C:\Users\Dan-LT\Desktop\DC Universe Online Live.lnk
[2011/12/21 12:22:56 | 000,002,515 | ---- | C] () -- C:\Users\Dan-LT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DC Universe Online Live.lnk
[2011/12/21 11:08:08 | 000,002,273 | ---- | C] () -- C:\Users\Public\Desktop\HP Deskjet 1000 J110 series.lnk
[2011/12/21 11:08:08 | 000,001,231 | ---- | C] () -- C:\Users\Public\Desktop\Shop for Supplies - HP Deskjet 1000 J110 series.lnk
[2011/12/20 20:20:43 | 000,007,610 | ---- | C] () -- C:\Users\Dan-LT\AppData\Local\Resmon.ResmonCfg
[2011/12/19 16:10:28 | 000,000,318 | ---- | C] () -- C:\Windows\WPE PRO - modified.INI
[2011/12/19 13:04:08 | 000,001,104 | ---- | C] () -- C:\Users\Dan-LT\Desktop\ManyCam.lnk
[2011/12/19 13:04:07 | 000,001,128 | ---- | C] () -- C:\Users\Dan-LT\Application Data\Microsoft\Internet Explorer\Quick Launch\ManyCam.lnk
[2011/12/15 00:09:47 | 000,001,189 | ---- | C] () -- C:\Users\Public\Desktop\IceOp (for Cloud).lnk
[2011/12/15 00:09:47 | 000,001,175 | ---- | C] () -- C:\Users\Public\Desktop\IceOp.lnk
[2011/12/06 11:25:41 | 000,001,171 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7.lnk
[2011/12/03 00:23:40 | 000,110,602 | ---- | C] () -- C:\Windows\SysWow64\xcdsfx32.bin
[2011/11/12 16:55:10 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011/11/12 16:55:10 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011/10/28 16:29:35 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/10/28 16:29:35 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/10/28 16:29:35 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/10/28 16:29:35 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/10/28 16:29:35 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/08/21 01:06:00 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\wgsrvins.dll
[2011/08/08 18:12:52 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2011/07/18 19:47:03 | 000,021,504 | ---- | C] () -- C:\Windows\SysWow64\WBCustomizer.dll
[2011/07/16 15:07:28 | 000,000,060 | ---- | C] () -- C:\Users\Dan-LT\AppData\Roaming\adobereader.inv
[2011/04/11 20:19:21 | 000,010,240 | ---- | C] () -- C:\Windows\SysWow64\vidx16.dll
[2011/04/11 20:17:38 | 000,000,272 | ---- | C] () -- C:\Windows\_delis32.ini
[2011/03/26 05:59:37 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\tsd32.dll
[2011/01/15 20:10:10 | 000,000,262 | ---- | C] () -- C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2010/10/24 06:39:38 | 000,230,752 | ---- | C] () -- C:\Windows\patchw32.dll
[2010/10/24 06:39:37 | 000,118,176 | ---- | C] () -- C:\Windows\patchw.dll
[2010/10/17 20:59:54 | 000,001,930 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2010/09/23 17:03:52 | 000,000,036 | -H-- | C] () -- C:\Windows\SysWow64\f9t.dat
[2010/06/30 22:30:59 | 000,000,077 | ---- | C] () -- C:\Users\Dan-LT\AppData\Roaming\RSBot Accounts.ini
[2010/06/26 13:03:37 | 000,008,704 | ---- | C] () -- C:\Users\Dan-LT\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/18 22:13:10 | 000,000,035 | ---- | C] () -- C:\Windows\popcinfo.dat
[2010/06/16 22:43:41 | 000,000,048 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/04/21 07:49:20 | 000,073,220 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat
[2010/04/21 07:49:20 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat
[2010/04/21 07:49:20 | 000,029,114 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat
[2010/04/21 07:49:20 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat
[2010/04/21 07:49:20 | 000,021,021 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat
[2010/04/21 07:49:20 | 000,015,670 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat
[2010/04/21 07:49:20 | 000,013,280 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat
[2010/04/21 07:49:20 | 000,010,673 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat
[2010/04/21 07:49:20 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat
[2010/04/21 07:49:20 | 000,001,140 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat
[2010/04/21 07:49:20 | 000,001,140 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat
[2010/04/21 07:49:20 | 000,001,137 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat
[2010/04/21 07:49:20 | 000,001,130 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat
[2010/04/21 07:49:20 | 000,001,130 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat
[2010/04/21 07:49:20 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat
[2010/04/21 07:49:20 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini
[2010/04/21 07:48:34 | 000,000,044 | ---- | C] () -- C:\Windows\EPSNX300.ini
[2010/04/19 14:32:54 | 000,001,036 | ---- | C] () -- C:\Users\Dan-LT\AppData\Roaming\wklnhst.dat
[2010/03/17 14:21:56 | 000,004,152 | ---- | C] () -- C:\ProgramData\cdjuscuc.sqp
[2010/03/02 16:20:39 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010/01/27 14:32:12 | 000,000,481 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010/01/27 14:31:26 | 000,001,590 | ---- | C] () -- C:\Windows\WPatchProgress.ini
[2009/10/29 15:56:57 | 000,000,189 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2009/10/29 15:56:57 | 000,000,147 | ---- | C] () -- C:\Windows\WisPriority.ini
[2009/10/29 15:56:57 | 000,000,119 | ---- | C] () -- C:\Windows\WisLangCode.ini
[2009/10/29 15:06:12 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2009/07/13 16:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2009/07/13 16:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2009/07/13 16:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/05/12 15:26:57 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\.minecraft
[2010/03/28 16:21:26 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\acccore
[2011/05/29 14:54:05 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Acoustica
[2011/12/24 10:59:21 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Affilorama
[2011/12/24 13:04:05 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Azureus
[2011/07/15 19:37:42 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\butel
[2011/07/15 19:38:45 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\butelsoap
[2011/12/06 09:52:03 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Camfrog
[2011/08/01 20:53:17 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\CamfrogWEB
[2010/10/02 14:51:13 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/07/26 04:39:40 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\DAEMON Tools Lite
