Solved Internet Explorer not responding properly ... very slow!

piperca · Jan 4, 2011

IE is not running properly. It takes forever to search with Google or to browse the internet in general. I get a lot of "looking for about:blank" messages in the bottom left corner of IE when attempting to redirect to a different page. I have scanned for viruses/malware; however, I have not found any. I am running Vista Home Premium.

Attached is a current HJT log.

Broni · Jan 4, 2011

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

piperca · Jan 5, 2011

Here's the Malwarebytes log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5461

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

1/4/2011 8:57:15 PM
mbam-log-2011-01-04 (20-57-15).txt

Scan type: Quick scan
Objects scanned: 193705
Time elapsed: 6 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

piperca · Jan 5, 2011

Here's the GMER log:

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2011-01-04 21:03:58
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000064 SAMSUNG_ rev.ZZ10
Running: x6d5dlhn.exe; Driver: C:\Users\Andrew\AppData\Local\Temp\uglcrpob.sys

---- System - GMER 1.0.15 ----

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x90F44BAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0x90F449D2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0x90F44B0C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi \Device\Ide\IdePort0 86CB81F8
Device \Driver\atapi \Device\Ide\IdePort1 86CB81F8
Device \Driver\a2ppyosj \Device\Scsi\a2ppyosj1 88A4C1F8
Device \Driver\a2ppyosj \Device\Scsi\a2ppyosj1Port5Path0Target0Lun0 88A4C1F8
Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)
Device \FileSystem\Ntfs \Ntfs 86CBA1F8

AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- EOF - GMER 1.0.15 ----

piperca · Jan 5, 2011

Here's the DDS log:

DDS (Ver_10-12-12.02) - NTFSx86
Run by Andrew at 21:06:57.62 on Tue 01/04/2011
Internet Explorer: 8.0.6001.18999
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1643 [GMT -8:00]

AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k hpdevmgmt
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
C:\Windows\system32\java.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Secunia\PSI\PSIA.exe
C:\Program Files\SGPSA\ie3sh.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Garmin\gStart.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Secunia\PSI\psi_tray.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Common Files\Teleca Shared\logger.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\Secunia\PSI\sua.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Andrew\Desktop\dds.scr
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://ww2.cox.com/myconnection/orangecounty/home.cox
uSearch Page = hxxp://www.google.com
uSearch Bar = Preserve
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant =
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No File
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - No File
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {196C3A46-4758-433D-A600-802C804AF39C} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [gStart] c:\garmin\gStart.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KbdStub.EXE
mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe"
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [<NO NAME>]
mRun: [SnapfishMediaDetector] c:\program files\snapfish media detector\SnapfishMediaDetector.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\maxtor\schedule2\schedhlp.exe"
mRun: [LELA] "c:\program files\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [FBSSA] c:\program files\sgpsa\ie3sh.exe
mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Mobile Connectivity Suite] "c:\program files\htc\htc sync\application launcher\Application Launcher.exe" /startoptions
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi_tray.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} - hxxps://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9}
DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com/s/v/63.27/uploader2.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp3.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\andrew\appdata\roaming\mozilla\firefox\profiles\j04kxzjj.default\
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\andrew\appdata\roaming\facebook\npfbplugin_1_0_1.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2008-12-26 165584]
R1 DCDisk;DCDisk;c:\windows\system32\drivers\DCDisk.sys [2007-10-7 23040]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-11-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-11-23 74480]
R1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\drivers\SWIPsec.sys [2010-1-22 87064]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-26 17744]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2008-12-26 50768]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-4-10 40384]
R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-1-15 204800]
R2 MSSQL$MYMOVIES;SQL Server (MYMOVIES);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2009-5-27 29262680]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2010-12-21 987704]
R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2010-12-21 399416]
R2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\sonicwall\sonicwall global vpn client\SWGVCSvc.exe [2009-3-5 227352]
R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2010-11-30 2222376]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-4-10 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-4-10 40384]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [2010-3-12 30576]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
R3 rt70x86;Linksys Home Wireless-G USB Adaptor Driver;c:\windows\system32\drivers\netr70.sys [2010-4-27 306016]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-11-23 7408]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-28 135664]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-2 21504]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2010-10-19 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-22 1493352]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2009-6-10 24576]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\drivers\WUSB54GCx86.sys [2007-3-12 256000]
S3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\drivers\SWVNIC.sys [2009-3-4 21016]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2011-01-05 04:44:01 709456 ----a-w- c:\windows\isRS-000.tmp
2011-01-05 03:51:24 388096 ----a-r- c:\users\andrew\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-01-05 03:51:23 -------- d-----w- c:\program files\Trend Micro
2011-01-04 15:00:14 6273872 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{94652474-941b-4c84-b0f5-e7cbbf0080e3}\mpengine.dll
2011-01-01 07:16:21 -------- d-----w- c:\program files\iPod
2010-12-22 02:45:51 -------- d-----w- c:\users\andrew\appdata\local\Secunia PSI
2010-12-19 19:57:39 -------- d-----w- c:\program files\PhotoCardMaker
2010-12-16 05:28:56 916480 ----a-w- c:\windows\system32\wininet.dll

==================== Find3M ====================

2010-12-02 03:35:18 4280320 ----a-w- c:\windows\system32\GPhotos.scr
2010-11-30 01:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-30 01:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-04 18:56:07 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-11-04 18:55:38 352768 ----a-w- c:\windows\system32\taskschd.dll
2010-11-04 18:55:38 270336 ----a-w- c:\windows\system32\taskcomp.dll
2010-11-04 18:55:12 601600 ----a-w- c:\windows\system32\schedsvc.dll
2010-11-04 16:34:06 171520 ----a-w- c:\windows\system32\taskeng.exe
2010-11-02 05:57:41 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-02 05:57:27 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-11-02 05:57:11 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-11-02 05:57:11 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-11-02 05:01:31 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 04:26:10 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-11-02 04:24:44 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2010-10-28 15:44:56 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-10-28 13:27:47 292352 ----a-w- c:\windows\system32\atmfd.dll
2010-10-28 13:20:12 2048 ----a-w- c:\windows\system32\tzres.dll
2010-10-22 22:02:04 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-19 18:41:44 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-18 13:37:35 81920 ----a-w- c:\windows\system32\consent.exe
2010-10-18 13:31:24 2038272 ----a-w- c:\windows\system32\win32k.sys

