Solved Malwarebytes cant be installed.Acess is denied

ernest157 · Sep 4, 2011

\\?\c:\\Users\All Users\Documents: JUNCTION
Print Name : C:\Users\Public\Documents
Substitute Name: C:\Users\Public\Documents

\\?\c:\\Users\All Users\Favorites: JUNCTION
Print Name : C:\Users\Public\Favorites
Substitute Name: C:\Users\Public\Favorites

\\?\c:\\Users\All Users\Start Menu: JUNCTION
Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

\\?\c:\\Users\All Users\Templates: JUNCTION
Print Name : C:\ProgramData\Microsoft\Windows\Templates
Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

...

...

...

...

...

..
Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\05f38fa840db2dfbea3f56f7bf4eaf48_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\0a78addef20a2ae026548bb10ade0b60_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\0ac96bef5fe0c8bfeaf79d00cc315f1f_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\0b9fee046491d3a6e40563bb6ae3f27c_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\0bab3bbcefdf9ffa46a12d3d2f79549f_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\137502b55facd3a0fc1de61a2fe669cf_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\14a9023208e218e1c2610d3dea77b85f_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\180fff626d76e06d0d702ca5fe1b8dcd_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\1ad069c9d6d5149f6928c628332b563d_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\1b01d578c6b4976aeb3fb03c7f1675b5_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\1d1511cfeb16eedd2a18c034f723dc12_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\1f9d00b7cdfb62031363fdb9a3bdcc28_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\204cb0887dace845dc1ccefd36b7b36f_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\20c9a6b879e7e8146a26b15f3c69b112_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\23b3790c4191263498f83479b1f1a932_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\24ac1dfd65961d5edde195d9ad0466f1_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\2be13a4837ca5fb7439b7ed9eb6878dc_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\2d0039e937a920c7b62264ded7437bcb_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\303bddf6cb680faa140f9481f1723fd2_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\316165db207542e12815fe460285d0be_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\3322248fafa78e1f4cd4714e785759e4_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\3a30c918cdf17394c01b76de093dff70_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\3d63bd9808e8b3102d9be9c830a56d1c_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\3dfab8c8e589a1f7c2b8fa6895cad68e_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\3f7f5e979c8c1b8fc55b254d7672ea79_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\421d8edba753610078ab66f610a3ada0_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\421f199340cc25decb8459de99de66d9_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\43b01780766ee2107813a91a0f7ad396_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\45fd0d79405a4e77cd8e3efb313e3780_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\478aa0b14dfac40be224b5d0c55bf1ac_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\491150cdfe5801226c4b30d39c9dec1f_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\49cb20a7746313ee1ff64e4e63144b54_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\520f5eb1443a2ac4882fa008959fce4f_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\52be461198515f5e8bcc4679c008f5cc_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\5353fea260606b23fdf0799f2e112810_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\53f5741327d8ca31869f555142ac6b02_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\545504a3183e6d358dace1f475061ab3_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\5955b0c721cb2823730c371df3239c73_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\5a99da9947a4ed2320c8c8b0e954c724_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\5e6a0938eaf141401255af4f39a83613_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\6629b7514669b0bd99149f70d3961213_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\685334060b3aaa85089289f678a967a9_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\73ab1cc40b82a2420ecf99635e4a6aa5_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\7dfb948a2d13ddba8a4a1c944f8fe1f3_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\7ec456b3308020dfb8868827c4d8b61f_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\7ef21468a51303967f63c0de9b105006_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\7fa3054c84dd13178de708f63c851017_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\822e2e7f14d1920d8b84eb7b5d7702b2_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\82c5915b87c154b1607f817512169c20_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\846a67e94e3a2965b1e31ea244fa2733_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\84dadacf77eb26c337ccd8238d8d852e_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\8bb14abee6cf618c07b57c6857319747_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\9267dea45ecfe8e989661f0a65154c0f_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\94ab97b7a01ba1d328d3158a1e41b449_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\959cf732998ccaa806042f9ae0532c81_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\95e59e20a8b1dbc33abe6d1bad69c46e_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\99ef1b53416906ebc5c3b487376f2839_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\9a10d30f19fd27533b36c014062778af_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\9ff0a375c616445269c6c040c656980d_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\a38d0402fc1637610e24a100e41a95ce_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\a458598bf92079feecd538f980cb20e8_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\a4ebb9695e615006f49e1e21cfff921a_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\a56baaac9a3d2243d5342c4b67357863_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\a84eca1f0d5e99bc7960b1b3383e5e4e_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\a8a013b1a08619ea3ca54f3d91eeada9_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\a9de6255519707cd35a6b7d3cc5d92fc_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\b0ab7f3794db939d6a6e03535c40e7d4_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\b2e1d801bb8606a66bb325a60a18f9ab_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\b353556240837b765db3933fc5f9b686_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\b90374bd4f5580f14c9229bf3321e47d_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\b99b3a31183f9eea1cbc149b12af5206_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\b9b271211b928a9d544719f3476e2238_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\bac30ab5877da15fbb2ac177ef6dbb47_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\bc58fb991b89d6bc0b537cf01c35f718_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\be647677218a792ebccb9ff8809459fc_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\bfb7d98779713ae04b0ddc18a69c37c7_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\c2c8403e174c72cc447609cc77d1b36e_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\c32e478eb4508a7bb8996584f368556a_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\c458fe7dae37ff8527a4f4374a5b1d13_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\c4732323ed38a3bc0e790cd2b45dab85_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\c83237f06bb275e4ee6afaa266aae5d5_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\cb2bbc8a6ea52711221a07c959a4002a_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\d2bf218b8a0471de0badaad76cbd78c7_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\d355bbacdb5e1f1c43827d835483003d_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\d97f63c07b00d4de089c18c21588d2b0_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\dc98c7a21041b882f6e1a9821e8f96a9_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\e471d49bb10d14cee278a12f9d11d60a_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\e53e08c58cd1c3ee138ca69b2b310afb_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\e78b115708371b87552cd0bd5330d0d8_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\e858b51d41441cb9e35bee6a13f93743_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\e9a664e328375c97bff363661faef3c4_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\eac7d2fd85dc800f992604253642fc72_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\ec5f96d7ed29ad59ae12894add161f0d_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\ede4470cfcceedb70bc810f1ca89cee1_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\eea91f3321b5db5279e0114a8763913a_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\f411b87512b10636a9176744cc4e43d1_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\f5ad841604ffef5b11da52d1d0a19184_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\fcf0748472dcd385372235e2de640e2c_c597019e-abf2-401d-8019-c71e51914842: Access is denied.

.

...

.\\?\c:\\Users\Default\Application Data: JUNCTION
Print Name : C:\Users\Default\AppData\Roaming
Substitute Name: C:\Users\Default\AppData\Roaming

\\?\c:\\Users\Default\Local Settings: JUNCTION
Print Name : C:\Users\Default\AppData\Local
Substitute Name: C:\Users\Default\AppData\Local

\\?\c:\\Users\Default\My Documents: JUNCTION
Print Name : C:\Users\Default\Documents
Substitute Name: C:\Users\Default\Documents

\\?\c:\\Users\Default\NetHood: JUNCTION
Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts
Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts

\\?\c:\\Users\Default\PrintHood: JUNCTION
Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts

\\?\c:\\Users\Default\Recent: JUNCTION
Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent
Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent

\\?\c:\\Users\Default\SendTo: JUNCTION
Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo
Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo

\\?\c:\\Users\Default\Start Menu: JUNCTION
Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu
Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu

\\?\c:\\Users\Default\Templates: JUNCTION
Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates
Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates

\\?\c:\\Users\Default\AppData\Local\Application Data: JUNCTION
Print Name : C:\Users\Default\AppData\Local
Substitute Name: C:\Users\Default\AppData\Local

\\?\c:\\Users\Default\AppData\Local\History: JUNCTION
Print Name : C:\Users\Default\AppData\Local\Microsoft\Windows\History
Substitute Name: C:\Users\Default\AppData\Local\Microsoft\Windows\History

\\?\c:\\Users\Default\AppData\Local\Temporary Internet Files: JUNCTION
Print Name : C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files
Substitute Name: C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files

\\?\c:\\Users\Default\Documents\My Music: JUNCTION
Print Name : C:\Users\Default\Music
Substitute Name: C:\Users\Default\Music