[2010/03/30 05:13:24 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\DAoC Portal
[2011/02/22 19:31:33 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Darkfall
[2011/12/21 02:01:05 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Darkfall US
[2010/03/26 19:21:31 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Electronic Arts
[2010/12/21 12:40:35 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\EPSON
[2010/07/26 22:01:23 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\EyeballChatAvatars
[2010/09/30 03:20:50 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\EyeballChatUserData
[2010/10/05 20:36:32 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Floodlight Games
[2011/04/13 18:51:58 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Foxit Software
[2010/12/14 23:17:08 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\FrostWire
[2010/07/28 02:11:34 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Gamelab
[2010/10/27 15:01:11 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\GetRightToGo
[2011/12/15 00:55:10 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\IceOp
[2010/07/14 15:24:32 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\ImgBurn
[2011/04/27 14:39:14 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\IObit
[2011/08/14 21:02:44 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Kermit Files
[2011/08/27 15:36:31 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\KSCraft
[2010/04/21 08:00:29 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Leadertech
[2010/09/02 20:26:23 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\LockHunter
[2011/09/28 00:38:54 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\LolClient
[2011/09/22 19:39:22 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\ManyCam
[2010/04/19 17:42:50 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Panda Security
[2011/06/06 15:21:00 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\picpick
[2011/07/15 18:48:10 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Radioshack
[2011/09/02 13:03:54 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\RoboForm
[2010/11/07 07:04:34 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Secret of the Solstice
[2011/02/14 00:37:35 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Sincell
[2011/10/30 15:05:30 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Smilebox
[2010/09/23 17:29:01 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Stamps.com Internet Postage
[2010/06/25 09:51:48 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\SurfSecret Privacy Suite
[2011/05/29 15:00:03 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\SynthMaker
[2011/12/21 02:01:06 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\TeamViewer
[2010/08/12 15:42:36 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Template
[2011/08/01 19:10:11 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\thriXXX
[2010/05/29 10:33:20 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\UDC Profiles
[2010/11/07 04:31:58 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Vivox
[2011/11/16 03:14:52 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\VoxOx2
[2011/08/14 21:16:46 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\WebcamMax
[2010/03/09 02:29:00 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\WildTangent
[2010/10/08 00:19:40 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Windows Live Writer
[2011/10/01 18:27:31 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\Y!Supra
[2011/01/13 11:37:02 | 000,000,000 | ---D | M] -- C:\Users\Dan-LT\AppData\Roaming\ZEN
[2011/11/11 09:09:07 | 000,032,622 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011/11/16 09:50:55 | 000,001,024 | ---- | M] () -- C:\.rnd
[2011/06/28 23:38:06 | 000,000,000 | ---- | M] () -- C:\0x0304A000.sfl
[2011/04/12 15:51:04 | 000,021,051 | ---- | M] () -- C:\aaw7boot.log
[2009/07/13 20:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
[2009/07/27 15:40:53 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2011/12/26 12:23:20 | 000,049,388 | ---- | M] () -- C:\ComboFix.txt
[2007/11/07 07:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
[2007/11/07 07:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
[2007/11/07 07:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
[2007/11/07 07:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
[2007/11/07 07:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
[2007/11/07 07:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
[2007/11/07 07:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
[2007/11/07 07:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
[2007/11/07 07:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2007/11/07 07:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2011/12/26 12:40:36 | 3018,608,640 | -HS- | M] () -- C:\hiberfil.sys
[2007/11/07 07:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2007/11/07 07:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2007/11/07 07:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2007/11/07 07:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2007/11/07 07:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2007/11/07 07:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2007/11/07 07:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2007/11/07 07:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2007/11/07 07:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2007/11/07 07:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2011/02/12 03:28:50 | 000,000,359 | -H-- | M] () -- C:\IPH.PH
[2011/12/26 12:40:41 | 4024,811,520 | -HS- | M] () -- C:\pagefile.sys
[2009/11/09 02:20:10 | 000,008,681 | RHS- | M] () -- C:\Patch.rev
[2010/01/27 14:32:38 | 000,000,181 | RHS- | M] () -- C:\Preload.rev
[2011/04/12 20:30:06 | 000,000,428 | ---- | M] () -- C:\rkill.log
[2011/10/29 12:32:03 | 000,002,261 | ---- | M] () -- C:\SoftUpdate.log
[2007/11/07 07:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007/11/07 07:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007/11/07 07:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI
[2011/10/15 02:29:54 | 021,073,936 | ---- | M] () -- C:\vlc-1.1.11-win32.exe
[2011/10/15 01:42:01 | 019,416,632 | ---- | M] () -- C:\wdm3516b_Cadenza.exe
[2011/09/18 15:14:07 | 000,000,188 | ---- | M] () -- C:\webdombot.log

