TechSpot

Internet Explorer not responding properly ... very slow!

Solved
By piperca
Jan 4, 2011
Topic Status:
Not open for further replies.
  1. IE is not running properly. It takes forever to search with Google or to browse the internet in general. I get a lot of "looking for about:blank" messages in the bottom left corner of IE when attempting to redirect to a different page. I have scanned for viruses/malware; however, I have not found any. I am running Vista Home Premium.

    Attached is a current HJT log.
  2. Broni

    Broni Malware Annihilator Posts: 46,748   +254

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
  3. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Here's the Malwarebytes log:

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5461

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18999

    1/4/2011 8:57:15 PM
    mbam-log-2011-01-04 (20-57-15).txt

    Scan type: Quick scan
    Objects scanned: 193705
    Time elapsed: 6 minute(s), 33 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
  4. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Here's the GMER log:

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2011-01-04 21:03:58
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000064 SAMSUNG_ rev.ZZ10
    Running: x6d5dlhn.exe; Driver: C:\Users\Andrew\AppData\Local\Temp\uglcrpob.sys


    ---- System - GMER 1.0.15 ----

    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x90F44BAE]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0x90F449D2]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0x90F44B0C]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

    ---- Devices - GMER 1.0.15 ----

    Device \Driver\atapi \Device\Ide\IdePort0 86CB81F8
    Device \Driver\atapi \Device\Ide\IdePort1 86CB81F8
    Device \Driver\a2ppyosj \Device\Scsi\a2ppyosj1 88A4C1F8
    Device \Driver\a2ppyosj \Device\Scsi\a2ppyosj1Port5Path0Target0Lun0 88A4C1F8
    Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)
    Device \FileSystem\Ntfs \Ntfs 86CBA1F8

    AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
    AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

    ---- EOF - GMER 1.0.15 ----
  5. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Here's the DDS log:

    DDS (Ver_10-12-12.02) - NTFSx86
    Run by Andrew at 21:06:57.62 on Tue 01/04/2011
    Internet Explorer: 8.0.6001.18999
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1643 [GMT -8:00]

    AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
    SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\hp\support\hpsysdrv.exe
    C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Windows\system32\svchost.exe -k hpdevmgmt
    c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    C:\Program Files\Microsoft LifeCam\MSCamS32.exe
    c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\RtHDVCpl.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
    C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
    C:\Windows\system32\java.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Secunia\PSI\PSIA.exe
    C:\Program Files\SGPSA\ie3sh.exe
    C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe
    C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    C:\Program Files\Logitech\SetPointP\SetPoint.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\ehome\ehtray.exe
    C:\Garmin\gStart.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Program Files\Secunia\PSI\psi_tray.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\System32\mobsync.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
    C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
    C:\Program Files\Common Files\Teleca Shared\logger.exe
    C:\hp\kbd\kbd.exe
    C:\Program Files\Common Files\Teleca Shared\Generic.exe
    C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
    C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
    C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
    C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
    C:\Windows\system32\svchost.exe -k HPService
    C:\Windows\system32\svchost.exe -k WindowsMobile
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    C:\Program Files\Secunia\PSI\sua.exe
    C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Users\Andrew\Desktop\dds.scr
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://ww2.cox.com/myconnection/orangecounty/home.cox
    uSearch Page = hxxp://www.google.com
    uSearch Bar = Preserve
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    mSearchAssistant =
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No File
    BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - No File
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: {196C3A46-4758-433D-A600-802C804AF39C} - No File
    TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
    uRun: [gStart] c:\garmin\gStart.exe
    uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
    uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
    mRun: [KBD] c:\hp\kbd\KbdStub.EXE
    mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe"
    mRun: [RtHDVCpl] RtHDVCpl.exe
    mRun: [<NO NAME>]
    mRun: [SnapfishMediaDetector] c:\program files\snapfish media detector\SnapfishMediaDetector.exe
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
    mRun: [Acronis Scheduler2 Service] "c:\program files\common files\maxtor\schedule2\schedhlp.exe"
    mRun: [LELA] "c:\program files\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized
    mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
    mRun: [FBSSA] c:\program files\sgpsa\ie3sh.exe
    mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"
    mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [Mobile Connectivity Suite] "c:\program files\htc\htc sync\application launcher\Application Launcher.exe" /startoptions
    mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi_tray.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
    IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
    IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
    DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} - hxxps://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9}
    DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com/s/v/63.27/uploader2.cab
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp3.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\andrew\appdata\roaming\mozilla\firefox\profiles\j04kxzjj.default\
    FF - prefs.js: network.proxy.type - 0
    FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\users\andrew\appdata\roaming\facebook\npfbplugin_1_0_1.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

    ============= SERVICES / DRIVERS ===============

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2008-12-26 165584]
    R1 DCDisk;DCDisk;c:\windows\system32\drivers\DCDisk.sys [2007-10-7 23040]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-11-23 9968]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-11-23 74480]
    R1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\drivers\SWIPsec.sys [2010-1-22 87064]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-26 17744]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2008-12-26 50768]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-4-10 40384]
    R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-1-15 204800]
    R2 MSSQL$MYMOVIES;SQL Server (MYMOVIES);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2009-5-27 29262680]
    R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2010-12-21 987704]
    R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2010-12-21 399416]
    R2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\sonicwall\sonicwall global vpn client\SWGVCSvc.exe [2009-3-5 227352]
    R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2010-11-30 2222376]
    R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-4-10 40384]
    R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-4-10 40384]
    R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [2010-3-12 30576]
    R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
    R3 rt70x86;Linksys Home Wireless-G USB Adaptor Driver;c:\windows\system32\drivers\netr70.sys [2010-4-27 306016]
    R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-11-23 7408]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-28 135664]
    S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-2 21504]
    S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2010-10-19 39272]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-22 1493352]
    S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2009-6-10 24576]
    S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\drivers\WUSB54GCx86.sys [2007-3-12 256000]
    S3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\drivers\SWVNIC.sys [2009-3-4 21016]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

    =============== Created Last 30 ================

    2011-01-05 04:44:01 709456 ----a-w- c:\windows\isRS-000.tmp
    2011-01-05 03:51:24 388096 ----a-r- c:\users\andrew\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2011-01-05 03:51:23 -------- d-----w- c:\program files\Trend Micro
    2011-01-04 15:00:14 6273872 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{94652474-941b-4c84-b0f5-e7cbbf0080e3}\mpengine.dll
    2011-01-01 07:16:21 -------- d-----w- c:\program files\iPod
    2010-12-22 02:45:51 -------- d-----w- c:\users\andrew\appdata\local\Secunia PSI
    2010-12-19 19:57:39 -------- d-----w- c:\program files\PhotoCardMaker
    2010-12-16 05:28:56 916480 ----a-w- c:\windows\system32\wininet.dll

    ==================== Find3M ====================

    2010-12-02 03:35:18 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-11-30 01:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-30 01:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-04 18:56:07 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
    2010-11-04 18:55:38 352768 ----a-w- c:\windows\system32\taskschd.dll
    2010-11-04 18:55:38 270336 ----a-w- c:\windows\system32\taskcomp.dll
    2010-11-04 18:55:12 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2010-11-04 16:34:06 171520 ----a-w- c:\windows\system32\taskeng.exe
    2010-11-02 05:57:41 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-11-02 05:57:27 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2010-11-02 05:57:11 71680 ----a-w- c:\windows\system32\iesetup.dll
    2010-11-02 05:57:11 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2010-11-02 05:01:31 385024 ----a-w- c:\windows\system32\html.iec
    2010-11-02 04:26:10 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2010-11-02 04:24:44 1638912 ----a-w- c:\windows\system32\mshtml.tlb
    2010-10-28 15:44:56 34304 ----a-w- c:\windows\system32\atmlib.dll
    2010-10-28 13:27:47 292352 ----a-w- c:\windows\system32\atmfd.dll
    2010-10-28 13:20:12 2048 ----a-w- c:\windows\system32\tzres.dll
    2010-10-22 22:02:04 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-10-19 18:41:44 222080 ------w- c:\windows\system32\MpSigStub.exe
    2010-10-18 13:37:35 81920 ----a-w- c:\windows\system32\consent.exe
    2010-10-18 13:31:24 2038272 ----a-w- c:\windows\system32\win32k.sys

    ============= FINISH: 21:08:18.22 ===============
  6. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Here's the Attach log:


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-12.02)

    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 10/6/2007 6:51:23 PM
    System Uptime: 1/4/2011 8:45:10 PM (1 hours ago)

    Motherboard: ECS | | Nettle2
    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+ | Socket AM2 | 2600/201mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 364 GiB total, 194.139 GiB free.
    D: is FIXED (NTFS) - 9 GiB total, 1 GiB free.
    E: is CDROM (CDFS)
    H: is Removable
    I: is Removable
    J: is Removable
    K: is CDROM ()
    L: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: SonicWALL Virtual NIC
    Device ID: ROOT\SWVNIC\0000
    Manufacturer: SonicWALL
    Name: SonicWALL Virtual NIC
    PNP Device ID: ROOT\SWVNIC\0000
    Service: SWVNIC

    ==== System Restore Points ===================


    ==== Installed Programs ======================

    32 Bit HP CIO Components Installer
    Acrobat.com
    Activation Assistant for the 2007 Microsoft Office suites
    ActivePerl 5.10.1 Build 1007
    Adobe AIR
    Adobe Color Common Settings
    Adobe ExtendScript Toolkit 2
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.4.1
    Adobe Setup
    Adobe Shockwave Player 11.5
    AIO_CDA_ProductContext
    AIO_CDA_Software
    AIO_Scan
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Audacity 1.3.7 (Unicode)
    Auslogics Disk Defrag
    avast! Free Antivirus
    AviSynth 2.5
    Bonjour
    BufferChm
    C5100
    c5100_Help
    Canon RAW Image Task for ZoomBrowser EX
    Canon Utilities CameraWindow
    Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    Canon Utilities MyCamera
    Canon Utilities RemoteCapture Task for ZoomBrowser EX
    Canon Utilities ZoomBrowser EX
    Canon ZoomBrowser EX Memory Card Utility
    CCleaner
    CDBurnerXP
    Copy
    Coupon Printer for Windows
    CustomerResearchQFolder
    D3DX10
    Destination Component
    DeviceDiscovery
    DeviceManagementQFolder
    Disney Toontown Online
    DivX Plus Web Player
    DocProc
    DocProcQFolder
    DVDFab 6.2.0.5 (11/11/2009)
    eMule
    Enermax
    Enhanced Multimedia Keyboard Solution
    Eraser
    eReg
    eSupportQFolder
    Facebook Plug-In
    Fax
    ffdshow [rev 1723] [2007-12-24]
    Garmin Communicator Plugin
    Garmin Training Center
    Garmin USB Drivers
    Garmin WebUpdater
    GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
    GDR 4053 for SQL Server Tools and Workstation Components 2005 ENU (KB970892)
    Google Chrome
    Google Earth
    Google Toolbar for Internet Explorer
    Google Update Helper
    Google Updater
    Hardware Diagnostic Tools
    HiJackThis
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    HP Advisor
    HP Customer Experience Enhancements
    HP Customer Feedback
    HP Customer Participation Program 8.0
    HP Driver Diagnostics
    HP Easy Setup - Frontend
    HP Imaging Device Functions 8.0
    HP OCR Software 8.0
    HP On-Screen Cap/Num/Scroll Lock Indicator
    HP Photosmart Essential
    HP Photosmart Essential 2.0
    HP Photosmart Essential2.5
    HP Photosmart.All-In-One Driver Software 8.0 .A
    HP Picasso Media Center Add-In
    HP Product Assistant
    HP Product Detection
    HP Solution Center 8.0
    HP Update
    HPProductAssistant
    HPSSupply
    HTC Driver Installer
    HTC Sync
    InterActual Player
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 22
    Junk Mail filter update
    KhalInstallWrapper
    LightScribe 1.4.142.1
    Linksys EasyLink Advisor
    Linksys Updater
    Logitech SetPoint 6.15
    Malwarebytes' Anti-Malware
    MarketResearch
    Memorex exPressit Label Design Studio
    Microsoft .NET Compact Framework 2.0 SP1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft Corporation
    Microsoft IntelliPoint 6.2
    Microsoft LifeCam
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Live Add-in 1.5
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Professional 2007
    Microsoft Office Professional Edition 2003
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Outlook Personal Folders Backup
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft SQL Server 2005 Express Edition (MYMOVIES)
    Microsoft SQL Server 2005 Tools Express Edition
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Works
    MobileMe Control Panel
    Mozilla Firefox (3.6.13)
    MSVCRT
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB941833)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    muvee autoProducer 6.0
    My HP Games
    My Movies for Windows Media Center
    NetDeviceManager
    NVIDIA Drivers
    OGA Notifier 2.0.0048.0
    Omron Health Management Software
    PhotoCardMaker 1.0.3
    Picasa 3
    PSSWCORE
    Pure Networks Platform
    Python 2.4.3
    QuickTime
    Realtek High Definition Audio Driver
    Revo Uninstaller 1.88
    Rhapsody Player Engine
    Roxio Activation Module
    Roxio Creator Audio
    Roxio Creator Basic v9
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator EasyArchive
    Roxio Creator Tools
    Roxio Express Labeler 3
    Roxio MyDVD Basic v9
    Samsung Master
    Samsung USB Driver
    Scan
    Secunia PSI (2.0.0.1003)
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2289158)
    Security Update for 2007 Microsoft Office System (KB2344875)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB2345035)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office Outlook 2007 (KB2288953)
    Security Update for Microsoft Office PowerPoint 2007 (KB982158)
    Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
    Security Update for Microsoft Office Publisher 2007 (KB2284697)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    Segoe UI
    Shanghai Dynasty
    Shop for HP Supplies
    Skype web features
    Skype™ 4.2
    Snapfish Media Detector
    Soft Data Fax Modem with SmartCP
    SolutionCenter
    SonicWALL Global VPN Client
    Sony DVD Architect Studio 4.5
    Spelling Dictionaries Support For Adobe Reader 9
    SportTracks 2.1
    SportTracks 3.0
    Status
    SUPERAntiSpyware Free Edition
    Switch
    System Requirements Lab
    TeamViewer 6
    Toolbox
    TrayApp
    Unity Web Player
    UnloadSupport
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Access 2007 Help (KB963663)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office Outlook 2007 Help (KB963677)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Publisher 2007 Help (KB963667)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Update for Outlook 2007 Junk Email Filter (KB2466076)
    VC80CRTRedist - 8.0.50727.4053
    Vegas Movie Studio Platinum 9.0
    Virtual Earth 3D (Beta)
    WebIQ Technology Engine
    WebReg
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Mail
    Windows Live Messenger
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live Sync
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Windows Mobile Device Center
    Windows Mobile Device Center Driver Update
    WinRAR archiver
    Wizard101
    Yahoo! Toolbar
    Zune
    Zune Language Pack (ES)
    Zune Language Pack (FR)

    ==== End Of File ===========================
  7. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Okay, I think that is it. Please let me know if I've missed something.