============= FINISH: 21:08:18.22 ===============

piperca · Jan 5, 2011

Here's the Attach log:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 10/6/2007 6:51:23 PM
System Uptime: 1/4/2011 8:45:10 PM (1 hours ago)

Motherboard: ECS | | Nettle2
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+ | Socket AM2 | 2600/201mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 364 GiB total, 194.139 GiB free.
D: is FIXED (NTFS) - 9 GiB total, 1 GiB free.
E: is CDROM (CDFS)
H: is Removable
I: is Removable
J: is Removable
K: is CDROM ()
L: is Removable

==== Disabled Device Manager Items =============

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: SonicWALL Virtual NIC
Device ID: ROOT\SWVNIC\0000
Manufacturer: SonicWALL
Name: SonicWALL Virtual NIC
PNP Device ID: ROOT\SWVNIC\0000
Service: SWVNIC

==== System Restore Points ===================

==== Installed Programs ======================

32 Bit HP CIO Components Installer
Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
ActivePerl 5.10.1 Build 1007
Adobe AIR
Adobe Color Common Settings
Adobe ExtendScript Toolkit 2
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.1
Adobe Setup
Adobe Shockwave Player 11.5
AIO_CDA_ProductContext
AIO_CDA_Software
AIO_Scan
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audacity 1.3.7 (Unicode)
Auslogics Disk Defrag
avast! Free Antivirus
AviSynth 2.5
Bonjour
BufferChm
C5100
c5100_Help
Canon RAW Image Task for ZoomBrowser EX
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities MyCamera
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
CCleaner
CDBurnerXP
Copy
Coupon Printer for Windows
CustomerResearchQFolder
D3DX10
Destination Component
DeviceDiscovery
DeviceManagementQFolder
Disney Toontown Online
DivX Plus Web Player
DocProc
DocProcQFolder
DVDFab 6.2.0.5 (11/11/2009)
eMule
Enermax
Enhanced Multimedia Keyboard Solution
Eraser
eReg
eSupportQFolder
Facebook Plug-In
Fax
ffdshow [rev 1723] [2007-12-24]
Garmin Communicator Plugin
Garmin Training Center
Garmin USB Drivers
Garmin WebUpdater
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
GDR 4053 for SQL Server Tools and Workstation Components 2005 ENU (KB970892)
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hardware Diagnostic Tools
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Advisor
HP Customer Experience Enhancements
HP Customer Feedback
HP Customer Participation Program 8.0
HP Driver Diagnostics
HP Easy Setup - Frontend
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP On-Screen Cap/Num/Scroll Lock Indicator
HP Photosmart Essential
HP Photosmart Essential 2.0
HP Photosmart Essential2.5
HP Photosmart.All-In-One Driver Software 8.0 .A
HP Picasso Media Center Add-In
HP Product Assistant
HP Product Detection
HP Solution Center 8.0
HP Update
HPProductAssistant
HPSSupply
HTC Driver Installer
HTC Sync
InterActual Player
iTunes
Java Auto Updater
Java(TM) 6 Update 22
Junk Mail filter update
KhalInstallWrapper
LightScribe 1.4.142.1
Linksys EasyLink Advisor
Linksys Updater
Logitech SetPoint 6.15
Malwarebytes' Anti-Malware
MarketResearch
Memorex exPressit Label Design Studio
Microsoft .NET Compact Framework 2.0 SP1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Corporation
Microsoft IntelliPoint 6.2
Microsoft LifeCam
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Live Add-in 1.5
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional 2007
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Outlook Personal Folders Backup
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server 2005 Express Edition (MYMOVIES)
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
MobileMe Control Panel
Mozilla Firefox (3.6.13)
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 6.0
My HP Games
My Movies for Windows Media Center
NetDeviceManager
NVIDIA Drivers
OGA Notifier 2.0.0048.0
Omron Health Management Software
PhotoCardMaker 1.0.3
Picasa 3
PSSWCORE
Pure Networks Platform
Python 2.4.3
QuickTime
Realtek High Definition Audio Driver
Revo Uninstaller 1.88
Rhapsody Player Engine
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Samsung Master
Samsung USB Driver
Scan
Secunia PSI (2.0.0.1003)
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB2288953)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Segoe UI
Shanghai Dynasty
Shop for HP Supplies
Skype web features
Skype™ 4.2
Snapfish Media Detector
Soft Data Fax Modem with SmartCP
SolutionCenter
SonicWALL Global VPN Client
Sony DVD Architect Studio 4.5
Spelling Dictionaries Support For Adobe Reader 9
SportTracks 2.1
SportTracks 3.0
Status
SUPERAntiSpyware Free Edition
Switch
System Requirements Lab
TeamViewer 6
Toolbox
TrayApp
Unity Web Player
UnloadSupport
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2466076)
VC80CRTRedist - 8.0.50727.4053
Vegas Movie Studio Platinum 9.0
Virtual Earth 3D (Beta)
WebIQ Technology Engine
WebReg
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Mobile Device Center
Windows Mobile Device Center Driver Update
WinRAR archiver
Wizard101
Yahoo! Toolbar
Zune
Zune Language Pack (ES)
Zune Language Pack (FR)

==== End Of File ===========================

piperca · Jan 5, 2011

Okay, I think that is it. Please let me know if I've missed something.

Thanks for your help!