< %systemroot%\Fonts\*.com >
[2009/07/14 00:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 15:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/13 14:42:24 | 000,302,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/05/04 09:39:06 | 000,000,221 | -HS- | M] () -- C:\Users\Dan-LT\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/12/26 10:27:34 | 000,302,592 | ---- | M] () -- C:\Users\Dan-LT\Desktop\7b8mkzlm.exe
[2011/12/26 10:29:01 | 001,918,464 | ---- | M] (AVAST Software) -- C:\Users\Dan-LT\Desktop\aswMBR(1).exe
[2010/09/01 18:52:41 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Users\Dan-LT\Desktop\ATF-Cleaner.exe
[2011/12/26 11:32:35 | 004,352,130 | R--- | M] (Swearware) -- C:\Users\Dan-LT\Desktop\ComboFix.exe
[2011/06/16 15:44:00 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Dan-LT\Desktop\esetsmartinstaller_enu.exe
[2011/07/10 21:29:29 | 000,440,832 | ---- | M] () -- C:\Users\Dan-LT\Desktop\LinkBukz V1.4.exe
[2011/12/26 15:58:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dan-LT\Desktop\OTL.exe
[2011/05/31 21:41:31 | 127,222,215 | ---- | M] (Igor Pavlov) -- C:\Users\Dan-LT\Desktop\OTLPENet.exe
[2011/06/16 15:54:27 | 000,879,099 | ---- | M] () -- C:\Users\Dan-LT\Desktop\SecurityCheck.exe
[2011/06/19 20:53:34 | 000,158,720 | ---- | M] () -- C:\Users\Dan-LT\Desktop\xxxsmileys_v6.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2010/06/03 10:41:12 | 000,387,904 | ---- | M] (Panda Security) -- C:\Users\Dan-LT\StubInstaller.exe

