Solved Sirefef infection of Vista Home32bit... constant rebooting.

C

Colin Reid

Posts: 25   +0
Hi,
Using Windows Defender Offline I've found my Vista Laptop is infected with Sirefef.R, AH and AB. It was able to delete one of these infections, but the other two causes errors and remain unresolved.
I've read through your five point initial procedure, but in this case Vista will only run for a minute or two before it reboots, even in safe mode. Not enough time to do any of these steps.
Is there any hope of cleaning the system?
 
Welcome aboard
yahooo.gif


Please, observe following rules:
  • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
  • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
  • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
  • Never run more than one scan at a time.
  • Keep updating me regarding your computer behavior, good, or bad.
  • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
  • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
  • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

========================================
For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt
  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
 
Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 16-07-2012 01
Ran by SYSTEM at 20-07-2012 19:39:49
Running from H:\
Windows Vista (TM) Home Premium (X86) OS Language: English(US)
The current controlset is ControlSet001
========================== Registry (Whitelisted) =============
HKLM\...\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe [159744 2007-04-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe [36864 2007-08-28] (Creative Technology Ltd.)
HKLM\...\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [101136 2007-01-11] (Logitech Inc.)
HKLM\...\Run: [] [x]
HKLM\...\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [81920 2006-10-02] (Macrovision Corporation)
HKLM\...\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [221184 2006-11-04] (Sonic Solutions)
HKLM\...\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [159744 2007-08-21] (CyberLink Corp.)
HKLM\...\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup [221184 2006-10-02] (Macrovision Corporation)
HKLM\...\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" [398728 2008-01-28] (Symantec Corporation)
HKLM\...\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [x]
HKLM\...\Run: [VolPanel] "C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" /r [180224 2006-11-26] (Creative Technology Ltd)
HKLM\...\Run: [UpdReg] C:\Windows\UpdReg.EXE [90112 2000-05-10] (Creative Technology Ltd.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: [RCApp] C:\Program Files\gigabyte\RCApp\U7000RCApp.exe [625152 2007-04-24] ()
HKLM\...\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-09-06] (IDT, Inc.)
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [13793824 2009-06-15] (NVIDIA Corporation)
HKLM\...\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start [92704 2009-06-15] (NVIDIA Corporation)
HKLM\...\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup [x]
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [249064 2010-10-28] (Sun Microsystems, Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40368 2011-05-26] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [3521424 2012-05-03] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe [600928 2010-05-31] (Sony Corporation)
HKLM\...\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [931200 2012-03-25] (Microsoft Corporation)
HKU\colin\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-18] (Microsoft Corporation)
HKU\colin\...\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [x]
HKU\colin\...\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray [1483264 2010-12-20] (Nokia)
HKU\colin\...\Run: [Steam] "H:\Program Files\Steam\Steam.exe" -silent [x]
HKU\colin\...\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe /s [955792 2012-05-03] (Samsung)
HKU\colin\...\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2012-05-03] ()
HKU\colin\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [17417392 2012-07-02] (Skype Technologies S.A.)
HKU\colin\...\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun [6149120 2012-05-13] (FreeDownloadManager.ORG)
HKU\Default\...\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup [460784 2007-03-14] (Gteko Ltd.)
HKU\Default User\...\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup [460784 2007-03-14] (Gteko Ltd.)
HKU\Wiz\...\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup [460784 2007-03-14] (Gteko Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.253
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\All Users\Start Menu\Programs\Startup\SetPoint.lnk
ShortcutTarget: SetPoint.lnk -> C:\Program Files\SetPoint\SetPoint.exe (Logitech Inc.)
================================ Services (Whitelisted) ==================
2 CLCapSvc; "C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe" [278611 2007-08-21] ()
2 CLSched; "C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe" [122975 2007-08-21] ()
2 Creative Labs Licensing Service; "C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe" [72704 2008-05-16] (Creative Labs)
2 Creative Service for CDROM Access; C:\Windows\system32\CTsvcCDA.exe [44032 1999-12-12] (Creative Technology Ltd)
3 DSBrokerService; "C:\Program Files\DellSupport\brkrsvc.exe" [70656 2007-03-18] ()
2 Eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [21504 2008-01-18] (Microsoft Corporation)
2 hnmsvc; "C:\Program Files\Dell Network Assistant\hnm_svc.exe" [111912 2007-08-27] (SingleClick Systems)
2 LiveUpdate Notice Service; "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll" [537992 2008-04-10] (Symantec Corporation)
2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [11552 2012-03-25] (Microsoft Corporation)
2 MSSQL$SQLEXPRESS; "C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS [43010392 2009-03-29] (Microsoft Corporation)
4 MSSQLServerADHelper100; "C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE" [47128 2009-07-22] (Microsoft Corporation)
3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [214952 2012-03-25] (Microsoft Corporation)
2 RichVideo; "C:\Program Files\CyberLink\Shared Files\RichVideo.exe" [262247 2007-08-21] ()
2 Skype C2C Service; "C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe" [3048136 2012-06-18] (Skype Technologies S.A.)
2 SkypeUpdate; "C:\Program Files\Skype\Updater\Updater.exe" [160944 2012-07-02] (Skype Technologies)
4 SQLAgent$SQLEXPRESS; "C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE" -I SQLEXPRESS [366936 2009-03-29] (Microsoft Corporation)
2 LiveUpdate Notice Ex; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
3 rpcapd; "C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini" [x]
========================== Drivers (Whitelisted) =============
2 altio; \??\C:\Program Files\Altium Designer Summer 09\System\Drivers\altio.sys [3200 2004-05-30] (Altium Limited)
3 AvsBluebird; C:\Windows\System32\drivers\bluebird2.sys [360704 2007-06-20] (Dvico, Inc.)
3 dmodusb; C:\Windows\System32\DRIVERS\dmodusb.sys [26240 2009-05-11] (Windows (R) Codename Longhorn DDK provider)
3 MFE_RR; \??\C:\Users\colin\AppData\Local\Temp\mfe_rr.sys [16960 2012-07-18] (McAfee, Inc.)
3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [543232 2007-07-12] (DiBcom)
3 MODRC; C:\Windows\System32\DRIVERS\modrc.sys [13824 2007-07-10] (DiBcom S.A.)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
1 MpKsld7218023; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A5B8789C-1B93-4CCA-9099-39124673D454}\MpKsld7218023.sys [29904 2012-07-19] ()
2 NPF; C:\Windows\System32\drivers\npf.sys [50704 2009-10-20] (CACE Technologies, Inc.)
2 Packet; C:\Windows\System32\DRIVERS\packet.sys [12672 2006-12-18] (SingleClick Systems)
4 RsFx0103; C:\Windows\System32\DRIVERS\RsFx0103.sys [239336 2009-03-29] (Microsoft Corporation)
2 Sentinel; C:\Windows\System32\Drivers\SENTINEL.SYS [73728 2001-06-21] (Rainbow Technologies, Inc.)
3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2011-10-13] (Silicon Laboratories)
3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61312 2011-10-13] (Silicon Laboratories)
3 Sntnlusb; C:\Windows\System32\DRIVERS\SNTNLUSB.SYS [20032 2001-06-21] (Rainbow Technologies Inc.)
3 sscdbus; C:\Windows\System32\DRIVERS\sscdbus.sys [104648 2010-12-20] (MCCI Corporation)
3 sscdmdfl; C:\Windows\System32\DRIVERS\sscdmdfl.sys [14920 2010-12-20] (MCCI Corporation)
3 sscdmdm; C:\Windows\System32\DRIVERS\sscdmdm.sys [132424 2010-12-20] (MCCI Corporation)
3 U6000ALL; C:\Windows\System32\DRIVERS\U6000ALL.sys [230784 2007-07-12] ()
3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [195968 2011-02-03] (Jungo)
2 XilinxPC4Driver; C:\Windows\System32\drivers\xpc4drvr.sys [16000 2007-05-18] (Xilinx, Inc.)
4 blbdrive; C:\Windows\system32\drivers\blbdrive.sys [x]
2 DS1410D; \??\C:\Windows\system32\drivers\ds1410d.sys [x]
3 IpInIp; C:\Windows\System32\DRIVERS\ipinip.sys [x]
3 NwlnkFlt; C:\Windows\System32\DRIVERS\nwlnkflt.sys [x]
3 NwlnkFwd; C:\Windows\System32\DRIVERS\nwlnkfwd.sys [x]
3 VSPerfDrv100; \??\F:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [x]
========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============
2012-07-19 18:04 - 2012-07-19 18:04 - 00000000 ____D C:\FRST
2012-07-18 23:21 - 2012-07-18 23:21 - 00043480 ____A C:\Windows\System32\Drivers\rttyhqek.sys
2012-07-18 18:01 - 2012-07-18 18:01 - 00000000 ____D C:\Windows\Microsoft Antimalware
2012-07-17 02:18 - 2012-07-17 02:18 - 00000000 ____D C:\Program Files\Microsoft Security Client
2012-07-17 00:29 - 2012-06-13 05:40 - 02047488 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-07-17 00:20 - 2012-02-29 07:11 - 00172032 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2012-07-17 00:20 - 2012-02-29 07:11 - 00005120 ____A (Microsoft Corporation) C:\Windows\System32\wmi.dll
2012-07-17 00:20 - 2012-02-29 07:09 - 00157696 ____A (Microsoft Corporation) C:\Windows\System32\imagehlp.dll
2012-07-17 00:20 - 2012-02-29 05:32 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fs_rec.sys
2012-07-17 00:09 - 2012-06-02 01:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-07-17 00:09 - 2012-06-02 00:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-07-17 00:09 - 2012-06-02 00:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-07-17 00:09 - 2012-06-02 00:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-07-17 00:09 - 2012-06-02 00:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-07-17 00:09 - 2012-06-02 00:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-07-17 00:09 - 2012-06-02 00:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-07-17 00:09 - 2012-06-02 00:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-07-17 00:09 - 2012-06-02 00:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-07-17 00:09 - 2012-06-02 00:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-07-17 00:09 - 2012-06-02 00:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-07-17 00:09 - 2012-06-02 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-07-17 00:09 - 2012-06-02 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-07-17 00:09 - 2012-06-02 00:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-07-17 00:04 - 2012-07-17 00:05 - 00271126 ____A C:\Windows\msxml4-KB2721691-enu.LOG
2012-07-16 23:53 - 2012-06-08 09:47 - 11586048 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-07-16 23:53 - 2012-06-05 08:47 - 01401856 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-07-16 23:53 - 2012-06-05 08:47 - 01248768 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-07-16 23:53 - 2012-06-04 07:26 - 00440704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-07-16 23:53 - 2012-06-01 16:04 - 00278528 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-07-16 23:53 - 2012-06-01 16:03 - 00204288 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-07-16 23:53 - 2012-05-01 06:03 - 00180736 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-07-16 23:53 - 2012-04-23 08:00 - 00984064 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-07-16 23:53 - 2012-04-23 08:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-07-16 23:53 - 2012-04-23 08:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-07-16 23:53 - 2012-04-03 00:16 - 03602816 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2012-07-16 23:53 - 2012-04-03 00:16 - 03550080 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-07-16 23:53 - 2012-03-30 04:39 - 00914304 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2012-07-16 23:53 - 2012-03-29 05:39 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpipreg.sys
2012-07-16 23:53 - 2012-03-20 15:28 - 00053120 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys
2012-07-16 23:53 - 2012-03-01 06:46 - 00219648 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll
2012-07-16 23:53 - 2012-03-01 06:46 - 00160768 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll
2012-07-16 23:53 - 2012-02-29 06:08 - 01172480 ____A (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2012-07-16 23:53 - 2012-02-29 05:44 - 00683008 ____A (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2012-07-16 23:53 - 2012-02-29 05:41 - 01069056 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2012-07-16 23:53 - 2012-01-09 07:54 - 00613376 ____A (Microsoft Corporation) C:\Windows\System32\rdpencom.dll
2012-07-16 02:13 - 2012-07-16 02:13 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-06-24 22:04 - 2012-06-24 22:04 - 01394248 ____A (Microsoft Corporation) C:\Windows\System32\msxml4.dll
2012-06-20 23:18 - 2012-06-02 14:19 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-20 23:18 - 2012-06-02 14:19 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-20 23:18 - 2012-06-02 14:19 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-20 23:18 - 2012-06-02 14:12 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-20 23:17 - 2012-06-02 14:19 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-20 23:17 - 2012-06-02 14:19 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-20 23:17 - 2012-06-02 14:12 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-20 23:17 - 2012-06-01 21:19 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-20 23:17 - 2012-06-01 21:12 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
============ 3 Months Modified Files ========================
2012-07-19 02:20 - 2009-12-29 04:44 - 00279552 ____A (Microsoft Corporation) C:\Windows\System32\services.exe
2012-07-19 02:20 - 2009-06-13 15:39 - 00230000 ____A C:\Users\All Users\nvModes.001
2012-07-19 02:18 - 2009-06-13 15:39 - 00230000 ____A C:\Users\All Users\nvModes.dat
2012-07-19 02:18 - 2006-11-02 05:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-19 02:18 - 2006-11-02 04:47 - 00003568 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-19 02:18 - 2006-11-02 04:47 - 00003568 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-18 23:21 - 2012-07-18 23:21 - 00043480 ____A C:\Windows\System32\Drivers\rttyhqek.sys
2012-07-18 23:14 - 2006-11-02 04:47 - 00464512 ____A C:\Windows\System32\FNTCACHE.DAT
2012-07-17 03:13 - 2007-11-08 19:58 - 00100886 ____A C:\Windows\PFRO.log
2012-07-17 02:48 - 2007-11-08 19:21 - 00003204 ____A C:\Windows\bthservsdp.dat
2012-07-17 02:48 - 2006-11-02 05:01 - 00032614 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-07-17 02:35 - 2007-11-08 19:20 - 01375404 ____A C:\Windows\WindowsUpdate.log
2012-07-17 02:25 - 2012-04-17 01:34 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-07-17 02:19 - 2011-02-11 02:13 - 00001945 ____A C:\Windows\epplauncher.mif
2012-07-17 02:18 - 2006-11-02 02:33 - 00862064 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-17 00:05 - 2012-07-17 00:04 - 00271126 ____A C:\Windows\msxml4-KB2721691-enu.LOG
2012-07-16 02:01 - 2012-01-28 19:05 - 00000434 ____A C:\Windows\System32\Drivers\etc\hosts.ics
2012-07-13 13:32 - 2008-03-16 23:24 - 00000703 ____A C:\Windows\NewsRover.INI
2012-07-12 01:26 - 2012-04-17 01:34 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2012-07-12 01:26 - 2011-06-07 01:27 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-07-08 23:25 - 2009-06-05 01:36 - 00007808 ____A C:\Users\colin\AppData\Local\d3d9caps.dat
2012-07-07 03:01 - 2006-11-02 04:52 - 00083369 ____A C:\Windows\setupact.log
2012-07-02 09:13 - 2006-11-02 02:24 - 57442464 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2012-06-30 22:28 - 2010-08-23 03:05 - 00000485 ____A C:\Windows\cedt.INI
2012-06-29 02:30 - 2011-02-24 01:24 - 00003592 ____A C:\Users\colin\coregen.log
2012-06-29 00:00 - 2011-03-11 23:27 - 00000001 ___AH C:\Windows\System32\m3.dll
2012-06-29 00:00 - 2008-02-04 13:46 - 00000100 ___AH C:\Windows\mti_enc
2012-06-29 00:00 - 2008-02-04 13:46 - 00000007 ___AH C:\Windows\mti_enc2
2012-06-24 22:04 - 2012-06-24 22:04 - 01394248 ____A (Microsoft Corporation) C:\Windows\System32\msxml4.dll
2012-06-19 03:00 - 2012-06-19 03:00 - 00000866 ____A C:\Users\colin\Desktop\Free Download Manager.lnk
2012-06-13 05:40 - 2012-07-17 00:29 - 02047488 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-10 23:16 - 2012-05-11 03:03 - 00002377 ____A C:\Users\Public\Desktop\Skype.lnk
2012-06-08 09:47 - 2012-07-16 23:53 - 11586048 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-06-05 08:47 - 2012-07-16 23:53 - 01401856 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-06-05 08:47 - 2012-07-16 23:53 - 01248768 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-06-04 07:26 - 2012-07-16 23:53 - 00440704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-06-02 14:19 - 2012-06-20 23:18 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-20 23:18 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-20 23:18 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-20 23:17 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-20 23:17 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:12 - 2012-06-20 23:18 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:12 - 2012-06-20 23:17 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 01:07 - 2012-07-17 00:09 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-02 00:43 - 2012-07-17 00:09 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-02 00:33 - 2012-07-17 00:09 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-02 00:26 - 2012-07-17 00:09 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-02 00:25 - 2012-07-17 00:09 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-02 00:25 - 2012-07-17 00:09 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-02 00:23 - 2012-07-17 00:09 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-02 00:21 - 2012-07-17 00:09 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-02 00:20 - 2012-07-17 00:09 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-02 00:19 - 2012-07-17 00:09 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-02 00:19 - 2012-07-17 00:09 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-02 00:17 - 2012-07-17 00:09 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-02 00:16 - 2012-07-17 00:09 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-02 00:14 - 2012-07-17 00:09 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-01 21:19 - 2012-06-20 23:17 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-01 21:12 - 2012-06-20 23:17 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-01 16:04 - 2012-07-16 23:53 - 00278528 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-06-01 16:03 - 2012-07-16 23:53 - 00204288 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-05-08 03:28 - 2008-03-16 22:36 - 00000049 __RSH C:\Users\Public\Documents\HBEPGUID.TXT
2012-05-04 04:43 - 2012-05-04 04:44 - 00001009 ____A C:\Users\colin\Desktop\Xilinx.lic
2012-05-01 06:03 - 2012-07-16 23:53 - 00180736 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-27 19:40 - 2012-04-27 19:40 - 00001699 ____A C:\Users\Public\Desktop\PMB Help.lnk
2012-04-27 19:40 - 2012-04-27 19:40 - 00000903 ____A C:\Users\Public\Desktop\PMB Launcher.lnk
2012-04-27 19:40 - 2012-04-27 19:40 - 00000880 ____A C:\Users\Public\Desktop\PMB.lnk
2012-04-27 19:37 - 2012-04-27 19:37 - 00002173 ____A C:\Users\Public\Desktop\Image Data Converter SR Ver. 3.lnk
2012-04-27 19:37 - 2012-04-27 19:37 - 00002108 ____A C:\Users\Public\Desktop\Image Data Lightbox SR.lnk
2012-04-24 14:37 - 2012-04-24 14:37 - 00001153 ____A C:\Users\colin\Desktop\Software Manuals.lnk
2012-04-23 08:00 - 2012-07-16 23:53 - 00984064 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-23 08:00 - 2012-07-16 23:53 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-23 08:00 - 2012-07-16 23:53 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll

ZeroAccess:
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\@
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\L
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\n
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\U
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\L\00000004.@
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\L\1afb2d56
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\L\201d3dde
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\U\00000004.@
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\U\00000008.@
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\U\000000cb.@
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\U\80000000.@
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\U\80000032.@
ZeroAccess:
C:\Users\colin\AppData\Local\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}
C:\Users\colin\AppData\Local\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\@
C:\Users\colin\AppData\Local\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\L
C:\Users\colin\AppData\Local\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\n
C:\Users\colin\AppData\Local\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\U
ZeroAccess:
C:\Windows\assembly\GAC\Desktop.ini
========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe 8737764F4FD36D6808EE80578409C843 ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
========================= Memory info ======================
Percentage of memory in use: 12%
Total physical RAM: 4093.38 MB
Available physical RAM: 3566.04 MB
Total Pagefile: 3835.43 MB
Available Pagefile: 3668.72 MB
Total Virtual: 2047.88 MB
Available Virtual: 1990.33 MB
======================= Partitions =========================
1 Drive c: (OS) (Fixed) (Total:114.3 GB) (Free:4.52 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (New Volume) (Fixed) (Total:44.53 GB) (Free:13.02 GB) NTFS
3 Drive e: (New Volume) (Fixed) (Total:63.94 GB) (Free:19.72 GB) FAT32
4 Drive f: (RECOVERY) (Fixed) (Total:10 GB) (Free:5.99 GB) NTFS
5 Drive g: (VISTA_32_PREMIUM) (CDROM) (Total:2.84 GB) (Free:0 GB) CDFS
6 Drive h: (Lexar) (Removable) (Total:14.92 GB) (Free:12.98 GB) FAT32
7 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 233 GB 1522 KB
Disk 1 Online 15 GB 0 B
Partitions of Disk 0:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 78 MB 32 KB
Partition 2 Primary 10 GB 79 MB
Partition 3 Primary 114 GB 10 GB
Partition 0 Extended 109 GB 124 GB
Partition 4 Logical 45 GB 124 GB
Partition 5 Logical 64 GB 169 GB
==================================================================================
Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 6 FAT Partition 78 MB Healthy Hidden
==================================================================================
Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 0 F RECOVERY NTFS Partition 10 GB Healthy
==================================================================================
Disk: 0
Partition 3
Type : 07
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C OS NTFS Partition 114 GB Healthy
==================================================================================
Disk: 0
Partition 4
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 D New Volume NTFS Partition 45 GB Healthy
==================================================================================
Disk: 0
Partition 5
Type : 0C
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 E New Volume FAT32 Partition 64 GB Healthy
==================================================================================
Partitions of Disk 1:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 15 GB 1104 KB
==================================================================================
Disk: 1
Partition 1
Type : 0C
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 H Lexar FAT32 Removable 15 GB Healthy
==================================================================================
==========================================================
Last Boot: 2012-07-17 02:21
======================= End Of Log ==========================
 
:)

In Vista or Windows 7: Boot to System Recovery Options and run FRST.
In Windows XP: Please boot to UBCD and run FRST.
Type the following in the edit box after "Search:".

services.exe

Click Search button and post the log (Search.txt) it makes to your reply.
 
Farbar Recovery Scan Tool Version: 16-07-2012 01
Ran by SYSTEM at 2012-07-21 14:59:44
Running from H:\
================== Search: "services.exe" ===================
C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe
[2009-12-29 04:44] - [2009-04-10 22:27] - 0279552 ____A (Microsoft Corporation) D4E6D91C1349B7BFB3599A6ADA56851B
C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2008-07-03 01:49] - [2008-01-18 23:33] - 0279040 ____A (Microsoft Corporation) 2B336AB6286D6C81FA02CBAB914E3C6C
C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.exe
[2006-11-02 00:35] - [2006-11-02 01:45] - 0279552 ____A (Microsoft Corporation) 329CF3C97CE4C19375C8ABCABAE258B0
C:\Windows\System32\services.exe
[2009-12-29 04:44] - [2012-07-19 02:20] - 0279552 ____A (Microsoft Corporation) 8737764F4FD36D6808EE80578409C843
=== End Of Search ===
 
Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next....

Restart normally.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  • Double click on combofix.exe & follow the prompts.

  • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe
  • Double-click on the Rkill icon to run the tool.
  • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
 

Attachments

  • fixlist.txt
    617 bytes · Views: 1
Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 16-07-2012 01
Ran by SYSTEM at 2012-07-22 10:18:06 Run:1
Running from H:\
==============================================
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows No ZeroAccess entry found.
C:\Windows\System32\consrv.dll not found.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UpdReg Value deleted successfully.
C:\Windows\System32\Drivers\rttyhqek.sys moved successfully.
C:\Windows\Installer\{afbfdf34-a2fc-9fbd-7888-c72f895e632c} moved successfully.
C:\Users\colin\AppData\Local\{afbfdf34-a2fc-9fbd-7888-c72f895e632c} moved successfully.
C:\Windows\assembly\GAC\Desktop.ini moved successfully.
C:\Windows\System32\services.exe moved successfully.
C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe copied successfully to C:\Windows\System32\services.exe
==== End of Fixlog ====
 