Broni · Jan 5, 2011

Sure thing

Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
Enter N to exit.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

========================================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

piperca · Jan 5, 2011

MBRcheck log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: ECS
BIOS Manufacturer: Phoenix Technologies, LTD
System Manufacturer: HP-Pavilion
System Product Name: GC671AAR-ABA a6130n
Logical Drives Mask: 0x00000f9c

Kernel Drivers (total 171):
0x83840000 \SystemRoot\system32\ntkrnlpa.exe
0x8380D000 \SystemRoot\system32\hal.dll
0x80405000 \SystemRoot\system32\kdcom.dll
0x8040C000 \SystemRoot\system32\PSHED.dll
0x8041D000 \SystemRoot\system32\BOOTVID.dll
0x80425000 \SystemRoot\system32\CLFS.SYS
0x80466000 \SystemRoot\system32\CI.dll
0x80546000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C2000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80606000 \SystemRoot\System32\Drivers\spfu.sys
0x80706000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x8070F000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x80735000 \SystemRoot\system32\drivers\acpi.sys
0x8077B000 \SystemRoot\system32\drivers\msisadrv.sys
0x80783000 \SystemRoot\system32\drivers\pci.sys
0x807AA000 \SystemRoot\System32\drivers\partmgr.sys
0x807B9000 \SystemRoot\system32\drivers\volmgr.sys
0x83E0F000 \SystemRoot\System32\drivers\volmgrx.sys
0x83E59000 \SystemRoot\system32\drivers\pciide.sys
0x83E60000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x83E6E000 \SystemRoot\System32\drivers\mountmgr.sys
0x83E7E000 \SystemRoot\system32\drivers\atapi.sys
0x83E86000 \SystemRoot\system32\drivers\ataport.SYS
0x83EA4000 \SystemRoot\system32\drivers\nvstor32.sys
0x83EC1000 \SystemRoot\system32\drivers\storport.sys
0x83F02000 \SystemRoot\system32\drivers\fltmgr.sys
0x83F34000 \SystemRoot\system32\drivers\fileinfo.sys
0x83F44000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x83F4D000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8B80A000 \SystemRoot\system32\drivers\ndis.sys
0x8B915000 \SystemRoot\system32\drivers\msrpc.sys
0x8B940000 \SystemRoot\system32\drivers\NETIO.SYS
0x8BA01000 \SystemRoot\System32\drivers\tcpip.sys
0x8BAEB000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8BC0E000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8BD1E000 \SystemRoot\system32\drivers\volsnap.sys
0x8BD57000 \SystemRoot\System32\Drivers\spldr.sys
0x8BD5F000 \SystemRoot\System32\Drivers\mup.sys
0x8BD6E000 \SystemRoot\System32\drivers\ecache.sys
0x8BD95000 \SystemRoot\system32\drivers\disk.sys
0x8BDA6000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x8BDC7000 \SystemRoot\system32\drivers\crcdisk.sys
0x8BDE7000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8BDF2000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8BB23000 \SystemRoot\system32\DRIVERS\amdk8.sys
0x8BC00000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8BB33000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8BB71000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8BB80000 \SystemRoot\system32\DRIVERS\HSXHWBS2.sys
0x8BBCC000 \SystemRoot\system32\DRIVERS\ks.sys
0x8FC05000 \SystemRoot\system32\DRIVERS\HSX_DP.sys
0x8FD07000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8FDBC000 \SystemRoot\system32\drivers\modem.sys
0x8FDC9000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8FDD9000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8FE0C000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8FE99000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
0x8FF99000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8FFB1000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0x90205000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x90B5D000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x90B5F000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8FFB7000 \SystemRoot\System32\drivers\watchdog.sys
0x8FFC3000 \SystemRoot\System32\Drivers\a2ppyosj.SYS
0x8B97B000 \SystemRoot\system32\DRIVERS\dne2000.sys
0x8B99A000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8FE00000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8FDE7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8B9C9000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8B9D4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x83FBE000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x83FCD000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x83FE1000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x83E00000 \SystemRoot\System32\Drivers\pcouffin.sys
0x807C8000 \SystemRoot\system32\DRIVERS\termdd.sys
0x807D8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x807E3000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x90200000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8BBF6000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x807EE000 \SystemRoot\system32\DRIVERS\umbus.sys
0x90E09000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x90E3E000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x91001000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x9129E000 \SystemRoot\system32\drivers\portcls.sys
0x912CB000 \SystemRoot\system32\drivers\drmk.sys
0x912F0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x912F9000 \SystemRoot\System32\Drivers\Null.SYS
0x91300000 \SystemRoot\System32\Drivers\Beep.SYS
0x91323000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x9132A000 \SystemRoot\System32\drivers\vga.sys
0x91336000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x91357000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x9136E000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x91370000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x91378000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x91381000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x91391000 \SystemRoot\system32\drivers\rdpencdd.sys
0x91399000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x913A1000 \SystemRoot\System32\Drivers\Msfs.SYS
0x913AC000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x913B5000 \SystemRoot\System32\Drivers\Npfs.SYS
0x913C3000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x913CB000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x913D4000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x913DC000 \??\C:\Windows\system32\Drivers\SWIPsec.sys
0x91307000 \SystemRoot\system32\DRIVERS\tdx.sys
0x913F4000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x9160E000 \SystemRoot\system32\DRIVERS\kl1.sys
0x91B2D000 \SystemRoot\system32\DRIVERS\netr70.sys
0x91B7C000 \SystemRoot\system32\DRIVERS\smb.sys
0x91B90000 \SystemRoot\system32\drivers\afd.sys
0x91BD8000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x90E4F000 \SystemRoot\System32\DRIVERS\netbt.sys
0x91BDD000 \SystemRoot\system32\DRIVERS\pacer.sys
0x91600000 \SystemRoot\system32\DRIVERS\netbios.sys
0x90E81000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x90E94000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
0x91BF3000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0x90EB9000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x90EF5000 \SystemRoot\system32\drivers\nsiproxy.sys
0x90EFF000 \SystemRoot\System32\Drivers\dfsc.sys
0x90F16000 \SystemRoot\System32\Drivers\DCDisk.SYS
0x90F25000 \SystemRoot\System32\Drivers\nx6000.sys
0x90F2F000 \SystemRoot\System32\Drivers\aswSP.SYS
0x90F56000 \SystemRoot\System32\Drivers\usbvideo.sys
0x90F77000 \SystemRoot\system32\drivers\usbaudio.sys
0x90F89000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x90F9E000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x90FB4000 \SystemRoot\System32\Drivers\crashdmp.sys
0x90FC1000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x90FCB000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
0x9C6B0000 \SystemRoot\System32\win32k.sys
0x90FE8000 \SystemRoot\System32\drivers\Dxapi.sys
0x8BDD0000 \SystemRoot\system32\DRIVERS\monitor.sys
0x9C8D0000 \SystemRoot\System32\TSDDD.dll
0x9C8F0000 \SystemRoot\System32\cdd.dll
0x9C900000 \SystemRoot\System32\ATMFD.DLL
0x8BB06000 \SystemRoot\system32\drivers\luafv.sys
0x81406000 \??\C:\Windows\system32\drivers\aswMonFlt.sys
0x8143D000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0x81448000 \SystemRoot\system32\drivers\spsys.sys
0x814F8000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x81508000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x81532000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8153C000 \SystemRoot\system32\DRIVERS\pnarp.sys
0x81546000 \SystemRoot\system32\DRIVERS\purendis.sys
0x81550000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x81563000 \SystemRoot\system32\drivers\HTTP.sys
0x815D0000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x805CF000 \SystemRoot\system32\DRIVERS\bowser.sys
0x805E8000 \SystemRoot\System32\drivers\mpsdrv.sys
0xA2C01000 \SystemRoot\system32\drivers\mrxdav.sys
0xA2C22000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA2C41000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xA2C7A000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA2C92000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA2CBA000 \SystemRoot\System32\DRIVERS\srv.sys
0xA2D08000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xA2D0C000 \SystemRoot\system32\drivers\peauth.sys
0xA2DEA000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA2DF4000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB4C07000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0xB4C1C000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0xB4C2E000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xB4C36000 \SystemRoot\system32\DRIVERS\psi_mf.sys
0xB4C39000 \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
0xB4C46000 \??\C:\Users\Andrew\AppData\Local\Temp\uglcrpob.sys
0xB4C5E000 \??\C:\Users\Andrew\AppData\Local\Temp\mbr.sys
0xB4C65000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x779B0000 \Windows\System32\ntdll.dll
0x10000000 \Program Files\DAEMON Tools Lite\daemon.dll