< %systemroot%\ADDINS\*.* >
[2009/06/10 16:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/06/20 22:11:32 | 000,000,402 | -HS- | M] () -- C:\Users\Dan-LT\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/03/17 14:21:56 | 000,004,152 | ---- | M] () -- C:\ProgramData\cdjuscuc.sqp
[2011/12/26 11:20:40 | 000,010,770 | -HS- | M] () -- C:\ProgramData\ut13yihf2ll5685fm4753sm2ex4kh5h3

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[1998/09/02 03:46:12 | 000,075,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >
[2011/06/15 01:16:06 | 001,067,368 | ---- | M] (SANDBOXIE L.T.D) -- C:\Windows\Installer\SandboxieInstall64.exe

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

OTL Extras logfile created on: 12/26/2011 4:00:59 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Dan-LT\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.17 Gb Available Physical Memory | 57.88% Memory free
7.50 Gb Paging File | 5.91 Gb Available in Paging File | 78.84% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 286.27 Gb Total Space | 13.49 Gb Free Space | 4.71% Space Free | Partition Type: NTFS

Computer Name: DANLT | User Name: Dan-LT | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\iCall\iCall.exe" = C:\Program Files (x86)\iCall\iCall.exe:*:Enabled:iCall -- ()
"C:\Program Files (x86)\iCall\iCall.exe" = C:\Program Files (x86)\iCall\iCall.exe:*:Enabled:iCall -- ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{3ED4AD02-F631-4A4C-AAC8-2325996E5A56}" = Microsoft IntelliPoint 8.1
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{50431EE1-C1CC-4AE7-BDE3-B60536E7BA92}" = Panda Cloud Antivirus
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{883B114D-BD3E-498F-9DAD-5E4A8E1C43BA}" = HP Deskjet 1000 J110 series Basic Device Software
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}" = Broadcom Gigabit NetLink Controller
"{9E61C67F-DFEC-466D-9478-56F3E36D1F31}" = Motorola Driver Installation 4.5.0
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A8DDE3ED-9B6A-F806-32AF-EC53A836A04F}" = ATI Catalyst Install Manager
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B613A9BB-2B34-4824-A4BE-2427653D59D6}" = iTunes
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{B7CF178A-2F3D-0125-0D78-98EB53D92A52}" = ccc-utility64
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CA0D2F09-F811-48D4-843E-C87696C6A9D9}" = Bonjour
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" = Ventrilo Client for Windows x64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"3134FEF0E1D959EC0CC2E458C94B7057B2AC0CC9" = Windows Driver Package - FTDI CDM Driver Package (10/22/2009 2.06.00)
"88EB56038379B8B7DCFB4D2448A60F52E064B265" = Windows Driver Package - FTDI CDM Driver Package (10/22/2009 2.06.00)
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"EPSON NX300 Series" = EPSON NX300 Series Printer Uninstall
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliPoint 8.1" = Microsoft IntelliPoint 8.1
"Sandboxie" = Sandboxie 3.54 (64-bit)
"Unlocker" = Unlocker 1.9.0-x64
"Virtual Audio Cable 4.10" = Virtual Audio Cable 4.10
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0695DD0E-0E07-061B-5317-1FCCEA3CA51F}" = CCC Help Czech
"{06A02948-CE93-82A0-7BD4-5FB9562136F7}" = CCC Help Japanese
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0B7169C2-4FC9-0454-6E6F-CDBA27D9C3CF}" = CCC Help Spanish
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{12A1B519-5934-4508-ADBD-335347B0DC87}" = Video Web Camera
"{13D9B9B4-DEDE-4C52-A4FA-D954E9C29EF3}" = IceOp 6.3
"{14C10725-0018-4534-AE5E-547C08B737B7}" = ASCOM Platform 5.0b
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FFA2D28-F77A-E27C-0659-F497926805AA}" = CCC Help Polish