\\?\c:\\Users\Default\Documents\My Pictures: JUNCTION
Print Name : C:\Users\Default\Pictures
Substitute Name: C:\Users\Default\Pictures

\\?\c:\\Users\Default\Documents\My Videos: JUNCTION
Print Name : C:\Users\Default\Videos
Substitute Name: C:\Users\Default\Videos

\\?\c:\\Users\Guest 2\Application Data: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Roaming
Substitute Name: C:\Users\Guest 2\AppData\Roaming

\\?\c:\\Users\Guest 2\Cookies: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Cookies
Substitute Name: C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Cookies

\\?\c:\\Users\Guest 2\Local Settings: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Local
Substitute Name: C:\Users\Guest 2\AppData\Local

\\?\c:\\Users\Guest 2\My Documents: JUNCTION
Print Name : C:\Users\Guest 2\Documents
Substitute Name: C:\Users\Guest 2\Documents

\\?\c:\\Users\Guest 2\NetHood: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Network Shortcuts
Substitute Name: C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Network Shortcuts

\\?\c:\\Users\Guest 2\PrintHood: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
Substitute Name: C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Printer Shortcuts

\\?\c:\\Users\Guest 2\Recent: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Recent
Substitute Name: C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Recent

\\?\c:\\Users\Guest 2\SendTo: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\SendTo
Substitute Name: C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\SendTo

.\\?\c:\\Users\Guest 2\Start Menu: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Start Menu
Substitute Name: C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Start Menu

\\?\c:\\Users\Guest 2\Templates: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Templates
Substitute Name: C:\Users\Guest 2\AppData\Roaming\Microsoft\Windows\Templates

\\?\c:\\Users\Guest 2\AppData\Local\Application Data: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Local
Substitute Name: C:\Users\Guest 2\AppData\Local

\\?\c:\\Users\Guest 2\AppData\Local\History: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Local\Microsoft\Windows\History
Substitute Name: C:\Users\Guest 2\AppData\Local\Microsoft\Windows\History

\\?\c:\\Users\Guest 2\AppData\Local\Temporary Internet Files: JUNCTION
Print Name : C:\Users\Guest 2\AppData\Local\Microsoft\Windows\Temporary Internet Files
Substitute Name: C:\Users\Guest 2\AppData\Local\Microsoft\Windows\Temporary Internet Files

.

.\\?\c:\\Users\Guest 2\Documents\My Music: JUNCTION
Print Name : C:\Users\Guest 2\Music
Substitute Name: C:\Users\Guest 2\Music

\\?\c:\\Users\Guest 2\Documents\My Pictures: JUNCTION
Print Name : C:\Users\Guest 2\Pictures
Substitute Name: C:\Users\Guest 2\Pictures

\\?\c:\\Users\Guest 2\Documents\My Videos: JUNCTION
Print Name : C:\Users\Guest 2\Videos
Substitute Name: C:\Users\Guest 2\Videos

\\?\c:\\Users\LogMeInRemoteUser\Application Data: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Roaming
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Roaming

\\?\c:\\Users\LogMeInRemoteUser\Cookies: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Cookies
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Cookies

\\?\c:\\Users\LogMeInRemoteUser\Local Settings: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Local
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Local

\\?\c:\\Users\LogMeInRemoteUser\My Documents: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\Documents
Substitute Name: C:\Users\LogMeInRemoteUser\Documents

\\?\c:\\Users\LogMeInRemoteUser\NetHood: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Network Shortcuts
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Network Shortcuts

\\?\c:\\Users\LogMeInRemoteUser\PrintHood: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Printer Shortcuts

\\?\c:\\Users\LogMeInRemoteUser\Recent: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Recent
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Recent

\\?\c:\\Users\LogMeInRemoteUser\SendTo: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\SendTo
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\SendTo

\\?\c:\\Users\LogMeInRemoteUser\Start Menu: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Start Menu
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Start Menu

\\?\c:\\Users\LogMeInRemoteUser\Templates: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Templates
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Roaming\Microsoft\Windows\Templates

\\?\c:\\Users\LogMeInRemoteUser\AppData\Local\Application Data: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Local
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Local

\\?\c:\\Users\LogMeInRemoteUser\AppData\Local\History: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Local\Microsoft\Windows\History
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Local\Microsoft\Windows\History

\\?\c:\\Users\LogMeInRemoteUser\AppData\Local\Temporary Internet Files: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\AppData\Local\Microsoft\Windows\Temporary Internet Files
Substitute Name: C:\Users\LogMeInRemoteUser\AppData\Local\Microsoft\Windows\Temporary Internet Files

.\\?\c:\\Users\LogMeInRemoteUser\Documents\My Music: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\Music
Substitute Name: C:\Users\LogMeInRemoteUser\Music

\\?\c:\\Users\LogMeInRemoteUser\Documents\My Pictures: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\Pictures
Substitute Name: C:\Users\LogMeInRemoteUser\Pictures

\\?\c:\\Users\LogMeInRemoteUser\Documents\My Videos: JUNCTION
Print Name : C:\Users\LogMeInRemoteUser\Videos
Substitute Name: C:\Users\LogMeInRemoteUser\Videos

\\?\c:\\Users\Owner\Application Data: JUNCTION
Print Name : C:\Users\Owner\AppData\Roaming
Substitute Name: C:\Users\Owner\AppData\Roaming

\\?\c:\\Users\Owner\Cookies: JUNCTION
Print Name : C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies
Substitute Name: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies

\\?\c:\\Users\Owner\Local Settings: JUNCTION
Print Name : C:\Users\Owner\AppData\Local
Substitute Name: C:\Users\Owner\AppData\Local

\\?\c:\\Users\Owner\My Documents: JUNCTION
Print Name : C:\Users\Owner\Documents
Substitute Name: C:\Users\Owner\Documents

\\?\c:\\Users\Owner\NetHood: JUNCTION
Print Name : C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Network Shortcuts
Substitute Name: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Network Shortcuts

\\?\c:\\Users\Owner\PrintHood: JUNCTION
Print Name : C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
Substitute Name: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Printer Shortcuts

\\?\c:\\Users\Owner\Recent: JUNCTION
Print Name : C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Recent
Substitute Name: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Recent

\\?\c:\\Users\Owner\SendTo: JUNCTION
Print Name : C:\Users\Owner\AppData\Roaming\Microsoft\Windows\SendTo
Substitute Name: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\SendTo

\\?\c:\\Users\Owner\Start Menu: JUNCTION
Print Name : C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu
Substitute Name: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu

\\?\c:\\Users\Owner\Templates: JUNCTION
Print Name : C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Templates
Substitute Name: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Templates

\\?\c:\\Users\Owner\AppData\Local\Application Data: JUNCTION
Print Name : C:\Users\Owner\AppData\Local
Substitute Name: C:\Users\Owner\AppData\Local

\\?\c:\\Users\Owner\AppData\Local\History: JUNCTION
Print Name : C:\Users\Owner\AppData\Local\Microsoft\Windows\History
Substitute Name: C:\Users\Owner\AppData\Local\Microsoft\Windows\History

\\?\c:\\Users\Owner\AppData\Local\Temporary Internet Files: JUNCTION
Print Name : C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files
Substitute Name: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files

.

...

...

...

...

...

...

...

...

...\\?\c:\\Users\Owner\Documents\My Music: JUNCTION
Print Name : C:\Users\Owner\Music
Substitute Name: C:\Users\Owner\Music

\\?\c:\\Users\Owner\Documents\My Pictures: JUNCTION
Print Name : C:\Users\Owner\Pictures
Substitute Name: C:\Users\Owner\Pictures

\\?\c:\\Users\Owner\Documents\My Videos: JUNCTION
Print Name : C:\Users\Owner\Videos
Substitute Name: C:\Users\Owner\Videos

.\\?\c:\\Users\Public\Documents\My Music: JUNCTION
Print Name : C:\Users\Public\Music
Substitute Name: C:\Users\Public\Music

\\?\c:\\Users\Public\Documents\My Pictures: JUNCTION
Print Name : C:\Users\Public\Pictures
Substitute Name: C:\Users\Public\Pictures

\\?\c:\\Users\Public\Documents\My Videos: JUNCTION
Print Name : C:\Users\Public\Videos
Substitute Name: C:\Users\Public\Videos

Failed to open \\?\c:\\Windows\bthservsdp.dat: Access is denied.