ComboFix 12-07-21.01 - colin 22/07/2012 10:43:11.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.61.1033.18.3581.2098 [GMT 10:00]
Running from: c:\users\colin\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\colin\AppData\Local\assembly\tmp
c:\users\colin\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll
c:\users\Default\is6A67.tmp
c:\users\Default\isC477.tmp
c:\users\Default\isC6C8.tmp
c:\users\Default\isC70.tmp
c:\users\Wiz\is6A67.tmp
c:\users\Wiz\isC477.tmp
c:\users\Wiz\isC6C8.tmp
c:\users\Wiz\isC70.tmp
c:\windows\system\WING32.DLL
c:\windows\system32\config\systemprofile\DMIE4C2.tmp
c:\windows\system32\config\systemprofile\flaD09A.tmp
c:\windows\system32\config\systemprofile\flaEF1.tmp
c:\windows\system32\config\systemprofile\JET1054.tmp
c:\windows\system32\config\systemprofile\JET11CB.tmp
c:\windows\system32\config\systemprofile\JET11DA.tmp
c:\windows\system32\config\systemprofile\JET1209.tmp
c:\windows\system32\config\systemprofile\JET1276.tmp
c:\windows\system32\config\systemprofile\JET13DD.tmp
c:\windows\system32\config\systemprofile\JET13ED.tmp
c:\windows\system32\config\systemprofile\JET1479.tmp
c:\windows\system32\config\systemprofile\JET147A.tmp
c:\windows\system32\config\systemprofile\JET14F6.tmp
c:\windows\system32\config\systemprofile\JET14F7.tmp
c:\windows\system32\config\systemprofile\JET1515.tmp
c:\windows\system32\config\systemprofile\JET1525.tmp
c:\windows\system32\config\systemprofile\JET157.tmp
c:\windows\system32\config\systemprofile\JET15C1.tmp
c:\windows\system32\config\systemprofile\JET166C.tmp
c:\windows\system32\config\systemprofile\JET166D.tmp
c:\windows\system32\config\systemprofile\JET1708.tmp
c:\windows\system32\config\systemprofile\JET1709.tmp
c:\windows\system32\config\systemprofile\JET17A4.tmp
c:\windows\system32\config\systemprofile\JET1840.tmp
c:\windows\system32\config\systemprofile\JET1959.tmp
c:\windows\system32\config\systemprofile\JET1998.tmp
c:\windows\system32\config\systemprofile\JET1A05.tmp
c:\windows\system32\config\systemprofile\JET1B2D.tmp
c:\windows\system32\config\systemprofile\JET1BC9.tmp
c:\windows\system32\config\systemprofile\JET1C56.tmp
c:\windows\system32\config\systemprofile\JET1C65.tmp
c:\windows\system32\config\systemprofile\JET1D20.tmp
c:\windows\system32\config\systemprofile\JET1D7E.tmp
c:\windows\system32\config\systemprofile\JET1ED5.tmp
c:\windows\system32\config\systemprofile\JET1EE5.tmp
c:\windows\system32\config\systemprofile\JET1F23.tmp
c:\windows\system32\config\systemprofile\JET1FA0.tmp
c:\windows\system32\config\systemprofile\JET1FEE.tmp
c:\windows\system32\config\systemprofile\JET1FFE.tmp
c:\windows\system32\config\systemprofile\JET208A.tmp
c:\windows\system32\config\systemprofile\JET20C8.tmp
c:\windows\system32\config\systemprofile\JET20F7.tmp
c:\windows\system32\config\systemprofile\JET20F8.tmp
c:\windows\system32\config\systemprofile\JET2184.tmp
c:\windows\system32\config\systemprofile\JET21D2.tmp
c:\windows\system32\config\systemprofile\JET21E1.tmp
c:\windows\system32\config\systemprofile\JET229C.tmp
c:\windows\system32\config\systemprofile\JET2319.tmp
c:\windows\system32\config\systemprofile\JET2338.tmp
c:\windows\system32\config\systemprofile\JET2358.tmp
c:\windows\system32\config\systemprofile\JET23C5.tmp
c:\windows\system32\config\systemprofile\JET2403.tmp
c:\windows\system32\config\systemprofile\JET241.tmp
c:\windows\system32\config\systemprofile\JET242.tmp
c:\windows\system32\config\systemprofile\JET2461.tmp
c:\windows\system32\config\systemprofile\JET2470.tmp
c:\windows\system32\config\systemprofile\JET24ED.tmp
c:\windows\system32\config\systemprofile\JET250C.tmp
c:\windows\system32\config\systemprofile\JET252C.tmp
c:\windows\system32\config\systemprofile\JET253B.tmp
c:\windows\system32\config\systemprofile\JET256A.tmp
c:\windows\system32\config\systemprofile\JET271F.tmp
c:\windows\system32\config\systemprofile\JET273E.tmp
c:\windows\system32\config\systemprofile\JET279C.tmp
c:\windows\system32\config\systemprofile\JET27BB.tmp
c:\windows\system32\config\systemprofile\JET27CA.tmp
c:\windows\system32\config\systemprofile\JET28D4.tmp
c:\windows\system32\config\systemprofile\JET2902.tmp
c:\windows\system32\config\systemprofile\JET2960.tmp
c:\windows\system32\config\systemprofile\JET29CD.tmp
c:\windows\system32\config\systemprofile\JET29CE.tmp
c:\windows\system32\config\systemprofile\JET2A98.tmp
c:\windows\system32\config\systemprofile\JET2AB7.tmp
c:\windows\system32\config\systemprofile\JET2B05.tmp
c:\windows\system32\config\systemprofile\JET2BD0.tmp
c:\windows\system32\config\systemprofile\JET2C7C.tmp
c:\windows\system32\config\systemprofile\JET2D18.tmp
c:\windows\system32\config\systemprofile\JET2DD.tmp
c:\windows\system32\config\systemprofile\JET2DF2.tmp
c:\windows\system32\config\systemprofile\JET2F0B.tmp
c:\windows\system32\config\systemprofile\JET2F97.tmp
c:\windows\system32\config\systemprofile\JET2FD6.tmp
c:\windows\system32\config\systemprofile\JET3072.tmp
c:\windows\system32\config\systemprofile\JET31F8.tmp
c:\windows\system32\config\systemprofile\JET3217.tmp
c:\windows\system32\config\systemprofile\JET3523.tmp
c:\windows\system32\config\systemprofile\JET35BF.tmp
c:\windows\system32\config\systemprofile\JET35DE.tmp
c:\windows\system32\config\systemprofile\JET360D.tmp
c:\windows\system32\config\systemprofile\JET3976.tmp
c:\windows\system32\config\systemprofile\JET3A22.tmp
c:\windows\system32\config\systemprofile\JET3BC7.tmp
c:\windows\system32\config\systemprofile\JET3C54.tmp
c:\windows\system32\config\systemprofile\JET3D7C.tmp
c:\windows\system32\config\systemprofile\JET3D8C.tmp
c:\windows\system32\config\systemprofile\JET3DBA.tmp
c:\windows\system32\config\systemprofile\JET3F6.tmp
c:\windows\system32\config\systemprofile\JET3F6F.tmp
c:\windows\system32\config\systemprofile\JET3F7.tmp
c:\windows\system32\config\systemprofile\JET3FBD.tmp
c:\windows\system32\config\systemprofile\JET3FCD.tmp
c:\windows\system32\config\systemprofile\JET4098.tmp
c:\windows\system32\config\systemprofile\JET41B0.tmp
c:\windows\system32\config\systemprofile\JET41D0.tmp
c:\windows\system32\config\systemprofile\JET41FE.tmp
c:\windows\system32\config\systemprofile\JET424.tmp
c:\windows\system32\config\systemprofile\JET428B.tmp
c:\windows\system32\config\systemprofile\JET4365.tmp
c:\windows\system32\config\systemprofile\JET4375.tmp
c:\windows\system32\config\systemprofile\JET43F2.tmp
c:\windows\system32\config\systemprofile\JET444.tmp
c:\windows\system32\config\systemprofile\JET45B6.tmp
c:\windows\system32\config\systemprofile\JET45D5.tmp
c:\windows\system32\config\systemprofile\JET4604.tmp
c:\windows\system32\config\systemprofile\JET4623.tmp
c:\windows\system32\config\systemprofile\JET46EE.tmp
c:\windows\system32\config\systemprofile\JET470D.tmp
c:\windows\system32\config\systemprofile\JET47F7.tmp
c:\windows\system32\config\systemprofile\JET4874.tmp
c:\windows\system32\config\systemprofile\JET4884.tmp
c:\windows\system32\config\systemprofile\JET4893.tmp
c:\windows\system32\config\systemprofile\JET48A3.tmp
c:\windows\system32\config\systemprofile\JET493F.tmp
c:\windows\system32\config\systemprofile\JET495E.tmp
c:\windows\system32\config\systemprofile\JET4C1C.tmp
c:\windows\system32\config\systemprofile\JET4C3B.tmp
c:\windows\system32\config\systemprofile\JET4CD7.tmp
c:\windows\system32\config\systemprofile\JET4E0.tmp
c:\windows\system32\config\systemprofile\JET4E0F.tmp
c:\windows\system32\config\systemprofile\JET4E5D.tmp
c:\windows\system32\config\systemprofile\JET4EBB.tmp
c:\windows\system32\config\systemprofile\JET4F28.tmp
c:\windows\system32\config\systemprofile\JET4FB4.tmp
c:\windows\system32\config\systemprofile\JET51C7.tmp
c:\windows\system32\config\systemprofile\JET5234.tmp
c:\windows\system32\config\systemprofile\JET52E.tmp
c:\windows\system32\config\systemprofile\JET538B.tmp
c:\windows\system32\config\systemprofile\JET54C3.tmp
c:\windows\system32\config\systemprofile\JET5649.tmp
c:\windows\system32\config\systemprofile\JET56D6.tmp
c:\windows\system32\config\systemprofile\JET5791.tmp
c:\windows\system32\config\systemprofile\JET580E.tmp
c:\windows\system32\config\systemprofile\JET584C.tmp
c:\windows\system32\config\systemprofile\JET59B.tmp
c:\windows\system32\config\systemprofile\JET5CA.tmp
c:\windows\system32\config\systemprofile\JET5F8.tmp
c:\windows\system32\config\systemprofile\JET60B5.tmp
c:\windows\system32\config\systemprofile\JET60B6.tmp
c:\windows\system32\config\systemprofile\JET641E.tmp
c:\windows\system32\config\systemprofile\JET64AB.tmp
c:\windows\system32\config\systemprofile\JET64F9.tmp
c:\windows\system32\config\systemprofile\JET6537.tmp
c:\windows\system32\config\systemprofile\JET670B.tmp
c:\windows\system32\config\systemprofile\JET6759.tmp
c:\windows\system32\config\systemprofile\JET685.tmp
c:\windows\system32\config\systemprofile\JET69D9.tmp
c:\windows\system32\config\systemprofile\JET6D33.tmp
c:\windows\system32\config\systemprofile\JET6DDF.tmp
c:\windows\system32\config\systemprofile\JET6DFE.tmp
c:\windows\system32\config\systemprofile\JET6DFF.tmp
c:\windows\system32\config\systemprofile\JET6EF7.tmp
c:\windows\system32\config\systemprofile\JET6FD2.tmp
c:\windows\system32\config\systemprofile\JET71F4.tmp
c:\windows\system32\config\systemprofile\JET721.tmp
c:\windows\system32\config\systemprofile\JET7406.tmp
c:\windows\system32\config\systemprofile\JET753E.tmp
c:\windows\system32\config\systemprofile\JET7628.tmp
c:\windows\system32\config\systemprofile\JET7676.tmp
c:\windows\system32\config\systemprofile\JET7695.tmp
c:\windows\system32\config\systemprofile\JET77FC.tmp
c:\windows\system32\config\systemprofile\JET78E.tmp
c:\windows\system32\config\systemprofile\JET7915.tmp
c:\windows\system32\config\systemprofile\JET79C0.tmp
c:\windows\system32\config\systemprofile\JET7A7C.tmp
c:\windows\system32\config\systemprofile\JET7ACA.tmp
c:\windows\system32\config\systemprofile\JET7B27.tmp
c:\windows\system32\config\systemprofile\JET7B37.tmp
c:\windows\system32\config\systemprofile\JET7B47.tmp
c:\windows\system32\config\systemprofile\JET7BA4.tmp
c:\windows\system32\config\systemprofile\JET7BE3.tmp
c:\windows\system32\config\systemprofile\JET7BE4.tmp
c:\windows\system32\config\systemprofile\JET7C31.tmp
c:\windows\system32\config\systemprofile\JET7CCD.tmp
c:\windows\system32\config\systemprofile\JET7CCE.tmp
c:\windows\system32\config\systemprofile\JET7CEC.tmp
c:\windows\system32\config\systemprofile\JET7D0B.tmp
c:\windows\system32\config\systemprofile\JET7D3A.tmp
c:\windows\system32\config\systemprofile\JET7D59.tmp
c:\windows\system32\config\systemprofile\JET7DA7.tmp
c:\windows\system32\config\systemprofile\JET7DB7.tmp
c:\windows\system32\config\systemprofile\JET7DB8.tmp
c:\windows\system32\config\systemprofile\JET7DC6.tmp
c:\windows\system32\config\systemprofile\JET7E14.tmp
c:\windows\system32\config\systemprofile\JET7EA1.tmp
c:\windows\system32\config\systemprofile\JET7EB0.tmp
c:\windows\system32\config\systemprofile\JET7EB1.tmp
c:\windows\system32\config\systemprofile\JET7EEF.tmp
c:\windows\system32\config\systemprofile\JET7EF0.tmp
c:\windows\system32\config\systemprofile\JET7F1D.tmp
c:\windows\system32\config\systemprofile\JET7F2D.tmp
c:\windows\system32\config\systemprofile\JET7F6B.tmp
c:\windows\system32\config\systemprofile\JET7F7B.tmp
c:\windows\system32\config\systemprofile\JET7FAA.tmp
c:\windows\system32\config\systemprofile\JET7FC9.tmp
c:\windows\system32\config\systemprofile\JET8017.tmp
c:\windows\system32\config\systemprofile\JET8018.tmp
c:\windows\system32\config\systemprofile\JET8036.tmp
c:\windows\system32\config\systemprofile\JET8046.tmp
c:\windows\system32\config\systemprofile\JET8055.tmp
c:\windows\system32\config\systemprofile\JET8084.tmp
c:\windows\system32\config\systemprofile\JET8085.tmp
c:\windows\system32\config\systemprofile\JET80B3.tmp
c:\windows\system32\config\systemprofile\JET80E2.tmp
c:\windows\system32\config\systemprofile\JET80E3.tmp
c:\windows\system32\config\systemprofile\JET814F.tmp
c:\windows\system32\config\systemprofile\JET815F.tmp
c:\windows\system32\config\systemprofile\JET817E.tmp
c:\windows\system32\config\systemprofile\JET818D.tmp
c:\windows\system32\config\systemprofile\JET818E.tmp
c:\windows\system32\config\systemprofile\JET818F.tmp
c:\windows\system32\config\systemprofile\JET819D.tmp
c:\windows\system32\config\systemprofile\JET81BC.tmp
c:\windows\system32\config\systemprofile\JET81DB.tmp
c:\windows\system32\config\systemprofile\JET81DC.tmp
c:\windows\system32\config\systemprofile\JET81EB.tmp
c:\windows\system32\config\systemprofile\JET81EC.tmp
c:\windows\system32\config\systemprofile\JET821A.tmp
c:\windows\system32\config\systemprofile\JET8239.tmp
c:\windows\system32\config\systemprofile\JET823A.tmp
c:\windows\system32\config\systemprofile\JET8249.tmp
c:\windows\system32\config\systemprofile\JET8268.tmp
c:\windows\system32\config\systemprofile\JET8269.tmp
c:\windows\system32\config\systemprofile\JET8297.tmp
c:\windows\system32\config\systemprofile\JET82A6.tmp
c:\windows\system32\config\systemprofile\JET82B6.tmp
c:\windows\system32\config\systemprofile\JET82E5.tmp
c:\windows\system32\config\systemprofile\JET82E6.tmp
c:\windows\system32\config\systemprofile\JET82E7.tmp
c:\windows\system32\config\systemprofile\JET8323.tmp
c:\windows\system32\config\systemprofile\JET8352.tmp
c:\windows\system32\config\systemprofile\JET8371.tmp
c:\windows\system32\config\systemprofile\JET8381.tmp
c:\windows\system32\config\systemprofile\JET83AF.tmp
c:\windows\system32\config\systemprofile\JET83BF.tmp
c:\windows\system32\config\systemprofile\JET83CF.tmp
c:\windows\system32\config\systemprofile\JET83FD.tmp
c:\windows\system32\config\systemprofile\JET841D.tmp
c:\windows\system32\config\systemprofile\JET843C.tmp
c:\windows\system32\config\systemprofile\JET845B.tmp
c:\windows\system32\config\systemprofile\JET848A.tmp
c:\windows\system32\config\systemprofile\JET848B.tmp
c:\windows\system32\config\systemprofile\JET8499.tmp
c:\windows\system32\config\systemprofile\JET84A9.tmp
c:\windows\system32\config\systemprofile\JET84C8.tmp
c:\windows\system32\config\systemprofile\JET84F7.tmp
c:\windows\system32\config\systemprofile\JET8507.tmp
c:\windows\system32\config\systemprofile\JET8508.tmp
c:\windows\system32\config\systemprofile\JET8516.tmp
c:\windows\system32\config\systemprofile\JET8535.tmp
c:\windows\system32\config\systemprofile\JET8555.tmp
c:\windows\system32\config\systemprofile\JET8574.tmp
c:\windows\system32\config\systemprofile\JET8593.tmp
c:\windows\system32\config\systemprofile\JET85A3.tmp
c:\windows\system32\config\systemprofile\JET85D1.tmp
c:\windows\system32\config\systemprofile\JET85D2.tmp
c:\windows\system32\config\systemprofile\JET85F1.tmp
c:\windows\system32\config\systemprofile\JET8600.tmp
c:\windows\system32\config\systemprofile\JET863F.tmp
c:\windows\system32\config\systemprofile\JET864E.tmp
c:\windows\system32\config\systemprofile\JET864F.tmp
c:\windows\system32\config\systemprofile\JET866D.tmp
c:\windows\system32\config\systemprofile\JET867D.tmp
c:\windows\system32\config\systemprofile\JET869C.tmp
c:\windows\system32\config\systemprofile\JET86BB.tmp
c:\windows\system32\config\systemprofile\JET86CB.tmp
c:\windows\system32\config\systemprofile\JET8709.tmp
c:\windows\system32\config\systemprofile\JET8719.tmp
c:\windows\system32\config\systemprofile\JET8729.tmp
c:\windows\system32\config\systemprofile\JET872A.tmp
c:\windows\system32\config\systemprofile\JET8738.tmp
c:\windows\system32\config\systemprofile\JET8796.tmp
c:\windows\system32\config\systemprofile\JET8797.tmp
c:\windows\system32\config\systemprofile\JET87A5.tmp
c:\windows\system32\config\systemprofile\JET8803.tmp
c:\windows\system32\config\systemprofile\JET8813.tmp
c:\windows\system32\config\systemprofile\JET8814.tmp
c:\windows\system32\config\systemprofile\JET8822.tmp
c:\windows\system32\config\systemprofile\JET8823.tmp
c:\windows\system32\config\systemprofile\JET8861.tmp
c:\windows\system32\config\systemprofile\JET8862.tmp
c:\windows\system32\config\systemprofile\JET88AF.tmp
c:\windows\system32\config\systemprofile\JET88FD.tmp
c:\windows\system32\config\systemprofile\JET891C.tmp
c:\windows\system32\config\systemprofile\JET892B.tmp
c:\windows\system32\config\systemprofile\JET894B.tmp
c:\windows\system32\config\systemprofile\JET895A.tmp
c:\windows\system32\config\systemprofile\JET895B.tmp
c:\windows\system32\config\systemprofile\JET896A.tmp
c:\windows\system32\config\systemprofile\JET8979.tmp
c:\windows\system32\config\systemprofile\JET897A.tmp
c:\windows\system32\config\systemprofile\JET8989.tmp
c:\windows\system32\config\systemprofile\JET89E7.tmp
c:\windows\system32\config\systemprofile\JET89F6.tmp
c:\windows\system32\config\systemprofile\JET8A06.tmp
c:\windows\system32\config\systemprofile\JET8A07.tmp
c:\windows\system32\config\systemprofile\JET8A7.tmp
c:\windows\system32\config\systemprofile\JET8AC1.tmp
c:\windows\system32\config\systemprofile\JET8AE0.tmp
c:\windows\system32\config\systemprofile\JET8B3E.tmp
c:\windows\system32\config\systemprofile\JET8B5D.tmp
c:\windows\system32\config\systemprofile\JET8B6D.tmp
c:\windows\system32\config\systemprofile\JET8B8C.tmp
c:\windows\system32\config\systemprofile\JET8BBB.tmp
c:\windows\system32\config\systemprofile\JET8BF9.tmp
c:\windows\system32\config\systemprofile\JET8C.tmp
c:\windows\system32\config\systemprofile\JET8C18.tmp
c:\windows\system32\config\systemprofile\JET8C28.tmp
c:\windows\system32\config\systemprofile\JET8C47.tmp
c:\windows\system32\config\systemprofile\JET8C48.tmp
c:\windows\system32\config\systemprofile\JET8C76.tmp
c:\windows\system32\config\systemprofile\JET8CE3.tmp
c:\windows\system32\config\systemprofile\JET8D60.tmp
c:\windows\system32\config\systemprofile\JET8D8F.tmp
c:\windows\system32\config\systemprofile\JET8D9E.tmp
c:\windows\system32\config\systemprofile\JET8E5.tmp
c:\windows\system32\config\systemprofile\JET8E98.tmp
c:\windows\system32\config\systemprofile\JET8EF5.tmp
c:\windows\system32\config\systemprofile\JET8F05.tmp
c:\windows\system32\config\systemprofile\JET8F63.tmp
c:\windows\system32\config\systemprofile\JET8F91.tmp
c:\windows\system32\config\systemprofile\JET8FB1.tmp
c:\windows\system32\config\systemprofile\JET904.tmp
c:\windows\system32\config\systemprofile\JET9137.tmp
c:\windows\system32\config\systemprofile\JET9156.tmp
c:\windows\system32\config\systemprofile\JET9175.tmp
c:\windows\system32\config\systemprofile\JET91B3.tmp
c:\windows\system32\config\systemprofile\JET924.tmp
c:\windows\system32\config\systemprofile\JET93C6.tmp
c:\windows\system32\config\systemprofile\JET9462.tmp
c:\windows\system32\config\systemprofile\JET9491.tmp
c:\windows\system32\config\systemprofile\JET956B.tmp
c:\windows\system32\config\systemprofile\JET957B.tmp
c:\windows\system32\config\systemprofile\JET9655.tmp
c:\windows\system32\config\systemprofile\JET96B3.tmp
c:\windows\system32\config\systemprofile\JET9877.tmp
c:\windows\system32\config\systemprofile\JET98F4.tmp
c:\windows\system32\config\systemprofile\JET9903.tmp
c:\windows\system32\config\systemprofile\JET9BA2.tmp
c:\windows\system32\config\systemprofile\JET9BE1.tmp
c:\windows\system32\config\systemprofile\JET9D57.tmp
c:\windows\system32\config\systemprofile\JET9ECD.tmp
c:\windows\system32\config\systemprofile\JET9EDD.tmp
c:\windows\system32\config\systemprofile\JET9EED.tmp
c:\windows\system32\config\systemprofile\JET9FA8.tmp
c:\windows\system32\config\systemprofile\JETA256.tmp
c:\windows\system32\config\systemprofile\JETA257.tmp
c:\windows\system32\config\systemprofile\JETA266.tmp
c:\windows\system32\config\systemprofile\JETA295.tmp
c:\windows\system32\config\systemprofile\JETA302.tmp
c:\windows\system32\config\systemprofile\JETA488.tmp
c:\windows\system32\config\systemprofile\JETA4F5.tmp
c:\windows\system32\config\systemprofile\JETA62D.tmp
c:\windows\system32\config\systemprofile\JETA7B.tmp
c:\windows\system32\config\systemprofile\JETA977.tmp
c:\windows\system32\config\systemprofile\JETA9B6.tmp
c:\windows\system32\config\systemprofile\JETA9C5.tmp
c:\windows\system32\config\systemprofile\JETAABF.tmp
c:\windows\system32\config\systemprofile\JETAAFD.tmp
c:\windows\system32\config\systemprofile\JETAB5B.tmp
c:\windows\system32\config\systemprofile\JETABA9.tmp
c:\windows\system32\config\systemprofile\JETABF7.tmp
c:\windows\system32\config\systemprofile\JETACD1.tmp
c:\windows\system32\config\systemprofile\JETAD2F.tmp
c:\windows\system32\config\systemprofile\JETAE96.tmp
c:\windows\system32\config\systemprofile\JETAEA5.tmp
c:\windows\system32\config\systemprofile\JETAF41.tmp
c:\windows\system32\config\systemprofile\JETAF42.tmp
c:\windows\system32\config\systemprofile\JETAF43.tmp
c:\windows\system32\config\systemprofile\JETAF51.tmp
c:\windows\system32\config\systemprofile\JETAF80.tmp
c:\windows\system32\config\systemprofile\JETAF81.tmp
c:\windows\system32\config\systemprofile\JETAFDD.tmp
c:\windows\system32\config\systemprofile\JETAFDE.tmp
c:\windows\system32\config\systemprofile\JETAFED.tmp
c:\windows\system32\config\systemprofile\JETB03B.tmp
c:\windows\system32\config\systemprofile\JETB04B.tmp
c:\windows\system32\config\systemprofile\JETB04C.tmp
c:\windows\system32\config\systemprofile\JETB05A.tmp
c:\windows\system32\config\systemprofile\JETB089.tmp
c:\windows\system32\config\systemprofile\JETB0A8.tmp
c:\windows\system32\config\systemprofile\JETB0C7.tmp
c:\windows\system32\config\systemprofile\JETB163.tmp
c:\windows\system32\config\systemprofile\JETB17.tmp
c:\windows\system32\config\systemprofile\JETB1D1.tmp
c:\windows\system32\config\systemprofile\JETB1E0.tmp
c:\windows\system32\config\systemprofile\JETB21F.tmp
c:\windows\system32\config\systemprofile\JETB29B.tmp
c:\windows\system32\config\systemprofile\JETB2E9.tmp
c:\windows\system32\config\systemprofile\JETB2EA.tmp
c:\windows\system32\config\systemprofile\JETB385.tmp
c:\windows\system32\config\systemprofile\JETB3E3.tmp
c:\windows\system32\config\systemprofile\JETB412.tmp
c:\windows\system32\config\systemprofile\JETB413.tmp
c:\windows\system32\config\systemprofile\JETB49E.tmp
c:\windows\system32\config\systemprofile\JETB4FC.tmp
c:\windows\system32\config\systemprofile\JETB52B.tmp
c:\windows\system32\config\systemprofile\JETB559.tmp
c:\windows\system32\config\systemprofile\JETB55A.tmp
c:\windows\system32\config\systemprofile\JETB598.tmp
c:\windows\system32\config\systemprofile\JETB5A7.tmp
c:\windows\system32\config\systemprofile\JETB5B7.tmp
c:\windows\system32\config\systemprofile\JETB5D6.tmp
c:\windows\system32\config\systemprofile\JETB65.tmp
c:\windows\system32\config\systemprofile\JETB6B1.tmp
c:\windows\system32\config\systemprofile\JETB6EF.tmp
c:\windows\system32\config\systemprofile\JETB6FF.tmp
c:\windows\system32\config\systemprofile\JETB7AA.tmp
c:\windows\system32\config\systemprofile\JETB7BA.tmp
c:\windows\system32\config\systemprofile\JETB7BB.tmp
c:\windows\system32\config\systemprofile\JETB808.tmp