Processes (total 110):
0 System Idle Process
4 System
576 C:\Windows\System32\smss.exe
644 csrss.exe
696 C:\Windows\System32\wininit.exe
708 csrss.exe
740 C:\Windows\System32\services.exe
756 C:\Windows\System32\lsass.exe
764 C:\Windows\System32\lsm.exe
844 C:\Windows\System32\winlogon.exe
944 C:\Windows\System32\svchost.exe
1008 C:\Windows\System32\nvvsvc.exe
1040 C:\Windows\System32\svchost.exe
1100 C:\Windows\System32\svchost.exe
1212 C:\Windows\System32\svchost.exe
1252 C:\Windows\System32\svchost.exe
1264 C:\Windows\System32\svchost.exe
1340 C:\Windows\System32\audiodg.exe
1364 C:\Windows\System32\svchost.exe
1388 C:\Windows\System32\SLsvc.exe
1412 C:\Windows\System32\svchost.exe
1532 C:\Windows\System32\nvvsvc.exe
1624 C:\Windows\System32\svchost.exe
1780 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
316 C:\Windows\System32\spoolsv.exe
568 C:\Windows\System32\svchost.exe
596 C:\Windows\System32\taskeng.exe
1572 C:\Windows\System32\dwm.exe
2068 C:\Windows\System32\taskeng.exe
2084 C:\Windows\explorer.exe
2444 C:\Program Files\Windows Defender\MSASCui.exe
2464 C:\hp\support\hpsysdrv.exe
2584 C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
2604 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2644 C:\Program Files\Bonjour\mDNSResponder.exe
2656 C:\Windows\System32\svchost.exe
2688 C:\Windows\System32\svchost.exe
2720 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2796 C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
2888 C:\Program Files\Microsoft LifeCam\MSCamS32.exe
2904 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
2932 C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
2944 C:\Windows\System32\svchost.exe
2980 C:\Windows\System32\svchost.exe
2988 C:\Windows\RtHDVCpl.exe
3000 C:\Windows\System32\svchost.exe
3028 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
3044 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
3060 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
3072 C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
3096 C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
3104 C:\Windows\System32\java.exe
3212 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
3220 C:\Program Files\Secunia\PSI\psia.exe
3240 C:\Program Files\SGPSA\ie3sh.exe
3268 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
3316 C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe
3668 C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
3892 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
3912 C:\Program Files\Logitech\SetPointP\SetPoint.exe
3952 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3968 C:\Program Files\iTunes\iTunesHelper.exe
3984 C:\Windows\ehome\ehtray.exe
4012 C:\Garmin\gStart.exe
4032 C:\Windows\ehome\ehmsas.exe
4048 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
2280 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
2248 C:\Program Files\Skype\Phone\Skype.exe
2148 C:\Windows\System32\svchost.exe
904 C:\Program Files\Windows Media Player\wmpnscfg.exe
2492 C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
2964 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
3020 C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
3548 C:\Windows\System32\svchost.exe
3572 C:\Program Files\Secunia\PSI\psi_tray.exe
3964 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
2168 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
2288 C:\Windows\System32\SearchIndexer.exe
1396 C:\Windows\System32\mobsync.exe
2860 WUDFHost.exe
1448 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
4496 C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
4784 C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
4836 C:\Program Files\Common Files\Teleca Shared\logger.exe
4916 C:\hp\KBD\kbd.exe
5156 C:\Program Files\Common Files\Teleca Shared\Generic.exe
5332 C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
5344 C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
5656 C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
5764 C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
5804 C:\Windows\System32\svchost.exe
6028 C:\Windows\System32\svchost.exe
1652 C:\Program Files\Windows Media Player\wmpnetwk.exe
1476 C:\Program Files\iPod\bin\iPodService.exe
5512 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
4436 C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
2328 C:\Program Files\Secunia\PSI\sua.exe
4316 C:\Program Files\Common Files\Java\Java Update\jucheck.exe
2224 C:\Windows\System32\wbem\unsecapp.exe
3112 WmiPrvSE.exe
5956 C:\Windows\System32\ctfmon.exe
5928 C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE
3740 C:\Program Files\HTC\HTC Sync\Sync Manager\SyncIndicator.exe
3396 C:\Program Files\Internet Explorer\iexplore.exe
920 C:\Program Files\Internet Explorer\iexplore.exe
5996 C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
2400 C:\Program Files\Internet Explorer\iexplore.exe
4320 C:\Windows\System32\SearchProtocolHost.exe
3716 C:\Windows\System32\SearchFilterHost.exe
2828 C:\Users\Andrew\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000005a`ef3f7600 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHD400LJ, Rev: ZZ10