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{22FC7536-BE5C-4E88-8069-C24689D34EC5}" = Snagit 10.0.1
"{23CA024E-7A69-467A-99F0-45462A144AE3}" = LOKI2
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 26
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Driver Installation Program
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{35A81F0A-A1CA-458D-8FCD-7D838E3D95FF}" = Microsoft WorldWide Telescope
"{37DA7059-EC42-8F87-2593-AB273A13CDE4}" = CCC Help Hungarian
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Gateway Power Management
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{554B7217-1988-2E1E-8CAC-30CB8498DA8E}" = CCC Help Portuguese
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5920C2D5-2969-9BAE-E5A7-947721CFF1F1}" = CCC Help English
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5C8C6C22-5B84-E88C-C38C-9E66DB569600}" = CCC Help Thai
"{5CF6EEE9-86B1-3DB6-A07C-8F6C079C39BA}" = Google Talk Plugin
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6122170D-F78E-182F-1D70-9187108F0AB7}" = Catalyst Control Center Graphics Light
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{77E70C3C-DBB9-4C47-8663-1E1F81FEC623}" = Logitech QuickCam
"{79BF8F0E-A3A6-D677-F4AE-157BE4AB9E46}" = CCC Help Danish
"{7E9E6DC1-BE81-F3C8-2D61-F9AFADC7B2F8}" = CCC Help Chinese Standard
"{7EFE7605-8879-F08C-9EBD-F0B0EBEDE2AA}" = CCC Help French
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Gateway Recovery Management
"{81CA0ED5-7522-01D4-2E20-018033B50087}" = CCC Help Korean
"{82809116-D1EE-443C-AE31-F19E709DDF7A}" = AMD USB Filter Driver
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B999A44-8314-493B-877E-A1DA5B54D9B8}" = Catalyst Control Center - Branding
"{8BABD70E-F698-48BC-89E9-7823E594FA71}" = Darkfall US
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-001B-0000-0000-0000000FF1CE}" = Microsoft Office Word 2007
"{90120000-001B-0000-0000-0000000FF1CE}_WORD_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0000-0000-0000000FF1CE}_WORD_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_WORD_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_WORD_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_WORD_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_WORD_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_WORD_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_WORD_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_WORD_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_WORD_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_WORD_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91903291-1546-5B74-AC17-FDBBFD57D3F9}" = CCC Help Russian
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9579E862-5FC7-4337-B1CC-5E37451524C5}" = Motorola Driver Installation
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{974A6749-A030-9EC2-D200-7BD29CA886AC}" = ccc-core-static
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9D77E042-7D73-0DDA-DAEF-95AD3247C63F}" = Catalyst Control Center Localization All
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA404934-A326-AC94-154A-73F65B2DBEFE}" = CCC Help Finnish
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B04FC2D5-AE5C-1526-69B8-7121BD8CE3B1}" = CCC Help Swedish
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B1C45394-E332-23F3-35EE-4086C5167C29}" = Catalyst Control Center Core Implementation
"{B2163962-BFD2-4187-8B47-D9B24737DFD7}" = Kort's Spellcraft Calculator
"{B6C21804-0E6C-D4E6-0CF1-4E7F96AAE930}" = CCC Help Turkish
"{B8726461-A7C6-4628-A67C-FE5FC5FB3E9F}" = Software for Scanners
"{BF59CB97-0475-8CDC-1DEB-F6565D3868FA}" = CCC Help Greek
"{C3A68A9A-2541-6171-3092-09C8AFAC4924}" = CCC Help Italian
"{C44CB060-2AD1-11D6-BC84-00D0B7E10CD1}" = Veo Advanced Connect