c:\windows\system32\config\systemprofile\JETB827.tmp
c:\windows\system32\config\systemprofile\JETB828.tmp
c:\windows\system32\config\systemprofile\JETB846.tmp
c:\windows\system32\config\systemprofile\JETB856.tmp
c:\windows\system32\config\systemprofile\JETB875.tmp
c:\windows\system32\config\systemprofile\JETB8B3.tmp
c:\windows\system32\config\systemprofile\JETB8D3.tmp
c:\windows\system32\config\systemprofile\JETB911.tmp
c:\windows\system32\config\systemprofile\JETB95F.tmp
c:\windows\system32\config\systemprofile\JETB96F.tmp
c:\windows\system32\config\systemprofile\JETB9CC.tmp
c:\windows\system32\config\systemprofile\JETBA2A.tmp
c:\windows\system32\config\systemprofile\JETBAF5.tmp
c:\windows\system32\config\systemprofile\JETBB14.tmp
c:\windows\system32\config\systemprofile\JETBB23.tmp
c:\windows\system32\config\systemprofile\JETBB52.tmp
c:\windows\system32\config\systemprofile\JETBBA0.tmp
c:\windows\system32\config\systemprofile\JETBBA1.tmp
c:\windows\system32\config\systemprofile\JETBBBF.tmp
c:\windows\system32\config\systemprofile\JETBBCF.tmp
c:\windows\system32\config\systemprofile\JETBC1D.tmp
c:\windows\system32\config\systemprofile\JETBC5B.tmp
c:\windows\system32\config\systemprofile\JETBCA9.tmp
c:\windows\system32\config\systemprofile\JETBCB9.tmp
c:\windows\system32\config\systemprofile\JETBCC9.tmp
c:\windows\system32\config\systemprofile\JETBCF7.tmp
c:\windows\system32\config\systemprofile\JETBD26.tmp
c:\windows\system32\config\systemprofile\JETBD45.tmp
c:\windows\system32\config\systemprofile\JETBD55.tmp
c:\windows\system32\config\systemprofile\JETBD84.tmp
c:\windows\system32\config\systemprofile\JETBD93.tmp
c:\windows\system32\config\systemprofile\JETBDA3.tmp
c:\windows\system32\config\systemprofile\JETBDD2.tmp
c:\windows\system32\config\systemprofile\JETBDD3.tmp
c:\windows\system32\config\systemprofile\JETBDE1.tmp
c:\windows\system32\config\systemprofile\JETBE01.tmp
c:\windows\system32\config\systemprofile\JETBE10.tmp
c:\windows\system32\config\systemprofile\JETBE11.tmp
c:\windows\system32\config\systemprofile\JETBE20.tmp
c:\windows\system32\config\systemprofile\JETBE5E.tmp
c:\windows\system32\config\systemprofile\JETBECB.tmp
c:\windows\system32\config\systemprofile\JETBEDB.tmp
c:\windows\system32\config\systemprofile\JETBEEB.tmp
c:\windows\system32\config\systemprofile\JETBEEC.tmp
c:\windows\system32\config\systemprofile\JETBF29.tmp
c:\windows\system32\config\systemprofile\JETBF96.tmp
c:\windows\system32\config\systemprofile\JETC003.tmp
c:\windows\system32\config\systemprofile\JETC080.tmp
c:\windows\system32\config\systemprofile\JETC090.tmp
c:\windows\system32\config\systemprofile\JETC09F.tmp
c:\windows\system32\config\systemprofile\JETC0CE.tmp
c:\windows\system32\config\systemprofile\JETC0FD.tmp
c:\windows\system32\config\systemprofile\JETC10D.tmp
c:\windows\system32\config\systemprofile\JETC11C.tmp
c:\windows\system32\config\systemprofile\JETC12C.tmp
c:\windows\system32\config\systemprofile\JETC15B.tmp
c:\windows\system32\config\systemprofile\JETC189.tmp
c:\windows\system32\config\systemprofile\JETC199.tmp
c:\windows\system32\config\systemprofile\JETC19A.tmp
c:\windows\system32\config\systemprofile\JETC1B8.tmp
c:\windows\system32\config\systemprofile\JETC1E7.tmp
c:\windows\system32\config\systemprofile\JETC1E8.tmp
c:\windows\system32\config\systemprofile\JETC225.tmp
c:\windows\system32\config\systemprofile\JETC254.tmp
c:\windows\system32\config\systemprofile\JETC255.tmp
c:\windows\system32\config\systemprofile\JETC273.tmp
c:\windows\system32\config\systemprofile\JETC2A2.tmp
c:\windows\system32\config\systemprofile\JETC2B2.tmp
c:\windows\system32\config\systemprofile\JETC2B3.tmp
c:\windows\system32\config\systemprofile\JETC2D1.tmp
c:\windows\system32\config\systemprofile\JETC2F0.tmp
c:\windows\system32\config\systemprofile\JETC31F.tmp
c:\windows\system32\config\systemprofile\JETC320.tmp
c:\windows\system32\config\systemprofile\JETC32F.tmp
c:\windows\system32\config\systemprofile\JETC33E.tmp
c:\windows\system32\config\systemprofile\JETC38C.tmp
c:\windows\system32\config\systemprofile\JETC39C.tmp
c:\windows\system32\config\systemprofile\JETC428.tmp
c:\windows\system32\config\systemprofile\JETC438.tmp
c:\windows\system32\config\systemprofile\JETC4A5.tmp
c:\windows\system32\config\systemprofile\JETC4F3.tmp
c:\windows\system32\config\systemprofile\JETC522.tmp
c:\windows\system32\config\systemprofile\JETC531.tmp
c:\windows\system32\config\systemprofile\JETC58F.tmp
c:\windows\system32\config\systemprofile\JETC5DD.tmp
c:\windows\system32\config\systemprofile\JETC5DE.tmp
c:\windows\system32\config\systemprofile\JETC5DF.tmp
c:\windows\system32\config\systemprofile\JETC5ED.tmp
c:\windows\system32\config\systemprofile\JETC60C.tmp
c:\windows\system32\config\systemprofile\JETC63B.tmp
c:\windows\system32\config\systemprofile\JETC63C.tmp
c:\windows\system32\config\systemprofile\JETC64A.tmp
c:\windows\system32\config\systemprofile\JETC669.tmp
c:\windows\system32\config\systemprofile\JETC679.tmp
c:\windows\system32\config\systemprofile\JETC689.tmp
c:\windows\system32\config\systemprofile\JETC68A.tmp
c:\windows\system32\config\systemprofile\JETC698.tmp
c:\windows\system32\config\systemprofile\JETC699.tmp
c:\windows\system32\config\systemprofile\JETC6A8.tmp
c:\windows\system32\config\systemprofile\JETC6E.tmp
c:\windows\system32\config\systemprofile\JETC6E6.tmp
c:\windows\system32\config\systemprofile\JETC725.tmp
c:\windows\system32\config\systemprofile\JETC726.tmp
c:\windows\system32\config\systemprofile\JETC763.tmp
c:\windows\system32\config\systemprofile\JETC7A1.tmp
c:\windows\system32\config\systemprofile\JETC7A2.tmp
c:\windows\system32\config\systemprofile\JETC7E0.tmp
c:\windows\system32\config\systemprofile\JETC81E.tmp
c:\windows\system32\config\systemprofile\JETC84D.tmp
c:\windows\system32\config\systemprofile\JETC85D.tmp
c:\windows\system32\config\systemprofile\JETC86C.tmp
c:\windows\system32\config\systemprofile\JETC8AB.tmp
c:\windows\system32\config\systemprofile\JETC908.tmp
c:\windows\system32\config\systemprofile\JETC927.tmp
c:\windows\system32\config\systemprofile\JETC928.tmp
c:\windows\system32\config\systemprofile\JETC966.tmp
c:\windows\system32\config\systemprofile\JETC9D3.tmp
c:\windows\system32\config\systemprofile\JETC9E3.tmp
c:\windows\system32\config\systemprofile\JETC9F2.tmp
c:\windows\system32\config\systemprofile\JETCA.tmp
c:\windows\system32\config\systemprofile\JETCA02.tmp
c:\windows\system32\config\systemprofile\JETCA21.tmp
c:\windows\system32\config\systemprofile\JETCA22.tmp
c:\windows\system32\config\systemprofile\JETCA31.tmp
c:\windows\system32\config\systemprofile\JETCA7F.tmp
c:\windows\system32\config\systemprofile\JETCA9E.tmp
c:\windows\system32\config\systemprofile\JETCABD.tmp
c:\windows\system32\config\systemprofile\JETCB2A.tmp
c:\windows\system32\config\systemprofile\JETCB69.tmp
c:\windows\system32\config\systemprofile\JETCB78.tmp
c:\windows\system32\config\systemprofile\JETCBA7.tmp
c:\windows\system32\config\systemprofile\JETCBA8.tmp
c:\windows\system32\config\systemprofile\JETCBA9.tmp
c:\windows\system32\config\systemprofile\JETCBF5.tmp
c:\windows\system32\config\systemprofile\JETCC14.tmp
c:\windows\system32\config\systemprofile\JETCC24.tmp
c:\windows\system32\config\systemprofile\JETCC25.tmp
c:\windows\system32\config\systemprofile\JETCCC0.tmp
c:\windows\system32\config\systemprofile\JETCCDF.tmp
c:\windows\system32\config\systemprofile\JETCCEF.tmp
c:\windows\system32\config\systemprofile\JETCCF0.tmp
c:\windows\system32\config\systemprofile\JETCCF1.tmp
c:\windows\system32\config\systemprofile\JETCCF2.tmp
c:\windows\system32\config\systemprofile\JETCCFE.tmp
c:\windows\system32\config\systemprofile\JETCD6B.tmp
c:\windows\system32\config\systemprofile\JETCD7B.tmp
c:\windows\system32\config\systemprofile\JETCDB.tmp
c:\windows\system32\config\systemprofile\JETCE07.tmp
c:\windows\system32\config\systemprofile\JETCE46.tmp
c:\windows\system32\config\systemprofile\JETCE47.tmp
c:\windows\system32\config\systemprofile\JETCE55.tmp
c:\windows\system32\config\systemprofile\JETCEA3.tmp
c:\windows\system32\config\systemprofile\JETCEA4.tmp
c:\windows\system32\config\systemprofile\JETCEC3.tmp
c:\windows\system32\config\systemprofile\JETCF4F.tmp
c:\windows\system32\config\systemprofile\JETCF5F.tmp
c:\windows\system32\config\systemprofile\JETCF7E.tmp
c:\windows\system32\config\systemprofile\JETCFBC.tmp
c:\windows\system32\config\systemprofile\JETCFDB.tmp
c:\windows\system32\config\systemprofile\JETD039.tmp
c:\windows\system32\config\systemprofile\JETD049.tmp
c:\windows\system32\config\systemprofile\JETD058.tmp
c:\windows\system32\config\systemprofile\JETD059.tmp
c:\windows\system32\config\systemprofile\JETD068.tmp
c:\windows\system32\config\systemprofile\JETD077.tmp
c:\windows\system32\config\systemprofile\JETD0E5.tmp
c:\windows\system32\config\systemprofile\JETD0E6.tmp
c:\windows\system32\config\systemprofile\JETD104.tmp
c:\windows\system32\config\systemprofile\JETD133.tmp
c:\windows\system32\config\systemprofile\JETD1BF.tmp
c:\windows\system32\config\systemprofile\JETD1CF.tmp
c:\windows\system32\config\systemprofile\JETD1D0.tmp
c:\windows\system32\config\systemprofile\JETD1DE.tmp
c:\windows\system32\config\systemprofile\JETD1EE.tmp
c:\windows\system32\config\systemprofile\JETD20D.tmp
c:\windows\system32\config\systemprofile\JETD24B.tmp
c:\windows\system32\config\systemprofile\JETD24C.tmp
c:\windows\system32\config\systemprofile\JETD26B.tmp
c:\windows\system32\config\systemprofile\JETD26C.tmp
c:\windows\system32\config\systemprofile\JETD2A9.tmp
c:\windows\system32\config\systemprofile\JETD2B9.tmp
c:\windows\system32\config\systemprofile\JETD2BA.tmp
c:\windows\system32\config\systemprofile\JETD2C8.tmp
c:\windows\system32\config\systemprofile\JETD2C9.tmp
c:\windows\system32\config\systemprofile\JETD2CA.tmp
c:\windows\system32\config\systemprofile\JETD335.tmp
c:\windows\system32\config\systemprofile\JETD355.tmp
c:\windows\system32\config\systemprofile\JETD41F.tmp
c:\windows\system32\config\systemprofile\JETD42F.tmp
c:\windows\system32\config\systemprofile\JETD43F.tmp
c:\windows\system32\config\systemprofile\JETD47D.tmp
c:\windows\system32\config\systemprofile\JETD48D.tmp
c:\windows\system32\config\systemprofile\JETD48E.tmp
c:\windows\system32\config\systemprofile\JETD4BB.tmp
c:\windows\system32\config\systemprofile\JETD4CB.tmp
c:\windows\system32\config\systemprofile\JETD509.tmp
c:\windows\system32\config\systemprofile\JETD519.tmp
c:\windows\system32\config\systemprofile\JETD51A.tmp
c:\windows\system32\config\systemprofile\JETD529.tmp
c:\windows\system32\config\systemprofile\JETD52A.tmp
c:\windows\system32\config\systemprofile\JETD548.tmp
c:\windows\system32\config\systemprofile\JETD549.tmp
c:\windows\system32\config\systemprofile\JETD567.tmp
c:\windows\system32\config\systemprofile\JETD596.tmp
c:\windows\system32\config\systemprofile\JETD5B5.tmp
c:\windows\system32\config\systemprofile\JETD5B6.tmp
c:\windows\system32\config\systemprofile\JETD5D4.tmp
c:\windows\system32\config\systemprofile\JETD603.tmp
c:\windows\system32\config\systemprofile\JETD641.tmp
c:\windows\system32\config\systemprofile\JETD670.tmp
c:\windows\system32\config\systemprofile\JETD68.tmp
c:\windows\system32\config\systemprofile\JETD6AF.tmp
c:\windows\system32\config\systemprofile\JETD6CE.tmp
c:\windows\system32\config\systemprofile\JETD75A.tmp
c:\windows\system32\config\systemprofile\JETD789.tmp
c:\windows\system32\config\systemprofile\JETD78A.tmp
c:\windows\system32\config\systemprofile\JETD844.tmp
c:\windows\system32\config\systemprofile\JETD845.tmp
c:\windows\system32\config\systemprofile\JETD854.tmp
c:\windows\system32\config\systemprofile\JETD87.tmp
c:\windows\system32\config\systemprofile\JETD8C1.tmp
c:\windows\system32\config\systemprofile\JETD8D1.tmp
c:\windows\system32\config\systemprofile\JETD8E0.tmp
c:\windows\system32\config\systemprofile\JETD8E1.tmp
c:\windows\system32\config\systemprofile\JETD8E2.tmp
c:\windows\system32\config\systemprofile\JETD93E.tmp
c:\windows\system32\config\systemprofile\JETD94D.tmp
c:\windows\system32\config\systemprofile\JETD95D.tmp
c:\windows\system32\config\systemprofile\JETD96.tmp
c:\windows\system32\config\systemprofile\JETD98C.tmp
c:\windows\system32\config\systemprofile\JETD9BB.tmp
c:\windows\system32\config\systemprofile\JETD9F9.tmp
c:\windows\system32\config\systemprofile\JETD9FA.tmp
c:\windows\system32\config\systemprofile\JETD9FB.tmp
c:\windows\system32\config\systemprofile\JETDA47.tmp
c:\windows\system32\config\systemprofile\JETDA6.tmp
c:\windows\system32\config\systemprofile\JETDA76.tmp
c:\windows\system32\config\systemprofile\JETDA77.tmp
c:\windows\system32\config\systemprofile\JETDA8B.tmp
c:\windows\system32\config\systemprofile\JETDAD3.tmp
c:\windows\system32\config\systemprofile\JETDB02.tmp
c:\windows\system32\config\systemprofile\JETDB12.tmp
c:\windows\system32\config\systemprofile\JETDB21.tmp
c:\windows\system32\config\systemprofile\JETDB31.tmp
c:\windows\system32\config\systemprofile\JETDB50.tmp
c:\windows\system32\config\systemprofile\JETDB60.tmp
c:\windows\system32\config\systemprofile\JETDB61.tmp
c:\windows\system32\config\systemprofile\JETDBAE.tmp
c:\windows\system32\config\systemprofile\JETDBDD.tmp
c:\windows\system32\config\systemprofile\JETDBEC.tmp
c:\windows\system32\config\systemprofile\JETDC1B.tmp
c:\windows\system32\config\systemprofile\JETDC1C.tmp
c:\windows\system32\config\systemprofile\JETDC1D.tmp
c:\windows\system32\config\systemprofile\JETDC1E.tmp
c:\windows\system32\config\systemprofile\JETDC3A.tmp
c:\windows\system32\config\systemprofile\JETDC4A.tmp
c:\windows\system32\config\systemprofile\JETDC98.tmp
c:\windows\system32\config\systemprofile\JETDCB7.tmp
c:\windows\system32\config\systemprofile\JETDD24.tmp
c:\windows\system32\config\systemprofile\JETDD82.tmp
c:\windows\system32\config\systemprofile\JETDD91.tmp
c:\windows\system32\config\systemprofile\JETDDFF.tmp
c:\windows\system32\config\systemprofile\JETDE7C.tmp
c:\windows\system32\config\systemprofile\JETDEBA.tmp
c:\windows\system32\config\systemprofile\JETDEF8.tmp
c:\windows\system32\config\systemprofile\JETDEF9.tmp
c:\windows\system32\config\systemprofile\JETDF37.tmp
c:\windows\system32\config\systemprofile\JETDF46.tmp
c:\windows\system32\config\systemprofile\JETDF56.tmp
c:\windows\system32\config\systemprofile\JETDF85.tmp
c:\windows\system32\config\systemprofile\JETDFB3.tmp
c:\windows\system32\config\systemprofile\JETDFE2.tmp
c:\windows\system32\config\systemprofile\JETE001.tmp
c:\windows\system32\config\systemprofile\JETE06F.tmp
c:\windows\system32\config\systemprofile\JETE0AD.tmp
c:\windows\system32\config\systemprofile\JETE0AE.tmp
c:\windows\system32\config\systemprofile\JETE0EB.tmp
c:\windows\system32\config\systemprofile\JETE0EC.tmp
c:\windows\system32\config\systemprofile\JETE10B.tmp
c:\windows\system32\config\systemprofile\JETE12A.tmp
c:\windows\system32\config\systemprofile\JETE1B6.tmp
c:\windows\system32\config\systemprofile\JETE1E5.tmp
c:\windows\system32\config\systemprofile\JETE1F5.tmp
c:\windows\system32\config\systemprofile\JETE252.tmp
c:\windows\system32\config\systemprofile\JETE262.tmp
c:\windows\system32\config\systemprofile\JETE271.tmp
c:\windows\system32\config\systemprofile\JETE2DF.tmp
c:\windows\system32\config\systemprofile\JETE2FE.tmp
c:\windows\system32\config\systemprofile\JETE30D.tmp
c:\windows\system32\config\systemprofile\JETE31D.tmp
c:\windows\system32\config\systemprofile\JETE35B.tmp
c:\windows\system32\config\systemprofile\JETE37B.tmp
c:\windows\system32\config\systemprofile\JETE3C9.tmp
c:\windows\system32\config\systemprofile\JETE3D8.tmp
c:\windows\system32\config\systemprofile\JETE42.tmp
c:\windows\system32\config\systemprofile\JETE474.tmp
c:\windows\system32\config\systemprofile\JETE4B3.tmp
c:\windows\system32\config\systemprofile\JETE4C2.tmp
c:\windows\system32\config\systemprofile\JETE4C3.tmp
c:\windows\system32\config\systemprofile\JETE52.tmp
c:\windows\system32\config\systemprofile\JETE520.tmp
c:\windows\system32\config\systemprofile\JETE52F.tmp
c:\windows\system32\config\systemprofile\JETE57D.tmp
c:\windows\system32\config\systemprofile\JETE57E.tmp
c:\windows\system32\config\systemprofile\JETE57F.tmp
c:\windows\system32\config\systemprofile\JETE58D.tmp
c:\windows\system32\config\systemprofile\JETE5AC.tmp
c:\windows\system32\config\systemprofile\JETE5BC.tmp
c:\windows\system32\config\systemprofile\JETE5CB.tmp
c:\windows\system32\config\systemprofile\JETE5CC.tmp
c:\windows\system32\config\systemprofile\JETE5DB.tmp
c:\windows\system32\config\systemprofile\JETE629.tmp
c:\windows\system32\config\systemprofile\JETE667.tmp
c:\windows\system32\config\systemprofile\JETE677.tmp
c:\windows\system32\config\systemprofile\JETE696.tmp
c:\windows\system32\config\systemprofile\JETE6C5.tmp
c:\windows\system32\config\systemprofile\JETE703.tmp
c:\windows\system32\config\systemprofile\JETE742.tmp
c:\windows\system32\config\systemprofile\JETE751.tmp
c:\windows\system32\config\systemprofile\JETE761.tmp
c:\windows\system32\config\systemprofile\JETE81C.tmp
c:\windows\system32\config\systemprofile\JETE85B.tmp
c:\windows\system32\config\systemprofile\JETE86A.tmp
c:\windows\system32\config\systemprofile\JETE86B.tmp
c:\windows\system32\config\systemprofile\JETE899.tmp
c:\windows\system32\config\systemprofile\JETE8E7.tmp
c:\windows\system32\config\systemprofile\JETE8E8.tmp
c:\windows\system32\config\systemprofile\JETE8F7.tmp
c:\windows\system32\config\systemprofile\JETE90.tmp
c:\windows\system32\config\systemprofile\JETE935.tmp
c:\windows\system32\config\systemprofile\JETE974.tmp
c:\windows\system32\config\systemprofile\JETE983.tmp
c:\windows\system32\config\systemprofile\JETE993.tmp
c:\windows\system32\config\systemprofile\JETEA6D.tmp
c:\windows\system32\config\systemprofile\JETEA9C.tmp
c:\windows\system32\config\systemprofile\JETEB28.tmp
c:\windows\system32\config\systemprofile\JETEB38.tmp
c:\windows\system32\config\systemprofile\JETEB39.tmp
c:\windows\system32\config\systemprofile\JETEB47.tmp
c:\windows\system32\config\systemprofile\JETEB57.tmp
c:\windows\system32\config\systemprofile\JETEB76.tmp
c:\windows\system32\config\systemprofile\JETEBC4.tmp
c:\windows\system32\config\systemprofile\JETEBD4.tmp
c:\windows\system32\config\systemprofile\JETEBE3.tmp
c:\windows\system32\config\systemprofile\JETEBE4.tmp
c:\windows\system32\config\systemprofile\JETEBF3.tmp
c:\windows\system32\config\systemprofile\JETEC41.tmp
c:\windows\system32\config\systemprofile\JETEC70.tmp
c:\windows\system32\config\systemprofile\JETECAE.tmp
c:\windows\system32\config\systemprofile\JETED5A.tmp
c:\windows\system32\config\systemprofile\JETED79.tmp
c:\windows\system32\config\systemprofile\JETED89.tmp
c:\windows\system32\config\systemprofile\JETEDA8.tmp
c:\windows\system32\config\systemprofile\JETEDB7.tmp
c:\windows\system32\config\systemprofile\JETEDB8.tmp
c:\windows\system32\config\systemprofile\JETEE44.tmp
c:\windows\system32\config\systemprofile\JETEE73.tmp
c:\windows\system32\config\systemprofile\JETEF1E.tmp
c:\windows\system32\config\systemprofile\JETEF2E.tmp
c:\windows\system32\config\systemprofile\JETEF5D.tmp
c:\windows\system32\config\systemprofile\JETEF8B.tmp
c:\windows\system32\config\systemprofile\JETEFAB.tmp
c:\windows\system32\config\systemprofile\JETF008.tmp
c:\windows\system32\config\systemprofile\JETF056.tmp
c:\windows\system32\config\systemprofile\JETF0C3.tmp
c:\windows\system32\config\systemprofile\JETF0C4.tmp
c:\windows\system32\config\systemprofile\JETF19E.tmp
c:\windows\system32\config\systemprofile\JETF19F.tmp
c:\windows\system32\config\systemprofile\JETF1BD.tmp
c:\windows\system32\config\systemprofile\JETF1CD.tmp
c:\windows\system32\config\systemprofile\JETF1CE.tmp
c:\windows\system32\config\systemprofile\JETF1DC.tmp
c:\windows\system32\config\systemprofile\JETF21B.tmp
c:\windows\system32\config\systemprofile\JETF259.tmp
c:\windows\system32\config\systemprofile\JETF2D6.tmp
c:\windows\system32\config\systemprofile\JETF2D7.tmp
c:\windows\system32\config\systemprofile\JETF2E5.tmp
c:\windows\system32\config\systemprofile\JETF2E6.tmp
c:\windows\system32\config\systemprofile\JETF381.tmp
c:\windows\system32\config\systemprofile\JETF3B0.tmp
c:\windows\system32\config\systemprofile\JETF3C.tmp
c:\windows\system32\config\systemprofile\JETF3EF.tmp
c:\windows\system32\config\systemprofile\JETF45C.tmp
c:\windows\system32\config\systemprofile\JETF49A.tmp
c:\windows\system32\config\systemprofile\JETF4C9.tmp
c:\windows\system32\config\systemprofile\JETF594.tmp
c:\windows\system32\config\systemprofile\JETF5B3.tmp
c:\windows\system32\config\systemprofile\JETF5D2.tmp
c:\windows\system32\config\systemprofile\JETF5E2.tmp
c:\windows\system32\config\systemprofile\JETF620.tmp
c:\windows\system32\config\systemprofile\JETF630.tmp
c:\windows\system32\config\systemprofile\JETF64F.tmp
c:\windows\system32\config\systemprofile\JETF67E.tmp
c:\windows\system32\config\systemprofile\JETF6A.tmp
c:\windows\system32\config\systemprofile\JETF6AD.tmp
c:\windows\system32\config\systemprofile\JETF6BC.tmp
c:\windows\system32\config\systemprofile\JETF797.tmp
c:\windows\system32\config\systemprofile\JETF8A0.tmp
c:\windows\system32\config\systemprofile\JETF8CF.tmp
c:\windows\system32\config\systemprofile\JETF92C.tmp
c:\windows\system32\config\systemprofile\JETF93C.tmp
c:\windows\system32\config\systemprofile\JETF94C.tmp
c:\windows\system32\config\systemprofile\JETFB3F.tmp
c:\windows\system32\config\systemprofile\JETFB4E.tmp
c:\windows\system32\config\systemprofile\JETFB4F.tmp
c:\windows\system32\config\systemprofile\JETFBAC.tmp
c:\windows\system32\config\systemprofile\JETFCA6.tmp
c:\windows\system32\config\systemprofile\JETFD22.tmp
c:\windows\system32\config\systemprofile\JETFDDE.tmp
c:\windows\system32\config\systemprofile\JETFDED.tmp
c:\windows\system32\config\systemprofile\JETFE2C.tmp
c:\windows\system32\config\systemprofile\JETFE3B.tmp
c:\windows\system32\config\systemprofile\JETFE3C.tmp
c:\windows\system32\config\systemprofile\JETFE4B.tmp
c:\windows\system32\config\systemprofile\JETFED7.tmp
c:\windows\system32\config\systemprofile\JETFF44.tmp
c:\windows\system32\config\systemprofile\JETFF54.tmp
c:\windows\system32\config\systemprofile\JETFF64.tmp
c:\windows\system32\config\systemprofile\si93B6.tmp
c:\windows\system32\config\systemprofile\si9701.tmp
c:\windows\system32\config\systemprofile\siA2D.tmp
c:\windows\system32\config\systemprofile\siB3E3.tmp
c:\windows\system32\config\systemprofile\siF140.tmp
c:\windows\system32\config\systemprofile\siF1CD.tmp
c:\windows\system32\config\systemprofile\TMP0000005DB4C5F2A11766798C
c:\windows\system32\m3.dll
c:\windows\system32\odbcad32.exe
c:\windows\system32\SET4C84.tmp
c:\windows\system32\SET4D51.tmp
c:\windows\system32\SET4DB1.tmp
c:\windows\system32\SETF759.tmp
c:\windows\system32\SETF8D2.tmp
c:\windows\system32\SETF912.tmp
.
 