..

...

...

...

...

...

...

...
Failed to open \\?\c:\\Windows\System32\C_11473.dll: Access is denied.

...
Failed to open \\?\c:\\Windows\System32\sppcomapi.dll: Access is denied.

...

...

...

...

...

...

...

...
Failed to open \\?\c:\\Windows\System32\LogFiles\WMI\RtBackup: Access is denied.

Failed to open \\?\c:\\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat: Access is denied.

Failed to open \\?\c:\\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat.LOG1: Access is denied.

Failed to open \\?\c:\\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat.LOG2: Access is denied.

Failed to open \\?\c:\\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{2179d868-a4a0-11df-9ab1-001b24745a03}.TM.blf: Access is denied.

Failed to open \\?\c:\\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{2179d868-a4a0-11df-9ab1-001b24745a03}.TMContainer00000000000000000001.regtrans-ms: Access is denied.

Failed to open \\?\c:\\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{2179d868-a4a0-11df-9ab1-001b24745a03}.TMContainer00000000000000000002.regtrans-ms: Access is denied.

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

..
Failed to open \\?\c:\\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7600.16385_none_5b97f4df0025c6e9\sppcomapi.dll: Access is denied.

Failed to open \\?\c:\\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_5dc908a6fd144a83\sppcomapi.dll: Access is denied.

.

...

...

...

...

Broni · Sep 4, 2011

Is that it, or more is coming?

ernest157 · Sep 4, 2011

Yes that is all

Broni · Sep 4, 2011

Please download Inherit by sUBs

Drag and drop mbam.exe onto Inherit
This shall restore permissions to the application
The application should now run normally

Please indicate in your next post if this was successful.

ernest157 · Sep 4, 2011

Nope still get access is denied. Should i try restarting my computer?

Broni · Sep 4, 2011

Please do.

ernest157 · Sep 4, 2011

Still cant install it.

Broni · Sep 4, 2011

1. Uninstall Malwarebytes' Anti-Malware using Add/Remove programs in the control panel.
2. Restart your computer (very important).
3. Download and run this utility.
4. It will ask to restart your computer (please allow it to).
5. After the computer restarts, install the latest version from here.

ernest157 · Sep 4, 2011

when i try to uninstall it i get the error.

internal error:Cannot find utcompiledcode record for this version of the uninstaller.

What should i do.

Broni · Sep 4, 2011

Try free version of Revo: http://www.revouninstaller.com/revo_uninstaller_free_download.html

ernest157 · Sep 4, 2011

Finally. Thank you so much for your help. Anything else i should do besides run a quick scan with malwarebytes

Broni · Sep 4, 2011

We're definitely not done, but I'm glad to hear good news

Give me MBAM scan log first.

ernest157 · Sep 4, 2011

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7651

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

9/4/2011 4:33:47 PM
mbam-log-2011-09-04 (16-33-47).txt

Scan type: Quick scan
Objects scanned: 211863
Time elapsed: 8 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Broni · Sep 4, 2011

Cool

Any current issues?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

ernest157 · Sep 4, 2011

OTL logfile created on: 9/4/2011 4:50:57 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Owner\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 0.90 Gb Available Physical Memory | 45.22% Memory free
3.98 Gb Paging File | 2.73 Gb Available in Paging File | 68.63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 178.03 Gb Total Space | 94.68 Gb Free Space | 53.18% Space Free | Partition Type: NTFS
Drive D: | 8.28 Gb Total Space | 1.82 Gb Free Space | 22.02% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/09/04 16:42:04 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Owner\Desktop\OTL.exe
PRC - [2011/09/01 20:35:49 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/08/18 21:03:44 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2011/07/06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/02/18 11:47:12 | 000,079,192 | ---- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2010/12/14 23:33:28 | 000,374,152 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
PRC - [2010/11/20 04:17:48 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/11/20 04:17:10 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010/11/05 23:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010/06/29 17:22:56 | 001,550,576 | ---- | M] (Lavasoft AB) -- C:\Program Files\Lavasoft\Ad-Aware Total Security\Firewall\GDFirewallTray.exe
PRC - [2010/06/29 17:22:22 | 000,412,944 | ---- | M] (Lavasoft AB) -- C:\Program Files\Lavasoft\Ad-Aware Total Security\AVK\AVKService.exe
PRC - [2010/06/29 17:20:32 | 000,981,504 | ---- | M] (Lavasoft AB) -- C:\Program Files\Lavasoft\Ad-Aware Total Security\AVKTray\AVKTray.exe
PRC - [2010/06/15 11:14:20 | 001,834,432 | ---- | M] (Lavasoft AB) -- C:\Program Files\Lavasoft\Ad-Aware Total Security\Firewall\GDFwSvc.exe
PRC - [2010/05/31 12:31:10 | 000,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
PRC - [2010/04/12 04:40:16 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files\PowerISO\PWRISOVM.EXE
PRC - [2009/10/26 14:46:54 | 001,458,176 | ---- | M] (Motorola Inc.) -- C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
PRC - [2008/12/15 17:40:08 | 000,552,064 | ---- | M] (Eset ) -- C:\Program Files\ESET\nod32krn.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/01/15 03:26:18 | 004,874,240 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/04/23 21:11:44 | 000,106,593 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
PRC - [2007/04/23 21:11:42 | 000,262,243 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe

========== Modules (No Company Name) ==========

MOD - [2011/09/03 13:42:58 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\4655321f01d2564f3c7acda08636ecc6\IAStorCommon.ni.dll
MOD - [2011/09/03 13:42:55 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\3dd77b6d66cda1f160a7adbe7c0e01af\IAStorUtil.ni.dll
MOD - [2011/09/03 13:34:22 | 011,819,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\33b601c8e2cf4993e68d763389246197\System.Web.ni.dll
MOD - [2011/09/03 13:33:29 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e3e3b399b69c569ab1ed3b0ace2c8c20\System.Runtime.Remoting.ni.dll
MOD - [2011/09/03 13:27:58 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\0d43c5e77ee7b8466700b16d7e7d4bb7\System.Windows.Forms.ni.dll
MOD - [2011/09/03 13:26:54 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\9e87dd8fe5d0f925d80a6a6eaf74fdb9\System.Drawing.ni.dll
MOD - [2011/09/03 13:25:42 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\6124dbbfd45927c4a6226d6e6bca6253\WindowsBase.ni.dll
MOD - [2011/09/03 13:25:11 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\16d2854bf69d59d94e64a918365705f1\System.Xml.ni.dll
MOD - [2011/09/03 13:24:49 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\36d0ed3f2a65b9d67933ed46dfcd2ccb\System.Configuration.ni.dll
MOD - [2011/09/03 13:24:46 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\3da7c6c1a0f26ae91883fd8b03ec192d\System.ni.dll
MOD - [2011/09/03 13:21:30 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\16b68fcaff063835ae0ee348a1201f2a\mscorlib.ni.dll
MOD - [2011/09/01 20:35:47 | 001,846,232 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/09/01 20:35:21 | 006,277,280 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2009/11/03 16:51:42 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2007/04/23 21:11:44 | 000,339,968 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLTinyDB.dll
MOD - [2007/04/23 21:11:34 | 000,237,673 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
MOD - [2007/04/23 21:11:34 | 000,114,787 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLSchMgr.dll
MOD - [2007/04/23 21:11:34 | 000,032,768 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/09/03 12:05:23 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/08/18 21:03:44 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/04/12 16:20:25 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\srvany.exe -- (KMService)
SRV - [2010/12/14 23:33:36 | 000,136,584 | ---- | M] (LogMeIn, Inc.) [Disabled | Stopped] -- C:\Program Files\LogMeIn\x86\RaMaint.exe -- (LMIMaint)
SRV - [2010/12/14 23:33:32 | 000,390,528 | ---- | M] (LogMeIn, Inc.) [Disabled | Stopped] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2010/12/14 23:33:28 | 000,374,152 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2010/11/05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010/06/29 17:22:22 | 000,412,944 | ---- | M] (Lavasoft AB) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware Total Security\AVK\AVKService.exe -- (AVKService)
SRV - [2010/06/29 17:22:18 | 001,081,384 | ---- | M] (Lavasoft AB) [Auto | Stopped] -- C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy)
SRV - [2010/06/29 17:16:06 | 000,624,064 | ---- | M] (Lavasoft AB) [Disabled | Stopped] -- C:\Program Files\Common Files\G Data\GDScan\GDScan.exe -- (GDScan)
SRV - [2010/06/29 17:15:58 | 000,911,976 | ---- | M] (Lavasoft AB) [On_Demand | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware Total Security\AVKBackup\AVKBackupService.exe -- (GDBackupSvc)
SRV - [2010/06/29 17:15:50 | 001,234,896 | ---- | M] (Lavasoft AB) [On_Demand | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware Total Security\AVKTuner\AVKTunerService.exe -- (GDTunerSvc)
SRV - [2010/06/23 12:35:18 | 001,635,672 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware Total Security\AVK\AVKWCtl.exe -- (AVKWCtl)
SRV - [2010/06/15 11:14:20 | 001,834,432 | ---- | M] (Lavasoft AB) [On_Demand | Running] -- C:\Program Files\Lavasoft\Ad-Aware Total Security\Firewall\GDFwSvc.exe -- (GDFwSvc)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2008/12/15 17:40:08 | 000,552,064 | ---- | M] (Eset ) [Auto | Start_Pending] -- C:\Program Files\Eset\nod32krn.exe -- (NOD32krn)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2007/05/31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007/04/23 21:11:44 | 000,106,593 | ---- | M] () [Auto | Running] -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2007/04/23 21:11:42 | 000,262,243 | ---- | M] () [Auto | Running] -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)