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C713C8B5-F0E1-401D-AE9B-3AB0E180D626}" = WinDriversBackup
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D416328F-D3ED-4DFD-A8E0-C31466E8E039}" = Tube Toolbox
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4C3DAFC-2F7A-E7A9-89D1-70E53F44D231}" = Catalyst Control Center InstallProxy
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DCF9791F-07F7-3FE8-E639-22EAE582C244}" = CCC Help Norwegian
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}" = HP Deskjet 1000 J110 series Help
"{DEDB47A3-C988-4A43-A645-E2CEA571E680}" = Epson Easy Photo Print 2
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E7C97E98-4C2D-BEAF-5D2F-CC45A2F95D90}" = Acrobat.com
"{E7DF4F40-A0CE-430E-8B3B-DB7C8DF1C1A2}" = ActivePerl 5.10.1 Build 1006
"{EB7879B9-891A-2502-1CAC-4D328A7DA434}" = Catalyst Control Center Graphics Full Existing
"{EC3102A1-F7D5-F4D7-0BBE-E9A336852DD5}" = CCC Help Dutch
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Gateway Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F491018F-5B58-4F43-8253-544967F6A45A}_is1" = Y!Supra version 1.0.0.67
"{FA03EF4C-DE79-C463-6B50-AAC28A9A64FD}" = Catalyst Control Center Graphics Full New
"{FAAAA82D-E8FE-04C8-72D5-619A2632E1DF}" = CCC Help Chinese Traditional
"{FCB13E0B-09AD-7133-0B7E-52A157C6582E}" = CCC Help German
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"8461-7759-5462-8226" = Vuze
"Acoustica Effects Pack" = Acoustica Effects Pack
"Acoustica Mixcraft 5" = Acoustica Mixcraft 5
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AI RoboForm" = RoboForm 7-4-2 (All Users)
"AIM_7" = AIM 7
"Cake Poker 2.0" = Cake Poker 2.0
"Cake Poker(uninstall)" = Cake Poker
"Camfrog 6.1" = Camfrog Video Chat 6.1
"CFWebAdvancedU" = CamfrogWEB Advanced ActiveX Plugin (remove only)
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"ClubWPT" = ClubWPT
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DAEMON Tools Lite" = DAEMON Tools Lite
"Dark Age of Camelot" = Dark Age of Camelot
"Directory Submitter_is1" = Directory Submitter 1.0.29
"DivX Setup.divx.com" = DivX Setup
"ESET Online Scanner" = ESET Online Scanner v3
"FLVTube Player" = FLVTube Player
"Foxit Reader" = Foxit Reader
"FrostWire 5" = FrostWire 5.1.4
"GearBunnies_is1" = GearBunnyX and Classic 1.102
"Graboid Video" = Graboid Video 2.3
"HotspotShield" = Hotspot Shield 1.57
"iCall_is1" = iCall
"IceOp 6.3 6.3" = IceOp 6.3
"iDEN Carrier RSS" = iDEN Carrier RSS
"Identity Card" = Identity Card
"ImgBurn" = ImgBurn
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Gateway MyBackup
"LManager" = Launch Manager
"Logitech Vid" = Logitech Vid HD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"ManyCam" = ManyCam 2.6.65 (remove only)
"Mozilla Firefox 8.0 (x86 en-US)" = Mozilla Firefox 8.0 (x86 en-US)
"OUGO Messenger_is1" = OUGO Messenger
"Panda Cloud Antivirus" = Panda Cloud Antivirus
"PicPick" = PicPick
"Port_Detective_2.0" = Port Detective
"PowerISO" = PowerISO
"RealPlayer 12.0" = RealPlayer
"SpywareBlaster_is1" = SpywareBlaster 4.4
"TeamViewer 7" = TeamViewer 7
"The Weather Channel Desktop 6" = The Weather Channel Desktop 6
"Tor" = Tor 0.2.2.34
"Traffic Travis_is1" = Traffic Travis 3.3.0
"TVAnts 1.0" = TVAnts 1.0
"Universal Document Converter_is1" = Universal Document Converter (Demo)
"Unlocker" = Unlocker 1.9.0
"Vidalia" = Vidalia 0.2.15
"Vilongu HTTP SOCKS tunneler_is1" = Vilongu HTTP SOCKS tunneler 1.0.0
"VLC media player" = VLC media player 1.0.1
"Voxox" = Voxox 2.6.3
"webDOMinator_is1" = webDOMinator 3.0.0
"WildTangent gateway Master Uninstall" = Gateway Games
"WinLiveSuite" = Windows Live Essentials
"WORD" = Microsoft Office Word 2007
"Xvid Video Codec 1.3.1" = Xvid Video Codec
"Yahoo! Messenger" = Yahoo! Messenger
"Yazak Chat" = Yazak Chat 8.92.2