----- File Replicators -----
.
c:\cygwin\bin\git.exe
c:\cygwin\lib\git-core\git-add.exe
c:\cygwin\lib\git-core\git-annotate.exe
c:\cygwin\lib\git-core\git-apply.exe
c:\cygwin\lib\git-core\git-archive.exe
c:\cygwin\lib\git-core\git-bisect--helper.exe
c:\cygwin\lib\git-core\git-blame.exe
c:\cygwin\lib\git-core\git-branch.exe
c:\cygwin\lib\git-core\git-bundle.exe
c:\cygwin\lib\git-core\git-cat-file.exe
c:\cygwin\lib\git-core\git-check-attr.exe
c:\cygwin\lib\git-core\git-check-ref-format.exe
c:\cygwin\lib\git-core\git-checkout-index.exe
c:\cygwin\lib\git-core\git-checkout.exe
c:\cygwin\lib\git-core\git-cherry-pick.exe
c:\cygwin\lib\git-core\git-cherry.exe
c:\cygwin\lib\git-core\git-clean.exe
c:\cygwin\lib\git-core\git-clone.exe
c:\cygwin\lib\git-core\git-commit-tree.exe
c:\cygwin\lib\git-core\git-commit.exe
c:\cygwin\lib\git-core\git-config.exe
c:\cygwin\lib\git-core\git-count-objects.exe
c:\cygwin\lib\git-core\git-describe.exe
c:\cygwin\lib\git-core\git-diff-files.exe
c:\cygwin\lib\git-core\git-diff-index.exe
c:\cygwin\lib\git-core\git-diff-tree.exe
c:\cygwin\lib\git-core\git-diff.exe
c:\cygwin\lib\git-core\git-fast-export.exe
c:\cygwin\lib\git-core\git-fetch-pack.exe
c:\cygwin\lib\git-core\git-fetch.exe
c:\cygwin\lib\git-core\git-fmt-merge-msg.exe
c:\cygwin\lib\git-core\git-for-each-ref.exe
c:\cygwin\lib\git-core\git-format-patch.exe
c:\cygwin\lib\git-core\git-fsck-objects.exe
c:\cygwin\lib\git-core\git-fsck.exe
c:\cygwin\lib\git-core\git-gc.exe
c:\cygwin\lib\git-core\git-get-tar-commit-id.exe
c:\cygwin\lib\git-core\git-grep.exe
c:\cygwin\lib\git-core\git-hash-object.exe
c:\cygwin\lib\git-core\git-help.exe
c:\cygwin\lib\git-core\git-index-pack.exe
c:\cygwin\lib\git-core\git-init-db.exe
c:\cygwin\lib\git-core\git-init.exe
c:\cygwin\lib\git-core\git-log.exe
c:\cygwin\lib\git-core\git-ls-files.exe
c:\cygwin\lib\git-core\git-ls-remote.exe
c:\cygwin\lib\git-core\git-ls-tree.exe
c:\cygwin\lib\git-core\git-mailinfo.exe
c:\cygwin\lib\git-core\git-mailsplit.exe
c:\cygwin\lib\git-core\git-merge-base.exe
c:\cygwin\lib\git-core\git-merge-file.exe
c:\cygwin\lib\git-core\git-merge-index.exe
c:\cygwin\lib\git-core\git-merge-ours.exe
c:\cygwin\lib\git-core\git-merge-recursive.exe
c:\cygwin\lib\git-core\git-merge-subtree.exe
c:\cygwin\lib\git-core\git-merge-tree.exe
c:\cygwin\lib\git-core\git-merge.exe
c:\cygwin\lib\git-core\git-mktag.exe
c:\cygwin\lib\git-core\git-mktree.exe
c:\cygwin\lib\git-core\git-mv.exe
c:\cygwin\lib\git-core\git-name-rev.exe
c:\cygwin\lib\git-core\git-pack-objects.exe
c:\cygwin\lib\git-core\git-pack-redundant.exe
c:\cygwin\lib\git-core\git-pack-refs.exe
c:\cygwin\lib\git-core\git-patch-id.exe
c:\cygwin\lib\git-core\git-peek-remote.exe
c:\cygwin\lib\git-core\git-prune-packed.exe
c:\cygwin\lib\git-core\git-prune.exe
c:\cygwin\lib\git-core\git-push.exe
c:\cygwin\lib\git-core\git-read-tree.exe
c:\cygwin\lib\git-core\git-receive-pack.exe
c:\cygwin\lib\git-core\git-reflog.exe
c:\cygwin\lib\git-core\git-remote.exe
c:\cygwin\lib\git-core\git-replace.exe
c:\cygwin\lib\git-core\git-repo-config.exe
c:\cygwin\lib\git-core\git-rerere.exe
c:\cygwin\lib\git-core\git-reset.exe
c:\cygwin\lib\git-core\git-rev-list.exe
c:\cygwin\lib\git-core\git-rev-parse.exe
c:\cygwin\lib\git-core\git-revert.exe
c:\cygwin\lib\git-core\git-rm.exe
c:\cygwin\lib\git-core\git-send-pack.exe
c:\cygwin\lib\git-core\git-shortlog.exe
c:\cygwin\lib\git-core\git-show-branch.exe
c:\cygwin\lib\git-core\git-show-ref.exe
c:\cygwin\lib\git-core\git-show.exe
c:\cygwin\lib\git-core\git-stage.exe
c:\cygwin\lib\git-core\git-status.exe
c:\cygwin\lib\git-core\git-stripspace.exe
c:\cygwin\lib\git-core\git-symbolic-ref.exe
c:\cygwin\lib\git-core\git-tag.exe
c:\cygwin\lib\git-core\git-tar-tree.exe
c:\cygwin\lib\git-core\git-unpack-file.exe
c:\cygwin\lib\git-core\git-unpack-objects.exe
c:\cygwin\lib\git-core\git-update-index.exe
c:\cygwin\lib\git-core\git-update-ref.exe
c:\cygwin\lib\git-core\git-update-server-info.exe
c:\cygwin\lib\git-core\git-upload-archive.exe
c:\cygwin\lib\git-core\git-var.exe
c:\cygwin\lib\git-core\git-verify-pack.exe
c:\cygwin\lib\git-core\git-verify-tag.exe
c:\cygwin\lib\git-core\git-whatchanged.exe
c:\cygwin\lib\git-core\git-write-tree.exe
c:\cygwin\lib\git-core\git.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-06-22 to 2012-07-22 )))))))))))))))))))))))))))))))
.
.
2012-07-22 01:02 . 2012-07-22 01:02 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8ACFD315-1F02-4F41-B38E-0D9C8F750854}\offreg.dll
2012-07-22 01:00 . 2012-07-22 01:04 -------- d-----w- c:\users\colin\AppData\Local\temp
2012-07-22 01:00 . 2012-07-22 01:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-22 01:00 . 2012-07-22 01:00 -------- d-----w- c:\users\Wiz\AppData\Local\temp
2012-07-22 00:35 . 2012-07-15 16:41 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8ACFD315-1F02-4F41-B38E-0D9C8F750854}\mpengine.dll
2012-07-20 02:04 . 2012-07-20 02:04 -------- d-----w- C:\FRST
2012-07-19 02:01 . 2012-07-19 02:01 -------- d-----w- c:\windows\Microsoft Antimalware
2012-07-17 10:33 . 2012-02-09 04:17 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9EE6C01A-A253-497E-9913-E9B118A81EAB}\gapaengine.dll
2012-07-17 10:32 . 2012-07-15 16:41 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-07-17 10:18 . 2012-07-17 10:18 -------- d-----w- c:\program files\Microsoft Security Client
2012-07-17 08:20 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-07-17 08:20 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-07-17 07:53 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll
2012-07-16 10:13 . 2012-07-16 10:13 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-07-09 10:23 . 2012-07-17 10:15 -------- d-----w- C:\Downloads
2012-06-25 06:04 . 2012-06-25 06:04 1394248 ----a-w- c:\windows\system32\msxml4.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-12 09:26 . 2012-04-17 09:34 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-12 09:26 . 2011-06-07 09:27 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-13 13:40 . 2012-07-17 08:29 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-06-02 22:19 . 2012-06-21 07:18 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-21 07:18 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-21 07:17 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-21 07:17 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-21 07:18 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-21 07:18 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-21 07:17 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 08:25 . 2012-07-17 08:09 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-06-02 05:19 . 2012-06-21 07:17 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 05:12 . 2012-06-21 07:17 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-05-13 10:38 . 2009-08-18 01:30 564632 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2012-05-13 10:37 . 2009-08-18 01:24 19352 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2009-10-07 09:12 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2009-10-07 09:12 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2009-10-07 09:12 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2009-10-07 09:12 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2009-10-07 09:12 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2009-10-07 09:12 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2009-10-07 09:12 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2009-10-07 09:12 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2009-10-07 09:12 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-12-21 1483264]
"Steam"="h:\program files\Steam\Steam.exe" [2011-10-02 1242448]
"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-05-04 955792]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-04 21392]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-03 17417392]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2012-05-14 6149120]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-04-18 159744]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-08-29 36864]
"Logitech Hardware Abstraction Layer"="c:\program files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2007-01-11 101136]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2007-08-22 159744]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"VolPanel"="c:\program files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" [2006-11-26 180224]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-11 101136]
"RCApp"="c:\program files\gigabyte\RCApp\U7000RCApp.exe" [2007-04-24 625152]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-07 405504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-15 13793824]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2009-06-15 92704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-05-04 3521424]
"PMBVolumeWatcher"="c:\program files\Sony\PMB\PMBVolumeWatcher.exe" [2010-05-31 600928]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-3 703280]
SetPoint.lnk - c:\program files\SetPoint\SetPoint.exe [2008-3-20 679936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-13 20:58 611712 ----a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DELL Webcam Manager]
2007-07-27 08:43 118784 ------w- c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2007-05-25 06:03 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 09:26]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.au/
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.253
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe
HKLM-Run-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-dscactivate - c:\program files\Dell Support Center\gs_agent\custom\dsca.exe
MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
MSConfigStartUp-PC Suite Tray - c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe
AddRemove-SLABCOMM&10C4&EA60 - c:\program files\Silabs\MCU\DriverUninstall\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files:
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CLCapSvc]
"ImagePath"="\"c:\program files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe\"\00am Files\CyberLink\PowerCinema\Kernel\TV\CapSetup\00HLP\00\12\00½¶\06wT:¬\03"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(4480)
c:\program files\SetPoint\lgscroll.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\windows\system32\btncopy.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\CTsvcCDA.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Dell Network Assistant\hnm_svc.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\STacSV.exe
c:\program files\TomTom HOME 2\TomTomHOMEService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\windows\ehome\ehmsas.exe
c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\HidFind.exe
c:\program files\DellTPad\Apntex.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\msfeedssync.exe
.
**************************************************************************
.
Completion time: 2012-07-22 11:14:26 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-22 01:12
.
Pre-Run: 4,135,829,504 bytes free
Post-Run: 13,484,158,976 bytes free
.
- - End Of File - - 7B579C93852BE287DF62212106BAE017
 