Size Device Name MBR Status
--------------------------------------------
372 GB \\.\PhysicalDrive0 Hewlett-Packard MBR code detected
SHA1: 161E5DF10EB9B6EAC4AA8DF99305EF77B11BEBD8

Done!

piperca · Jan 5, 2011

Combofix log:

ComboFix 11-01-04.04 - Andrew 01/04/2011 21:52:03.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1511 [GMT -8:00]
Running from: c:\users\Andrew\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\SGPSA
c:\program files\SGPSA\BHO.dll
c:\program files\SGPSA\ie3sh.exe
c:\users\Andrew\AppData\Roaming\inst.exe
c:\users\Public\RemoveSGP.exe
c:\windows\system32\drivers\OCA_LOG.TXT
c:\windows\system32\MSVBVM60.$$A

.
((((((((((((((((((((((((( Files Created from 2010-12-05 to 2011-01-05 )))))))))))))))))))))))))))))))
.

2011-01-05 06:02 . 2011-01-05 06:02 -------- d-----w- c:\users\Andrew\AppData\Local\temp
2011-01-05 06:02 . 2011-01-05 06:02 -------- d-----w- c:\users\Lilly\AppData\Local\temp
2011-01-05 04:44 . 2011-01-05 04:44 709456 ----a-w- c:\windows\isRS-000.tmp
2011-01-05 03:51 . 2011-01-05 03:51 388096 ----a-r- c:\users\Andrew\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-01-05 03:51 . 2011-01-05 03:51 -------- d-----w- c:\program files\Trend Micro
2011-01-04 15:00 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94652474-941B-4C84-B0F5-E7CBBF0080E3}\mpengine.dll
2011-01-01 07:16 . 2011-01-01 07:16 -------- d-----w- c:\program files\iPod
2010-12-22 03:30 . 2010-12-22 03:30 -------- d-----w- c:\program files\QuickTime
2010-12-22 02:45 . 2010-12-22 02:45 -------- d-----w- c:\users\Andrew\AppData\Local\Secunia PSI
2010-12-19 19:57 . 2010-12-19 19:57 -------- d-----w- c:\program files\PhotoCardMaker
2010-12-16 05:28 . 2010-11-02 06:03 638232 ----a-w- c:\program files\Internet Explorer\iexplore.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 02:09 . 2008-12-27 01:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 02:08 . 2008-12-27 01:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\system32\GPhotos.scr
2010-11-30 01:38 . 2010-11-30 01:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-30 01:38 . 2010-11-30 01:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-10-22 22:02 . 2010-10-22 22:02 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-19 18:41 . 2009-10-03 15:13 222080 ------w- c:\windows\system32\MpSigStub.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-16 39408]
"gStart"="c:\garmin\gStart.exe" [2008-08-13 1891416]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-23 2001648]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26194728]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"SnapfishMediaDetector"="c:\program files\Snapfish Media Detector\SnapfishMediaDetector.exe" [2007-03-02 1441792]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Maxtor\Schedule2\schedhlp.exe" [2007-08-09 148760]
"LELA"="c:\program files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe" [2008-05-01 131072]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-04-09 648504]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-03-13 119152]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-30 13797992]
"Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" [2009-11-19 598016]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-14 421160]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2010-12-21 291896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Enermax.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Enermax.lnk
backup=c:\windows\pss\Enermax.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
2007-07-28 21:05 277328 ----a-w- c:\program files\Eraser\Eraser.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
2009-08-26 19:38 122368 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
2007-05-31 16:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1001]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 135664]
R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-01-15 204800]
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-06-10 24576]
R3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\DRIVERS\WUSB54GCx86.sys [2007-03-12 256000]
R3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\DRIVERS\swvnic.sys [2009-03-05 21016]
R3 ttermdd;ttermdd;c:\users\Andrew\AppData\Local\Temp\ttermdd.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-11-21 717296]
S1 aswSP;aswSP; [x]
S1 DCDisk;DCDisk; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-11-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-11-23 74480]
S1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\Drivers\SWIPsec.sys [2009-03-06 87064]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S2 MSSQL$MYMOVIES;SQL Server (MYMOVIES);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2010-12-21 987704]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2010-12-21 399416]
S2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe [2009-03-06 227352]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2010-11-30 2222376]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-03-13 30576]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
S3 rt70x86;Linksys Home Wireless-G USB Adaptor Driver;c:\windows\system32\DRIVERS\netr70.sys [2010-04-27 306016]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-11-23 7408]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - UGLCRPOB
*Deregistered* - uglcrpob

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2011-01-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-11-07 03:19]

2011-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 18:40]

2011-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 18:40]

2011-01-04 c:\windows\Tasks\User_Feed_Synchronization-{30A0782B-8CD6-4FEA-AFA6-7DAAE2E1E03A}.job
- c:\windows\system32\msfeedssync.exe [2010-12-16 04:25]

2011-01-05 c:\windows\Tasks\User_Feed_Synchronization-{8D9F3B64-1F15-4366-BE8C-370FFD9B6EEA}.job
- c:\windows\system32\msfeedssync.exe [2010-12-16 04:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://ww2.cox.com/myconnection/orangecounty/home.cox
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab
FF - ProfilePath - c:\users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\j04kxzjj.default\
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
WebBrowser-{196C3A46-4758-433D-A600-802C804AF39C} - (no file)
HKLM-Run-FBSSA - c:\program files\SGPSA\ie3sh.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-04 22:02
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
FBSSA = c:\program files\SGPSA\ie3sh.exe?et Explorer\URLSearchHooks?????????17.js??????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-01-04 22:07:34
ComboFix-quarantined-files.txt 2011-01-05 06:07

Pre-Run: 208,253,411,328 bytes free
Post-Run: 208,586,145,792 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,11
- - End Of File - - D07F96209613FB842E0783597735696F

piperca · Jan 5, 2011

Okay, waiting for further instruction ...