    Thanks for your help!
  8. Broni

    Broni Malware Annihilator Posts: 46,748   +254

    Sure thing :)

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    ========================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
  9. piperca

    piperca TS Rookie Topic Starter Posts: 24

    MBRcheck log:

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows Vista Home Premium Edition
    Windows Information: Service Pack 2 (build 6002), 32-bit
    Base Board Manufacturer: ECS
    BIOS Manufacturer: Phoenix Technologies, LTD
    System Manufacturer: HP-Pavilion
    System Product Name: GC671AAR-ABA a6130n
    Logical Drives Mask: 0x00000f9c

    Kernel Drivers (total 171):
    0x83840000 \SystemRoot\system32\ntkrnlpa.exe
    0x8380D000 \SystemRoot\system32\hal.dll
    0x80405000 \SystemRoot\system32\kdcom.dll
    0x8040C000 \SystemRoot\system32\PSHED.dll
    0x8041D000 \SystemRoot\system32\BOOTVID.dll
    0x80425000 \SystemRoot\system32\CLFS.SYS
    0x80466000 \SystemRoot\system32\CI.dll
    0x80546000 \SystemRoot\system32\drivers\Wdf01000.sys
    0x805C2000 \SystemRoot\system32\drivers\WDFLDR.SYS
    0x80606000 \SystemRoot\System32\Drivers\spfu.sys
    0x80706000 \SystemRoot\System32\Drivers\WMILIB.SYS
    0x8070F000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
    0x80735000 \SystemRoot\system32\drivers\acpi.sys
    0x8077B000 \SystemRoot\system32\drivers\msisadrv.sys
    0x80783000 \SystemRoot\system32\drivers\pci.sys
    0x807AA000 \SystemRoot\System32\drivers\partmgr.sys
    0x807B9000 \SystemRoot\system32\drivers\volmgr.sys
    0x83E0F000 \SystemRoot\System32\drivers\volmgrx.sys
    0x83E59000 \SystemRoot\system32\drivers\pciide.sys
    0x83E60000 \SystemRoot\system32\drivers\PCIIDEX.SYS
    0x83E6E000 \SystemRoot\System32\drivers\mountmgr.sys
    0x83E7E000 \SystemRoot\system32\drivers\atapi.sys
    0x83E86000 \SystemRoot\system32\drivers\ataport.SYS
    0x83EA4000 \SystemRoot\system32\drivers\nvstor32.sys
    0x83EC1000 \SystemRoot\system32\drivers\storport.sys
    0x83F02000 \SystemRoot\system32\drivers\fltmgr.sys
    0x83F34000 \SystemRoot\system32\drivers\fileinfo.sys
    0x83F44000 \SystemRoot\System32\Drivers\PxHelp20.sys
    0x83F4D000 \SystemRoot\System32\Drivers\ksecdd.sys
    0x8B80A000 \SystemRoot\system32\drivers\ndis.sys
    0x8B915000 \SystemRoot\system32\drivers\msrpc.sys
    0x8B940000 \SystemRoot\system32\drivers\NETIO.SYS
    0x8BA01000 \SystemRoot\System32\drivers\tcpip.sys
    0x8BAEB000 \SystemRoot\System32\drivers\fwpkclnt.sys
    0x8BC0E000 \SystemRoot\System32\Drivers\Ntfs.sys
    0x8BD1E000 \SystemRoot\system32\drivers\volsnap.sys
    0x8BD57000 \SystemRoot\System32\Drivers\spldr.sys
    0x8BD5F000 \SystemRoot\System32\Drivers\mup.sys
    0x8BD6E000 \SystemRoot\System32\drivers\ecache.sys
    0x8BD95000 \SystemRoot\system32\drivers\disk.sys
    0x8BDA6000 \SystemRoot\system32\drivers\CLASSPNP.SYS
    0x8BDC7000 \SystemRoot\system32\drivers\crcdisk.sys
    0x8BDE7000 \SystemRoot\system32\DRIVERS\tunnel.sys
    0x8BDF2000 \SystemRoot\system32\DRIVERS\tunmp.sys
    0x8BB23000 \SystemRoot\system32\DRIVERS\amdk8.sys
    0x8BC00000 \SystemRoot\system32\DRIVERS\usbohci.sys
    0x8BB33000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0x8BB71000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0x8BB80000 \SystemRoot\system32\DRIVERS\HSXHWBS2.sys
    0x8BBCC000 \SystemRoot\system32\DRIVERS\ks.sys
    0x8FC05000 \SystemRoot\system32\DRIVERS\HSX_DP.sys
    0x8FD07000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
    0x8FDBC000 \SystemRoot\system32\drivers\modem.sys
    0x8FDC9000 \SystemRoot\system32\DRIVERS\ohci1394.sys
    0x8FDD9000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
    0x8FE0C000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
    0x8FE99000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
    0x8FF99000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0x8FFB1000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    0x90205000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    0x90B5D000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
    0x90B5F000 \SystemRoot\System32\drivers\dxgkrnl.sys
    0x8FFB7000 \SystemRoot\System32\drivers\watchdog.sys
    0x8FFC3000 \SystemRoot\System32\Drivers\a2ppyosj.SYS
    0x8B97B000 \SystemRoot\system32\DRIVERS\dne2000.sys
    0x8B99A000 \SystemRoot\system32\DRIVERS\msiscsi.sys
    0x8FE00000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0x8FDE7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0x8B9C9000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0x8B9D4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0x83FBE000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0x83FCD000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0x83FE1000 \SystemRoot\system32\DRIVERS\rassstp.sys
    0x83E00000 \SystemRoot\System32\Drivers\pcouffin.sys
    0x807C8000 \SystemRoot\system32\DRIVERS\termdd.sys
    0x807D8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0x807E3000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0x90200000 \SystemRoot\system32\DRIVERS\swenum.sys
    0x8BBF6000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0x807EE000 \SystemRoot\system32\DRIVERS\umbus.sys
    0x90E09000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0x90E3E000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0x91001000 \SystemRoot\system32\drivers\RTKVHDA.sys
    0x9129E000 \SystemRoot\system32\drivers\portcls.sys
    0x912CB000 \SystemRoot\system32\drivers\drmk.sys
    0x912F0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0x912F9000 \SystemRoot\System32\Drivers\Null.SYS
    0x91300000 \SystemRoot\System32\Drivers\Beep.SYS
    0x91323000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    0x9132A000 \SystemRoot\System32\drivers\vga.sys
    0x91336000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
    0x91357000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0x9136E000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0x91370000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0x91378000 \SystemRoot\system32\DRIVERS\hidusb.sys
    0x91381000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    0x91391000 \SystemRoot\system32\drivers\rdpencdd.sys
    0x91399000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
    0x913A1000 \SystemRoot\System32\Drivers\Msfs.SYS
    0x913AC000 \SystemRoot\system32\DRIVERS\kbdhid.sys
    0x913B5000 \SystemRoot\System32\Drivers\Npfs.SYS
    0x913C3000 \SystemRoot\system32\DRIVERS\mouhid.sys
    0x913CB000 \SystemRoot\System32\DRIVERS\rasacd.sys
    0x913D4000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
    0x913DC000 \??\C:\Windows\system32\Drivers\SWIPsec.sys
    0x91307000 \SystemRoot\system32\DRIVERS\tdx.sys
    0x913F4000 \SystemRoot\System32\Drivers\aswTdi.SYS
    0x9160E000 \SystemRoot\system32\DRIVERS\kl1.sys
    0x91B2D000 \SystemRoot\system32\DRIVERS\netr70.sys
    0x91B7C000 \SystemRoot\system32\DRIVERS\smb.sys
    0x91B90000 \SystemRoot\system32\drivers\afd.sys
    0x91BD8000 \SystemRoot\System32\Drivers\aswRdr.SYS
    0x90E4F000 \SystemRoot\System32\DRIVERS\netbt.sys
    0x91BDD000 \SystemRoot\system32\DRIVERS\pacer.sys
    0x91600000 \SystemRoot\system32\DRIVERS\netbios.sys
    0x90E81000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0x90E94000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
    0x91BF3000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    0x90EB9000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0x90EF5000 \SystemRoot\system32\drivers\nsiproxy.sys
    0x90EFF000 \SystemRoot\System32\Drivers\dfsc.sys
    0x90F16000 \SystemRoot\System32\Drivers\DCDisk.SYS
    0x90F25000 \SystemRoot\System32\Drivers\nx6000.sys
    0x90F2F000 \SystemRoot\System32\Drivers\aswSP.SYS
    0x90F56000 \SystemRoot\System32\Drivers\usbvideo.sys
    0x90F77000 \SystemRoot\system32\drivers\usbaudio.sys
    0x90F89000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    0x90F9E000 \SystemRoot\system32\DRIVERS\cdfs.sys
    0x90FB4000 \SystemRoot\System32\Drivers\crashdmp.sys
    0x90FC1000 \SystemRoot\System32\Drivers\dump_diskdump.sys
    0x90FCB000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
    0x9C6B0000 \SystemRoot\System32\win32k.sys
    0x90FE8000 \SystemRoot\System32\drivers\Dxapi.sys
    0x8BDD0000 \SystemRoot\system32\DRIVERS\monitor.sys
    0x9C8D0000 \SystemRoot\System32\TSDDD.dll
    0x9C8F0000 \SystemRoot\System32\cdd.dll
    0x9C900000 \SystemRoot\System32\ATMFD.DLL
    0x8BB06000 \SystemRoot\system32\drivers\luafv.sys
    0x81406000 \??\C:\Windows\system32\drivers\aswMonFlt.sys
    0x8143D000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
    0x81448000 \SystemRoot\system32\drivers\spsys.sys
    0x814F8000 \SystemRoot\system32\DRIVERS\lltdio.sys
    0x81508000 \SystemRoot\system32\DRIVERS\nwifi.sys
    0x81532000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0x8153C000 \SystemRoot\system32\DRIVERS\pnarp.sys
    0x81546000 \SystemRoot\system32\DRIVERS\purendis.sys
    0x81550000 \SystemRoot\system32\DRIVERS\rspndr.sys
    0x81563000 \SystemRoot\system32\drivers\HTTP.sys
    0x815D0000 \SystemRoot\System32\DRIVERS\srvnet.sys
    0x805CF000 \SystemRoot\system32\DRIVERS\bowser.sys
    0x805E8000 \SystemRoot\System32\drivers\mpsdrv.sys
    0xA2C01000 \SystemRoot\system32\drivers\mrxdav.sys
    0xA2C22000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xA2C41000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    0xA2C7A000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    0xA2C92000 \SystemRoot\System32\DRIVERS\srv2.sys
    0xA2CBA000 \SystemRoot\System32\DRIVERS\srv.sys
    0xA2D08000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    0xA2D0C000 \SystemRoot\system32\drivers\peauth.sys
    0xA2DEA000 \SystemRoot\System32\Drivers\secdrv.SYS
    0xA2DF4000 \SystemRoot\System32\drivers\tcpipreg.sys
    0xB4C07000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
    0xB4C1C000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
    0xB4C2E000 \SystemRoot\system32\DRIVERS\xaudio.sys
    0xB4C36000 \SystemRoot\system32\DRIVERS\psi_mf.sys
    0xB4C39000 \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
    0xB4C46000 \??\C:\Users\Andrew\AppData\Local\Temp\uglcrpob.sys
    0xB4C5E000 \??\C:\Users\Andrew\AppData\Local\Temp\mbr.sys
    0xB4C65000 \SystemRoot\system32\DRIVERS\asyncmac.sys
    0x779B0000 \Windows\System32\ntdll.dll
    0x10000000 \Program Files\DAEMON Tools Lite\daemon.dll

    Processes (total 110):
    0 System Idle Process
    4 System
    576 C:\Windows\System32\smss.exe
    644 csrss.exe
    696 C:\Windows\System32\wininit.exe
    708 csrss.exe
    740 C:\Windows\System32\services.exe
    756 C:\Windows\System32\lsass.exe
    764 C:\Windows\System32\lsm.exe
    844 C:\Windows\System32\winlogon.exe
    944 C:\Windows\System32\svchost.exe
    1008 C:\Windows\System32\nvvsvc.exe
    1040 C:\Windows\System32\svchost.exe
    1100 C:\Windows\System32\svchost.exe
    1212 C:\Windows\System32\svchost.exe
    1252 C:\Windows\System32\svchost.exe
    1264 C:\Windows\System32\svchost.exe
    1340 C:\Windows\System32\audiodg.exe
    1364 C:\Windows\System32\svchost.exe
    1388 C:\Windows\System32\SLsvc.exe
    1412 C:\Windows\System32\svchost.exe
    1532 C:\Windows\System32\nvvsvc.exe
    1624 C:\Windows\System32\svchost.exe
    1780 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    316 C:\Windows\System32\spoolsv.exe
    568 C:\Windows\System32\svchost.exe
    596 C:\Windows\System32\taskeng.exe
    1572 C:\Windows\System32\dwm.exe
    2068 C:\Windows\System32\taskeng.exe
    2084 C:\Windows\explorer.exe
    2444 C:\Program Files\Windows Defender\MSASCui.exe
    2464 C:\hp\support\hpsysdrv.exe
    2584 C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
    2604 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    2644 C:\Program Files\Bonjour\mDNSResponder.exe
    2656 C:\Windows\System32\svchost.exe
    2688 C:\Windows\System32\svchost.exe
    2720 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    2796 C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    2888 C:\Program Files\Microsoft LifeCam\MSCamS32.exe
    2904 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    2932 C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
    2944 C:\Windows\System32\svchost.exe
    2980 C:\Windows\System32\svchost.exe
    2988 C:\Windows\RtHDVCpl.exe
    3000 C:\Windows\System32\svchost.exe
    3028 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    3044 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    3060 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    3072 C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
    3096 C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
    3104 C:\Windows\System32\java.exe
    3212 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    3220 C:\Program Files\Secunia\PSI\psia.exe
    3240 C:\Program Files\SGPSA\ie3sh.exe
    3268 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    3316 C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe
    3668 C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
    3892 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    3912 C:\Program Files\Logitech\SetPointP\SetPoint.exe
    3952 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    3968 C:\Program Files\iTunes\iTunesHelper.exe
    3984 C:\Windows\ehome\ehtray.exe
    4012 C:\Garmin\gStart.exe
    4032 C:\Windows\ehome\ehmsas.exe
    4048 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    2280 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    2248 C:\Program Files\Skype\Phone\Skype.exe
    2148 C:\Windows\System32\svchost.exe
    904 C:\Program Files\Windows Media Player\wmpnscfg.exe
    2492 C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
    2964 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    3020 C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
    3548 C:\Windows\System32\svchost.exe
    3572 C:\Program Files\Secunia\PSI\psi_tray.exe
    3964 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    2168 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    2288 C:\Windows\System32\SearchIndexer.exe
    1396 C:\Windows\System32\mobsync.exe
    2860 WUDFHost.exe
    1448 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    4496 C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
    4784 C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
    4836 C:\Program Files\Common Files\Teleca Shared\logger.exe
    4916 C:\hp\KBD\kbd.exe
    5156 C:\Program Files\Common Files\Teleca Shared\Generic.exe
    5332 C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
    5344 C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
    5656 C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
    5764 C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
    5804 C:\Windows\System32\svchost.exe
    6028 C:\Windows\System32\svchost.exe
    1652 C:\Program Files\Windows Media Player\wmpnetwk.exe
    1476 C:\Program Files\iPod\bin\iPodService.exe
    5512 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    4436 C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    2328 C:\Program Files\Secunia\PSI\sua.exe
    4316 C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    2224 C:\Windows\System32\wbem\unsecapp.exe
    3112 WmiPrvSE.exe
    5956 C:\Windows\System32\ctfmon.exe
    5928 C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE
    3740 C:\Program Files\HTC\HTC Sync\Sync Manager\SyncIndicator.exe
    3396 C:\Program Files\Internet Explorer\iexplore.exe
    920 C:\Program Files\Internet Explorer\iexplore.exe
    5996 C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
    2400 C:\Program Files\Internet Explorer\iexplore.exe
    4320 C:\Windows\System32\SearchProtocolHost.exe
    3716 C:\Windows\System32\SearchFilterHost.exe
    2828 C:\Users\Andrew\Desktop\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
    \\.\D: --> \\.\PhysicalDrive0 at offset 0x0000005a`ef3f7600 (NTFS)

    PhysicalDrive0 Model Number: SAMSUNGHD400LJ, Rev: ZZ10

    Size Device Name MBR Status
    --------------------------------------------
    372 GB \\.\PhysicalDrive0 Hewlett-Packard MBR code detected
    SHA1: 161E5DF10EB9B6EAC4AA8DF99305EF77B11BEBD8


    Done!
  10. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Combofix log:

    ComboFix 11-01-04.04 - Andrew 01/04/2011 21:52:03.1.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1511 [GMT -8:00]
    Running from: c:\users\Andrew\Desktop\ComboFix.exe
    AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
    SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\SGPSA
    c:\program files\SGPSA\BHO.dll
    c:\program files\SGPSA\ie3sh.exe
    c:\users\Andrew\AppData\Roaming\inst.exe
    c:\users\Public\RemoveSGP.exe
    c:\windows\system32\drivers\OCA_LOG.TXT
    c:\windows\system32\MSVBVM60.$$A

    .
    ((((((((((((((((((((((((( Files Created from 2010-12-05 to 2011-01-05 )))))))))))))))))))))))))))))))
    .