Hi Broni,
ComboFix indicated that microsoft security essentials still had antivirus and antimalware enabled even after I disabled real time operation. So rather than completely removing microsoft securirty essentials I chose to press ahead and continue with Combofix. The Combo log file is split over the previous two postings.
Regards,
Colin
 
Looks good :)

Any current issues?

================================

Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
NOTE. If you already have MBAM installed, update it before running the scan.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer IF MBAM asks you to do so.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

===============================

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click the Scan All Users checkbox.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
 
Hi Broni,
The computer will now boot without then rebooting after a minute. But, iexplorer, windows explorer and even the mbam-setup-1.6.2.0.1300.exe fail to run. The error reported is "Illegal operation attempted on a registry key that has been marked for deletion".
Regards,
Colin... :eek:
 
Pay attention!

**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
Click to expand...
 
Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org
Database version: v2012.07.23.04
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
colin :: DELL1720 [administrator]
Protection: Enabled
23/07/2012 5:45:12 PM
mbam-log-2012-07-23 (17-45-12).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 229723
Time elapsed: 9 minute(s), 35 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
 
OTL logfile created on: 23/07/2012 5:59:45 PM - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\colin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.50 Gb Total Physical Memory | 1.97 Gb Available Physical Memory | 56.27% Memory free
7.18 Gb Paging File | 5.76 Gb Available in Paging File | 80.31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 114.30 Gb Total Space | 12.45 Gb Free Space | 10.89% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.99 Gb Free Space | 59.92% Space Free | Partition Type: NTFS
Drive E: | 2.84 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 63.94 Gb Total Space | 19.72 Gb Free Space | 30.85% Space Free | Partition Type: FAT32
Drive G: | 14.92 Gb Total Space | 12.82 Gb Free Space | 85.94% Space Free | Partition Type: FAT32
Drive H: | 44.53 Gb Total Space | 13.02 Gb Free Space | 29.24% Space Free | Partition Type: NTFS

Computer Name: DELL1720 | User Name: colin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/22 17:30:06 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\colin\Desktop\OTL.exe
PRC - [2012/07/05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/07/03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/05/14 11:28:22 | 006,149,120 | ---- | M] (FreeDownloadManager.ORG) -- C:\Program Files\Free Download Manager\fdm.exe
PRC - [2012/05/04 15:37:10 | 000,021,392 | ---- | M] () -- C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2012/05/04 15:37:00 | 003,521,424 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2010/12/08 14:31:06 | 000,628,736 | ---- | M] (Nokia) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
PRC - [2010/11/16 14:48:32 | 000,152,576 | ---- | M] (Nokia) -- C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2010/08/23 17:58:06 | 001,531,904 | ---- | M] (Nokia) -- C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
PRC - [2010/06/01 03:01:56 | 000,367,456 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
PRC - [2010/06/01 03:01:54 | 000,600,928 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
PRC - [2010/05/11 10:16:34 | 000,140,288 | ---- | M] (Nokia) -- C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
PRC - [2009/11/13 21:31:14 | 000,092,008 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2009/10/27 09:15:02 | 000,120,832 | ---- | M] (Nokia) -- C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
PRC - [2009/04/11 16:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/05/17 14:25:49 | 000,072,704 | ---- | M] (Creative Labs) -- C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
PRC - [2008/01/29 16:38:31 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2007/09/07 10:25:12 | 000,102,400 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\stacsv.exe
PRC - [2007/09/07 10:23:36 | 000,405,504 | ---- | M] (IDT, Inc.) -- C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
PRC - [2007/08/29 15:54:58 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM02Mon.exe
PRC - [2007/08/29 12:25:16 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEstSrv.exe
PRC - [2007/08/28 01:36:34 | 000,111,912 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\hnm_svc.exe
PRC - [2007/08/22 12:28:08 | 000,122,975 | ---- | M] () -- C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
PRC - [2007/08/22 12:28:06 | 000,278,611 | ---- | M] () -- C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
PRC - [2007/08/22 12:27:36 | 000,159,744 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerCinema\PCMService.exe
PRC - [2007/04/24 19:33:41 | 000,625,152 | ---- | M] () -- C:\Program Files\Gigabyte\RCApp\U7000RCApp.exe
PRC - [2007/04/18 14:48:18 | 000,050,736 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2007/04/18 13:31:58 | 000,159,744 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\Apoint.exe
PRC - [2007/01/11 21:15:00 | 000,101,136 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.exe
PRC - [2006/11/16 12:51:46 | 000,679,936 | ---- | M] (Logitech Inc.) -- C:\Program Files\SetPoint\SetPoint.exe
PRC - [2006/11/05 13:22:16 | 000,221,184 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2006/11/05 12:55:48 | 000,010,752 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006/11/03 19:55:50 | 000,703,280 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2006/11/03 19:55:48 | 001,583,920 | ---- | M] (Broadcom Corporation.) -- c:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2006/09/09 09:10:22 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\hidfind.exe
PRC - [2006/09/09 09:06:08 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApntEx.exe


========== Modules (No Company Name) ==========

MOD - [2012/07/22 11:05:46 | 000,115,137 | ---- | M] () -- C:\Users\colin\AppData\Local\temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll
MOD - [2012/07/17 18:29:11 | 013,198,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\d55bed00e3d36b0db5bd3994c77fe850\System.Windows.Forms.ni.dll
MOD - [2012/07/17 18:25:06 | 018,019,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\063174e87d258ef1db040cbfbdd4cd31\PresentationFramework.ni.dll
MOD - [2012/07/17 18:24:49 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\984f8802a334d2ae862b66bf71332c10\PresentationCore.ni.dll
MOD - [2012/07/17 18:24:38 | 003,881,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\697786bb51408d41d980263d90a56d03\WindowsBase.ni.dll
MOD - [2012/07/17 18:24:36 | 000,311,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d967cc1d136bda3aaa2ecd6699a6803a\PresentationFramework.Classic.ni.dll
MOD - [2012/07/17 18:20:20 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\9abdaeea6a61127606bbc324d9177579\System.Drawing.ni.dll
MOD - [2012/07/17 18:15:47 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0189f9fb0ff0476b570aeadfc036ddd6\System.Management.ni.dll
MOD - [2012/07/17 18:15:14 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\f91c92735c4a913143a0914c8cb531f2\System.Xaml.ni.dll
MOD - [2012/07/17 18:15:02 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\1a7c90bf70e6fef2970dd02ca5def39a\System.Runtime.Remoting.ni.dll
MOD - [2012/07/17 18:09:06 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\d131eefaea0ca120aaf11568d8e44cad\System.Configuration.ni.dll
MOD - [2012/07/17 18:09:01 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\500ffaf6258746eaf0bfc333ab534a51\System.Core.ni.dll
MOD - [2012/07/17 18:09:00 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b54a85f8f8f5ac297357c80b95834a90\System.Xml.ni.dll
MOD - [2012/07/17 18:08:54 | 009,092,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\360d70391adff56f1d029b1a538d2431\System.ni.dll
MOD - [2012/07/17 18:08:47 | 014,415,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\97d737762adec957a2d7c80fafb4703a\mscorlib.ni.dll
MOD - [2012/05/14 11:29:58 | 003,538,944 | ---- | M] () -- C:\Program Files\Free Download Manager\fdmbtsupp.dll
MOD - [2012/05/04 15:37:10 | 000,021,392 | ---- | M] () -- C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MOD - [2007/08/22 12:28:08 | 000,339,968 | ---- | M] () -- C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLTinyDB.dll
MOD - [2007/08/22 12:27:52 | 000,245,863 | ---- | M] () -- C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapEngine.dll
MOD - [2007/08/22 12:27:52 | 000,114,785 | ---- | M] () -- C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSchMgr.dll
MOD - [2007/08/22 12:27:52 | 000,032,768 | ---- | M] () -- C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvcps.dll
MOD - [2007/04/24 19:38:27 | 000,203,264 | ---- | M] () -- C:\Program Files\Gigabyte\RCApp\U7000HookDll.dll
MOD - [2007/04/24 19:33:41 | 000,625,152 | ---- | M] () -- C:\Program Files\Gigabyte\RCApp\U7000RCApp.exe
MOD - [2006/11/05 12:58:44 | 000,516,096 | ---- | M] () -- C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\LayoutDll9.dll
MOD - [2006/11/05 12:28:18 | 004,587,520 | R--- | M] () -- C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
MOD - [2006/11/03 19:25:56 | 000,389,120 | ---- | M] () -- C:\Windows\System32\btwhidcs.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (LiveUpdate Notice Ex)
SRV - [2012/07/12 19:26:03 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/07/03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/03/26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2011/10/15 16:07:53 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/12/25 09:29:35 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/12/08 14:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010/06/01 03:01:56 | 000,367,456 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2009/11/13 21:31:14 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2009/10/21 04:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2008/05/17 14:25:49 | 000,072,704 | ---- | M] (Creative Labs) [Auto | Running] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe -- (Creative Labs Licensing Service)
SRV - [2008/01/29 16:38:31 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2008/01/19 17:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/07 10:25:12 | 000,102,400 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV)
SRV - [2007/08/29 12:25:16 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEstSrv.exe -- (AESTFilters)
SRV - [2007/08/28 01:36:34 | 000,111,912 | ---- | M] (SingleClick Systems) [Auto | Running] -- C:\Program Files\Dell Network Assistant\hnm_svc.exe -- (hnmsvc)
SRV - [2007/08/22 12:28:08 | 000,122,975 | ---- | M] () [Auto | Running] -- C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2007/08/22 12:28:06 | 000,278,611 | ---- | M] () [Auto | Running] -- C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2007/03/19 14:44:44 | 000,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
 