Broni · Jan 5, 2011

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File::
c:\users\Andrew\AppData\Local\Temp\ttermdd.sys


Folder::
c:\program files\SGPSA

Driver::
ttermdd


Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
FBSSA =-

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

piperca · Jan 5, 2011

Here's the new Combofix log:

ComboFix 11-01-05.01 - Andrew 01/05/2011 16:25:12.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1566 [GMT -8:00]
Running from: c:\users\Andrew\Desktop\ComboFix.exe
Command switches used :: c:\users\Andrew\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FILE ::
"c:\users\Andrew\AppData\Local\Temp\ttermdd.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ttermdd

((((((((((((((((((((((((( Files Created from 2010-12-06 to 2011-01-06 )))))))))))))))))))))))))))))))
.

2011-01-06 00:36 . 2011-01-06 00:36 -------- d-----w- c:\users\Lilly\AppData\Local\temp
2011-01-06 00:36 . 2011-01-06 00:36 -------- d-----w- c:\users\Lilly.Andrew-PC\AppData\Local\temp
2011-01-06 00:36 . 2011-01-06 00:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-06 00:36 . 2011-01-06 00:36 -------- d-----w- c:\users\Cathie\AppData\Local\temp
2011-01-05 06:07 . 2011-01-06 00:40 -------- d-----w- c:\users\Andrew\AppData\Local\temp
2011-01-05 03:51 . 2011-01-05 03:51 388096 ----a-r- c:\users\Andrew\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-01-05 03:51 . 2011-01-05 03:51 -------- d-----w- c:\program files\Trend Micro
2011-01-04 15:00 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94652474-941B-4C84-B0F5-E7CBBF0080E3}\mpengine.dll
2011-01-01 07:16 . 2011-01-01 07:16 -------- d-----w- c:\program files\iPod
2010-12-22 03:30 . 2010-12-22 03:30 -------- d-----w- c:\program files\QuickTime
2010-12-22 02:45 . 2010-12-22 02:45 -------- d-----w- c:\users\Andrew\AppData\Local\Secunia PSI
2010-12-19 19:57 . 2010-12-19 19:57 -------- d-----w- c:\program files\PhotoCardMaker
2010-12-16 05:28 . 2010-11-02 06:03 638232 ----a-w- c:\program files\Internet Explorer\iexplore.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 02:09 . 2008-12-27 01:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 02:08 . 2008-12-27 01:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\system32\GPhotos.scr
2010-11-30 01:38 . 2010-11-30 01:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-30 01:38 . 2010-11-30 01:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-10-22 22:02 . 2010-10-22 22:02 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-19 18:41 . 2009-10-03 15:13 222080 ------w- c:\windows\system32\MpSigStub.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-16 39408]
"gStart"="c:\garmin\gStart.exe" [2008-08-13 1891416]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-23 2001648]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26194728]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"SnapfishMediaDetector"="c:\program files\Snapfish Media Detector\SnapfishMediaDetector.exe" [2007-03-02 1441792]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Maxtor\Schedule2\schedhlp.exe" [2007-08-09 148760]
"LELA"="c:\program files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe" [2008-05-01 131072]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-04-09 648504]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-03-13 119152]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-30 13797992]
"Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" [2009-11-19 598016]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-14 421160]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2010-12-21 291896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Enermax.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Enermax.lnk
backup=c:\windows\pss\Enermax.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
2007-07-28 21:05 277328 ----a-w- c:\program files\Eraser\Eraser.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
2009-08-26 19:38 122368 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
2007-05-31 16:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1001]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 135664]
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-06-10 24576]
R3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\system32\DRIVERS\WUSB54GCx86.sys [2007-03-12 256000]
R3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\DRIVERS\swvnic.sys [2009-03-05 21016]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-11-21 717296]
S1 aswSP;aswSP; [x]
S1 DCDisk;DCDisk; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-11-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-11-23 74480]
S1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\Drivers\SWIPsec.sys [2009-03-06 87064]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-01-15 204800]
S2 MSSQL$MYMOVIES;SQL Server (MYMOVIES);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2010-12-21 987704]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2010-12-21 399416]
S2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe [2009-03-06 227352]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2010-11-30 2222376]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-03-13 30576]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
S3 rt70x86;Linksys Home Wireless-G USB Adaptor Driver;c:\windows\system32\DRIVERS\netr70.sys [2010-04-27 306016]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-11-23 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2011-01-06 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-11-07 03:19]

2011-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 18:40]

2011-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 18:40]

2011-01-06 c:\windows\Tasks\User_Feed_Synchronization-{30A0782B-8CD6-4FEA-AFA6-7DAAE2E1E03A}.job
- c:\windows\system32\msfeedssync.exe [2010-12-16 04:25]

2011-01-06 c:\windows\Tasks\User_Feed_Synchronization-{8D9F3B64-1F15-4366-BE8C-370FFD9B6EEA}.job
- c:\windows\system32\msfeedssync.exe [2010-12-16 04:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://ww2.cox.com/myconnection/orangecounty/home.cox
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab
FF - ProfilePath - c:\users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\j04kxzjj.default\
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-05 16:42
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\TEMP\SEP8B04.tmp 0 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Maxtor\Schedule2\schedul2.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\java.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
c:\windows\RtHDVCpl.exe
c:\program files\Alwil Software\Avast5\AvastUI.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Microsoft IntelliPoint\dpupdchk.exe
c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Common Files\Teleca Shared\Generic.exe
c:\program files\Common Files\Teleca Shared\logger.exe
c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
c:\program files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
c:\program files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
c:\program files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
c:\program files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\Common Files\Java\Java Update\jucheck.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2011-01-05 16:53:53 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-06 00:53
ComboFix2.txt 2011-01-05 06:07

Pre-Run: 208,448,942,080 bytes free
Post-Run: 207,855,845,376 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,11
- - End Of File - - D72D9B214ABEEC2ACB299ED3BDF78532

Broni · Jan 5, 2011

Looks good

How is computer doing?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

piperca · Jan 5, 2011

To be honest, I have tried to avoid using the computer until it has been fixed. I have noticed it takes a little while to load Windows, but that may be due to the operations it is going through during the fix. I will report back with results, once we are completely finished.