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Smilebox" = Smilebox
"SOE-DC Universe Online Live" = DC Universe Online Live
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

========== Alternate Data Streams ==========

@Alternate Data Stream - 81 bytes -> C:\Program Files (x86)\Cake Poker 2.0:MID
@Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:C0789917

< End of report >

[Broni]

Good news :)

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  FF - prefs.js..browser.search.defaultengine: "Ask.com"
  FF - prefs.js..browser.search.defaultenginename: "Ask.com"
  FF - prefs.js..browser.search.order.1: "Ask.com"
  [2011/08/14 22:48:42 | 000,002,572 | ---- | M] () -- C:\Users\Dan-LT\AppData\Roaming\Mozilla\Firefox\Profiles\ilvr329v.default\searchplugins\askcom.xml
  O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Dan-LT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk File not found
  O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
  O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
  O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
  O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
  O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
  O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
  O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
  O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
  O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
  O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
  O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
  O15 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\..Trusted Domains: freerealms.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\..Trusted Domains: soe.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-21-3767059194-2169123214-450175519-1001\..Trusted Domains: sony.com ([]* in Trusted sites)
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
  [2011/12/26 11:20:40 | 000,010,770 | -HS- | M] () -- C:\ProgramData\ut13yihf2ll5685fm4753sm2ex4kh5h3
  [2011/12/26 11:20:39 | 000,010,770 | -HS- | M] () -- C:\Users\Dan-LT\AppData\Local\ut13yihf2ll5685fm4753sm2ex4kh5h3
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [Reboot]
  

  
  
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
  
• You will get a log that shows the results of the fix. Please post it.

=====================================================================

1. Update your Java version here: http://www.java.com/...d/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
  
• Accept any prompts.

===================================================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

• Double-click SecurityCheck.exe
  
• Follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  
  NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

• Double click on TFC.exe to run the program.
  
• Click on Start button to begin cleaning process.
  
• TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

• Disable your antivirus program
  
• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• Accept any security warnings from your browser.
  
• Check Scan archives
  
• Click Start
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, click on List of found threats
  
• Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• NOTE. If Eset won't find any threats, it won't produce any log.