========== Driver Services (SafeList) ==========

DRV - [2011/08/04 12:49:30 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011/08/04 12:49:29 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/05/23 23:22:50 | 000,029,992 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\GRD.sys -- (GRD)
DRV - [2011/05/23 22:45:53 | 000,047,560 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PktIcpt.sys -- (GDPkIcpt)
DRV - [2011/05/23 22:44:10 | 000,062,024 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\MiniIcpt.sys -- (GDMnIcpt)
DRV - [2011/05/23 22:44:10 | 000,038,856 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\System32\drivers\HookCentre.sys -- (HookCentre)
DRV - [2011/05/23 22:44:07 | 000,033,480 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\GDBehave.sys -- (GDBehave)
DRV - [2011/05/23 22:44:03 | 000,040,904 | ---- | M] (G DATA Software AG) [Kernel | System | Running] -- C:\Windows\System32\drivers\gdwfpcd32.sys -- (gdwfpcd)
DRV - [2010/12/14 23:33:29 | 000,083,360 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\Windows\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2010/11/20 02:24:42 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 01:59:46 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WINUSB)
DRV - [2010/05/31 12:31:12 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2010/05/31 12:31:10 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\Windows\System32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2010/04/12 04:44:34 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2010/02/25 01:02:30 | 000,015,544 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2010/02/24 19:59:13 | 000,015,424 | ---- | M] () [Kernel | System | Running] -- C:\Windows\system32\drivers\nod32drv.sys -- (nod32drv)
DRV - [2009/10/26 15:09:06 | 001,095,936 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2009/07/13 18:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2007/09/05 12:04:34 | 000,079,408 | ---- | M] (PACE Anti-Piracy, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TPkd.sys -- (TPkd)
DRV - [2007/08/28 15:47:36 | 000,146,560 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)
DRV - [2007/05/11 18:31:36 | 003,580,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech QuickCam Fusion(UVC)
DRV - [2007/05/11 18:31:22 | 000,041,888 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/05/11 18:30:04 | 001,921,184 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvpopflt.sys -- (lvpopflt)
DRV - [2007/02/24 10:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007/01/23 13:03:28 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007/01/23 12:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2004/04/01 16:30:46 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pfc.sys -- (pfc)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
IE - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine,version=1.0: C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Owner\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Owner\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Owner\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/01 20:35:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/08/30 22:23:14 | 000,000,000 | ---D | M]

[2010/08/04 22:53:49 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Extensions
[2011/08/29 20:57:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\syzwhatx.default\extensions
[2011/08/29 20:57:57 | 000,000,000 | ---D | M] ("NetVideoHunter") -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\syzwhatx.default\extensions\netvideohunter@netvideohunter.com
[2011/04/18 16:30:24 | 000,000,000 | ---D | M] (vShare) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\syzwhatx.default\extensions\vshare@toolbar
[2011/08/12 12:03:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/05/23 22:44:30 | 000,000,000 | ---D | M] (Ad-Aware WebFilter) -- C:\Program Files\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
[2011/04/18 16:29:20 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/08/12 12:03:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SYZWHATX.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SYZWHATX.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SYZWHATX.DEFAULT\EXTENSIONS\VIDEO.DOWNLOADER.PLUGIN@FFPIMP.COM.XPI
[2011/09/01 20:35:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/08/12 12:02:16 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/09/04 02:15:58 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Ad-Aware WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\Lavasoft\Ad-Aware Total Security\Webfilter\AvkWebIE.dll (G Data Software AG)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Updater For ooVoo Toolbar) - {442AE524-EBA5-4b17-82F3-888D68BC999A} - C:\Program Files\oovootb\auxi\oovooAu.dll (Visicom Media)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ooVoo Toolbar) - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\oovoodx.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Ad-Aware WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\Lavasoft\Ad-Aware Total Security\Webfilter\AvkWebIE.dll (G Data Software AG)
O3 - HKLM\..\Toolbar: (ooVoo Toolbar) - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\oovoodx.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files\Lavasoft\Ad-Aware Total Security\AVKTray\AVKTray.exe (Lavasoft AB)
O4 - HKLM..\Run: [GDFirewallTray] C:\Program Files\Lavasoft\Ad-Aware Total Security\Firewall\GDFirewallTray.exe (Lavasoft AB)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UpdateReminder] C:\Program Files\ESET\UpdateReminder.exe (ESET, spol. s r.o.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\imon.dll (Eset )
O15 - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} http://myitlab.pearsoned.com/Pegasus/Modules/SIMIntegration/Resources/ax/stub.cab (Enlite 2.x Simulation Engine Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://investools.webex.com/client/T27L10NSP11EP5/webex/ieatgpc1.cab (GpcContainer Class)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 4.2.2.1 4.2.2.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F742D3F1-212F-47BD-8008-A7165719FB01}: DhcpNameServer = 4.2.2.1 4.2.2.2
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\Owner\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Owner\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 11:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - File not found
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: wave3 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)