I am exceeding the character limit for this post, so it'll be in two posts.

Here is the OTL.txt log (part 1):

OTL logfile created on: 1/5/2011 6:24:31 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Andrew\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 363.74 Gb Total Space | 193.13 Gb Free Space | 53.10% Space Free | Partition Type: NTFS
Drive D: | 8.87 Gb Total Space | 1.00 Gb Free Space | 11.27% Space Free | Partition Type: NTFS
Drive E: | 156.23 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ANDREWPC | User Name: Andrew | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/05 18:23:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
PRC - [2010/12/21 04:04:30 | 000,987,704 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psia.exe
PRC - [2010/12/21 04:04:30 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\sua.exe
PRC - [2010/12/21 04:04:30 | 000,291,896 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psi_tray.exe
PRC - [2010/11/30 09:08:30 | 002,222,376 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2010/10/22 14:02:04 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
PRC - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/09/22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010/09/07 07:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/07 07:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/06/25 16:15:32 | 001,311,312 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe
PRC - [2010/06/22 11:09:20 | 000,112,208 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
PRC - [2010/05/14 10:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe
PRC - [2010/03/19 14:05:08 | 000,389,120 | R--- | M] (Teleca) -- C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
PRC - [2010/03/19 14:04:58 | 000,249,856 | R--- | M] (Teleca Sweden AB) -- C:\Program Files\HTC\HTC Sync\Sync Manager\SyncIndicator.exe
PRC - [2010/03/17 14:22:52 | 001,019,904 | R--- | M] (Teleca Sweden AB) -- C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
PRC - [2010/03/17 14:08:22 | 000,253,952 | R--- | M] (TODO: <Company name>) -- C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
PRC - [2010/03/17 14:08:04 | 000,462,848 | R--- | M] (Teleca AB) -- C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
PRC - [2010/03/12 17:41:16 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2009/12/11 13:50:34 | 000,557,056 | R--- | M] (Teleca AB) -- C:\Program Files\Common Files\Teleca Shared\Generic.exe
PRC - [2009/11/23 08:43:26 | 002,001,648 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2009/11/19 15:19:48 | 000,598,016 | R--- | M] (Teleca Sweden AB) -- C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe
PRC - [2009/06/03 08:25:16 | 000,106,496 | R--- | M] (Popwire AB) -- C:\Program Files\Common Files\Teleca Shared\logger.exe
PRC - [2009/04/14 11:14:26 | 000,139,264 | ---- | M] (Teleca Sweden AB) -- C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
PRC - [2009/04/10 22:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/03/05 23:57:56 | 000,227,352 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
PRC - [2008/08/13 14:34:08 | 001,891,416 | ---- | M] (GARMIN Corp.) -- C:\Garmin\gStart.exe
PRC - [2008/05/01 10:38:00 | 000,131,072 | ---- | M] (Linksys LLC - A Division of Cisco Systems) -- C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe
PRC - [2008/04/08 23:15:12 | 000,648,504 | ---- | M] (Pure Networks, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2008/04/08 23:15:10 | 000,648,504 | ---- | M] (Pure Networks, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2008/01/15 10:26:18 | 004,874,240 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008/01/15 09:28:20 | 000,204,800 | ---- | M] () -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
PRC - [2007/08/08 17:31:24 | 000,148,760 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
PRC - [2007/08/08 17:31:14 | 000,410,904 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
PRC - [2007/02/15 02:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
PRC - [2006/12/08 08:16:56 | 000,065,536 | ---- | M] () -- C:\hp\KBD\KbdStub.exe
PRC - [2006/09/28 05:42:24 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe

========== Modules (SafeList) ==========

MOD - [2011/01/05 18:23:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
MOD - [2010/08/31 07:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/12/21 04:04:30 | 000,987,704 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2010/12/21 04:04:30 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010/11/30 09:08:30 | 002,222,376 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/09/22 23:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010/09/22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2010/09/07 07:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/07 07:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/07 07:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/05/06 01:29:12 | 000,293,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2010/03/18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/12 17:41:16 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2009/09/24 17:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/09/04 12:17:00 | 000,447,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2009/09/04 12:16:54 | 005,893,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2009/03/05 23:57:56 | 000,227,352 | ---- | M] (SonicWALL, Inc.) [Auto | Running] -- C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe -- (SWGVCSvc)
SRV - [2008/04/08 23:15:12 | 000,648,504 | ---- | M] (Pure Networks, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2008/01/18 23:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/15 09:28:20 | 000,204,800 | ---- | M] () [Auto | Running] -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe -- (LinksysUpdater)
SRV - [2007/08/08 17:31:14 | 000,410,904 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2007/05/31 08:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 08:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/09/22 23:21:24 | 000,039,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV - [2010/09/22 11:19:02 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2010/09/07 06:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/07 06:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/07 06:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/07 06:47:30 | 000,050,768 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2010/09/07 06:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/09/01 00:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
DRV - [2010/04/27 12:41:10 | 000,306,016 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr70.sys -- (rt70x86)
DRV - [2010/03/18 01:02:08 | 000,037,328 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2010/03/18 01:01:52 | 000,038,864 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2010/03/12 17:41:16 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2009/11/23 08:43:30 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/11/23 08:43:30 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Running] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009/11/23 08:43:28 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/10/30 18:01:10 | 009,803,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/08/04 08:48:20 | 002,744,800 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/06/10 15:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009/05/22 15:08:32 | 000,029,696 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VClone.sys -- (VClone)
DRV - [2009/04/10 20:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/04/10 20:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb)
DRV - [2009/03/05 23:58:12 | 000,087,064 | ---- | M] (SonicWALL, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\SWIPsec.sys -- (SWIPsec)
DRV - [2009/03/04 18:03:32 | 000,021,016 | ---- | M] (SonicWALL, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SWVNIC.sys -- (SWVNIC)
DRV - [2008/11/21 07:35:59 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008/11/16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008/08/01 19:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/07/21 17:34:36 | 000,121,872 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\System32\drivers\kl1.sys -- (kl1)
DRV - [2008/05/08 12:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/08 12:04:16 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2008/05/08 12:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
DRV - [2008/04/08 23:14:02 | 000,024,888 | ---- | M] (Pure Networks, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
DRV - [2008/04/08 23:14:00 | 000,026,424 | ---- | M] (Pure Networks, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
DRV - [2008/01/18 21:53:31 | 000,045,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\61883.sys -- (61883)
DRV - [2008/01/18 21:53:31 | 000,040,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avc.sys -- (Avc)
DRV - [2008/01/18 21:53:28 | 000,050,048 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mstape.sys -- (MSTAPE)
DRV - [2008/01/18 21:53:26 | 000,014,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avcstrm.sys -- (AVCSTRM)
DRV - [2007/10/26 18:51:24 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/10/18 14:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/10/07 11:55:58 | 000,023,040 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\DCDisk.sys -- (DCDisk)
DRV - [2007/08/21 00:13:04 | 000,024,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)
DRV - [2007/03/12 10:12:00 | 000,256,000 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WUSB54GCx86.sys -- (netr73)
DRV - [2006/11/02 01:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 01:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 01:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 01:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 01:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 01:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 01:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 01:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 01:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 01:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 01:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 01:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 01:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 01:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 01:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 01:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 01:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 01:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 01:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 01:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 01:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 01:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 01:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 01:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 01:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 01:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 01:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 01:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 01:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 01:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 01:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 01:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 01:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 01:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 01:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 00:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 00:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 00:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 00:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 00:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 00:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/01 23:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/01 23:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2005/12/12 09:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ww2.cox.com/myconnection/orangecounty/home.cox
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}:5.0.17
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/21 19:31:11 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/21 19:31:11 | 000,000,000 | ---D | M]