    2011-01-05 06:02 . 2011-01-05 06:02 -------- d-----w- c:\users\Andrew\AppData\Local\temp
    2011-01-05 06:02 . 2011-01-05 06:02 -------- d-----w- c:\users\Lilly\AppData\Local\temp
    2011-01-05 04:44 . 2011-01-05 04:44 709456 ----a-w- c:\windows\isRS-000.tmp
    2011-01-05 03:51 . 2011-01-05 03:51 388096 ----a-r- c:\users\Andrew\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-01-05 03:51 . 2011-01-05 03:51 -------- d-----w- c:\program files\Trend Micro
    2011-01-04 15:00 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94652474-941B-4C84-B0F5-E7CBBF0080E3}\mpengine.dll
    2011-01-01 07:16 . 2011-01-01 07:16 -------- d-----w- c:\program files\iPod
    2010-12-22 03:30 . 2010-12-22 03:30 -------- d-----w- c:\program files\QuickTime
    2010-12-22 02:45 . 2010-12-22 02:45 -------- d-----w- c:\users\Andrew\AppData\Local\Secunia PSI
    2010-12-19 19:57 . 2010-12-19 19:57 -------- d-----w- c:\program files\PhotoCardMaker
    2010-12-16 05:28 . 2010-11-02 06:03 638232 ----a-w- c:\program files\Internet Explorer\iexplore.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-21 02:09 . 2008-12-27 01:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-21 02:08 . 2008-12-27 01:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-11-30 01:38 . 2010-11-30 01:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-30 01:38 . 2010-11-30 01:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-10-22 22:02 . 2010-10-22 22:02 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-10-19 18:41 . 2009-10-03 15:13 222080 ------w- c:\windows\system32\MpSigStub.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-16 39408]
    "gStart"="c:\garmin\gStart.exe" [2008-08-13 1891416]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-23 2001648]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26194728]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
    "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
    "OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
    "RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
    "SnapfishMediaDetector"="c:\program files\Snapfish Media Detector\SnapfishMediaDetector.exe" [2007-03-02 1441792]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
    "Acronis Scheduler2 Service"="c:\program files\Common Files\Maxtor\Schedule2\schedhlp.exe" [2007-08-09 148760]
    "LELA"="c:\program files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe" [2008-05-01 131072]
    "nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-04-09 648504]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
    "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-03-13 119152]
    "avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-30 13797992]
    "Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" [2009-11-19 598016]
    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-14 421160]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
    Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2010-12-21 291896]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Enermax.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Enermax.lnk
    backup=c:\windows\pss\Enermax.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
    backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
    2007-07-28 21:05 277328 ----a-w- c:\program files\Eraser\Eraser.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
    2009-08-26 19:38 122368 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
    2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
    2007-05-31 16:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1000]
    "EnableNotifications"=dword:00000001
    "EnableNotificationsRef"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1001]
    "EnableNotifications"=dword:00000001
    "EnableNotificationsRef"=dword:00000001

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 135664]
    R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-01-15 204800]
    R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-06-10 24576]
    R3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\DRIVERS\WUSB54GCx86.sys [2007-03-12 256000]
    R3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\DRIVERS\swvnic.sys [2009-03-05 21016]
    R3 ttermdd;ttermdd;c:\users\Andrew\AppData\Local\Temp\ttermdd.sys [x]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-11-21 717296]
    S1 aswSP;aswSP; [x]
    S1 DCDisk;DCDisk; [x]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-11-23 9968]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-11-23 74480]
    S1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\Drivers\SWIPsec.sys [2009-03-06 87064]
    S2 aswFsBlk;aswFsBlk; [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
    S2 MSSQL$MYMOVIES;SQL Server (MYMOVIES);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
    S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2010-12-21 987704]
    S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2010-12-21 399416]
    S2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe [2009-03-06 227352]
    S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2010-11-30 2222376]
    S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-03-13 30576]
    S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
    S3 rt70x86;Linksys Home Wireless-G USB Adaptor Driver;c:\windows\system32\DRIVERS\netr70.sys [2010-04-27 306016]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-11-23 7408]


    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - UGLCRPOB
    *Deregistered* - uglcrpob

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    WindowsMobile REG_MULTI_SZ wcescomm rapimgr
    LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
    bthsvcs REG_MULTI_SZ BthServ
    HPService REG_MULTI_SZ HPSLPSVC
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder

    2011-01-05 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-11-07 03:19]

    2011-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 18:40]

    2011-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 18:40]

    2011-01-04 c:\windows\Tasks\User_Feed_Synchronization-{30A0782B-8CD6-4FEA-AFA6-7DAAE2E1E03A}.job
    - c:\windows\system32\msfeedssync.exe [2010-12-16 04:25]

    2011-01-05 c:\windows\Tasks\User_Feed_Synchronization-{8D9F3B64-1F15-4366-BE8C-370FFD9B6EEA}.job
    - c:\windows\system32\msfeedssync.exe [2010-12-16 04:25]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://ww2.cox.com/myconnection/orangecounty/home.cox
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
    DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab
    FF - ProfilePath - c:\users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\j04kxzjj.default\
    FF - prefs.js: network.proxy.type - 0
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    .
    - - - - ORPHANS REMOVED - - - -

    Toolbar-Locked - (no file)
    WebBrowser-{196C3A46-4758-433D-A600-802C804AF39C} - (no file)
    HKLM-Run-FBSSA - c:\program files\SGPSA\ie3sh.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-01-04 22:02
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    FBSSA = c:\program files\SGPSA\ie3sh.exe?et Explorer\URLSearchHooks?????????17.js??????????????????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    Completion time: 2011-01-04 22:07:34
    ComboFix-quarantined-files.txt 2011-01-05 06:07

    Pre-Run: 208,253,411,328 bytes free
    Post-Run: 208,586,145,792 bytes free

    Current=1 Default=1 Failed=0 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,11
    - - End Of File - - D07F96209613FB842E0783597735696F
  11. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Okay, waiting for further instruction ...
     
  12. Broni

    Broni Malware Annihilator Posts: 46,748   +254

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
    c:\users\Andrew\AppData\Local\Temp\ttermdd.sys
    
    
    Folder::
    c:\program files\SGPSA
    
    Driver::
    ttermdd
    
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=
    [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
    FBSSA =-
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
  13. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Here's the new Combofix log:

    ComboFix 11-01-05.01 - Andrew 01/05/2011 16:25:12.2.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1566 [GMT -8:00]
    Running from: c:\users\Andrew\Desktop\ComboFix.exe
    Command switches used :: c:\users\Andrew\Desktop\CFScript.txt
    AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
    SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    FILE ::
    "c:\users\Andrew\AppData\Local\Temp\ttermdd.sys"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_ttermdd


    ((((((((((((((((((((((((( Files Created from 2010-12-06 to 2011-01-06 )))))))))))))))))))))))))))))))
    .

    2011-01-06 00:36 . 2011-01-06 00:36 -------- d-----w- c:\users\Lilly\AppData\Local\temp
    2011-01-06 00:36 . 2011-01-06 00:36 -------- d-----w- c:\users\Lilly.Andrew-PC\AppData\Local\temp
    2011-01-06 00:36 . 2011-01-06 00:36 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-01-06 00:36 . 2011-01-06 00:36 -------- d-----w- c:\users\Cathie\AppData\Local\temp
    2011-01-05 06:07 . 2011-01-06 00:40 -------- d-----w- c:\users\Andrew\AppData\Local\temp
    2011-01-05 03:51 . 2011-01-05 03:51 388096 ----a-r- c:\users\Andrew\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-01-05 03:51 . 2011-01-05 03:51 -------- d-----w- c:\program files\Trend Micro
    2011-01-04 15:00 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94652474-941B-4C84-B0F5-E7CBBF0080E3}\mpengine.dll
    2011-01-01 07:16 . 2011-01-01 07:16 -------- d-----w- c:\program files\iPod
    2010-12-22 03:30 . 2010-12-22 03:30 -------- d-----w- c:\program files\QuickTime
    2010-12-22 02:45 . 2010-12-22 02:45 -------- d-----w- c:\users\Andrew\AppData\Local\Secunia PSI
    2010-12-19 19:57 . 2010-12-19 19:57 -------- d-----w- c:\program files\PhotoCardMaker
    2010-12-16 05:28 . 2010-11-02 06:03 638232 ----a-w- c:\program files\Internet Explorer\iexplore.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-21 02:09 . 2008-12-27 01:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-21 02:08 . 2008-12-27 01:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-11-30 01:38 . 2010-11-30 01:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-30 01:38 . 2010-11-30 01:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-10-22 22:02 . 2010-10-22 22:02 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-10-19 18:41 . 2009-10-03 15:13 222080 ------w- c:\windows\system32\MpSigStub.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-16 39408]
    "gStart"="c:\garmin\gStart.exe" [2008-08-13 1891416]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-23 2001648]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26194728]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
    "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
    "OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
    "RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
    "SnapfishMediaDetector"="c:\program files\Snapfish Media Detector\SnapfishMediaDetector.exe" [2007-03-02 1441792]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
    "Acronis Scheduler2 Service"="c:\program files\Common Files\Maxtor\Schedule2\schedhlp.exe" [2007-08-09 148760]
    "LELA"="c:\program files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe" [2008-05-01 131072]
    "nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-04-09 648504]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
    "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-03-13 119152]
    "avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-30 13797992]
    "Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" [2009-11-19 598016]
    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-14 421160]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
    Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2010-12-21 291896]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Enermax.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Enermax.lnk
    backup=c:\windows\pss\Enermax.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
    backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
    2007-07-28 21:05 277328 ----a-w- c:\program files\Eraser\Eraser.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
    2009-08-26 19:38 122368 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
    2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
    2007-05-31 16:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1000]
    "EnableNotifications"=dword:00000001
    "EnableNotificationsRef"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1001]
    "EnableNotifications"=dword:00000001
    "EnableNotificationsRef"=dword:00000001

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 135664]
    R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-06-10 24576]
    R3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\DRIVERS\WUSB54GCx86.sys [2007-03-12 256000]
    R3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\DRIVERS\swvnic.sys [2009-03-05 21016]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-11-21 717296]
    S1 aswSP;aswSP; [x]
    S1 DCDisk;DCDisk; [x]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-11-23 9968]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-11-23 74480]
    S1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\Drivers\SWIPsec.sys [2009-03-06 87064]
    S2 aswFsBlk;aswFsBlk; [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
    S2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-01-15 204800]
    S2 MSSQL$MYMOVIES;SQL Server (MYMOVIES);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
    S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2010-12-21 987704]
    S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2010-12-21 399416]
    S2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe [2009-03-06 227352]
    S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2010-11-30 2222376]
    S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-03-13 30576]
    S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
    S3 rt70x86;Linksys Home Wireless-G USB Adaptor Driver;c:\windows\system32\DRIVERS\netr70.sys [2010-04-27 306016]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-11-23 7408]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    WindowsMobile REG_MULTI_SZ wcescomm rapimgr
    LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
    bthsvcs REG_MULTI_SZ BthServ
    HPService REG_MULTI_SZ HPSLPSVC
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder

    2011-01-06 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-11-07 03:19]

    2011-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 18:40]

    2011-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 18:40]

    2011-01-06 c:\windows\Tasks\User_Feed_Synchronization-{30A0782B-8CD6-4FEA-AFA6-7DAAE2E1E03A}.job
    - c:\windows\system32\msfeedssync.exe [2010-12-16 04:25]

    2011-01-06 c:\windows\Tasks\User_Feed_Synchronization-{8D9F3B64-1F15-4366-BE8C-370FFD9B6EEA}.job
    - c:\windows\system32\msfeedssync.exe [2010-12-16 04:25]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://ww2.cox.com/myconnection/orangecounty/home.cox
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
    DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab
    FF - ProfilePath - c:\users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\j04kxzjj.default\
    FF - prefs.js: network.proxy.type - 0
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-01-05 16:42
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\windows\TEMP\SEP8B04.tmp 0 bytes

    scan completed successfully
    hidden files: 1

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\nvvsvc.exe
    c:\windows\system32\nvvsvc.exe
    c:\program files\Alwil Software\Avast5\AvastSvc.exe
    c:\program files\Common Files\Maxtor\Schedule2\schedul2.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\program files\Microsoft LifeCam\MSCamS32.exe
    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\windows\system32\java.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    c:\windows\system32\WUDFHost.exe
    c:\windows\RtHDVCpl.exe
    c:\program files\Alwil Software\Avast5\AvastUI.exe
    c:\windows\ehome\ehmsas.exe
    c:\program files\Microsoft IntelliPoint\dpupdchk.exe
    c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
    c:\windows\system32\wbem\unsecapp.exe
    c:\program files\Common Files\Teleca Shared\Generic.exe
    c:\program files\Common Files\Teleca Shared\logger.exe
    c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
    c:\program files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
    c:\program files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
    c:\program files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
    c:\program files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
    c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
    c:\program files\Common Files\Java\Java Update\jucheck.exe
    c:\windows\servicing\TrustedInstaller.exe
    .
    **************************************************************************
    .
    Completion time: 2011-01-05 16:53:53 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-01-06 00:53
    ComboFix2.txt 2011-01-05 06:07

    Pre-Run: 208,448,942,080 bytes free
    Post-Run: 207,855,845,376 bytes free

    Current=1 Default=1 Failed=0 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,11
    - - End Of File - - D72D9B214ABEEC2ACB299ED3BDF78532
  14. Broni

    Broni Malware Annihilator Posts: 46,748   +254

    Looks good :)

    How is computer doing?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
  15. piperca

    piperca TS Rookie Topic Starter Posts: 24

    To be honest, I have tried to avoid using the computer until it has been fixed. I have noticed it takes a little while to load Windows, but that may be due to the operations it is going through during the fix. I will report back with results, once we are completely finished.

    I am exceeding the character limit for this post, so it'll be in two posts.

    Here is the OTL.txt log (part 1):