ernest157 · Sep 4, 2011

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/09/04 16:42:26 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Users\Owner\Desktop\OTL.exe
[2011/09/04 16:04:52 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Malwarebytes
[2011/09/04 16:04:39 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/09/04 16:04:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/09/04 16:04:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/09/04 16:04:32 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/09/04 16:04:31 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/09/04 16:03:06 | 009,466,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup.exe
[2011/09/04 15:55:38 | 000,066,896 | ---- | C] (Malwarebytes Corporation) -- C:\Users\Owner\Desktop\mbam-clean.exe
[2011/09/04 15:35:37 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2011/09/04 15:35:37 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2011/09/04 15:34:13 | 002,617,176 | ---- | C] (VS Revo Group Ltd.) -- C:\Users\Owner\Desktop\revosetup.exe
[2011/09/04 14:46:36 | 009,466,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup-1.51.1.1800.exe
[2011/09/04 13:41:20 | 000,150,392 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Windows\junction.exe
[2011/09/04 12:44:57 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Owner\Desktop\dds.scr
[2011/09/04 02:30:01 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/09/03 21:11:55 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Local\temp
[2011/09/03 19:50:22 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/09/03 19:50:21 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/09/03 18:32:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/09/03 18:31:50 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/09/03 13:10:52 | 000,098,304 | ---- | C] (Realtek Semiconductor) -- C:\Windows\RTKAUDIOSERVICE.EXE
[2011/09/03 12:48:29 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2011/09/03 12:04:14 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2011/09/03 10:57:58 | 001,406,768 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Owner\Desktop\tdsskiller.exe
[2011/09/03 10:56:21 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2
[2011/08/30 22:50:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/08/30 22:45:16 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/08/30 22:21:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/08/30 22:19:49 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2011/08/30 16:07:54 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2011/08/15 20:03:11 | 000,000,000 | ---D | C] -- C:\ProgramData\UAB
[2011/08/15 20:03:06 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Local\PC_Drivers_Headquarters
[2011/08/15 20:02:50 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Drivers HeadQuarters
[2011/08/15 20:00:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Detective
[2011/08/15 19:59:12 | 000,000,000 | ---D | C] -- C:\Program Files\PC Drivers HeadQuarters
[2011/08/12 13:09:53 | 000,000,000 | ---D | C] -- C:\Users\Owner\Desktop\RootRepeal
[2011/08/12 12:33:49 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Local\AIM
[2011/08/12 12:33:48 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Local\AOL
[2011/08/12 12:20:23 | 004,194,725 | R--- | C] (Swearware) -- C:\Users\Owner\Desktop\ComboFix.exe
[2011/08/11 09:29:00 | 000,000,000 | ---D | C] -- C:\found.001
[2011/08/08 20:30:58 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Blackberry Desktop
[2011/08/08 20:13:49 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\BlackBerry
[2011/08/08 20:10:37 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Local\Research In Motion
[2011/08/08 20:10:35 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Research In Motion
[2011/08/08 20:07:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlackBerry
[2011/08/08 20:06:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Research In Motion
[2011/08/08 20:06:31 | 000,000,000 | ---D | C] -- C:\Program Files\Research In Motion
[2011/08/08 20:06:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Research In Motion
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/04 17:04:12 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4012077812-2504022390-1015822191-1000UA.job
[2011/09/04 16:48:10 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/04 16:42:04 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Owner\Desktop\OTL.exe
[2011/09/04 16:04:40 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/04 16:03:44 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup.exe
[2011/09/04 15:58:39 | 000,000,149 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
[2011/09/04 15:58:00 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2011/09/04 15:57:37 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/04 15:57:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/09/04 15:57:07 | 1603,084,288 | -HS- | M] () -- C:\hiberfil.sys
[2011/09/04 15:55:24 | 000,066,896 | ---- | M] (Malwarebytes Corporation) -- C:\Users\Owner\Desktop\mbam-clean.exe
[2011/09/04 15:35:38 | 000,001,226 | ---- | M] () -- C:\Users\Owner\Desktop\Revo Uninstaller.lnk
[2011/09/04 15:34:09 | 002,617,176 | ---- | M] (VS Revo Group Ltd.) -- C:\Users\Owner\Desktop\revosetup.exe
[2011/09/04 14:47:21 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup-1.51.1.1800.exe
[2011/09/04 14:44:31 | 000,085,504 | ---- | M] () -- C:\Users\Owner\Desktop\Inherit.exe
[2011/09/04 13:40:32 | 000,079,623 | ---- | M] () -- C:\Users\Owner\Desktop\Junction.zip
[2011/09/04 13:08:47 | 000,294,400 | ---- | M] () -- C:\Users\Owner\Desktop\exeHelper.com
[2011/09/04 12:44:52 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Owner\Desktop\dds.scr
[2011/09/04 12:33:26 | 000,139,264 | ---- | M] () -- C:\Users\Owner\Desktop\RKUnhookerLE.EXE
[2011/09/04 12:18:52 | 731,080,704 | ---- | M] () -- C:\Users\Owner\Desktop\KNOPPIX_V6.7.0CD-2011-08-01-EN.iso
[2011/09/04 10:04:03 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4012077812-2504022390-1015822191-1000Core.job
[2011/09/04 02:15:58 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/09/03 18:36:18 | 004,194,725 | R--- | M] (Swearware) -- C:\Users\Owner\Desktop\ComboFix.exe
[2011/09/03 17:55:59 | 001,008,092 | ---- | M] () -- C:\Users\Owner\Desktop\rkill.com
[2011/09/03 17:07:54 | 000,002,401 | ---- | M] () -- C:\Users\Owner\Desktop\Google Chrome.lnk
[2011/09/03 15:00:52 | 000,012,080 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/03 15:00:51 | 000,012,080 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/03 13:18:48 | 003,871,280 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/09/03 11:03:22 | 263,412,801 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/09/03 10:57:48 | 001,406,768 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Owner\Desktop\tdsskiller.exe
[2011/09/01 22:14:03 | 000,945,592 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/09/01 22:14:03 | 000,215,886 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/09/01 20:36:28 | 000,001,849 | ---- | M] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/01 17:42:40 | 000,163,353 | ---- | M] () -- C:\Users\Owner\Desktop\pcscorecard.pdf
[2011/08/30 22:50:19 | 000,001,753 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/08/30 22:21:32 | 000,001,815 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/08/30 16:02:44 | 005,348,673 | ---- | M] () -- C:\Users\Owner\Desktop\Drake - 9am In Dallas Freestyle (www.hiphoplead.com).mp3
[2011/08/18 19:20:18 | 000,000,322 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForOwner.job
[2011/08/12 13:05:33 | 000,465,298 | ---- | M] () -- C:\Users\Owner\Desktop\RootRepeal.rar
[2011/08/12 12:38:56 | 000,000,000 | ---- | M] () -- C:\Users\Owner\AppData\Local\{0C691FDF-D514-4494-8674-18CA04A5B0D2}
[2011/08/12 12:23:18 | 002,419,140 | ---- | M] () -- C:\MGtools.exe
[2011/08/12 12:17:46 | 000,000,000 | ---- | M] () -- C:\Users\Owner\defogger_reenable
[2011/08/11 09:31:09 | 000,003,416 | ---- | M] () -- C:\bootsqm.dat
[2011/08/09 15:17:34 | 000,005,632 | ---- | M] () -- C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/08 20:13:44 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_RimUsb_01009.Wdf
[2011/08/08 20:07:09 | 000,002,189 | ---- | M] () -- C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/04 16:04:40 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/04 15:35:38 | 000,001,226 | ---- | C] () -- C:\Users\Owner\Desktop\Revo Uninstaller.lnk
[2011/09/04 14:44:38 | 000,085,504 | ---- | C] () -- C:\Users\Owner\Desktop\Inherit.exe
[2011/09/04 13:40:46 | 000,079,623 | ---- | C] () -- C:\Users\Owner\Desktop\Junction.zip
[2011/09/04 13:08:54 | 000,294,400 | ---- | C] () -- C:\Users\Owner\Desktop\exeHelper.com
[2011/09/04 12:33:37 | 000,139,264 | ---- | C] () -- C:\Users\Owner\Desktop\RKUnhookerLE.EXE
[2011/09/04 11:11:26 | 731,080,704 | ---- | C] () -- C:\Users\Owner\Desktop\KNOPPIX_V6.7.0CD-2011-08-01-EN.iso
[2011/09/03 19:50:23 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/09/03 19:50:23 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/09/03 19:50:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/09/03 19:50:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/09/03 19:50:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/09/03 17:56:09 | 001,008,092 | ---- | C] () -- C:\Users\Owner\Desktop\rkill.com
[2011/09/01 17:42:40 | 000,163,353 | ---- | C] () -- C:\Users\Owner\Desktop\pcscorecard.pdf
[2011/08/30 22:50:19 | 000,001,753 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/08/30 22:21:32 | 000,001,815 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/08/30 15:59:54 | 005,348,673 | ---- | C] () -- C:\Users\Owner\Desktop\Drake - 9am In Dallas Freestyle (www.hiphoplead.com).mp3
[2011/08/12 13:06:01 | 000,465,298 | ---- | C] () -- C:\Users\Owner\Desktop\RootRepeal.rar
[2011/08/12 12:38:56 | 000,000,000 | ---- | C] () -- C:\Users\Owner\AppData\Local\{0C691FDF-D514-4494-8674-18CA04A5B0D2}
[2011/08/12 12:23:22 | 002,419,140 | ---- | C] () -- C:\MGtools.exe
[2011/08/12 12:17:46 | 000,000,000 | ---- | C] () -- C:\Users\Owner\defogger_reenable
[2011/08/11 09:31:09 | 000,003,416 | ---- | C] () -- C:\bootsqm.dat
[2011/08/08 20:13:44 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_RimUsb_01009.Wdf
[2011/08/08 20:07:09 | 000,002,189 | ---- | C] () -- C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
[2011/07/29 08:50:42 | 000,000,000 | ---- | C] () -- C:\Users\Owner\AppData\Local\{2B661DF7-256E-47B2-8B5F-478F49693E3D}
[2011/07/06 22:54:40 | 000,014,464 | -HS- | C] () -- C:\ProgramData\bw52mhcyw1t2ljbudg4qdjf
[2011/05/23 22:44:58 | 000,015,880 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2011/05/20 18:29:10 | 000,000,000 | ---- | C] () -- C:\Users\Owner\AppData\Local\{755DF11D-4B3D-407C-AD79-A985C4312A36}
[2011/04/29 22:21:03 | 000,013,556 | -HS- | C] () -- C:\Users\Owner\AppData\Local\ge75n4sv4s6wc15a2mb56fem6cm642xx4
[2011/04/29 22:21:03 | 000,013,556 | -HS- | C] () -- C:\ProgramData\ge75n4sv4s6wc15a2mb56fem6cm642xx4
[2011/04/23 18:15:30 | 000,007,605 | ---- | C] () -- C:\Users\Owner\AppData\Local\Resmon.ResmonCfg
[2011/04/19 22:45:24 | 000,015,498 | -HS- | C] () -- C:\Users\Owner\AppData\Local\cpk5s2g0t8
[2011/04/19 22:45:24 | 000,001,448 | -HS- | C] () -- C:\ProgramData\414915279
[2011/04/19 22:45:19 | 000,015,498 | -HS- | C] () -- C:\ProgramData\cpk5s2g0t8
[2011/04/18 23:10:09 | 000,193,536 | ---- | C] () -- C:\Windows\System32\sppcomapi.dll
[2011/04/07 15:19:15 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2011/01/27 21:32:04 | 000,008,192 | ---- | C] () -- C:\Windows\System32\srvany.exe
[2011/01/27 19:06:23 | 000,110,592 | RHS- | C] () -- C:\Windows\System32\C_11473.dll
[2011/01/09 15:51:47 | 000,000,120 | -H-- | C] () -- C:\Users\Owner\AppData\Local\Gpasum.dat
[2011/01/09 15:51:47 | 000,000,000 | -H-- | C] () -- C:\Users\Owner\AppData\Local\Wzajaqoxis.bin
[2010/10/10 22:19:55 | 000,000,132 | -H-- | C] () -- C:\Users\Owner\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/09/28 17:19:44 | 000,001,456 | -H-- | C] () -- C:\Users\Owner\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/09/10 16:41:44 | 000,005,632 | ---- | C] () -- C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/04 23:24:23 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010/08/04 23:05:02 | 000,021,316 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2010/08/04 01:19:37 | 000,217,088 | ---- | C] () -- C:\Windows\System32\qtmlClient.dll
[2010/06/28 03:45:45 | 000,000,600 | -H-- | C] () -- C:\Users\Owner\AppData\Roaming\winscp.rnd
[2010/06/23 01:31:11 | 000,000,132 | -H-- | C] () -- C:\Users\Owner\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010/06/14 22:20:33 | 000,000,031 | ---- | C] () -- C:\Windows\System32\wdsdtdsini.dll
[2010/04/14 19:17:13 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2010/03/07 23:04:57 | 000,000,045 | ---- | C] () -- C:\Windows\System32\imon1.dat
[2010/02/28 12:33:32 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/02/27 12:19:52 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/02/24 19:59:44 | 000,015,424 | ---- | C] () -- C:\Windows\System32\drivers\nod32drv.sys
[2010/01/25 11:58:06 | 000,462,848 | ---- | C] () -- C:\Windows\System32\ractrlkeyhook.dll
[2009/09/23 19:16:08 | 002,050,952 | ---- | C] () -- C:\Windows\System32\igkrng400.bin
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 003,871,280 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,945,592 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,215,886 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2007/05/14 08:13:40 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat
[2007/05/14 08:13:40 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat
[2007/05/14 07:58:55 | 000,103,437 | ---- | C] () -- C:\Windows\hpqins13.dat
[2007/05/11 17:12:54 | 000,057,126 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2007/02/27 16:43:02 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/12/14 02:01:36 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/12/14 02:01:36 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/03/09 20:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2005/05/07 08:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2005/04/03 16:30:00 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll
[2004/08/26 06:13:00 | 000,159,744 | ---- | C] () -- C:\Windows\System32\EPSPTDV.DLL
[1998/05/06 21:10:00 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll

========== LOP Check ==========

[2011/05/12 11:50:46 | 000,000,000 | ---D | M] -- C:\Users\Guest 2\AppData\Roaming\acccore
[2011/05/06 00:48:48 | 000,000,000 | ---D | M] -- C:\Users\Guest 2\AppData\Roaming\ooVoo Details
[2010/08/04 22:52:31 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\acccore
[2011/08/11 02:14:32 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\BitTorrent
[2011/08/08 20:31:04 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Blackberry Desktop
[2010/08/04 22:53:08 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/04/18 17:51:40 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Dropbox
[2011/07/15 23:32:45 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\EPSON
[2011/08/11 02:16:06 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\FrostWire
[2010/08/07 20:55:29 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\Hardcore
[2010/08/04 22:53:30 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\Megaupload
[2011/05/22 17:33:33 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\mjusbsp
[2010/12/28 19:18:22 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\muvee Technologies
[2011/04/18 16:05:21 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\NVD
[2010/08/04 22:53:54 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\ooVoo Details
[2011/04/18 16:05:21 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\OpenOffice.org
[2010/08/04 22:53:55 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\PACE Anti-Piracy
[2011/08/08 20:12:18 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Research In Motion
[2010/09/21 23:33:49 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\SharePod
[2010/08/04 22:53:55 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011/04/18 16:05:23 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\StreamTorrent
[2011/04/18 16:05:25 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\TD AMERITRADE
[2011/04/18 16:30:25 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\TP
[2010/10/04 19:56:08 | 000,000,000 | -H-D | M] -- C:\Users\Owner\AppData\Roaming\webex
[2011/06/11 21:11:56 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\WindSolutions
[2011/09/03 11:03:40 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/13 18:49:02 | 000,001,024 | ---- | M] () -- C:\.rnd
[2011/09/04 15:57:05 | 000,050,844 | ---- | M] () -- C:\aaw7boot.log
[2009/06/10 17:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2010/11/20 04:40:08 | 000,383,786 | RHS- | M] () -- C:\bootmgr
[2010/08/05 02:12:30 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2011/08/11 09:31:09 | 000,003,416 | ---- | M] () -- C:\bootsqm.dat
[2011/09/04 02:34:38 | 000,022,683 | ---- | M] () -- C:\ComboFix.txt
[2009/06/10 17:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2011/09/04 15:57:07 | 1603,084,288 | -HS- | M] () -- C:\hiberfil.sys
[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2011/02/17 17:55:34 | 000,001,062 | -H-- | M] () -- C:\IPH.PH
[2010/06/12 14:20:39 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2011/08/12 12:23:18 | 002,419,140 | ---- | M] () -- C:\MGtools.exe
[2010/10/12 19:50:34 | 000,000,653 | -H-- | M] () -- C:\os245324.bin
[2011/09/04 15:57:07 | 2137,448,448 | -HS- | M] () -- C:\pagefile.sys
[2011/09/03 18:30:45 | 000,000,567 | ---- | M] () -- C:\rkill.log
[2011/06/19 15:28:39 | 000,000,000 | ---- | M] () -- C:\sfcreport.txt
[2011/09/04 12:20:41 | 000,071,068 | ---- | M] () -- C:\TDSSKiller.2.5.17.0_04.09.2011_12.19.11_log.txt
[2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI

ernest157 · Sep 4, 2011

< %systemroot%\Fonts\*.com >
[2009/07/14 00:52:25 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:52:25 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:52:25 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:52:25 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 17:31:19 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 21:15:18 | 000,033,280 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Windows\system32\spool\prtprocs\w32x86\EP0NPP01.DLL
[2009/07/13 21:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2010/12/14 23:33:28 | 000,053,632 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\system32\spool\prtprocs\w32x86\LMIproc.dll
[2003/06/18 18:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll
[2010/11/20 04:21:38 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/02/28 11:10:33 | 000,000,365 | -HS- | M] () -- C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2011/05/20 18:39:46 | 000,000,221 | -HS- | M] () -- C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/09/03 18:36:18 | 004,194,725 | R--- | M] (Swearware) -- C:\Users\Owner\Desktop\ComboFix.exe
[2011/09/04 14:44:31 | 000,085,504 | ---- | M] () -- C:\Users\Owner\Desktop\Inherit.exe
[2011/09/04 15:55:24 | 000,066,896 | ---- | M] (Malwarebytes Corporation) -- C:\Users\Owner\Desktop\mbam-clean.exe
[2011/09/04 14:47:21 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup-1.51.1.1800.exe
[2011/09/04 16:03:44 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup.exe
[2011/09/04 16:42:04 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Owner\Desktop\OTL.exe
[2011/09/04 15:34:09 | 002,617,176 | ---- | M] (VS Revo Group Ltd.) -- C:\Users\Owner\Desktop\revosetup.exe
[2011/09/04 12:33:26 | 000,139,264 | ---- | M] () -- C:\Users\Owner\Desktop\RKUnhookerLE.EXE
[2011/09/03 10:57:48 | 001,406,768 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Owner\Desktop\tdsskiller.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 17:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2011/04/19 00:19:22 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.log
[2011/04/19 00:19:22 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00001.jrs
[2011/04/19 00:19:22 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00002.jrs
[2011/04/19 00:19:22 | 000,786,432 | ---- | M] () -- C:\Windows\SECURITY\Database\edbtmp.log
[2011/04/19 00:19:22 | 001,056,768 | ---- | M] () -- C:\Windows\SECURITY\Database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/04/19 00:21:19 | 000,000,402 | -HS- | M] () -- C:\Users\Owner\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2011/04/19 22:45:24 | 000,001,448 | -HS- | M] () -- C:\ProgramData\414915279
[2011/07/07 16:43:42 | 000,014,464 | -HS- | M] () -- C:\ProgramData\bw52mhcyw1t2ljbudg4qdjf
[2011/04/19 23:18:56 | 000,015,498 | -HS- | M] () -- C:\ProgramData\cpk5s2g0t8
[2011/04/30 00:59:06 | 000,013,556 | -HS- | M] () -- C:\ProgramData\ge75n4sv4s6wc15a2mb56fem6cm642xx4
[2010/08/04 23:24:23 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:A6CD15C3

< End of report >

ernest157 · Sep 4, 2011

OTL Extras logfile created on: 9/4/2011 4:50:57 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Owner\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 0.90 Gb Available Physical Memory | 45.22% Memory free
3.98 Gb Paging File | 2.73 Gb Available in Paging File | 68.63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 178.03 Gb Total Space | 94.68 Gb Free Space | 53.18% Space Free | Partition Type: NTFS
Drive D: | 8.28 Gb Total Space | 1.82 Gb Free Space | 22.02% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-4012077812-2504022390-1015822191-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A003011-002C-446B-AF91-D6C13C0E08FE}" = Ad-Aware Total Security
"{0BFC200F-C45D-4271-AF34-4CA969225DEB}" = muvee autoProducer 6.0
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{1517A7CB-5F00-4A88-8F06-E89B6DB63784}" = ESU for Microsoft Vista
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{25613C10-27D2-410B-942B-D922D5C3A7BE}" = Interlok driver setup x32
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{315F5FFC-1A5C-4A2A-B8E7-1C5B1174C198}_is1" = AML Free Registry Cleaner 4.22
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}" = Roxio MyDVD Basic v9
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.20 B1
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
"{3B6E3FC6-274C-4B6C-BC85-5C3B15DE18E2}" = Mega Manager
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3FFB3B34-D639-4384-9AE9-DDE58430D86F}" = MSCU for Microsoft Vista
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{41BB38A4-ED84-4682-8329-042FEBD8C30B}" = Mega Manager
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.2
"{4640FDE1-B83A-4376-84ED-86F86BEE2D41}" = Driver Detective
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{5D112C61-C8D0-4718-8DD7-B9115EB9AF90}" = LogMeIn
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{69995C7A-062A-4A90-A4DF-8C22895DF522}" = iTunes
"{6EFA70F2-D6C3-4ECA-BEA9-C1A31277C63A}_is1" = FLV Converter 3.2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{75157F34-02C6-4831-BD66-3BC49E7A8394}" = BlackBerry Desktop Software 6.1
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F362F06-A9A3-440F-8B19-6A01A72723C4}" = AuthenTec Fingerprint Sensor Minimum Install
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile Device Center
"{9061CEF2-51F5-42C9-8A70-9ED351C6597A}" = HP Help and Support
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{99E16265-E162-43E7-B3C5-D28640E23AE9}" = PSP ISO Shrink
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe 1.4.136.1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1033-7B44-A80000000002}" = Adobe Reader 8
"{AFE354A5-640F-4A23-94C8-0B441E8967CA}" = Digidesign Shared Plug-Ins 7.4
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B61B6668-A674-4A06-8405-51944D5CCDDD}" = AuthenTec Fingerprint Sensor Minimum Install
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}" = HP Active Support Library
"{D02F30FB-0BC4-419A-9B9C-ADC610029B50}" = EPSON File Manager
"{D03482C5-9AD8-496D-B388-692AE04C93AF}" = Bonjour
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D32067CD-7409-4792-BFA0-1469BCD8F0C8}" = HP Wireless Assistant
"{D47087E7-AA15-4D1D-8C0A-60F7E446D597}" = PSP ISO Compressor
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX
"{DDFD9BA2-8E26-4E49-92AE-882424DAB1BC}" = HP User Guides 0057
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile Device Center Driver Update
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6B29003-A078-4491-AFBE-62EFB6CFFE19}" = HP Total Care Advisor
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}" = HP Active Support Library 32 bit components
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Akamai" = Akamai NetSession Interface
"Aleks 3.14" = Aleks 3.14
"BitTorrent" = BitTorrent
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.1
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Drumaxx" = Drumaxx
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Printer and Utilities" = EPSON Printer Software
"FL Studio 9" = FL Studio 9
"FrostWire" = FrostWire 4.20.3
"Hardcore" = Hardcore
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Icy Tower v1.4_is1" = Icy Tower v1.4
"IL Download Manager" = IL Download Manager
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"LimeWire" = LimeWire PRO 4.9.23
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Mozilla Firefox 6.0.1 (x86 en-US)" = Mozilla Firefox 6.0.1 (x86 en-US)
"NOD32" = NOD32 antivirus system
"oovootb" = ooVoo Toolbar (Remove Toolbar Only)
"PoiZone" = PoiZone
"PowerISO" = PowerISO
"Revo Uninstaller" = Revo Uninstaller 1.93
"Rhapsody" = Rhapsody
"Sakura" = Sakura
"Sawer" = Sawer
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"thinkorswim from TD AMERITRADE" = thinkorswim from TD AMERITRADE
"Toxic Biohazard" = Toxic Biohazard
"TVWiz" = Intel(R) TV Wizard
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"winscp3_is1" = WinSCP 4.2.7
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update
"YTdetect" = Yahoo! Detect

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-4012077812-2504022390-1015822191-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{8BE526A5-98B7-4A15-84DA-F5377843AD51}" = TD AMERITRADE StrategyDesk 3.4
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"magicJack" = magicJack
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/4/2011 5:28:43 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0x1290 Faulting application start time: 0x01cc6b499e743c77 Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: dcabdaf9-d73c-11e0-8e6d-001b24745a03

Error - 9/4/2011 5:28:47 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0xc94 Faulting application start time: 0x01cc6b49a0e67e22 Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: df61dd62-d73c-11e0-8e6d-001b24745a03

Error - 9/4/2011 5:28:52 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0x143c Faulting application start time: 0x01cc6b49a1eef152 Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: e24cac32-d73c-11e0-8e6d-001b24745a03

Error - 9/4/2011 5:28:54 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0x948 Faulting application start time: 0x01cc6b49a5031aac Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: e3706ff7-d73c-11e0-8e6d-001b24745a03