========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\colin\AppData\Local\Temp\mfe_rr.sys -- (MFE_RR)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Auto | Stopped] -- C:\Windows\system32\drivers\ds1410d.sys -- (DS1410D)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/03/20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/12/08 14:22:26 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/12/08 14:22:26 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2011/12/08 14:22:26 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2011/10/14 15:13:26 | 000,061,312 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\silabser.sys -- (silabser)
DRV - [2011/10/14 15:13:26 | 000,047,176 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\silabenm.sys -- (silabenm)
DRV - [2011/02/04 08:27:50 | 000,195,968 | ---- | M] (Jungo) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\windrvr6.sys -- (WinDriver6)
DRV - [2010/12/21 15:55:02 | 000,132,424 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2010/12/21 15:55:02 | 000,104,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
DRV - [2010/12/21 15:55:02 | 000,014,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2010/07/30 14:16:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2010/07/30 14:16:44 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2010/07/30 14:16:42 | 000,023,040 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2010/07/30 14:16:38 | 000,018,048 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009/12/08 21:24:26 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- F:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys -- (VSPerfDrv100)
DRV - [2009/10/21 04:19:44 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2009/06/16 13:59:00 | 009,768,640 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/05/12 07:49:02 | 000,026,240 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmodusb.sys -- (dmodusb)
DRV - [2009/03/30 02:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\RsFx0103.sys -- (RsFx0103)
DRV - [2008/08/26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007/10/10 17:03:00 | 000,235,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Dev.sys -- (OEM02Dev)
DRV - [2007/09/26 08:12:00 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
DRV - [2007/09/07 09:26:04 | 000,330,240 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/08/29 15:55:06 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
DRV - [2007/07/13 14:07:00 | 000,543,232 | ---- | M] (DiBcom) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mod7700.sys -- (mod7700)
DRV - [2007/07/13 08:56:08 | 000,230,784 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\U6000ALL.sys -- (U6000ALL) U6000 TV Box(ALL)
DRV - [2007/07/11 12:06:22 | 000,013,824 | ---- | M] (DiBcom S.A.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\modrc.sys -- (MODRC)
DRV - [2007/06/20 19:44:24 | 000,360,704 | ---- | M] (Dvico, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bluebird2.sys -- (AvsBluebird)
DRV - [2007/05/19 07:12:12 | 000,016,000 | ---- | M] (Xilinx, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XPC4DRVR.SYS -- (XilinxPC4Driver)
DRV - [2007/04/13 10:02:56 | 000,157,184 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2007/02/25 14:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2007/01/11 21:15:16 | 000,032,528 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/01/11 21:15:06 | 000,032,272 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2006/12/18 20:01:20 | 000,012,672 | ---- | M] (SingleClick Systems) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\packet.sys -- (Packet)
DRV - [2006/11/27 17:48:46 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/11/27 17:48:44 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/27 17:48:44 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/21 22:25:44 | 000,045,568 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/11/02 17:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/11/02 17:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2006/10/05 19:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/08/05 10:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2004/05/31 16:20:04 | 000,003,200 | ---- | M] (Altium Limited) [Kernel | Auto | Running] -- C:\Program Files\Altium Designer Summer 09\System\Drivers\altio.sys -- (altio)
DRV - [2001/06/21 20:39:02 | 000,073,728 | ---- | M] (Rainbow Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SENTINEL.SYS -- (Sentinel)
DRV - [2001/06/21 20:39:02 | 000,020,032 | R--- | M] (Rainbow Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SNTNLUSB.SYS -- (Sntnlusb)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sea...&oe={outputEncoding}&sourceid=ie7&rlz=1I7DAAU


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
IE - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: MapShare-status@tomtom.com:1.7
FF - prefs.js..extensions.enabledItems: baseTheme@tomtom.com:1.0.2
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)


[2009/04/25 13:22:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\colin\AppData\Roaming\Mozilla\Extensions
[2009/04/25 13:22:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\colin\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
[2010/04/27 11:00:43 | 000,000,000 | ---D | M] (Map status indicator) -- C:\PROGRAM FILES\TOMTOM HOME 2\XUL\EXTENSIONS\MAPSHARE-STATUS@TOMTOM.COM

O1 HOSTS File: ([2012/07/22 11:03:32 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
O2 - BHO: (Microsoft Web Test Recorder 10.0 Helper) - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - F:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [PCMService] C:\Program Files\CyberLink\PowerCinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [RCApp] C:\Program Files\Gigabyte\RCApp\U7000RCApp.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe (FreeDownloadManager.ORG)
O4 - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000..\Run: [Steam] H:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3243999921-1978943613-2518992103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: Microsoft XML Parser for Java file:///C:/Windows/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.253
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F7FC2D68-1631-4B52-B2E1-9DA581A45F07}: DhcpNameServer = 192.168.1.253
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/19 07:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/11/03 06:00:00 | 000,000,043 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========

[2012/07/23 17:56:44 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\colin\Desktop\OTL.exe
[2012/07/23 17:43:46 | 000,000,000 | ---D | C] -- C:\Users\colin\AppData\Roaming\Malwarebytes
[2012/07/23 17:43:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/23 17:43:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/23 17:43:29 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/07/23 17:43:28 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/07/23 17:38:41 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/07/22 11:10:22 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/07/22 11:00:08 | 000,000,000 | ---D | C] -- C:\Users\colin\AppData\Local\temp
[2012/07/22 10:39:38 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/07/22 10:39:38 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/07/22 10:39:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/07/22 10:39:32 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/07/22 10:32:38 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/22 10:31:33 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/07/22 10:25:54 | 004,582,474 | R--- | C] (Swearware) -- C:\Users\colin\Desktop\ComboFix.exe
[2012/07/20 12:04:02 | 000,000,000 | ---D | C] -- C:\FRST
[2012/07/19 12:01:22 | 000,000,000 | ---D | C] -- C:\Windows\Microsoft Antimalware
[2012/07/17 20:18:08 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012/07/16 20:13:49 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2012/07/09 20:23:34 | 000,000,000 | ---D | C] -- C:\Downloads

========== Files - Modified Within 30 Days ==========

[2012/07/23 17:43:40 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/23 17:39:33 | 000,000,432 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2012/07/23 17:39:24 | 000,230,000 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012/07/23 17:39:10 | 000,230,000 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012/07/23 17:38:46 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/23 17:38:46 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/23 17:38:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/23 17:38:39 | 3756,195,840 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/22 19:51:59 | 000,003,204 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012/07/22 19:25:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/22 17:32:17 | 000,715,964 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/07/22 17:32:17 | 000,149,922 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/07/22 17:30:06 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\colin\Desktop\OTL.exe
[2012/07/22 11:03:32 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/07/22 10:24:28 | 004,582,474 | R--- | M] (Swearware) -- C:\Users\colin\Desktop\ComboFix.exe
[2012/07/19 17:14:52 | 000,464,512 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/07/17 20:19:28 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/07/14 07:32:47 | 000,000,703 | ---- | M] () -- C:\Windows\NewsRover.INI
[2012/07/09 17:25:21 | 000,007,808 | ---- | M] () -- C:\Users\colin\AppData\Local\d3d9caps.dat
[2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/07/01 16:28:12 | 000,000,485 | ---- | M] () -- C:\Windows\cedt.INI
[2012/06/29 18:00:44 | 000,000,100 | -H-- | M] () -- C:\Windows\mti_enc
[2012/06/29 18:00:44 | 000,000,007 | -H-- | M] () -- C:\Windows\mti_enc2

========== Files Created - No Company Name ==========

[2012/07/23 17:43:40 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/22 10:39:38 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/07/22 10:39:38 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/07/22 10:39:38 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/07/22 10:39:38 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/07/22 10:39:38 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/07/19 20:18:15 | 3756,195,840 | -HS- | C] () -- C:\hiberfil.sys
[2012/07/17 20:18:18 | 000,001,828 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/12/23 19:58:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011/09/12 18:07:17 | 000,093,683 | ---- | C] () -- C:\Windows\News Rover Uninstaller.exe
[2011/04/23 10:31:52 | 000,037,153 | ---- | C] () -- C:\Users\colin\AppData\Roaming\NMM-MetaData.db
[2011/03/20 08:44:33 | 000,071,187 | ---- | C] () -- C:\Users\colin\.compxlib.cfg
[2011/03/20 08:44:33 | 000,007,702 | ---- | C] () -- C:\Users\colin\compxlib.cfg
[2011/03/20 08:43:59 | 000,077,820 | ---- | C] () -- C:\Users\colin\modelsim.ini
[2011/03/20 08:42:50 | 000,000,070 | ---- | C] () -- C:\Users\colin\.cxl.mti_se.version
[2011/03/08 14:41:04 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011/03/08 14:41:04 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011/03/08 14:41:04 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011/03/08 14:41:04 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2010/11/13 16:17:48 | 000,000,426 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010/11/13 16:17:48 | 000,000,034 | ---- | C] () -- C:\Windows\System32\BD2150N.DAT
[2010/09/12 17:11:00 | 000,014,848 | ---- | C] () -- C:\Windows\System32\BASSMOD.dll
[2010/09/04 18:06:10 | 000,006,550 | ---- | C] () -- C:\Windows\jautoexp.dat
[2010/08/26 20:37:53 | 000,000,409 | ---- | C] () -- C:\Windows\MYOBP.INI
[2010/08/26 20:37:53 | 000,000,047 | ---- | C] () -- C:\Windows\MYOB.INI
[2010/08/26 20:29:30 | 000,000,663 | ---- | C] () -- C:\Windows\openrda.ini
[2010/08/26 20:29:11 | 000,000,000 | ---- | C] () -- C:\Windows\drvxl32.INI
[2010/08/26 20:29:10 | 000,000,000 | ---- | C] () -- C:\Windows\drvwd32.INI
[2010/08/23 21:05:28 | 000,000,485 | ---- | C] () -- C:\Windows\cedt.INI
[2009/06/14 09:39:04 | 000,230,000 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/06/14 09:39:00 | 000,230,000 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/06/05 19:36:12 | 000,007,808 | ---- | C] () -- C:\Users\colin\AppData\Local\d3d9caps.dat
[2007/11/20 19:28:57 | 000,054,133 | ---- | C] () -- C:\Users\colin\AppData\Roaming\nvModes.001
[2007/11/20 19:12:13 | 000,054,133 | ---- | C] () -- C:\Users\colin\AppData\Roaming\nvModes.dat
[2007/11/13 16:20:01 | 000,030,208 | ---- | C] () -- C:\Users\colin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== LOP Check ==========

[2011/12/23 15:55:23 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\AltiumDesignerSummer09
[2012/05/07 20:17:19 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\Digilent
[2012/07/23 18:08:20 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\Free Download Manager
[2009/06/05 20:18:22 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\GetRightToGo
[2009/12/11 20:14:50 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\HDI
[2011/07/10 14:04:06 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\Home Designer Suite 8.0
[2011/03/12 18:42:07 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\hte
[2010/11/21 19:30:23 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\Mathsoft
[2012/07/16 19:42:24 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\NewsRover
[2011/10/09 18:48:54 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\Nokia
[2011/04/23 10:27:30 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\PC Suite
[2012/02/15 16:56:37 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\Samsung
[2012/05/11 22:26:16 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\Temp
[2009/04/25 13:22:07 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\TomTom
[2012/03/10 18:53:39 | 000,000,000 | ---D | M] -- C:\Users\colin\AppData\Roaming\Xilinx
[2012/02/13 20:29:12 | 000,000,000 | ---D | M] -- C:\Users\Wiz\AppData\Roaming\PC Suite
[2012/07/22 19:51:59 | 000,032,614 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Xilinx:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Visual Studio 2010:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Visual Studio 2008:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\TS-L632H_D300[1]:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Tools:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\streamAcc.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Standards:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Sony PMB:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\SelfMV:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Sandra:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Models:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\MATLAB:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Linear-eqns-how-to.wxm[1]:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Letters:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Kerrs Lane:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Jobs:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Home Designer Suite 8.0 Data:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Farming:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Dell Webcam Center:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Climate Change:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\CFA:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Bridge Design:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Bluetooth Exchange Folder:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\00022AC1FC9202004501908EA8F7D2B0:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Desktop\vfeast.asx:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Desktop\Sandra N:Roxio EMC Stream
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:63238B95
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:BEB71B81
< End of report >
 
OTL Extras logfile created on: 23/07/2012 5:59:45 PM - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\colin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.50 Gb Total Physical Memory | 1.97 Gb Available Physical Memory | 56.27% Memory free
7.18 Gb Paging File | 5.76 Gb Available in Paging File | 80.31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 114.30 Gb Total Space | 12.45 Gb Free Space | 10.89% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.99 Gb Free Space | 59.92% Space Free | Partition Type: NTFS
Drive E: | 2.84 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 63.94 Gb Total Space | 19.72 Gb Free Space | 30.85% Space Free | Partition Type: FAT32
Drive G: | 14.92 Gb Total Space | 12.82 Gb Free Space | 85.94% Space Free | Partition Type: FAT32
Drive H: | 44.53 Gb Total Space | 13.02 Gb Free Space | 29.24% Space Free | Partition Type: NTFS