    OTL logfile created on: 1/5/2011 6:24:31 PM - Run 1
    OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Andrew\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18999)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
    6.00 Gb Paging File | 5.00 Gb Available in Paging File | 75.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 363.74 Gb Total Space | 193.13 Gb Free Space | 53.10% Space Free | Partition Type: NTFS
    Drive D: | 8.87 Gb Total Space | 1.00 Gb Free Space | 11.27% Space Free | Partition Type: NTFS
    Drive E: | 156.23 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: ANDREWPC | User Name: Andrew | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/01/05 18:23:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
    PRC - [2010/12/21 04:04:30 | 000,987,704 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psia.exe
    PRC - [2010/12/21 04:04:30 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\sua.exe
    PRC - [2010/12/21 04:04:30 | 000,291,896 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psi_tray.exe
    PRC - [2010/11/30 09:08:30 | 002,222,376 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
    PRC - [2010/10/22 14:02:04 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
    PRC - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    PRC - [2010/09/22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    PRC - [2010/09/07 07:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2010/09/07 07:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2010/06/25 16:15:32 | 001,311,312 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe
    PRC - [2010/06/22 11:09:20 | 000,112,208 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
    PRC - [2010/05/14 10:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    PRC - [2010/03/19 14:05:08 | 000,389,120 | R--- | M] (Teleca) -- C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
    PRC - [2010/03/19 14:04:58 | 000,249,856 | R--- | M] (Teleca Sweden AB) -- C:\Program Files\HTC\HTC Sync\Sync Manager\SyncIndicator.exe
    PRC - [2010/03/17 14:22:52 | 001,019,904 | R--- | M] (Teleca Sweden AB) -- C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
    PRC - [2010/03/17 14:08:22 | 000,253,952 | R--- | M] (TODO: <Company name>) -- C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
    PRC - [2010/03/17 14:08:04 | 000,462,848 | R--- | M] (Teleca AB) -- C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
    PRC - [2010/03/12 17:41:16 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
    PRC - [2009/12/11 13:50:34 | 000,557,056 | R--- | M] (Teleca AB) -- C:\Program Files\Common Files\Teleca Shared\Generic.exe
    PRC - [2009/11/23 08:43:26 | 002,001,648 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    PRC - [2009/11/19 15:19:48 | 000,598,016 | R--- | M] (Teleca Sweden AB) -- C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe
    PRC - [2009/06/03 08:25:16 | 000,106,496 | R--- | M] (Popwire AB) -- C:\Program Files\Common Files\Teleca Shared\logger.exe
    PRC - [2009/04/14 11:14:26 | 000,139,264 | ---- | M] (Teleca Sweden AB) -- C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
    PRC - [2009/04/10 22:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
    PRC - [2009/03/05 23:57:56 | 000,227,352 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
    PRC - [2008/08/13 14:34:08 | 001,891,416 | ---- | M] (GARMIN Corp.) -- C:\Garmin\gStart.exe
    PRC - [2008/05/01 10:38:00 | 000,131,072 | ---- | M] (Linksys LLC - A Division of Cisco Systems) -- C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
    PRC - [2008/04/08 23:15:12 | 000,648,504 | ---- | M] (Pure Networks, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    PRC - [2008/04/08 23:15:10 | 000,648,504 | ---- | M] (Pure Networks, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    PRC - [2008/01/15 10:26:18 | 004,874,240 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
    PRC - [2008/01/15 09:28:20 | 000,204,800 | ---- | M] () -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    PRC - [2007/08/08 17:31:24 | 000,148,760 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
    PRC - [2007/08/08 17:31:14 | 000,410,904 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
    PRC - [2007/02/15 02:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
    PRC - [2006/12/08 08:16:56 | 000,065,536 | ---- | M] () -- C:\hp\KBD\KbdStub.exe
    PRC - [2006/09/28 05:42:24 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/01/05 18:23:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
    MOD - [2010/08/31 07:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2010/12/21 04:04:30 | 000,987,704 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
    SRV - [2010/12/21 04:04:30 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\sua.exe -- (Secunia Update Agent)
    SRV - [2010/11/30 09:08:30 | 002,222,376 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
    SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
    SRV - [2010/09/22 23:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
    SRV - [2010/09/22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
    SRV - [2010/09/07 07:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
    SRV - [2010/09/07 07:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
    SRV - [2010/09/07 07:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2010/05/06 01:29:12 | 000,293,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
    SRV - [2010/03/18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
    SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2010/03/12 17:41:16 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
    SRV - [2009/09/24 17:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
    SRV - [2009/09/04 12:17:00 | 000,447,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
    SRV - [2009/09/04 12:16:54 | 005,893,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
    SRV - [2009/03/05 23:57:56 | 000,227,352 | ---- | M] (SonicWALL, Inc.) [Auto | Running] -- C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe -- (SWGVCSvc)
    SRV - [2008/04/08 23:15:12 | 000,648,504 | ---- | M] (Pure Networks, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
    SRV - [2008/01/18 23:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2008/01/15 09:28:20 | 000,204,800 | ---- | M] () [Auto | Running] -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe -- (LinksysUpdater)
    SRV - [2007/08/08 17:31:14 | 000,410,904 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe -- (AcrSch2Svc)
    SRV - [2007/05/31 08:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
    SRV - [2007/05/31 08:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
    DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
    DRV - [2010/09/22 23:21:24 | 000,039,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
    DRV - [2010/09/22 11:19:02 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
    DRV - [2010/09/07 06:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2010/09/07 06:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2010/09/07 06:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2010/09/07 06:47:30 | 000,050,768 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
    DRV - [2010/09/07 06:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2010/09/01 00:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
    DRV - [2010/04/27 12:41:10 | 000,306,016 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr70.sys -- (rt70x86)
    DRV - [2010/03/18 01:02:08 | 000,037,328 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
    DRV - [2010/03/18 01:01:52 | 000,038,864 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
    DRV - [2010/03/12 17:41:16 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
    DRV - [2009/11/23 08:43:30 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
    DRV - [2009/11/23 08:43:30 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Running] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
    DRV - [2009/11/23 08:43:28 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
    DRV - [2009/10/30 18:01:10 | 009,803,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
    DRV - [2009/08/04 08:48:20 | 002,744,800 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
    DRV - [2009/06/10 15:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND32)
    DRV - [2009/05/22 15:08:32 | 000,029,696 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VClone.sys -- (VClone)
    DRV - [2009/04/10 20:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
    DRV - [2009/04/10 20:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb)
    DRV - [2009/03/05 23:58:12 | 000,087,064 | ---- | M] (SonicWALL, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\SWIPsec.sys -- (SWIPsec)
    DRV - [2009/03/04 18:03:32 | 000,021,016 | ---- | M] (SonicWALL, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SWVNIC.sys -- (SWVNIC)
    DRV - [2008/11/21 07:35:59 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
    DRV - [2008/11/16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
    DRV - [2008/08/01 19:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
    DRV - [2008/07/21 17:34:36 | 000,121,872 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\System32\drivers\kl1.sys -- (kl1)
    DRV - [2008/05/08 12:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
    DRV - [2008/05/08 12:04:16 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
    DRV - [2008/05/08 12:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
    DRV - [2008/04/08 23:14:02 | 000,024,888 | ---- | M] (Pure Networks, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
    DRV - [2008/04/08 23:14:00 | 000,026,424 | ---- | M] (Pure Networks, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
    DRV - [2008/01/18 21:53:31 | 000,045,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\61883.sys -- (61883)
    DRV - [2008/01/18 21:53:31 | 000,040,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avc.sys -- (Avc)
    DRV - [2008/01/18 21:53:28 | 000,050,048 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mstape.sys -- (MSTAPE)
    DRV - [2008/01/18 21:53:26 | 000,014,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avcstrm.sys -- (AVCSTRM)
    DRV - [2007/10/26 18:51:24 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
    DRV - [2007/10/18 14:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
    DRV - [2007/10/07 11:55:58 | 000,023,040 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\DCDisk.sys -- (DCDisk)
    DRV - [2007/08/21 00:13:04 | 000,024,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)
    DRV - [2007/03/12 10:12:00 | 000,256,000 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WUSB54GCx86.sys -- (netr73)
    DRV - [2006/11/02 01:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
    DRV - [2006/11/02 01:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
    DRV - [2006/11/02 01:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
    DRV - [2006/11/02 01:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
    DRV - [2006/11/02 01:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
    DRV - [2006/11/02 01:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
    DRV - [2006/11/02 01:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
    DRV - [2006/11/02 01:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
    DRV - [2006/11/02 01:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
    DRV - [2006/11/02 01:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
    DRV - [2006/11/02 01:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
    DRV - [2006/11/02 01:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
    DRV - [2006/11/02 01:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
    DRV - [2006/11/02 01:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
    DRV - [2006/11/02 01:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
    DRV - [2006/11/02 01:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
    DRV - [2006/11/02 01:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
    DRV - [2006/11/02 01:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
    DRV - [2006/11/02 01:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
    DRV - [2006/11/02 01:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
    DRV - [2006/11/02 01:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
    DRV - [2006/11/02 01:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
    DRV - [2006/11/02 01:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
    DRV - [2006/11/02 01:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
    DRV - [2006/11/02 01:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
    DRV - [2006/11/02 01:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
    DRV - [2006/11/02 01:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
    DRV - [2006/11/02 01:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
    DRV - [2006/11/02 01:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
    DRV - [2006/11/02 01:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
    DRV - [2006/11/02 01:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
    DRV - [2006/11/02 01:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
    DRV - [2006/11/02 01:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
    DRV - [2006/11/02 01:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
    DRV - [2006/11/02 01:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
    DRV - [2006/11/02 00:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
    DRV - [2006/11/02 00:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
    DRV - [2006/11/02 00:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
    DRV - [2006/11/02 00:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
    DRV - [2006/11/02 00:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
    DRV - [2006/11/02 00:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
    DRV - [2006/11/01 23:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
    DRV - [2006/11/01 23:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
    DRV - [2005/12/12 09:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ww2.cox.com/myconnection/orangecounty/home.cox
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}:5.0.17
    FF - prefs.js..network.proxy.no_proxies_on: "*.local"
    FF - prefs.js..network.proxy.type: 0

    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/21 19:31:11 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/21 19:31:11 | 000,000,000 | ---D | M]

    [2010/10/30 07:56:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Andrew\AppData\Roaming\Mozilla\Extensions
    [2010/10/31 08:55:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\j04kxzjj.default\extensions
    [2010/10/30 07:59:39 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\j04kxzjj.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2010/12/21 18:47:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2008/12/07 17:32:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
    [2008/11/10 23:38:54 | 000,663,552 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
    [2008/06/17 22:43:04 | 000,086,016 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll

    O1 HOSTS File: ([2011/01/05 16:38:44 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
    O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
    O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
    O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
    O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
    O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
    O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe (Acronis)
    O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
    O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
    O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
    O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
    O4 - HKLM..\Run: [LELA] C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe (Linksys LLC - A Division of Cisco Systems)
    O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
    O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.)
    O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
    O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
    O4 - HKLM..\Run: [SnapfishMediaDetector] C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe ()
    O4 - HKCU..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.)
    O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
    O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
    O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
    O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
    O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab (Device Detection)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
    O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
    O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} https://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9} (WebIQ Engine Application Object)
    O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.com/s/v/63.27/uploader2.cab (UploadListView Class)
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} http://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab (P3DActiveX Control)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
    O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll (Pure Networks, Inc.)
    O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
    O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
    O24 - Desktop WallPaper: C:\Users\Andrew\Desktop\Digital pictures\Boat pics\P1010007.JPG
    O24 - Desktop BackupWallPaper: C:\Users\Andrew\Desktop\Digital pictures\Boat pics\P1010007.JPG
    O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2007/08/21 04:36:12 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O32 - AutoRun File - [1997/12/11 08:50:54 | 000,000,134 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: FastUserSwitchingCompatibility - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Nla - File not found
    NetSvcs: Ntmssvc - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: SRService - File not found
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: LogonHours - File not found
    NetSvcs: PCAudit - File not found
    NetSvcs: helpsvc - File not found
    NetSvcs: uploadmgr - File not found

    Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
    Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
    Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/01/05 18:23:24 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
    [2011/01/05 16:53:56 | 000,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Local\temp
    [2011/01/05 16:38:52 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
    [2011/01/05 16:19:28 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
    [2011/01/04 21:49:01 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011/01/04 21:49:01 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011/01/04 21:49:01 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2011/01/04 21:48:55 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011/01/04 21:48:25 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/01/04 20:31:15 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Andrew\Desktop\TFC.exe
    [2011/01/04 19:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
    [2011/01/04 19:51:23 | 000,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
    [2010/12/31 23:17:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
    [2010/12/31 23:16:21 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
    [2010/12/21 19:30:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
    [2010/12/21 19:30:16 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
    [2010/12/21 18:45:51 | 000,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Local\Secunia PSI
    [2010/12/19 12:00:25 | 000,000,000 | ---D | C] -- C:\Users\Andrew\Desktop\templates
    [2010/12/19 11:57:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoCardMaker
    [2010/12/19 11:57:39 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoCardMaker
    [2010/12/15 21:29:11 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
    [2010/12/15 21:29:11 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
    [2010/12/15 21:29:11 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
    [2010/12/15 21:29:10 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
    [2010/12/15 21:29:08 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
    [2010/12/15 21:29:07 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
    [2010/12/15 21:29:07 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
    [2010/12/15 21:29:07 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
    [2010/12/15 21:29:01 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
    [2010/12/15 21:28:56 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
    [2010/12/15 21:28:56 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
    [2010/12/15 21:28:56 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
    [2010/12/15 21:28:55 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
    [2010/12/15 21:28:55 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
    [2010/12/15 21:28:55 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
    [2010/12/15 21:28:55 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
    [2010/12/15 21:28:55 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
    [2010/12/15 21:28:55 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
    [2010/12/15 21:28:55 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
    [2010/12/15 21:28:55 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
    [2010/12/15 21:28:55 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
    [2010/12/15 21:28:55 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
    [2010/12/15 21:28:55 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
    [2010/12/15 21:28:55 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
    [2010/12/15 21:28:55 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
    [2010/12/15 21:28:39 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
    [2009/12/04 10:42:22 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Andrew\AppData\Roaming\pcouffin.sys

    ========== Files - Modified Within 30 Days ==========

    [2011/01/05 18:27:00 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8D9F3B64-1F15-4366-BE8C-370FFD9B6EEA}.job
    [2011/01/05 18:23:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
    [2011/01/05 18:10:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011/01/05 17:07:08 | 000,002,617 | ---- | M] () -- C:\Users\Andrew\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook 2007.lnk
    [2011/01/05 16:58:20 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
    [2011/01/05 16:39:03 | 000,064,542 | ---- | M] () -- C:\ProgramData\nvModes.001
    [2011/01/05 16:38:44 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2011/01/05 16:38:36 | 000,064,542 | ---- | M] () -- C:\ProgramData\nvModes.dat
    [2011/01/05 16:38:35 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011/01/05 16:38:28 | 000,003,696 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/01/05 16:38:28 | 000,003,696 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/01/05 16:38:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011/01/05 16:37:06 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
    [2011/01/05 16:19:18 | 004,148,657 | R--- | M] () -- C:\Users\Andrew\Desktop\ComboFix.exe
    [2011/01/05 16:13:11 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{30A0782B-8CD6-4FEA-AFA6-7DAAE2E1E03A}.job
    [2011/01/04 21:43:40 | 000,080,384 | ---- | M] () -- C:\Users\Andrew\Desktop\MBRCheck.exe
    [2011/01/04 21:06:56 | 000,624,128 | ---- | M] () -- C:\Users\Andrew\Desktop\dds.scr
    [2011/01/04 21:01:28 | 000,296,448 | ---- | M] () -- C:\Users\Andrew\Desktop\x6d5dlhn.exe
    [2011/01/04 20:44:01 | 000,000,868 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/01/04 20:31:20 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\TFC.exe
    [2011/01/04 19:57:06 | 000,002,485 | ---- | M] () -- C:\Users\Andrew\Desktop\HiJackThis.lnk
    [2011/01/01 09:30:59 | 000,001,626 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
    [2010/12/31 23:16:28 | 000,180,978 | ---- | M] () -- C:\Users\Andrew\Desktop\Tangled.docx
    [2010/12/21 19:30:39 | 000,001,688 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
    [2010/12/21 18:47:56 | 000,001,686 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
    [2010/12/21 18:45:45 | 000,000,861 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
    [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
    [2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2010/12/19 15:07:02 | 003,758,585 | ---- | M] () -- C:\Users\Andrew\Desktop\DSC00136.JPG
    [2010/12/19 15:06:54 | 003,684,858 | ---- | M] () -- C:\Users\Andrew\Desktop\DSC00135.JPG
    [2010/12/19 12:30:58 | 000,176,028 | ---- | M] () -- C:\Users\Andrew\Desktop\Christmas card 2010.jpg
    [2010/12/19 12:19:08 | 002,785,645 | ---- | M] () -- C:\Users\Andrew\Desktop\SDC11985-1.JPG
    [2010/12/19 12:10:27 | 002,686,895 | ---- | M] () -- C:\Users\Andrew\Desktop\SDC11985.JPG
    [2010/12/19 11:57:41 | 000,000,774 | ---- | M] () -- C:\Users\Public\Desktop\PhotoCardMaker.lnk
    [2010/12/17 19:54:06 | 000,019,706 | ---- | M] () -- C:\Users\Andrew\Documents\Someday.docx
    [2010/12/16 17:52:56 | 001,830,400 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2010/12/13 22:11:05 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
    [2010/12/13 17:16:20 | 000,041,943 | ---- | M] () -- C:\Users\Andrew\Documents\AcademicPlanMARY ROSS.pdf
    [2010/12/13 10:03:18 | 000,026,064 | ---- | M] () -- C:\Users\Andrew\Documents\env1 final review.xps
    [2010/12/12 18:30:18 | 000,236,032 | ---- | M] () -- C:\Users\Andrew\Documents\PFAFrequentlyAskedQuestions2010.doc
    [2010/12/12 18:30:18 | 000,236,032 | ---- | M] () -- C:\Users\Andrew\Desktop\PFAFrequentlyAskedQuestions2010.doc
    [2010/12/08 17:22:35 | 000,011,298 | ---- | M] () -- C:\Users\Andrew\Documents\Candy Cane Lane.docx
    [2010/12/06 18:47:39 | 000,012,713 | ---- | M] () -- C:\Users\Andrew\Documents\critical thnking 10.docx
    [2010/12/06 18:35:40 | 000,012,807 | ---- | M] () -- C:\Users\Andrew\Documents\final essay english1b.docx
  16. piperca

    piperca TS Rookie Topic Starter Posts: 24

    OTL.txt log (part 2):