[ProblemsRBad]

Thanks!

All processes killed
========== OTL ==========
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
C:\Users\Dan-LT\AppData\Roaming\Mozilla\Firefox\Profiles\ilvr329v.default\searchplugins\askcom.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{d9288080-1baa-4bc4-9cf8-a92d743db949}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d9288080-1baa-4bc4-9cf8-a92d743db949}\ not found.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clonewarsadventures.com\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\freerealms.com\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\soe.com\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sony.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clonewarsadventures.com\ not found.
Registry key HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\freerealms.com\ not found.
Registry key HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\soe.com\ not found.
Registry key HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sony.com\ not found.
Registry key HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clonewarsadventures.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\freerealms.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\soe.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sony.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clonewarsadventures.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\freerealms.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\soe.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sony.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clonewarsadventures.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\freerealms.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\soe.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3767059194-2169123214-450175519-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sony.com\ deleted successfully.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\ProgramData\ut13yihf2ll5685fm4753sm2ex4kh5h3 moved successfully.
C:\Users\Dan-LT\AppData\Local\ut13yihf2ll5685fm4753sm2ex4kh5h3 moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes

User: All Users

User: AppData
->Temp folder emptied: 0 bytes

User: Dan-LT
->Temp folder emptied: 51962365 bytes
->Temporary Internet Files folder emptied: 55232965 bytes
->Java cache emptied: 161345592 bytes
->FireFox cache emptied: 47054835 bytes
->Flash cache emptied: 137618 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1794 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 3801 bytes

Total Files Cleaned = 301.00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: AppData

User: Dan-LT
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 12262011_171516

Files\Folders moved on Reboot...
C:\Users\Dan-LT\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Results of screen317's Security Check version 0.99.13
Windows 7 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
ESET Online Scanner v3
Panda Cloud Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Adobe Flash Player
Adobe Reader X (10.1.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
Panda Security Panda Cloud Antivirus PSANHost.exe
Panda Security Panda Cloud Antivirus PSUNMain.exe
``````````End of Log````````````

----------------------------------------------------------------------------------------------------------------------------------------------------------------------

Eset log


C:\Program Files (x86)\IObit\Advanced SystemCare 4\ASCpatch.exe a variant of Win32/Toolbar.Widgi application deleted - quarantined
C:\Qoobox\Quarantine\C\Users\Dan-LT\AppData\Local\csd.exe.vir a variant of Win32/Kryptik.YAP trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir Win64/Sirefef.G trojan cleaned by deleting - quarantined
C:\Users\Dan-LT\Downloads\gamebooster.exe a variant of Win32/Toolbar.Widgi application deleted - quarantined
C:\Users\Dan-LT\Podcasts\Tools\setup_1437822.exe a variant of Win32/Toolbar.Zugo application deleted - quarantined
C:\Windows\assembly\temp\U\80000032.@ probably a variant of Win32/Olmarik.AVQ trojan cleaned by deleting - quarantined

[Broni]

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
  
• Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

• Double-click OTL.exe to start the program.
  
• Close all other programs apart from OTL as this step will require a reboot
  
• On the OTL main screen, press the CLEANUP button
  
• Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/v...ning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingc.../topic2520.html

13. Please, let me know, how your computer is doing.
v

[ProblemsRBad]

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes

User: All Users

User: AppData
->Temp folder emptied: 0 bytes

User: Dan-LT
->Temp folder emptied: 8972576 bytes
->Temporary Internet Files folder emptied: 513788 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 53024157 bytes
->Flash cache emptied: 1226 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1794 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 60.00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: AppData

User: Dan-LT
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.31.0 log created on 12272011_002232

Files\Folders moved on Reboot...
C:\Users\Dan-LT\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...


The system is running much better now, thanks!

[Broni]

Way to go!!
Good luck and stay safe :)