Error - 9/4/2011 5:28:57 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0xc68 Faulting application start time: 0x01cc6b49a6174dd7 Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: e4ef4d63-d73c-11e0-8e6d-001b24745a03

Error - 9/4/2011 5:29:01 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0x1358 Faulting application start time: 0x01cc6b49a780f543 Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: e7a6af61-d73c-11e0-8e6d-001b24745a03

Error - 9/4/2011 5:29:03 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0xec0 Faulting application start time: 0x01cc6b49aa566702 Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: e8d3c21a-d73c-11e0-8e6d-001b24745a03

Error - 9/4/2011 5:29:07 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0x1788 Faulting application start time: 0x01cc6b49ab5e6500 Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: eb58efcc-d73c-11e0-8e6d-001b24745a03

Error - 9/4/2011 5:29:10 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0x644 Faulting application start time: 0x01cc6b49ae080b2b Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: ed183289-d73c-11e0-8e6d-001b24745a03

Error - 9/4/2011 5:29:12 PM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: nod32krn.exe, version: 2.70.39.0, time
stamp: 0x46440be6 Faulting module name: nod32krn.exe, version: 2.70.39.0, time stamp:
0x46440be6 Exception code: 0xc0000005 Fault offset: 0x0002a996 Faulting process id:
0x418 Faulting application start time: 0x01cc6b49afdc35c6 Faulting application path:
C:\Program Files\Eset\nod32krn.exe Faulting module path: C:\Program Files\Eset\nod32krn.exe
Report
Id: ee454541-d73c-11e0-8e6d-001b24745a03

[ System Events ]
Error - 9/4/2011 5:33:17 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1781 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 9/4/2011 5:33:18 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1782 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 9/4/2011 5:33:19 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1783 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 9/4/2011 5:33:23 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1784 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 9/4/2011 5:33:24 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1785 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 9/4/2011 5:33:29 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1786 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 9/4/2011 5:33:32 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1787 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 9/4/2011 5:33:36 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1788 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 9/4/2011 5:33:40 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1789 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 9/4/2011 5:33:47 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7031
Description = The NOD32 Kernel Service service terminated unexpectedly. It has
done this 1790 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

< End of report >

Broni · Sep 4, 2011

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.

===================================================================

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
IE - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: File not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [UpdateReminder] C:\Program Files\ESET\UpdateReminder.exe (ESET, spol. s r.o.)
O15 - HKU\S-1-5-21-4012077812-2504022390-1015822191-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2011/07/06 22:54:40 | 000,014,464 | -HS- | C] () -- C:\ProgramData\bw52mhcyw1t2ljbudg4qdjf
[2011/04/29 22:21:03 | 000,013,556 | -HS- | C] () -- C:\Users\Owner\AppData\Local\ge75n4sv4s6wc15a2mb56fem6cm642xx4
[2011/04/29 22:21:03 | 000,013,556 | -HS- | C] () -- C:\ProgramData\ge75n4sv4s6wc15a2mb56fem6cm642xx4
[2011/04/19 22:45:24 | 000,015,498 | -HS- | C] () -- C:\Users\Owner\AppData\Local\cpk5s2g0t8
[2011/04/19 22:45:24 | 000,001,448 | -HS- | C] () -- C:\ProgramData\414915279
[2011/04/19 22:45:19 | 000,015,498 | -HS- | C] () -- C:\ProgramData\cpk5s2g0t8
[2011/01/27 19:06:23 | 000,110,592 | RHS- | C] () -- C:\Windows\System32\C_11473.dll
[2011/01/09 15:51:47 | 000,000,120 | -H-- | C] () -- C:\Users\Owner\AppData\Local\Gpasum.dat
[2011/01/09 15:51:47 | 000,000,000 | -H-- | C] () -- C:\Users\Owner\AppData\Local\Wzajaqoxis.bin
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:A6CD15C3


:Services

:Reg

:Files
C:\Program Files\Ask.com


:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

===================================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

ernest157 · Sep 4, 2011

Here is the otl log:

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-4012077812-2504022390-1015822191-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-4012077812-2504022390-1015822191-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-21-4012077812-2504022390-1015822191-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UpdateReminder deleted successfully.
C:\Program Files\ESET\UpdateReminder.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-4012077812-2504022390-1015822191-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http deleted successfully.
C:\Windows\msdownld.tmp\AS0A52C1.tmp\Aug2009_d3dcsx_42_x86.cab deleted successfully.
C:\Windows\msdownld.tmp\AS0A52C1.tmp folder deleted successfully.
C:\Windows\msdownld.tmp folder deleted successfully.
C:\ProgramData\bw52mhcyw1t2ljbudg4qdjf moved successfully.
C:\Users\Owner\AppData\Local\ge75n4sv4s6wc15a2mb56fem6cm642xx4 moved successfully.
C:\ProgramData\ge75n4sv4s6wc15a2mb56fem6cm642xx4 moved successfully.
C:\Users\Owner\AppData\Local\cpk5s2g0t8 moved successfully.
C:\ProgramData\414915279 moved successfully.
C:\ProgramData\cpk5s2g0t8 moved successfully.
C:\Windows\System32\C_11473.dll moved successfully.
C:\Users\Owner\AppData\Local\Gpasum.dat moved successfully.
C:\Users\Owner\AppData\Local\Wzajaqoxis.bin moved successfully.
ADS C:\ProgramData\TEMP:A6CD15C3 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\Ask.com folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 2834 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest 2
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 3327744 bytes
->Flash cache emptied: 16629 bytes

User: LogMeInRemoteUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Owner
->Temp folder emptied: 5947254 bytes
->Temporary Internet Files folder emptied: 377253 bytes
->Java cache emptied: 19138230 bytes
->FireFox cache emptied: 121852699 bytes
->Google Chrome cache emptied: 15447840 bytes
->Flash cache emptied: 1079246 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 72115 bytes
RecycleBin emptied: 59100688 bytes

Total Files Cleaned = 216.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Guest 2
->Flash cache emptied: 0 bytes

User: LogMeInRemoteUser

User: Owner
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.27.0 log created on 09042011_183541

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Here is the security log
Results of screen317's Security Check version 0.99.7
Windows 7 Service Pack 1 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
NOD32 antivirus system
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
CCleaner
AML Free Registry Cleaner 4.22
Java(TM) 6 Update 27
Out of date Java installed!
Adobe Flash Player 10.3.183.7
Adobe Reader 8
Out of date Adobe Reader installed!
Mozilla Firefox (x86 en-US..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
Lavasoft Ad-Aware Total Security Firewall GDFirewallTray.exe
``````````End of Log````````````

ernest157 · Sep 4, 2011

i am going to run the tfc and eset scans now

Broni · Sep 4, 2011

Uninstall AML Free Registry Cleaner 4.22.
Registry cleaners/optimizers are not recommended for several reasons:

Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".

Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.

==================================================================

Update Adobe Reader

You can download it from https://www.techspot.com/downloads/2083-adobe-reader-dc.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

ernest157 · Sep 5, 2011

Here is the Eset Log:

C:\Qoobox\Quarantine\MBR_HardDisk0.mbr Win32/Olmarik.AJL trojan cleaned by deleting - quarantined
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3cc664c-2abba9a5 probably a variant of Java/Exploit.CVE-2010-4452.A trojan cleaned by deleting - quarantined
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\6342ea82-23433544 probably a variant of Java/TrojanDownloader.OpenStream.NCC trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\09042011_183541\C_Windows\System32\C_11473.dll a variant of Win32/Kryptik.LLT trojan cleaned by deleting - quarantined

Broni · Sep 5, 2011

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.

ernest157 · Sep 5, 2011

My computer is working perfect.no more redirects and its running good. Thank you very much for your help.
Here is the otl log:
All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest 2
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LogMeInRemoteUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Owner
->Temp folder emptied: 392667 bytes
->Temporary Internet Files folder emptied: 6879065 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 65693115 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1084 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 608 bytes
RecycleBin emptied: 176129273 bytes

Total Files Cleaned = 238.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Guest 2
->Flash cache emptied: 0 bytes

User: LogMeInRemoteUser

User: Owner
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.27.0 log created on 09052011_140210

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Solved Malwarebytes cant be installed.Acess is denied

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Posts: 36 +0

Posts: 36 +0

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Posts: 56,041 +516

Posts: 36 +0

Similar threads