    ========== Files Created - No Company Name ==========

    [2011/01/04 21:49:01 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
    [2011/01/04 21:49:01 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011/01/04 21:49:01 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
    [2011/01/04 21:49:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011/01/04 21:49:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011/01/04 21:47:36 | 004,148,657 | R--- | C] () -- C:\Users\Andrew\Desktop\ComboFix.exe
    [2011/01/04 21:43:40 | 000,080,384 | ---- | C] () -- C:\Users\Andrew\Desktop\MBRCheck.exe
    [2011/01/04 21:05:53 | 000,624,128 | ---- | C] () -- C:\Users\Andrew\Desktop\dds.scr
    [2011/01/04 21:01:25 | 000,296,448 | ---- | C] () -- C:\Users\Andrew\Desktop\x6d5dlhn.exe
    [2011/01/04 19:51:23 | 000,002,485 | ---- | C] () -- C:\Users\Andrew\Desktop\HiJackThis.lnk
    [2010/12/31 23:17:43 | 000,236,032 | ---- | C] () -- C:\Users\Andrew\Documents\PFAFrequentlyAskedQuestions2010.doc
    [2010/12/31 23:17:04 | 000,001,626 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
    [2010/12/31 23:16:27 | 000,180,978 | ---- | C] () -- C:\Users\Andrew\Desktop\Tangled.docx
    [2010/12/21 19:30:39 | 000,001,688 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
    [2010/12/21 18:45:45 | 000,000,861 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
    [2010/12/19 12:30:57 | 000,176,028 | ---- | C] () -- C:\Users\Andrew\Desktop\Christmas card 2010.jpg
    [2010/12/19 12:19:07 | 002,785,645 | ---- | C] () -- C:\Users\Andrew\Desktop\SDC11985-1.JPG
    [2010/12/19 12:10:27 | 002,686,895 | ---- | C] () -- C:\Users\Andrew\Desktop\SDC11985.JPG
    [2010/12/19 11:57:41 | 000,000,774 | ---- | C] () -- C:\Users\Public\Desktop\PhotoCardMaker.lnk
    [2010/12/19 11:53:32 | 003,758,585 | ---- | C] () -- C:\Users\Andrew\Desktop\DSC00136.JPG
    [2010/12/19 11:53:31 | 003,684,858 | ---- | C] () -- C:\Users\Andrew\Desktop\DSC00135.JPG
    [2010/12/13 17:16:19 | 000,041,943 | ---- | C] () -- C:\Users\Andrew\Documents\AcademicPlanMARY ROSS.pdf
    [2010/12/13 10:03:17 | 000,026,064 | ---- | C] () -- C:\Users\Andrew\Documents\env1 final review.xps
    [2010/12/12 18:30:17 | 000,236,032 | ---- | C] () -- C:\Users\Andrew\Desktop\PFAFrequentlyAskedQuestions2010.doc
    [2010/12/08 17:22:35 | 000,011,298 | ---- | C] () -- C:\Users\Andrew\Documents\Candy Cane Lane.docx
    [2010/12/06 18:47:38 | 000,012,713 | ---- | C] () -- C:\Users\Andrew\Documents\critical thnking 10.docx
    [2010/08/07 18:58:16 | 000,000,245 | ---- | C] () -- C:\Users\Andrew\AppData\Local\RAExpertHistory.xml
    [2010/07/24 14:29:20 | 000,038,427 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\Comma Separated Values (DOS).ADR
    [2010/05/31 11:41:10 | 000,064,542 | ---- | C] () -- C:\ProgramData\nvModes.001
    [2010/05/31 11:40:39 | 000,064,542 | ---- | C] () -- C:\ProgramData\nvModes.dat
    [2009/12/04 19:25:35 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
    [2009/12/04 10:44:05 | 000,000,034 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\pcouffin.log
    [2009/12/04 10:42:22 | 000,007,887 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\pcouffin.cat
    [2009/12/04 10:42:22 | 000,001,144 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\pcouffin.inf
    [2009/11/25 21:06:34 | 000,000,000 | ---- | C] () -- C:\Windows\iPlayer.INI
    [2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
    [2009/05/30 08:17:54 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
    [2009/05/14 14:29:30 | 000,008,520 | ---- | C] () -- C:\Windows\System32\ractrlkeyhook.dll
    [2008/12/25 19:18:54 | 000,027,043 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\UserTile.png
    [2008/11/21 07:35:59 | 000,717,296 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
    [2008/10/15 20:09:56 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
    [2008/10/15 20:09:56 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
    [2008/04/12 11:51:11 | 000,000,000 | ---- | C] () -- C:\Windows\ka.ini
    [2008/01/21 12:51:00 | 000,001,361 | ---- | C] () -- C:\Windows\System32\WLAN.INI
    [2007/10/25 13:14:03 | 000,010,240 | ---- | C] () -- C:\Users\Andrew\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2007/10/18 18:01:05 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
    [2007/10/07 11:55:58 | 000,023,040 | ---- | C] () -- C:\Windows\System32\drivers\DCDisk.sys
    [2007/10/06 20:32:13 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
    [2007/10/06 20:17:44 | 000,000,000 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\wklnhst.dat
    [2007/08/21 04:27:59 | 000,015,143 | ---- | C] () -- C:\ProgramData\hpzinstall.log
    [2007/08/21 04:08:08 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom24.dll
    [2007/08/21 04:08:08 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes24.dll
    [2007/06/28 16:09:04 | 000,258,048 | ---- | C] () -- C:\Windows\System32\SDL.dll
    [2007/06/18 22:13:02 | 000,760,531 | ---- | C] () -- C:\Windows\System32\avformat-51.dll
    [2007/06/18 22:12:56 | 000,097,358 | ---- | C] () -- C:\Windows\System32\avutil-49.dll
    [2007/06/18 16:56:40 | 002,041,856 | ---- | C] () -- C:\Windows\System32\avcodec-51.dll
    [2007/06/18 16:56:02 | 000,141,824 | ---- | C] () -- C:\Windows\System32\swscale-0.dll
    [2007/03/06 00:47:24 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
    [2007/01/12 06:07:48 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
    [2007/01/12 06:07:48 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
    [2006/11/02 04:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
    [2006/11/01 23:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2010/01/22 09:30:38 | 014,855,290 | ---- | M] () -- C:\184-001310-00_Rev_A_GVCSetup32_4.2.6.0305.zip
    [2007/08/21 04:36:12 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
    [2009/04/10 22:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
    [2007/08/21 05:00:19 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
    [2011/01/05 16:53:54 | 000,018,078 | ---- | M] () -- C:\ComboFix.txt
    [2006/09/18 13:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
    [2007/10/07 11:56:27 | 000,000,512 | ---- | M] () -- C:\dcload.bin
    [2007/10/07 11:56:27 | 000,030,860 | ---- | M] () -- C:\dcload.bio
    [2010/01/01 15:10:33 | 000,000,064 | ---- | M] () -- C:\FINIS_IT.TXT
    [2009/03/06 01:03:48 | 014,912,536 | ---- | M] (Microsoft Corporation) -- C:\GVCSetup32.exe
    [2007/02/01 00:24:24 | 000,258,048 | ---- | M] (Hewlett-Packard) -- C:\hpzids01.dll
    [2007/08/28 04:41:49 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2009/08/22 09:45:14 | 000,029,537 | ---- | M] () -- C:\JavaRa.log
    [2010/04/30 19:38:38 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
    [2007/08/28 04:41:49 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2008/12/25 18:06:19 | 000,262,144 | ---- | M] () -- C:\ntuser.dat
    [2008/12/25 18:06:19 | 000,005,120 | -H-- | M] () -- C:\ntuser.dat.LOG1
    [2008/12/25 18:05:25 | 000,000,000 | -H-- | M] () -- C:\ntuser.dat.LOG2
    [2008/12/25 18:05:25 | 000,065,536 | -HS- | M] () -- C:\ntuser.dat{3c6c4862-d2f0-11dd-a6e3-001bb952aaf2}.TM.blf
    [2008/12/25 18:05:25 | 000,524,288 | -HS- | M] () -- C:\ntuser.dat{3c6c4862-d2f0-11dd-a6e3-001bb952aaf2}.TMContainer00000000000000000001.regtrans-ms
    [2008/12/25 18:05:25 | 000,524,288 | -HS- | M] () -- C:\ntuser.dat{3c6c4862-d2f0-11dd-a6e3-001bb952aaf2}.TMContainer00000000000000000002.regtrans-ms
    [2008/12/25 18:06:19 | 000,065,536 | -HS- | M] () -- C:\ntuser.dat{3c6c4866-d2f0-11dd-a6e3-001bb952aaf2}.TM.blf
    [2008/12/25 18:06:19 | 000,524,288 | -HS- | M] () -- C:\ntuser.dat{3c6c4866-d2f0-11dd-a6e3-001bb952aaf2}.TMContainer00000000000000000001.regtrans-ms
    [2008/12/25 18:05:25 | 000,524,288 | -HS- | M] () -- C:\ntuser.dat{3c6c4866-d2f0-11dd-a6e3-001bb952aaf2}.TMContainer00000000000000000002.regtrans-ms
    [2011/01/05 16:38:16 | 3466,342,400 | -HS- | M] () -- C:\pagefile.sys
    [2008/10/18 22:13:52 | 000,000,477 | ---- | M] () -- C:\RHDSetup.log
    [2009/04/17 20:27:28 | 000,000,302 | ---- | M] () -- C:\RUU.log
    [2007/10/07 11:56:00 | 003,145,728 | ---- | M] () -- C:\spc_init
    [2009/04/04 11:32:12 | 002,917,607 | ---- | M] () -- C:\spc_kern
    [2007/10/07 11:56:26 | 094,371,840 | ---- | M] () -- C:\spc_root
    [2009/04/04 11:32:12 | 000,000,000 | ---- | M] () -- C:\tasks.ini

    < %systemroot%\Fonts\*.com >
    [2006/11/02 04:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
    [2006/11/02 04:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
    [2006/11/02 04:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
    [2009/05/30 08:29:13 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2006/09/18 13:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2007/02/02 10:26:36 | 000,273,920 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp4v2.dll
    [2006/11/02 04:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
    [2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
    [2006/10/26 18:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2010/09/07 07:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
    [2010/09/22 23:32:56 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2008/06/02 18:15:03 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2006/11/02 02:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
    [2006/11/02 02:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
    [2006/11/02 02:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
    [2006/11/02 02:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
    [2006/11/02 02:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2009/05/02 10:34:10 | 000,000,286 | -HS- | M] () -- C:\Users\Andrew\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2011/01/05 16:19:18 | 004,148,657 | R--- | M] () -- C:\Users\Andrew\Desktop\ComboFix.exe
    [2011/01/04 21:43:40 | 000,080,384 | ---- | M] () -- C:\Users\Andrew\Desktop\MBRCheck.exe
    [2011/01/05 18:23:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
    [2009/10/21 14:40:29 | 036,471,079 | ---- | M] (CWS ) -- C:\Users\Andrew\Desktop\RUU_STAR100_4.1.502.5_02.79.30_CWS_SHIP.exe
    [2011/01/04 20:31:20 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\TFC.exe
    [2011/01/04 21:01:28 | 000,296,448 | ---- | M] () -- C:\Users\Andrew\Desktop\x6d5dlhn.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >
    [2007/10/31 16:31:09 | 000,722,176 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Andrew\gotomypc_428.exe
    [2008/01/30 17:20:38 | 000,724,984 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Andrew\gotomypc_437.exe

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >
    [2009/05/30 08:49:01 | 000,008,192 | ---- | M] () -- C:\Windows\security\database\edb.chk
    [2009/05/30 08:48:31 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edb.log
    [2007/08/28 04:28:00 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00001.jrs
    [2007/08/28 04:28:00 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00002.jrs
    [2009/05/30 08:48:32 | 001,056,768 | ---- | M] () -- C:\Windows\security\database\tmp.edb

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2007/10/06 20:54:26 | 000,000,402 | -HS- | M] () -- C:\Users\Andrew\Favorites\desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [2009/05/27 19:58:21 | 000,015,143 | ---- | M] () -- C:\ProgramData\hpzinstall.log
    [2009/05/03 08:09:39 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
    [2011/01/05 16:39:03 | 000,064,542 | ---- | M] () -- C:\ProgramData\nvModes.001

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < >

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:40E5AD89
    @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:4A9220C3

    < End of report >
  17. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Here's the Extras.txt log (part 1 of 3):

    OTL Extras logfile created on: 1/5/2011 6:24:31 PM - Run 1
    OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Andrew\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18999)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
    6.00 Gb Paging File | 5.00 Gb Available in Paging File | 75.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 363.74 Gb Total Space | 193.13 Gb Free Space | 53.10% Space Free | Partition Type: NTFS
    Drive D: | 8.87 Gb Total Space | 1.00 Gb Free Space | 11.27% Space Free | Partition Type: NTFS
    Drive E: | 156.23 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: ANDREWPC | User Name: Andrew | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
    .html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = ChromeHTML] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found
    "VistaSp2" = Reg Error: Unknown registry data type -- File not found

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1000]
    "EnableNotifications" = 1
    "EnableNotificationsRef" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1001]
    "EnableNotifications" = 1
    "EnableNotificationsRef" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{04B5D28F-79EA-44C3-AD72-0A5294C10DF0}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{1112E794-68DA-4A05-8172-8157EF078250}" = lport=137 | protocol=17 | dir=in | app=system |
    "{1192E760-82E9-4AEF-9E5B-467A8535BB30}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
    "{17B79BF1-A5EE-4DA5-8720-5EEADDE4C571}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{1C961607-CD04-41E8-914A-0FD3B6903842}" = lport=16130 | protocol=17 | dir=in | name=bitcomet 16130 udp |
    "{1DC87D1B-1225-4AF3-9BAF-EC47FC9BF5A9}" = lport=139 | protocol=6 | dir=in | app=system |
    "{1F84FAE9-0830-44C5-9C39-A5C67829A262}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
    "{2D15E076-0B95-4795-A12F-5EBC2F4BA0A4}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
    "{349675F4-DE91-40FB-9E88-446F95D09CE0}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |
    "{34BE3F51-36E3-47A2-8778-54D117E27195}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{3709BC26-D304-42C3-86F7-156E606B57CF}" = rport=137 | protocol=17 | dir=out | app=system |
    "{3985BD4D-8694-4E67-AEA7-A983F3A7E4F4}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
    "{3B5A24D5-6A0D-4AA6-BD42-D5C608022EDB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{41AAAD28-F8D0-438E-B5CE-5B185D52CE78}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{420E94B2-F8F7-4299-B46F-E13A79E07016}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
    "{429075AA-F088-4785-B4C2-37B217CF46C2}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
    "{49906ED6-24CA-423E-8002-6E44A78DB24D}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
    "{51E6B943-E2B2-47F3-BFB0-63CD90A747AA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{594EECF1-8AE4-4E9C-9643-CDB000A02CF9}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
    "{5A50454E-3273-4752-AD9B-393FFFE02E40}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{6412BEA6-92CC-4535-93DA-9FC744540F4B}" = lport=10243 | protocol=6 | dir=in | app=system |
    "{66921918-CC2C-4804-8991-B1CD040E41F6}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{67AC3AB4-950D-4C3B-A1D7-1EAAE6C83475}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{6F76D109-D08E-4D5F-B62A-AEAA7F611C47}" = rport=138 | protocol=17 | dir=out | app=system |
    "{7015C3B6-A862-4C48-B3F3-112D2AD19BCB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{7810A45E-FCF1-47A4-B95C-9B9A6F85DFF2}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
    "{7D22C87B-C41E-4E8D-B843-0967C720F1F2}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{7D92524C-7CF5-47EC-BD9B-7A98A455C5E9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{7DDEC37B-2770-4EBC-932A-455A27CDF281}" = lport=445 | protocol=6 | dir=in | app=system |
    "{7FEC2FEC-F77F-4F09-A195-098BFF98277A}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{8438484B-C3DB-479B-8A04-077628CFC163}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{85F00A56-4DBC-40F6-9E85-70BD744888B3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{88BC6AEE-293B-4ADA-8394-B793B2A2E85A}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{8A7B4400-0B5A-403B-8FDC-78ADDF31F563}" = lport=16130 | protocol=6 | dir=in | name=bitcomet 16130 tcp |
    "{8C92A045-E02F-4225-B054-3A9C2E679877}" = lport=138 | protocol=17 | dir=in | app=system |
    "{91EDBEF3-785F-41FE-BBE0-3F9ADFA68C44}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
    "{96C12D21-09C6-458E-8D01-E916082BD86F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{977EBB44-D171-46C1-A807-A2BB04043D7A}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{979434A0-7BC2-454D-B78C-D528F15FEADF}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |
    "{98A046CD-FE43-4795-A08B-DF762D2D649C}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
    "{A1C36454-F319-4BCA-B783-FDD6EC01AA7C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{C0D76A66-DAD5-4083-82AF-F92B5050E21C}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{CD9CD83C-BE87-4863-B298-68B9DECBF21D}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
    "{D0BCEFB1-3FD7-48D1-848B-F416DE4A6493}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{D8F7F1AB-1BBD-4E13-AE79-4406F1021377}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
    "{DE238D8E-2312-43A4-9B8E-A11588F6194D}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
    "{DE6A47ED-3467-4566-B44C-AD5CA961BEE9}" = rport=10243 | protocol=6 | dir=out | app=system |
    "{E820A291-7769-41AD-B65D-B3109F122671}" = rport=139 | protocol=6 | dir=out | app=system |
    "{F28150B7-D6BA-486F-9A83-A006B7EB1DF5}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{F6502306-AD3C-4052-9C71-867013A7D709}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
    "{F7459F53-2441-463A-8860-B5D91EB15A1D}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
    "{FE226EC6-F57B-4296-9FB0-743E9F569CF6}" = rport=445 | protocol=6 | dir=out | app=system |
  18. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Extras.txt log (page 2 of 3):