Computer Name: DELL1720 | User Name: colin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{198D5B3C-4E32-49E3-B684-1703E135B55C}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{408E209A-90DB-43F1-AB45-384318EEB9D1}" = rport=2869 | protocol=6 | dir=out | app=system |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{75C335AE-DA64-47E7-913A-DA162E5EDBE3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{82488B57-E22E-4621-9E72-277E46BCB55B}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A78D4C7F-B3EE-4A6D-A75D-577C37C24771}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C48BA89E-21FB-4CD3-9777-59F8786CF54F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DB41E836-6DC9-493A-B23D-C4511D32EDC4}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{E4DE62CE-4E27-4AF2-8F26-0E72CD3CC784}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{128A918E-404B-49C2-98D3-B77178BBEF6E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{2D63A072-EB90-4699-A7DA-ED26DC465E8C}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EC7D201C-4CED-4074-9DB9-C012778BE95D}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{F884D25D-3E90-4275-9C15-9C04C1AA9D22}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{7933BE26-03CA-4FB7-8D88-41E12BAC0BF7}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0240BDFB-2995-4A3F-8C96-18D41282B716}" = Dell Network Assistant
"{035400A4-29BD-3723-BEED-E2718A68CDE0}" = Microsoft Visual Studio 2010 Office Developer Tools (x86)
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{09C468CA-2940-466A-AAE8-DCC0C6E9323C}" = Nokia Software Updater
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B9E27C7-9ECD-4362-B311-030EA48F8E72}" = Crystal XI
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0DDCEC37-369C-484B-B16D-B4413FD42FB9}" = Microsoft SQL Server 2008 R2 Data-Tier Application Framework
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{0F95AA42-0FF6-4D48-9CA1-64C8D0777500}" = QuickSet
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{14AFE241-FC6E-4FDB-BCA0-7AD6F4974171}" = Adobe Setup
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{170DE2A7-4768-370C-9671-D8D17826EFBF}" = Microsoft Visual Studio 2010 Performance Collection Tools - ENU
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{196E77C5-F524-4B50-BD1A-2C21EEE9B8F7}" = Microsoft SQL Server 2008 Common Files
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar v1.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{205ACCD7-5342-4694-91F3-3A99E4FD5AA6}" = Mathcad 14 Help
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = PowerCinema
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 24
"{2A2F3AE8-246A-4252-BB26-1BEB45627074}" = Microsoft SQL Server System CLR Types
"{2D9FEBEE-F1B7-344F-BFDF-760E18332D96}" = Microsoft Visual Studio 2010 SharePoint Developer Tools
"{2E295B5B-1AD4-4d36-97C2-A316084722CF}" = Python 2.7.2
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = SetPoint
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{359FCAA7-B544-4147-AE3B-8C8A526E2427}" = Sony Image Data Suite
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}" = Dotfuscator Software Services - Community Edition
"{4216D328-0FE8-48B8-85B8-BD300E6F080F}" = Nokia Connectivity Cable Driver
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4815BD99-96A4-49FE-A885-DCF06E9E4E78}" = Microsoft SQL Server 2008 Database Engine Shared
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{49687D4B-FAB3-473D-B9D3-C180C53A8E4E}" = Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{4E968D9C-21A7-4915-B698-F7AEB913541D}" = Microsoft SQL Server 2008 R2 Management Objects
"{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}" = Microsoft SQL Server 2008 Native Client
"{53C6D09E-EAB6-49E5-BA4C-BA7FF13830FB}" = Sound Blaster Audigy ADVANCED MB
"{55D5A77E-FAAA-4358-B3E5-6565E024F78B}" = MYOB ODBC Direct v10 AUS
"{5783781E-60C1-4898-842F-FE48DA57A55A}" = MYOB AccountRight Enterprise v19 ED
"{58721EC3-8D4E-4B79-BC51-1054E2DDCD10}" = Microsoft SQL Server 2008 Database Engine Services
"{5A13987D-55F4-4271-A40E-76AC9B1B38FD}" = OpenOffice.org 3.2
"{5A37B181-B8D0-48C3-B4A4-5DC1ED104CED}" = VC9RunTime
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6283B16A-66AE-48F9-BCA5-9EABDAE1790B}" = MYOB Accounting Plus v18 ED
"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.30319
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6ED37A91-7710-3183-BE50-AB043FF6689E}" = Microsoft Team Foundation Server 2010 Object Model - ENU
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{76F9F5C5-FF87-4ED8-B63C-2A25A299C4AA}" = CVSNT 2.5.05.3744
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78C3657E-742C-40B1-9F53-E5A921D40F17}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}" = CDDRV_Installer
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{900792CC-3203-356C-EC2D-C3E558991ACE}" = Home Designer Suite 8
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9060B698-2B29-4A1F-B876-BEAC4C0A25D5}" = KhalSetup
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91FD3E1D-FE00-4ECB-8379-204704812A9D}" = Crystal10
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96D33319-C14C-3070-A464-CE8416E46487}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{97CE8B73-AA5A-4987-A1BE-50DD1A187478}" = Microsoft Sync Framework SDK v1.0 SP1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A659EC3-4252-4117-8E16-57D6343651F4}" = Gigabyte U8000 TV Card Driver
"{9A824ED3-387B-44ED-90CA-B58D5B8171AB}" = Gigabyte U7000 TV Card Remote Control Device
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9BF3C220-0401-4945-A46F-63AFE6F4C114}" = Altium Designer Summer 09
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}" = WIDCOMM Bluetooth Software 6.0.1.3100
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AB37A8EB-BEC1-49F2-841E-ABE3A426B749}" = Driver Install 32-bit
"{AB756389-9A03-44f3-ABAF-3699C01B4868}-Navman-7.30" = NavDesk 7.30
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC76BA86-7AD7-1033-7B44-A83000000003}" = Adobe Reader 8.3.0
"{AC76BA86-7AD7-2447-0000-800000000003}" = Chinese Simplified Fonts Support For Adobe Reader 8
"{AC76BA86-7AD7-5670-0000-800000000003}" = Korean Fonts Support For Adobe Reader 8
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services
"{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}" = PMB
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B857D868-F8B0-43EE-BC2B-D9E5ED21F237}" = Microsoft SQL Server VSS Writer
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BC0464FA-A0BA-3E38-85BF-DC5B3A401F48}" = Microsoft Visual Studio 2010 Ultimate - ENU
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C078C299-C2C2-4110-A6EF-8D5E66C228DA}" = e-tax 2011
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{C6DD625F-4B61-4561-8286-87CA0275CEA1}" = Microsoft Sync Framework Runtime v1.0 SP1 (x86)
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
"{C9DCF4E9-A41B-40E7-B028-2255E36D2A1C}" = TortoiseOverlays
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE1B03BC-3C99-4580-A2AC-A41DB9B83378}" = EasyWeather
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D1565BD9-6E66-4292-90C6-5FC70A98A428}" = MYOB ODBC Direct v8 AUS
"{D441BD04-E548-4F8E-97A4-1B66135BAAA8}" = Microsoft SQL Server 2008 Setup Support Files
"{D4AEC53C-1720-41D9-B6D7-6A60DE62D444}" = PC Connectivity Solution
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DC3D6AFB-78B4-489F-81D7-30B66E0C2417}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x86)
"{E4423F16-0E98-4855-BFF4-3EF016C55D67}" = Nokia_Multimedia_Common_Components_2_5
"{E5AE9031-79A5-4627-9641-BEFA82819B08}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E666A69B-A76D-43D5-AF28-4B2150A6EDE2}" = Mathcad 14
"{EBD38AE9-D52D-448D-9DB4-4D5F66E1DAFC}" = Mathcad 14 Resource Center
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EE7B9A8D-19F0-450D-8E94-3E391E6044CD}" = KhalSetup
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F38FD0E4-B991-462B-873D-F2115EADD093}" = Nokia PC Suite
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}" = mCore
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{F990B526-8F7C-46E0-B1F1-6C893A8B478F}" = Microsoft Sync Framework Services v1.0 SP1 (x86)
"{FBE569CA-BFEB-4E57-A674-F94D938E1AEF}" = e-tax 2010
"3ivx MPEG-4 5.0.2" = 3ivx MPEG-4 5.0.2 (remove only)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"6DA48AFDE796708D5A4C9121A83E7617A63A9A15" = Windows Driver Package - Nokia Modem (10/07/2010 4.6)
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe_acce07fd2c8fe7f9e3f26243e626578" = Adobe Dreamweaver CS4
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced Video FX Engine" = Advanced Video FX Engine
"CBF192A85B624E32B8D19ADEEF2DCFC5BC3AA73A" = Windows Driver Package - Nokia Modem (03/05/2008 3.7)
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"Crimson Editor SVN286" = Crimson Editor SVN286
"DeadlockDeinstKey" = Deadlock
"Dell Webcam Center" = Dell Webcam Center
"Dell Webcam Manager" = Dell Webcam Manager
"Digilent Software" = Digilent Software
"E092B2EBF2FFE83E896F8F7F829A7B5D7D1B2F9D" = Windows Driver Package - Nokia Modem (03/13/2008 6.86.0.1)
"E5372C32E8562C76C24DBA6525002B1031495F34" = Windows Driver Package - Nokia Modem (06/09/2010 7.01.0.8)
"Free Download Manager_is1" = Free Download Manager 3.9
"InstallShield_{55D5A77E-FAAA-4358-B3E5-6565E024F78B}" = MYOB ODBC Direct v10 AUS
"InstallShield_{5783781E-60C1-4898-842F-FE48DA57A55A}" = MYOB AccountRight Enterprise v19 ED
"InstallShield_{6283B16A-66AE-48F9-BCA5-9EABDAE1790B}" = MYOB Accounting Plus v18 ED
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{AB37A8EB-BEC1-49F2-841E-ABE3A426B749}" = Driver Install 32-bit
"InstallShield_{D1565BD9-6E66-4292-90C6-5FC70A98A428}" = MYOB ODBC Direct v8 AUS
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"MatlabR2010a" = MATLAB R2010a
"MentorGraphicsJI" = Mentor Graphics Products
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Microsoft Team Foundation Server 2010 Object Model - ENU" = Microsoft Team Foundation Server 2010 Object Model - ENU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"Microsoft Visual Studio 2010 Ultimate - ENU" = Microsoft Visual Studio 2010 Ultimate - ENU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"News Rover" = News Rover -- Usenet newsreader
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"ProInst" = Intel(R) PROSet/Wireless Software
"PROR" = Microsoft Office Professional 2007
"QuicktimeAlt_is1" = QuickTime Alternative 1.81
"Rainbow Sentinel Driver" = Sentinel System Driver
"Realterm" = Realterm
"Recover My Files_is1" = Recover My Files
"Steam App 400" = Portal
"TomTom HOME" = TomTom HOME 2.7.3.1894
"TortoiseCVS_is1" = TortoiseCVS 1.12.5
"VLC media player" = VLC media player 2.0.1
"WinMerge_is1" = WinMerge 2.6.4.0
"WinPcapInst" = WinPcap 4.1.1
"Xilinx ISE Design Suite 13.4" = Xilinx ISE Design Suite 13.4 (H:\Xilinx\13.4\ISE_DS)
"YTdetect" = Yahoo! Detect

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3243999921-1978943613-2518992103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"MyFreeCodec" = MyFreeCodec

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 25/04/2011 6:39:22 PM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 25/04/2011 6:39:26 PM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 27/04/2011 3:51:30 AM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 27/04/2011 3:51:35 AM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 29/04/2011 3:34:58 AM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 29/04/2011 3:35:13 AM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 29/04/2011 6:02:40 PM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 29/04/2011 6:02:57 PM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 30/04/2011 10:02:12 AM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 30/04/2011 10:02:20 AM | Computer Name = DELL1720 | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

[ OSession Events ]
Error - 11/04/2011 4:21:01 PM | Computer Name = DELL1720 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 52
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 21/07/2012 9:04:12 PM | Computer Name = DELL1720 | Source = Service Control Manager | ID = 7000
Description =

Error - 21/07/2012 9:04:48 PM | Computer Name = DELL1720 | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

Error - 21/07/2012 9:08:40 PM | Computer Name = DELL1720 | Source = Service Control Manager | ID = 7022
Description =

Error - 22/07/2012 3:24:24 AM | Computer Name = DELL1720 | Source = BTHUSB | ID = 327697
Description = The local Bluetooth adapter has failed in an undetermined manner and
will not be used. The driver has been unloaded.

Error - 23/07/2012 3:39:33 AM | Computer Name = DELL1720 | Source = ipnathlp | ID = 34001
Description = The ICS_IPV6 failed to configure IPv6 stack.

Error - 23/07/2012 3:39:33 AM | Computer Name = DELL1720 | Source = ipnathlp | ID = 30013
Description = The DHCP allocator has disabled itself on IP address 192.168.1.5,
since the IP address is outside the 192.168.137.0/255.255.255.0 scope from which
addresses are being allocated to DHCP clients. To enable the DHCP allocator on
this IP address, change the scope to include the IP address, or change the IP address
to fall within the scope.

Error - 23/07/2012 3:40:17 AM | Computer Name = DELL1720 | Source = Service Control Manager | ID = 7000
Description =

Error - 23/07/2012 3:41:37 AM | Computer Name = DELL1720 | Source = DCOM | ID = 10005
Description =

Error - 23/07/2012 3:41:37 AM | Computer Name = DELL1720 | Source = Service Control Manager | ID = 7009
Description =

Error - 23/07/2012 3:41:37 AM | Computer Name = DELL1720 | Source = Service Control Manager | ID = 7000
Description =


< End of report >
 
You didn't answer my question:
Any current issues?
Click to expand...

p4494882.gif


=====================================

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    Code: 
    :OTL
PRC - [2008/01/29 16:38:31 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (LiveUpdate Notice Ex)
SRV - [2008/01/29 16:38:31 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\colin\AppData\Local\Temp\mfe_rr.sys -- (MFE_RR)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
[2012/07/20 12:04:02 | 000,000,000 | ---D | C] -- C:\FRST
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Xilinx:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Visual Studio 2010:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Visual Studio 2008:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\TS-L632H_D300[1]:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Tools:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\streamAcc.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Standards:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Sony PMB:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\SelfMV:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Sandra:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Models:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\MATLAB:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Linear-eqns-how-to.wxm[1]:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Letters:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Kerrs Lane:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Jobs:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Home Designer Suite 8.0 Data:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Farming:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Dell Webcam Center:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Climate Change:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\CFA:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Bridge Design:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\Bluetooth Exchange Folder:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Documents\00022AC1FC9202004501908EA8F7D2B0:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Desktop\vfeast.asx:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\colin\Desktop\Sandra N:Roxio EMC Stream
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:63238B95
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:BEB71B81


:Services

:Reg

:Files
C:\Program Files\Common Files\Symantec Shared

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • You will get a log that shows the results of the fix. Please post it.

===========================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.
  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.


3. Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
  • Double click on TFC.exe to run the program.
  • Click on Start button to begin cleaning process.
  • TFC will close all running programs, and it may ask you to restart computer.


4. Please run a free online scan with the ESET Online Scanner

  • Disable your antivirus program
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • Accept any security warnings from your browser.
  • Check Scan archives
  • Click Start
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click on List of found threats
  • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • NOTE. If Eset won't find any threats, it won't produce any log.
 
Hi Broni, :), no issues so far, though I'm only using the computer to perform the anti-virus instructions you are providing. I will post the latest set of logs and when the ESET scan completes I will post its log, should it have one.
Regards,
Colin
 
All processes killed
========== OTL ==========
No active process named PIFSvc.exe was found!
Service LiveUpdate Notice Ex stopped successfully!
Service LiveUpdate Notice Ex deleted successfully!
File C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon not found.
Service LiveUpdate Notice Service stopped successfully!
Service LiveUpdate Notice Service deleted successfully!
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe moved successfully.
Service MFE_RR stopped successfully!
Service MFE_RR deleted successfully!
File C:\Users\colin\AppData\Local\Temp\mfe_rr.sys not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Symantec PIF AlertEng deleted successfully.
File C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
C:\FRST\Quarantine\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\U folder moved successfully.
C:\FRST\Quarantine\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\L folder moved successfully.
C:\FRST\Quarantine\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\{afbfdf34-a2fc-9fbd-7888-c72f895e632c} folder moved successfully.
C:\FRST\Quarantine\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\U folder moved successfully.
C:\FRST\Quarantine\{afbfdf34-a2fc-9fbd-7888-c72f895e632c}\L folder moved successfully.
C:\FRST\Quarantine\{afbfdf34-a2fc-9fbd-7888-c72f895e632c} folder moved successfully.
Folder move failed. C:\FRST\Quarantine scheduled to be moved on reboot.
C:\FRST\Logs folder moved successfully.
C:\FRST\Hives folder moved successfully.
C:\FRST folder moved successfully.
ADS C:\Users\colin\Documents\Xilinx:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Visual Studio 2010:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Visual Studio 2008:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\TS-L632H_D300[1]:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Tools:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\streamAcc.jpg:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Standards:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Sony PMB:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\SelfMV:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Sandra:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Models:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\MATLAB:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Linear-eqns-how-to.wxm[1]:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Letters:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Kerrs Lane:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Jobs:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Home Designer Suite 8.0 Data:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Farming:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Downloads:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Dell Webcam Center:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Climate Change:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\CFA:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Bridge Design:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\Bluetooth Exchange Folder:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Documents\00022AC1FC9202004501908EA8F7D2B0:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Desktop\vfeast.asx:Roxio EMC Stream deleted successfully.
ADS C:\Users\colin\Desktop\Sandra N:Roxio EMC Stream deleted successfully.
ADS C:\ProgramData\TEMP:63238B95 deleted successfully.
ADS C:\ProgramData\TEMP:BEB71B81 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\Common Files\Symantec Shared\SPManifests folder moved successfully.
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\Languages\09\01 folder moved successfully.
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\Languages\09 folder moved successfully.
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\Languages folder moved successfully.
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08} folder moved successfully.
C:\Program Files\Common Files\Symantec Shared\PIF folder moved successfully.
C:\Program Files\Common Files\Symantec Shared\CCPD-LC folder moved successfully.
C:\Program Files\Common Files\Symantec Shared folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: colin
->Temp folder emptied: 1146100 bytes
->Temporary Internet Files folder emptied: 31791391 bytes
->Java cache emptied: 37897522 bytes
->Flash cache emptied: 35742 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Wiz
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5286 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 68.00 mb


[EMPTYJAVA]

User: All Users

User: colin
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Public

User: Wiz
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: colin
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Public

User: Wiz

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.54.0 log created on 07242012_194944
Files\Folders moved on Reboot...
File\Folder C:\FRST\Quarantine not found!
C:\Users\colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\26S1E3F2\message[1].htm moved successfully.
PendingFileRenameOperations files...
File C:\FRST\Quarantine not found!
File C:\Users\colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat not found!
File C:\Users\colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\26S1E3F2\message[1].htm not found!
Registry entries deleted on Reboot...
 
You must log in or register to reply here.

Similar threads

midian182
Tim Cook says Android has 47 times more malware than iOS because of sideloading
2 3 4
Replies
80
Views
10K
Xallisto
Xallisto
William Gayde
Intel says 90 percent of CPUs have "received" Spectre and Meltdown patch (which is not...
Replies
8
Views
2K
john henry
J
midian182
70% of Washington DC's CCTV cameras were hit with ransomware in week leading up to inauguration
Replies
10
Views
1K
psycros
psycros

Latest posts

Back