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{00D9358F-3E5E-4A47-BD46-14E7187481A9}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
    "{0147E956-6283-43D1-820B-19109D3A7209}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{019E59F0-8FAC-4C6D-A2CD-F26E78F20D44}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{02072FDC-1EBB-422D-AE76-B09EEBB8D2AD}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{02467B63-4229-4412-A7FB-7696DFE1232F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{0277B8B0-557B-4F38-9F49-77B03CC71F17}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{02811CF0-5227-4719-A193-1EAD51A508DB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{03728E03-A395-45D1-AFDA-D63786AF5CE7}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{04DC5B01-98F3-4C1B-B27A-25F6BD4DBDC0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{04E269E8-D74F-477C-8C4D-10DDFF694E16}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{0510D2B5-C8E5-4B39-B49F-BF6B156393C4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{0559A56E-7BEA-4872-8BB7-516DC2BF1FBF}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{05AA88DB-DFAC-4518-8CCF-68274B5240B1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{05FAD389-75A6-41D9-9991-6F8FBD8C1534}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{064040FB-079D-4A8F-A58E-7200E9A01CB0}" = protocol=17 | dir=in | app=c:\program files\shareaza\shareaza.exe |
    "{091E8BC1-7617-40CB-8E09-B3C3A3D800AD}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{098927D0-8226-4784-8F2C-7BCE3026F769}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{09E33C22-2B99-4F7F-9EDD-D72DCA58625E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{0A163290-AA07-4B80-83E9-47FCFA76FF72}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{0B140977-3F77-45F2-9198-1E858D186F7F}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{0BC2124A-DC40-4A1E-8681-A856E2B29792}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{0C12879E-7929-4870-8F95-7552FF26D0D9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{0C2981FE-F56F-4AC3-B3DA-8CD3FF22F441}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{0C5C0F1A-322C-449B-BBE0-2A24CE2DDFE8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{0F7E515D-4F12-4160-A318-24C375A5A066}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{0FB61AE3-DF8F-45F3-9835-C6340FBAC764}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{101E2B2C-A15B-4CCD-A0C8-0728193F5A2A}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{102669D9-0062-4373-AF82-C39EBC16383D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{10B2DB94-5708-4AF1-9B79-4C183D777C6D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{10DE2351-684A-46ED-BBF3-0FC0078C943B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{11277668-869B-42FA-A824-DDC40A63F44A}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{1165E751-DDB8-44BD-A053-E51D2307F4C7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{11D06F14-91B7-4F1B-A4AF-ECE360B239C8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{11E42F3B-1EEA-418A-9ACE-D47FC51D6C7C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{12B8D90D-0A74-40CF-AEF3-C674813C6A02}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{12D123B3-BFD9-471E-9F01-FA18FAF5781F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{139F7695-DA64-4A9C-835C-008F7B275CB6}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
    "{1410DBFD-5CFC-4586-B691-B23F567F099B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{14A22E91-3E56-45AB-80D1-A60D3BA95A95}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{152C13D4-A652-492A-9586-8A9DAEA9C2A7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1574C1C5-CE43-4619-A634-946A6B053F50}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{158C99AD-FAC1-4169-989E-D8482EEFBABD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{15D97676-3FAD-4E85-9454-74172B8FA33A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1655ACD7-25D4-4FD8-8435-CF428D0E2D03}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{16D2E7AC-CDB4-494F-9D13-A6C629D25231}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{18A38170-6948-431C-BE64-848E8A93BAA3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1AA12916-8533-41BB-811C-2711E9A240BA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1B0A671B-B1E5-4BB1-AA7A-E4C243BB1FCF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1B401531-AF36-4A1F-A566-FFEEF1A5F86D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1B86BFA0-EBFA-4DC2-848C-6E189996BBD9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1C46A195-C204-4C63-8C63-236F45188A90}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1C618E66-BD51-430B-B0A8-ACD6D26D40F4}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
    "{1CCE999A-2AE4-4812-9A93-1074D1FBFD93}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{1CFA7F7D-EE4F-4554-8A46-513CC9EED813}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1DBA194F-BD97-4FA9-AE3C-7190770AE6F0}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{1E1E4C0C-A8D3-4732-853A-A54776F8BF17}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1E259B13-E4DC-4679-8FD8-33FF1973DACD}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
    "{1E304E48-352A-499D-80EC-9B65FE620E35}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1E4662AB-5ADB-4C1E-9A15-6EA9587A955F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1F99D85F-D237-4CDF-8123-8DE3F1889F0E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{1FFA4DA5-8544-4C67-BA72-A3DAF16D1E2C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{20D2E6BE-BE10-4F18-AB9A-3DAD552E9466}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{21071667-3125-4C7E-BAC2-8EEC7B10DC1B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{21921669-B923-4C4E-BDB6-9EC68C500547}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{23D3105E-7CB4-4A7A-8481-9B84120F67DA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{2571CEE3-F436-46B8-AEFD-3E41C262B9F7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
    "{25BBE837-100A-4096-BC76-BA090E12BA24}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{26814056-9B17-49D0-B1C2-68AAD6B52FDE}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{26D0AD26-5759-4AB3-958F-B7E9B7A5C714}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{2BB4E2BC-13F4-48D2-B7C2-D7D0E21B0D13}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{2CB02493-D684-4447-8246-F0EAEF8FE806}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{2D43D2F4-75CF-46EC-B760-0AE8CC877641}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{2D6F8EE9-7A88-4667-8010-AB5B0F5A3742}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{2D9BE95F-B3A6-41B2-A4E4-F26207CF67F5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{2E3F7263-BFA6-4A8C-ACCC-0E15AA01D5FD}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{2ECCD72B-398F-474C-AA20-1640DBF454DA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{307115AA-8AEA-4BED-BF3F-9AA8CC658AAC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{310FC37D-05E6-48B7-A8A4-114A013B1A6D}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{318687E6-6C1B-452F-8671-DCB31B5018FC}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{31A84E2C-5F67-487E-917F-4AB11A87916B}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{3227AD6B-C9ED-42CB-A464-03238B49ED07}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{32319EC2-2DE3-4958-960D-E662D7E7611D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{325936FD-ABB3-442C-828A-90FE30BD99D9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{327DE811-1847-4E6B-9100-949EBA500232}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{33564C4B-8874-4E78-8F9B-D7DF00D6A7D2}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{33DECDF5-8BCE-4BD8-8D42-4CB6FC8762D4}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{35AB31F8-2851-41D8-933D-9465EFD47019}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{35AD1376-191C-49A5-971D-E2423F58ACA3}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
    "{393F5259-5132-499B-A25B-2BBA1714D0B7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{3A2ABED5-1F2D-4BA2-B57B-549D12D62E47}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{3A989BFF-6533-4D24-A99A-A5786EC3E106}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{3B0EFF77-030E-48F8-B19F-D9F71333C4F8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{3B2369EC-3AD6-457B-ACB3-D98B68AF06E0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{3B3A0A9E-8CF7-4E02-8B18-5CD23172BD96}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{3F6A0FD6-8AF7-4E21-85DD-D2D4F21F8E9E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{3FB26936-124A-48B7-81D6-5FD678FAE08D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{40FFBF5A-9501-4315-89E9-1610751898F3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{4179F81D-EB4C-4827-8F6C-C889413F1FFC}" = protocol=6 | dir=in | app=c:\users\andrew\appdata\local\tversity\media server\mediaserver.exe |
    "{41A8131C-6328-41E6-87D4-718B4588EE44}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
    "{41CE177F-9A0F-4C98-A3AD-FFE2C152C264}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{41F80443-227B-484A-B348-553CAB7BE3E1}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{42281F0A-5CD2-4410-9EA5-EBEC8B1746A9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{42758453-EEE4-4F63-9304-1474A4AEEAFD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{42A2A144-05F2-4165-8E7F-3721ED0C84E6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{432B4AF8-1A44-4C57-AE20-8EFE6EE4B3C6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{441448B1-C121-42D6-A500-D6366D4438BF}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{44293DC4-EBF3-4161-9FC1-7260B591DFB2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{44AC26AE-5D1D-483E-BBC2-8C85F8092E25}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{4514D44D-CAF0-4B16-BEA6-AC506F2DC552}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{451CC22D-3A1C-4AA5-B72D-0DEFB0B9794D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{462A1A0B-D6E6-415C-A20B-C138274D8F51}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{464DB161-EA3C-4251-9910-FF6C5E0D136C}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
    "{465F6A60-4C69-4294-BFE7-540D80611260}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{46FB3A2C-4B90-4E48-B737-6FF5B7DDC462}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{49B9A635-A13A-45DC-81B3-3897D5AB70A9}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{49C5863A-CD67-4258-95DF-EA48CA3DC68E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{49E774F0-C7A5-4CC5-A489-DE50EA97A623}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{4A0EE9E1-9F75-432E-AFF1-BB66E820EFD1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{4A40730F-D7EC-4BF5-85F5-53920D6D6E61}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{4A8F123A-E0F8-4FB7-9924-D0520258B963}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{4B7148DC-EB82-4604-A7C5-B28B64B9ECBD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{4B9EB9BF-9126-4BB2-9AEB-96C248ACB4B3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{4FA2C524-CD5E-4228-9259-C10BDE63C09B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{507955A9-0C12-4F5B-B5B6-B0C860AC0AEF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{5079A743-D3B2-4595-9898-9AE66780EAAC}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{516E4568-8456-466C-8EF8-CC2EE2005BDE}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{522C91F4-F136-4EE8-8CA2-7FCF6C2CB5FC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{525C6AA1-9D81-41E1-847D-28CBAC29A294}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
    "{52882EC7-639C-4891-8E35-A9221FC3FDC2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{5290EFB1-071E-459F-8CBC-49015BB9693C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{52EE63B0-FE83-4FDA-9064-C5C787B969D1}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{5382795A-A80C-4888-9DD4-1FDCC38CC0D1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{54747F5F-6711-444C-927D-9CC42C7745F9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{54878134-5B1C-408D-BC71-303C7551ADCD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{548E0E51-012F-49F5-8D20-E6CF4A8226BB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{554A156A-1566-4E49-BF1D-AEF38F4E8D7C}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{558C1EDA-42C5-4945-9117-5CE017A3088E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{573614CC-BD8F-40E8-8580-80CCD5747E6D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{582D8FBC-7A71-4930-9A1C-E5A0E40AA2A3}" = protocol=17 | dir=in | app=c:\users\andrew\appdata\local\tversity\media server\mediaserver.exe |
    "{595B23DF-4A34-44B7-803D-0978F21E740E}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{59F39F1F-913E-4DF9-87D4-8F150931FB00}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{5A73E01D-683E-46E2-AD8E-5D77C690A298}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{5B7D684C-EAB0-47EA-BECC-FBCAFA636905}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{5CE2129E-3649-45FA-A1C5-B88A2D016FF9}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{5D9F9A86-B2AB-4CB9-BD5A-8A742922B752}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{5DDD70C1-E679-435B-8B97-3A1BDD58681A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{5E4D06E1-433F-46E2-AE13-FF47583D29A0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{5EC6C00B-9823-433F-9E5F-55840FC23544}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{5F5A727F-C2F8-4EFB-A2A0-546FF1FAC40F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{5FB66504-8BE8-4571-B21E-E214D07D036D}" = protocol=6 | dir=out | app=system |
    "{5FFF36A1-CE4B-4E3C-AA9D-E2348F0746D2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{60A6D53F-1612-4A81-99D4-09B86F089C84}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{6371220A-FEAE-43FB-8999-61A45F0A7970}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{63AE574D-708C-4460-BB42-FCBB7F828537}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{650BC8F1-F462-4EBE-B5B2-2586688C0FE9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{65B4BA42-510F-40DA-A186-32E513C5CB6E}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{664F9178-5CBF-4BBD-B7FF-D70023A1A0CD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{66C5CF81-B0F4-4D6E-B913-15933E1B4E14}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{68605D8E-3D15-4892-8BBB-B64622C7BBF1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{696C56AF-0E92-4B2B-AC21-214159E9F4E3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{6995682A-5417-4F5B-B453-E9B9C5723C57}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{6A74A1C5-E74A-4E97-ACF0-98EEA3028D49}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{6B02A77B-5FCF-4518-B418-645B2B240336}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{6BBCC6AB-CDF8-4774-BF6E-C82128608D9A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{6BDD06B0-478A-454B-B998-5A2ECC53956F}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
    "{6BF58162-20E1-40C9-8264-42B6ABD49123}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{6CC0847E-3062-4579-938F-4A1312C8BC9B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{6CF19052-DB6B-45FB-AF40-B0CB1EC9E3E4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
    "{6D460FB9-38B7-4B24-B7E4-A28E6743A8EA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{6D874597-B351-4D64-8A92-1927DB9D6240}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{6F0A2460-3212-4C4E-9C95-D120D09CDF05}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{6F51CED8-7BA0-4303-A1FF-738409C402E9}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{6F53379A-A895-49BB-8585-8C38673DEECC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{70C76A01-9FB4-4943-B75E-DF614435B749}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{71BCF4B8-7786-4F29-BCEE-128EFEDFD533}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{73660543-6411-46E0-A2DF-50FAEB4D3C71}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{738B1489-2D24-4F15-859B-8F7AB3F5712F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{74B83038-AC4B-4EB9-AEC1-799FB0205758}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{74D864E7-8789-46B2-9988-E06C2988926E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{75087198-81AA-4805-B909-4E0132EBF258}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{7613D0A3-92EE-49E6-BC4D-07CD41B8906B}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{77678A44-20ED-4F12-9AD9-71A97D160693}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{77834B9A-76BD-45EC-B884-25E03EAD4B3A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{7968376C-CB1C-42E3-8210-BFEB0FCC4B7E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{79F6BB86-BCB6-41AC-BEBB-7113861E89F6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{7A615D71-96F8-4FB0-8131-E523B4879ED4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{7AE21A06-96E3-4ED6-B001-0F7E890F6E0D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{7AE52608-AB67-4B6D-B246-413EEF023FDB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{7B7EB5AB-8FB9-49B8-A25C-14D7116FE45D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{7C0F2B86-001B-43F1-829A-5E072C380A17}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
    "{7FCB1489-A4E9-461B-818B-A7B7F7CFC2C4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8036F1CE-078A-4817-B234-9825A2DF540A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{808531D6-AD86-459D-8C8B-45C28DEAAB4F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{809EA909-BEB8-4DAF-BAD7-25B2EDD6AEDF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{82524198-FB61-45FC-99F5-739AC61A8B64}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{830D0F9B-C06D-467C-AEAD-2C06626EE237}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{83701AC9-0ADC-4F40-A204-97A200DBC403}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{83EDC4CF-B039-440C-BF55-74809401FB23}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{85D0C4C2-38C7-4590-A017-CE205D2BF9A3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{86F021B9-9A91-4DB4-B173-EFFDC45B7E73}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{873E8FDC-8DAA-4801-B37D-07089E1409AE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8742E1A1-9D59-4E12-A741-504F9A8395C1}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
    "{8787981C-C9B0-485F-9DA4-EACD539B325B}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{885D00A5-828F-4CDF-B8B0-B47CA138F121}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{89231BF6-3770-4CA2-8A06-23184CE83431}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{899172AF-3780-415B-95A9-05F6E1713868}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{89A471ED-18F0-461C-AC8C-23B926E9260A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8A914425-532A-42DC-8610-B8FDFC478D35}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8A9DDEDB-EC8F-479B-9E71-CC6EC0D47D8C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8CBC951C-33D4-40B5-84A9-275C287FBADB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8CBF42AF-46C1-4FB1-B455-8184EA893A6E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8D5A0453-F7CA-43EE-AC2E-ED2B7AB9E18D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8D5E4094-D662-4271-B272-8CECF2CABFB0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8D890B0A-BF3E-4120-84FE-FA82F691F0A0}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{8E292724-BBA8-47E5-BE59-37905B63F502}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{8EE1B916-B350-4CE1-A0DA-0129C1B8F493}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8F4FE155-B2B9-449C-BBF9-E98773F2637B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{8FC5BBEC-530A-4762-8C38-78002D84BDC8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9008BFD2-098C-4E7B-9DCE-5C317D018863}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{90EECA9E-F096-49A6-BED2-9696EE8D0181}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9165F7CA-6146-4096-91C0-2C8BCFDDC2A1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{91BB0415-9FA2-4089-8B0A-A06AE52AA8D9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{91C552E7-4A52-46B0-8BB8-2267953398B5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{92CA5283-5587-4B86-A20E-9D6D9F43F0E2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9367D880-9EBD-4310-B6EF-EF9032A6F224}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{93B793F0-4322-4FED-B7CA-F4B4FCA03879}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{94BCD3AA-229D-4EE8-9FDA-2E52B766F71D}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{9525723E-DE43-47A0-BDC5-C69A399D5E97}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{95645974-D5B1-4CA5-B274-2EAE5C80930C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{956482EA-73BD-4A5D-BF43-D12E464C614E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{962459C4-00D0-414E-8BDE-F71442C8F5B9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{97000786-D8DA-4F67-ABD0-DA2C22D444CC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{977263F4-EC40-436D-BA88-665F0CF6C481}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{97D5CF8B-CD45-48A1-806E-FB07A0DEBD88}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{985C2970-33B3-4CA5-907D-0A8F1CC72271}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{99C27F10-3791-4AEF-8E0F-22D26ADB23D6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9A5E8634-019A-4DA5-86C1-92762C920327}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9A8F925D-5FA4-4E64-9551-4349DE065CA6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9B29EA99-C03C-4607-80DF-97C58FAFFC1B}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{9B70F0DB-CC56-4F86-B52E-B22812A61AA2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9BFD656A-6AB4-4157-B8B0-B386941142DC}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |
    "{9C147B79-34B2-4629-BBFB-4888FBCE6540}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9C2ECE3E-7251-489D-AF98-F4951A0EDCC2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9C72B945-6243-4FB4-93B4-F8738D27964E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9CA99C5C-4B9E-41BA-B1C9-4BE47DB66CBF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9DDF7F5D-188B-465F-819C-9545F8735E30}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{9DE615C1-D0E6-47D3-BCA1-ECDE8C6EF672}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9E023A3B-D975-48B4-9902-28B690D10492}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9EB6670B-8E47-4FC5-ADAC-CB6380A13277}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{9EC1FBBE-542D-47D3-A331-6CFD59E5EB0B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{9F6C843A-91EC-458F-B920-930014A4871F}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{9FF0967F-38C2-417F-BFD4-BDCCDAC8DFCF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{A049F9F9-3CDD-4BDC-8313-B08F6B2F79A6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{A22581D6-8555-49AF-B39B-C4E6D24258F0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{A249CB2D-4AD6-40CA-B225-459E137AEC1A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{A449EABC-67F1-4734-AAAB-8A50727824B5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{A58CB830-D85F-4AD0-88F0-F6E8DD7BD817}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{A5E5AA17-081F-4FA2-A595-A2DAA3EF0DCC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{A5E5C302-8F7B-44E3-92DA-D00B1E174D2E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{AA6632BC-F665-4BD9-8FC6-BF9C04D57118}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{AAFB4C08-F031-4410-A193-C8CAC5352DC6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{AB50C49D-7DC0-49BD-BE5B-5D5D329740CE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{AC8E3167-41B9-47D9-B169-F96B4D00D089}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{AD69669F-B015-4B14-81F6-3BDE4AD42FC6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{AD797931-C20E-474F-9B99-A76249527673}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{AE52E7AB-5EE1-4AA0-83D1-EF12A0E93718}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{AF00AC51-2A34-4CBD-9EDD-93573E4CF8F6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B07046DA-F5C4-4201-8BEC-A7C2370C4DD8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B0914F99-3A75-4C10-87BB-06492001DFBF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    "{B0AE0878-BA36-4696-BF5E-C4330E88287D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B19781D2-27CF-4B90-BB06-D4485F2CD828}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B212FA0F-F683-4445-BDF9-99B9C3869BA6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B2264336-8730-4CDF-B2BF-3D76F62004EF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B2D849DF-68FD-4A4D-8B93-9EE8B642CCCD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B323F918-29C4-409D-A9EC-5141BD283D3E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B37F87B9-BA0F-4E80-9CA0-3CC3FD91A677}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{B398EDE2-C431-433B-B139-8449B1F77134}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B3A20987-B5D5-4C09-92C3-D70520C38737}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{B3FB9B36-09E6-42DA-ABE1-6F2660C5E882}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B58974A5-6A4E-4639-A335-A2F37596E8CF}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
    "{B58F23E2-4745-426C-8CD0-8C44C6CDB100}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B5A1B03F-0DC0-4673-BC87-2433DC09692F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{B5EA3933-9B3D-475E-965C-E89AFEDB66F3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B6F1D458-E37C-46A3-B96C-411225D62527}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B71108B3-2208-429E-8983-0EAD9919F3AD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B737F64D-DF40-4040-B6B1-FF66C8201E9A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B7411853-7818-4CF4-BE2A-2EF4E995CC08}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B870E344-0915-4FD3-8591-547AC9CBBCB3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B8C3C6B8-2C63-4A08-9EC3-B0B6C43877FA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{BA4729A6-B288-4F1F-B89A-71E5E93D1089}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BA91EBD9-9900-419A-B5E2-9825EB7C5428}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BAAA51DC-BD6B-4FC5-9DBD-84FB3042E7C8}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{BB0282F4-A874-4EE7-A780-599044150F59}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BB6D1773-3DAC-488E-B95C-A26549281EBF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BBE617F3-B7B9-4FD1-A5B8-F35AF1C670E6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BCB2A926-BACB-40EF-A536-BB4F13C5F29F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BCF36210-E368-4675-93A7-041AD7D04227}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BD4FF7A8-9DF9-4B84-910A-6816722A2913}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
    "{BD57511E-FBDA-4680-846B-FFB686074A12}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{BDB10B48-BA36-4123-AC83-9697A4B6DAEF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BF171506-71C5-493D-BA5E-695C2E37CF14}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BF332CA8-16A7-4631-AD43-639E9D3C4482}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{BF7CA69E-DAF5-4A36-A625-69C0C0538BB5}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{C05F9D5D-D5A6-4085-AF97-E3EB1AA36723}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
    "{C0686CAD-F115-45B2-A3BB-3EBCE5A5E5BC}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
    "{C0983677-AD7E-4B46-8776-4F1A05AADBF4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C0D69813-2726-4710-AB0D-2B45A3B289D3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C1A4DB4A-4076-47F2-852E-98649B255B14}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C1AB288D-56D4-4FD0-84F6-E634C65E1BAD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C2108334-AD7D-4180-B779-C916D9CF6363}" = protocol=6 | dir=in | app=c:\program files\shareaza\shareaza.exe |
    "{C243E6BB-E27F-4E27-AED5-FB87F629D2AF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C3852C90-E6B6-41C6-B148-5E34D5BC1A24}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{C38CB4F8-2DE7-4A9A-9773-46A32B0DBEEC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C3F5929B-6E23-4C4B-BACE-39C0A700CF5F}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{C40B2D5B-F950-49D8-9BB7-609016AF5951}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C5A56904-F25E-43DB-8746-340B55AEA785}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C6484CB5-75E0-4CDA-AD52-3022573189CA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C6BC7290-EBC3-4EEE-AE1B-3EAF8B4BE15C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C7C50D16-11D6-4D4D-8B0C-E5752EC90E9F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C7F61A26-6E2A-4922-8DAD-0C8870A4F3C7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C849A1DD-C285-4FD3-918D-03B6EED44B81}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{C866EE75-C656-4277-B3C5-F89F2F075EB2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{C92D66C8-D802-4B04-9746-92B7C87C73E3}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{C9E0A3C9-F928-44F1-A131-2C41155CE996}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{C9EE4FCA-5D52-48C0-948D-C093968B8426}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{CA05238E-EE1D-4E8F-8CA4-F9E40241F40D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{CA3CB567-C589-48D5-B6BD-63929DE7BD32}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{CADCB6E7-36EC-43E8-A899-CA4419B191D6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{CBA452B3-36C8-4805-AF6D-1AF9ECFD4F4B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{CC708721-2715-44CF-B1D5-3242DC4718C5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{CCA80F47-0F1A-4C38-90C4-5BE6B7AEDBCB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{CCD9355E-F750-4AC0-B886-F473EC672640}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{CCFE5340-1C5E-4D93-B8C7-5171B0437754}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{CF401254-01DA-467E-8EB5-04D92F99B3C0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D20BA50C-B13F-4567-9869-B1F04EEE3C81}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D236F020-4BBB-43C2-B35A-4C83CE836B8E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D266969D-567D-4C41-BAE5-8B2D03A495B9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D27BC5C7-E15E-43DB-A976-196A97A6F659}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D2883758-07FB-4F14-9730-8D0DE56F8627}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D2A8BDB8-3A22-4A3C-B359-B40F99E565A7}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{D2D815F8-CE33-4397-A0C4-971AD9CAB1CE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D31B6AC6-0C7D-482C-8BEE-E49882FD797C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D386C199-1B6D-422C-945E-05D1E795A75A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D44FEB0E-5C21-4DE1-AFB5-2645DD5DDFB6}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{D5A61B3D-E4FA-4F08-A9DE-0EFCE5F5D648}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{D5F501AE-D7DC-4DB0-B37D-BCA08EDDA0B3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D619ABC8-2947-4E87-B050-EB476A38E08D}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{D63F5024-BE26-44C1-A9BA-0BD934D8F3FB}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{D674C34C-BAF1-4162-B299-F23D04201FF7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D715E8E1-50DC-4D0A-8AD7-706B3A764A7D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D732E77A-1A9A-4A19-9626-1A69029FDC90}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D794E86C-7F41-4EE9-B069-AFEFE9FE5B6B}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{D7FD258B-AAA0-4139-97D8-83D469705EEC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D85B0CE2-CD4C-4CDA-BBD6-E51588162499}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{D9B7ABA6-805E-424B-863D-1890C9428919}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{DA0794A7-A851-4A00-B3DC-87AB72FF5ED9}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{DA58B396-23A8-403B-BA0C-3A99C4D41729}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{DA8E67C8-7A30-4064-9938-8794AF9DF9A3}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{DAC70677-AE3F-46A3-8874-851751319E07}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
    "{DAD906E0-45BA-4686-A2AE-CD101B649BF4}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{DB459A46-6896-47DF-A3C2-54DB46DD589B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{DC5E346D-2D2A-4F94-9200-897750108C94}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{DC7E6CEA-8913-44AA-9195-30DD60B7E800}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{DC8C6925-984B-4AC9-B7DA-E05C58504AFC}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{DCB3DDB4-0D15-4FE8-9CC8-831448535677}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |
    "{DD5C8005-6081-4CBD-A485-486C25CAC2E4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{DDFCE1E6-4856-41EC-A9D5-79CA9B828FCE}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{DE449342-C6D6-43D7-8121-1A80AF7918D1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{DE7A3CA7-B964-4285-9C29-ECA1E5C4C024}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{DF7B0DBC-7289-42B3-9D73-43BB9CEEEF66}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{DFFDB256-80A3-4A47-B0E1-4EA9AC377F54}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{E047E463-76D9-46C6-860E-4310E15BC347}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{E0D3F93F-C5EA-405C-983B-BF0255FA875B}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
    "{E1007923-0D7D-438F-A6D6-4C605901A882}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{E1C0BA56-6905-4D25-8085-A97770EA7DD5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{E254EC35-55D1-4127-9388-D96ED6D000F3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{E2683C36-9C56-4B7C-8279-9306FA7FFCA8}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{E26BCA03-640B-4348-9F49-D0A6AE8E9679}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{E3807B1C-4011-4857-BF67-302F149B6C46}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{E386472E-D4F4-4D88-B3A7-ED6C3800EB1E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{E3A2B99C-AA0A-46CC-A945-20AF037B300B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{E446945D-763C-4C87-926E-D8DCB5B3ACEC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{E5B44E8D-ACF2-4A45-B5DC-452C40D31849}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{E5E89EAB-7045-47B9-96FA-C9F10FDD25A8}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{E79C66E5-DB0F-4EB7-8B2C-A1854F024D2F}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
    "{E887F7BE-45EC-4A38-9E39-FBA5FE0797DF}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{E998319E-33C0-4715-B994-8B25D81A8A6C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{EB9AE955-F48D-4F26-AAFD-66DE47368EB1}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{EB9FC8A3-FFA1-418D-A6E3-259A846418FB}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{EBB883D0-8FB1-477A-AAB9-9E33AA12A5A3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{EBCF4D9B-2A6B-421C-83F0-F4CAB3131114}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{EC9E81A3-C5C8-4DA4-8811-1552F50A0FE4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{ECA90B90-C519-4D8A-9A94-B32DA6E38A1A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{EDA6E09B-D359-4DF8-8437-FE28280D518C}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
    "{EDCB6D80-D148-4376-B117-AF6DDD4926A2}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{EE1F21D1-80F4-4A8A-9C48-5933E8D2F2D6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F0664D69-2975-4642-905B-AFC9DC73BD0F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F24FF478-551B-44F8-91F7-9856AC367E4D}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
    "{F2701D68-DC1E-4C4F-A2D1-A5285299F4F7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F2A5D748-7A66-46AE-AF15-157CAC79EB3E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F2C8A7E3-1780-4E13-8590-A49C7EBC52CC}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{F2DE334F-6068-49E3-8998-BA70C6B16382}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
    "{F30356B6-94CE-4D31-BCCF-9DCE1C08ED50}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F3EBC232-CA64-4E61-A06B-309FCEA3E898}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F3F2FCC1-48DE-4375-91E6-E2E371AB4E28}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F43BF510-4036-4C17-B9CE-A1C6A5F295CA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F45E8D90-07F2-4948-A991-15555CC2AC57}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F49EBB97-E02C-4156-8C45-1066F606FC7C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F5D33AF1-BDB2-4D1B-A794-24A7AEB7AB62}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F79CA28A-6790-4EB8-B2DC-95062F9F3933}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
    "{F7C15373-4741-4632-B3CE-EBF7A1F8C599}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
    "{F9BB112D-1BE3-407D-82CA-08A39A5FECAD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{F9BC5895-93B3-4B38-BAF2-FE4960A97C3F}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
    "{FA3D1323-E147-46C3-9E1F-649587777DFB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FB2B8839-695F-4146-912D-BA245865FB86}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FB41E4AD-1AA8-4595-B19F-E110C0DD100C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FB450D0C-25F0-4470-A11F-10CB1FB4639A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FBC94BFE-9437-4304-B1BD-2EBAF84BAD98}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FD0D66CA-FCDE-45D1-97F5-74F915831813}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FD10C720-29BF-4356-BF97-F59F0E179BAA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FD2D577B-DC7F-485B-87D4-81A19778690E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FD96996F-E337-4EBF-8247-D794464AFAD8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FEBE1470-59D2-46D3-B164-B06A7AF170EF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{FFF4B509-8667-43ED-8A0A-CF397C7619AA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "TCP Query User{11A5FEDE-BE8B-4612-89E3-D8D1069B9E87}C:\windows\ehome\ehexthost.exe" = protocol=6 | dir=in | app=c:\windows\ehome\ehexthost.exe |
    "TCP Query User{179A29C7-7009-4F13-9A2E-4EF2DD1170E2}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=6 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
    "TCP Query User{3DD0C1BE-AEF3-4CCD-8D0F-9793E25A9CAA}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
    "TCP Query User{41ECC000-25C2-4ACF-BE9E-9C95BCF7887B}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=6 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
    "TCP Query User{6F62AEA3-4265-4088-83D3-E810CD4935B2}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
    "TCP Query User{7C588D54-4CBF-461D-B96E-3704D89BB061}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe |
    "TCP Query User{BB281A61-207B-4874-9D16-19C8BE6C9726}C:\program files\bitcomet\bitcomet.exe" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
    "TCP Query User{DB9FB2E1-3B1F-4E6F-B0FD-004EF22DB9A5}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
    "TCP Query User{EA5200E8-2C42-4C1A-939A-A7F57525D87A}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
    "TCP Query User{F9AE9B21-419C-4763-831F-D3CDFF8D50CB}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe |
    "UDP Query User{0DB8F9B0-8F26-4692-8F8D-BC9050F91A42}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
    "UDP Query User{6D3DA6A1-E597-4151-A125-E09BE4EAC24B}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe |
    "UDP Query User{8FB1280E-A3E1-4535-BB4E-300BAEF4DC65}C:\program files\bitcomet\bitcomet.exe" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
    "UDP Query User{A28CB58B-D167-4AA8-8765-6B3D6865CC9E}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
    "UDP Query User{A46F7D95-D559-41F0-9D89-40476B8CCE99}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe |
    "UDP Query User{C31A3F99-1CB7-4FA6-9772-DE7C830DD36A}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=17 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
    "UDP Query User{E30ACB5E-1502-4C1E-B8E2-EFB8CDAC2306}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
    "UDP Query User{F5891625-E02A-4D0E-A3A0-C81793028026}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=17 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
    "UDP Query User{F6449D53-5BF3-43DE-A05A-38E2499B9CA8}C:\windows\ehome\ehexthost.exe" = protocol=17 | dir=in | app=c:\windows\ehome\ehexthost.exe |
  19. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Extras.txt log (page 3 of 3):

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
    "{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
    "{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
    "{08D5F667-E1D7-4792-9FFD-5888C8D4A0DF}" = Garmin Training Center
    "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
    "{0CFD3BAF-9F4D-4D70-BD0B-638EA2504C25}" = PSSWCORE
    "{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
    "{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
    "{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
    "{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
    "{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
    "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
    "{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
    "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
    "{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
    "{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
    "{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
    "{282E5AB2-8E47-4571-B6FA-6B512555B557}" = HP Photosmart.All-In-One Driver Software 8.0 .A
    "{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
    "{2A03B9F8-BE6D-43C6-A16A-B9998A194AF0}" = Garmin Training Center
    "{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MYMOVIES)
    "{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
    "{2FB5E6F3-AE50-45D9-8AE4-DD331FDD7C84}" = My Movies for Windows Media Center
    "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
    "{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
    "{324CEC09-007A-48eb-90E0-9D42D4D5EB0A}" = NetDeviceManager
    "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
    "{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
    "{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
    "{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
    "{39CB30DB-27F8-4dd4-A294-CB4AE3B584FD}" = Copy
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
    "{40624553-811E-400E-B69B-38D8926A66BD}" = SonicWALL Global VPN Client
    "{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
    "{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
    "{44F5A980-8A6B-4aca-8D85-EFCE5D67D379}" = AIO_CDA_ProductContext
    "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
    "{47A3FE80-528F-482B-8143-B3A4645557FC}" = Microsoft LifeCam
    "{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
    "{4EF6FDB0-3B11-4820-9860-8E08E9965195}" = Snapfish Media Detector
    "{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
    "{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
    "{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
    "{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
    "{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
    "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
    "{5B48A8D9-D1AD-4424-BD4D-E462737099DF}" = SportTracks 3.0
    "{5C474A83-A45F-470C-9AC8-2BD1C251BF9A}" = Skype™ 4.2
    "{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
    "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
    "{5FDFCCA0-59EC-4162-B0B8-632EEE3DF787}" = WebIQ Technology Engine
    "{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
    "{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
    "{625386A4-B6B6-4911-A6E8-23189C3F2D15}" = Microsoft .NET Compact Framework 2.0 SP1
    "{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
    "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
    "{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
    "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
    "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
    "{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
    "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
    "{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
    "{6AF49698-949A-4C89-9B31-041D2CCB5FBD}" = muvee autoProducer 6.0
    "{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
    "{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
    "{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
    "{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
    "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
    "{73A43E42-3658-4DD9-8551-FACDA3632538}" = HP Advisor
    "{7410AD7D-468D-4D3E-B6D1-ED7836B0AE16}" = Enermax
    "{75E71ADD-042C-4F30-BFAC-A9EC42351313}" = Python 2.4.3
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
    "{7FE3214C-283E-40C6-A8D5-CB773110090C}" = Linksys EasyLink Advisor
    "{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
    "{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
    "{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
    "{86D6A20D-3910-4441-A3E5-EB6977251C86}" = Samsung USB Driver
    "{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
    "{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
    "{888FFC82-688D-46AB-A776-B417885432B6}" = Zune
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8C5FAD77-F678-4758-A296-C12F08D179E0}" = Microsoft IntelliPoint 6.2
    "{8CEA85DE-955B-4BF4-87F2-0BAA62821633}" = HP Photosmart Essential2.5
    "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
    "{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
    "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
    "{90120000-0015-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
    "{90120000-0019-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
    "{90120000-001A-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
    "{90120000-0117-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile Device Center
    "{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
    "{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
    "{938B1CD7-7C60-491E-AA90-1F1888168240}" = Roxio MyDVD Basic v9
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9C1EED58-1790-45C4-ADBC-5D45FCA7292E}" = Pure Networks Platform
    "{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
    "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
    "{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
    "{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
    "{A5436728-2DFD-4221-B4D7-F49F740134C9}" = c5100_Help
    "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
    "{A7DEBAA4-B211-4D1A-A6B3-E52BFAAA1D0C}" = Garmin Communicator Plugin
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
    "{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}" = Wizard101
    "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
    "{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
    "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
    "{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
    "{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
    "{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
    "{ADC7FA12-E165-428a-AF13-4CE686E030AA}" = C5100
    "{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}" = Samsung Master
    "{AF1C9345-B53D-4110-BFBF-A0DD83AEAB83}" = AIO_CDA_Software
    "{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
    "{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
    "{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
    "{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
    "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
    "{B7C7A59F-CF70-481E-A94F-7C2563AA5ADD}" = Sony DVD Architect Studio 4.5
    "{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
    "{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
    "{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
    "{C15B6175-689A-4D97-A42C-7225353F60A7}" = Linksys Updater
    "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
    "{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}" = Microsoft Outlook Personal Folders Backup
    "{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
    "{C716522C-3731-4667-8579-40B098294500}" = Toolbox
    "{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
    "{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
    "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
    "{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
    "{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
    "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
    "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
    "{D76D1828-BBA0-4BD9-8181-5ACC617DC5F2}" = Virtual Earth 3D (Beta)
    "{DA507A38-4B2A-40C0-90AC-E30AAA0B757C}" = Vegas Movie Studio Platinum 9.0
    "{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
    "{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
    "{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
    "{E0783143-EAE2-4047-A8D6-E155523C594C}" = Garmin WebUpdater
    "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
    "{E6FA148F-1E7D-4A42-A9A2-7DFABC2C6A2B}" = SportTracks 2.1
    "{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile Device Center Driver Update
    "{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
    "{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
    "{ED3F469E-D9EC-4DF1-968F-5812CE2F30F8}" = HP Driver Diagnostics
    "{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
    "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
    "{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
    "{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
    "{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
    "{F6BA8EF2-A9F8-45B7-BD59-0A15DA9F7D68}" = Omron Health Management Software
    "{F7B9B60F-DBB3-4116-967B-BA93E278331E}" = ActivePerl 5.10.1 Build 1007
    "{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}" = Eraser
    "{FCAFEEB3-3520-4539-89AF-4B743D2DFAEC}" = HTC Sync
    "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
    "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
    "49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
    "Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
    "Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.7 (Unicode)
    "avast5" = avast! Free Antivirus
    "AviSynth" = AviSynth 2.5
    "CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    "CameraWindowLauncher" = Canon Utilities CameraWindow
    "CCleaner" = CCleaner
    "CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
    "com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
    "Coupon Printer for Windows4.0" = Coupon Printer for Windows
    "Disney Toontown Online" = Disney Toontown Online
    "DVDFab 6_is1" = DVDFab 6.2.0.5 (11/11/2009)
    "eMule" = eMule
    "Eraser" = Eraser
    "ffdshow_is1" = ffdshow [rev 1723] [2007-12-24]
    "Google Chrome" = Google Chrome
    "Google Updater" = Google Updater
    "HP Imaging Device Functions" = HP Imaging Device Functions 8.0
    "HP Photosmart Essential" = HP Photosmart Essential 2.0
    "HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
    "HPExtendedCapabilities" = HP Customer Participation Program 8.0
    "HPOCR" = HP OCR Software 8.0
    "InstallShield_{7410AD7D-468D-4D3E-B6D1-ED7836B0AE16}" = Enermax
    "InstallShield_{7FE3214C-283E-40C6-A8D5-CB773110090C}" = Linksys EasyLink Advisor
    "InterActual Player" = InterActual Player
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Microsoft SQL Server 2005" = Microsoft SQL Server 2005
    "Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
    "MVApplication1" = Memorex exPressit Label Design Studio
    "MyCamera" = Canon Utilities MyCamera
    "NVIDIA Drivers" = NVIDIA Drivers
    "OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
    "PC-Doctor 5 for Windows" = Hardware Diagnostic Tools
    "PhotoCardMaker_is1" = PhotoCardMaker 1.0.3
    "Picasa 3" = Picasa 3
    "PROR" = Microsoft Office Professional 2007
    "RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
    "RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
    "Revo Uninstaller" = Revo Uninstaller 1.88
    "Secunia PSI" = Secunia PSI (2.0.0.1003)
    "ShanghaiDynastyUninstallKey" = Shanghai Dynasty
    "Shop for HP Supplies" = Shop for HP Supplies
    "SP6" = Logitech SetPoint 6.15
    "Switch" = Switch
    "SystemRequirementsLab" = System Requirements Lab
    "TeamViewer 6" = TeamViewer 6
    "UnityWebPlayer" = Unity Web Player
    "WildTangent hpdesktop Master Uninstall" = My HP Games
    "WinLiveSuite" = Windows Live Essentials
    "WinRAR archiver" = WinRAR archiver
    "Yahoo! Companion" = Yahoo! Toolbar
    "ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
    "ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
    "Zune" = Zune

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Facebook Plug-In" = Facebook Plug-In

    ========== Last 10 Event Log Errors ==========

    [ Antivirus Events ]
    Error - 4/6/2008 12:12:20 PM | Computer Name = Andrew-PC | Source = avast! | ID = 33554522
    Description =

    Error - 4/7/2008 2:26:42 AM | Computer Name = Andrew-PC | Source = avast! | ID = 33554522
    Description =

    Error - 4/7/2008 10:39:41 AM | Computer Name = Andrew-PC | Source = avast! | ID = 33554522
    Description =

    Error - 12/26/2008 1:14:44 AM | Computer Name = Andrew-PC | Source = avast! | ID = 33554522
    Description =

    Error - 4/25/2009 12:10:58 AM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
    Description =

    Error - 2/6/2010 6:46:50 PM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
    Description =

    Error - 2/6/2010 6:46:56 PM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
    Description =

    Error - 2/6/2010 6:47:01 PM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
    Description =

    Error - 2/6/2010 6:47:33 PM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
    Description =

    Error - 2/14/2010 3:07:41 AM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
    Description =

    [ Application Events ]
    Error - 12/24/2010 10:57:33 PM | Computer Name = AndrewPC | Source = Application Hang | ID = 1002
    Description = The program iexplore.exe version 8.0.6001.18999 stopped interacting
    with Windows and was closed. To see if more information about the problem is available,
    check the problem history in the Problem Reports and Solutions control panel. Process
    ID: 428 Start Time: 01cba3d3e7fc2700 Termination Time: 0

    Error - 12/26/2010 8:10:15 PM | Computer Name = AndrewPC | Source = Application Error | ID = 1000
    Description = Faulting application Dynasty.exe, version 0.0.0.0, time stamp 0x349b8a1c,
    faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821, exception
    code 0xc0000005, fault offset 0x0006803d, process id 0x1824, application start time
    0x01cba5594e51fee0.

    Error - 12/27/2010 10:36:46 PM | Computer Name = AndrewPC | Source = Application Error | ID = 1000
    Description = Faulting application Dynasty.exe, version 0.0.0.0, time stamp 0x349b8a1c,
    faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821, exception
    code 0xc0000005, fault offset 0x000675ff, process id 0xb74, application start time
    0x01cba636e7b33f80.

    Error - 1/1/2011 3:15:04 AM | Computer Name = AndrewPC | Source = Bonjour Service | ID = 100
    Description = 456: ERROR: read_msg errno 10054 (An existing connection was forcibly
    closed by the remote host.)

    Error - 1/1/2011 3:15:04 AM | Computer Name = AndrewPC | Source = Bonjour Service | ID = 100
    Description = 440: ERROR: read_msg errno 10054 (An existing connection was forcibly
    closed by the remote host.)

    Error - 1/1/2011 3:15:04 AM | Computer Name = AndrewPC | Source = Bonjour Service | ID = 100
    Description = 448: ERROR: read_msg errno 10054 (An existing connection was forcibly
    closed by the remote host.)

    Error - 1/1/2011 3:15:04 AM | Computer Name = AndrewPC | Source = Bonjour Service | ID = 100
    Description = 392: ERROR: read_msg errno 10054 (An existing connection was forcibly
    closed by the remote host.)

    Error - 1/1/2011 10:13:24 PM | Computer Name = AndrewPC | Source = Perflib | ID = 1010
    Description =

    Error - 1/1/2011 10:13:27 PM | Computer Name = AndrewPC | Source = Perflib | ID = 1008
    Description =

    Error - 1/3/2011 11:36:19 AM | Computer Name = AndrewPC | Source = Application Error | ID = 1000
    Description = Faulting application Dynasty.exe, version 0.0.0.0, time stamp 0x349b8a1c,
    faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821, exception
    code 0xc0000005, fault offset 0x000675ff, process id 0x19a8, application start time
    0x01cbab59927037f5.

    [ Media Center Events ]
    Error - 8/17/2009 5:38:12 PM | Computer Name = AndrewPC | Source = MCUpdate | ID = 0
    Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

    Error - 12/2/2009 11:49:30 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
    Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
    returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

    Error - 12/4/2009 4:15:56 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
    Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
    returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

    Error - 12/4/2009 4:27:05 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
    Description = Event Info: ERROR: SqmApiWrapper.WaitForUploadComplete failed. Please
    try to ping www.msn.com prior to filing a bug.; Win32 GetLastError returned 10000109
    Process: DefaultDomain Object Name: Media Center Guide

    Error - 12/4/2009 6:16:06 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
    Description = Event Info: ERROR: SqmApiWrapper.WaitForUploadComplete failed. Please
    try to ping www.msn.com prior to filing a bug.; Win32 GetLastError returned 10000109
    Process: DefaultDomain Object Name: Media Center Guide

    Error - 12/4/2009 6:25:34 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
    Description = Event Info: ERROR: SqmApiWrapper.TimerAccumulate failed; Win32 GetLastError
    returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

    Error - 12/4/2009 6:25:34 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
    Description = Event Info: ERROR: SqmApiWrapper.TimerAccumulate failed; Win32 GetLastError
    returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

    Error - 12/4/2009 9:35:10 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
    Description = Event Info: ERROR: SqmApiWrapper.WaitForUploadComplete failed. Please
    try to ping www.msn.com prior to filing a bug.; Win32 GetLastError returned 10000109
    Process: DefaultDomain Object Name: Media Center Guide

    Error - 12/4/2009 9:39:18 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
    Description = Event Info: ERROR: SqmApiWrapper.TimerAccumulate failed; Win32 GetLastError
    returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

    Error - 5/19/2010 4:57:50 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
    Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
    returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

    [ System Events ]
    Error - 1/5/2011 8:18:40 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
    Description =

    Error - 1/5/2011 8:19:44 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
    Description =

    Error - 1/5/2011 8:24:40 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7034
    Description =

    Error - 1/5/2011 8:24:42 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
    Description =

    Error - 1/5/2011 8:36:15 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
    Description =

    Error - 1/5/2011 8:36:30 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
    Description =

    Error - 1/5/2011 8:41:06 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7022
    Description =

    Error - 1/5/2011 8:41:07 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7022
    Description =

    Error - 1/5/2011 8:41:07 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7026
    Description =

    Error - 1/5/2011 8:43:45 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7009
    Description =


    < End of report >
  20. piperca

    piperca TS Rookie Topic Starter Posts: 24

    I noticed when running OTL that there was a box that was not ticked that said "scan all users." Should I have ticked that box?
  21. Broni

    Broni Malware Annihilator Posts: 46,748   +254

    That's fine....

    Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    =====================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
      O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
      O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
      O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
      O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
      @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:40E5AD89
      @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:4A9220C3
      
      
      :Services
      
      :Reg
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
      "DisableMonitoring" =-
      
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =====================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
  22. piperca

    piperca TS Rookie Topic Starter Posts: 24

    OTL fix log:

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\ deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
    Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
    C:\Windows\Downloaded Program Files\erma.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\Windows\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
    ADS C:\ProgramData\TEMP:40E5AD89 deleted successfully.
    ADS C:\ProgramData\TEMP:4A9220C3 deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\\DisableMonitoring deleted successfully.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Andrew
    ->Temp folder emptied: 7853 bytes
    ->Temporary Internet Files folder emptied: 10792745 bytes
    ->Java cache emptied: 2027 bytes
    ->FireFox cache emptied: 0 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 1024 bytes

    User: Cathie
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Lilly
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Lilly.Andrew-PC
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 3085258 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 13.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Andrew
    ->Flash cache emptied: 0 bytes

    User: Cathie
    ->Flash cache emptied: 0 bytes

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Lilly

    User: Lilly.Andrew-PC
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.20.1 log created on 01052011_192934

    Files\Folders moved on Reboot...
    File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

    Registry entries deleted on Reboot...
  23. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Security Check log:

    Results of screen317's Security Check version 0.99.7
    Windows Vista Service Pack 2 (UAC is disabled!)
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    avast! Free Antivirus
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    CCleaner
    Java(TM) 6 Update 23
    Out of date Java installed!
    Adobe Flash Player 10.1.102.64
    Adobe Reader 9.4.1
    Out of date Adobe Reader installed!
    Mozilla Firefox (3.6.13)
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Alwil Software Avast5 AvastSvc.exe
    Alwil Software Avast5 AvastUI.exe
    ``````````End of Log````````````
  24. Broni

    Broni Malware Annihilator Posts: 46,748   +254

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
    On this page:

    [​IMG]

    make sure, you have both boxes UN-checked AND (important!) click on Decline button
  25. piperca

    piperca TS Rookie Topic Starter Posts: 24

    Okay, I've done everything, but the Eset scan. It took way too long and I have to go to bed, so I'll give it another shot tomorrow. I got about 50 percent done and had nothing showing up.

    A couple of things:

    My desktop now has a few transparent icons that say "desktop.ini" and one file containing a couple of photographs that is also transparent. Inside the folder, with the photos, is another .ini file. Where did they come from and how do I correct this?

    Now that I've downloaded all of these programs, what is the best way to remove all remnants of them?

    And lastly; what on earth was causing the issues with my PC? I suspect the "SGPSA" file had something to do with it ... what the heck is this?

    Short of sparking this thing up tomorrow evening and having it crash, I think you done a fine job of fixing this for me. I would like to thank you very much for your assistance ... you have a fine website here!

    I will complete the Eset scan tomorrow and give you an update on the overall health of the computer.

    Thanks again!
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.