[2010/10/30 07:56:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Andrew\AppData\Roaming\Mozilla\Extensions
[2010/10/31 08:55:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\j04kxzjj.default\extensions
[2010/10/30 07:59:39 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Andrew\AppData\Roaming\Mozilla\Firefox\Profiles\j04kxzjj.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/12/21 18:47:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2008/12/07 17:32:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
[2008/11/10 23:38:54 | 000,663,552 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2008/06/17 22:43:04 | 000,086,016 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll

O1 HOSTS File: ([2011/01/05 16:38:44 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [LELA] C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe (Linksys LLC - A Division of Cisco Systems)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SnapfishMediaDetector] C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe ()
O4 - HKCU..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab (Device Detection)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} https://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9} (WebIQ Engine Application Object)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.com/s/v/63.27/uploader2.cab (UploadListView Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} http://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab (P3DActiveX Control)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll (Pure Networks, Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\Andrew\Desktop\Digital pictures\Boat pics\P1010007.JPG
O24 - Desktop BackupWallPaper: C:\Users\Andrew\Desktop\Digital pictures\Boat pics\P1010007.JPG
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/08/21 04:36:12 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [1997/12/11 08:50:54 | 000,000,134 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/01/05 18:23:24 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
[2011/01/05 16:53:56 | 000,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Local\temp
[2011/01/05 16:38:52 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2011/01/05 16:19:28 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/01/04 21:49:01 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/01/04 21:49:01 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/01/04 21:49:01 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/01/04 21:48:55 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/01/04 21:48:25 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/01/04 20:31:15 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Andrew\Desktop\TFC.exe
[2011/01/04 19:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2011/01/04 19:51:23 | 000,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2010/12/31 23:17:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2010/12/31 23:16:21 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/12/21 19:30:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2010/12/21 19:30:16 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/12/21 18:45:51 | 000,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Local\Secunia PSI
[2010/12/19 12:00:25 | 000,000,000 | ---D | C] -- C:\Users\Andrew\Desktop\templates
[2010/12/19 11:57:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoCardMaker
[2010/12/19 11:57:39 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoCardMaker
[2010/12/15 21:29:11 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2010/12/15 21:29:11 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2010/12/15 21:29:11 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2010/12/15 21:29:10 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010/12/15 21:29:08 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2010/12/15 21:29:07 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2010/12/15 21:29:07 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2010/12/15 21:29:07 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010/12/15 21:29:01 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010/12/15 21:28:56 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010/12/15 21:28:56 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2010/12/15 21:28:56 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010/12/15 21:28:55 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010/12/15 21:28:55 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010/12/15 21:28:55 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010/12/15 21:28:55 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010/12/15 21:28:55 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010/12/15 21:28:55 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010/12/15 21:28:55 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2010/12/15 21:28:55 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2010/12/15 21:28:55 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2010/12/15 21:28:55 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2010/12/15 21:28:55 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010/12/15 21:28:55 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2010/12/15 21:28:55 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010/12/15 21:28:39 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2009/12/04 10:42:22 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Andrew\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2011/01/05 18:27:00 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8D9F3B64-1F15-4366-BE8C-370FFD9B6EEA}.job
[2011/01/05 18:23:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
[2011/01/05 18:10:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/05 17:07:08 | 000,002,617 | ---- | M] () -- C:\Users\Andrew\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook 2007.lnk
[2011/01/05 16:58:20 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2011/01/05 16:39:03 | 000,064,542 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/01/05 16:38:44 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/01/05 16:38:36 | 000,064,542 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/01/05 16:38:35 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/05 16:38:28 | 000,003,696 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/01/05 16:38:28 | 000,003,696 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/01/05 16:38:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/01/05 16:37:06 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011/01/05 16:19:18 | 004,148,657 | R--- | M] () -- C:\Users\Andrew\Desktop\ComboFix.exe
[2011/01/05 16:13:11 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{30A0782B-8CD6-4FEA-AFA6-7DAAE2E1E03A}.job
[2011/01/04 21:43:40 | 000,080,384 | ---- | M] () -- C:\Users\Andrew\Desktop\MBRCheck.exe
[2011/01/04 21:06:56 | 000,624,128 | ---- | M] () -- C:\Users\Andrew\Desktop\dds.scr
[2011/01/04 21:01:28 | 000,296,448 | ---- | M] () -- C:\Users\Andrew\Desktop\x6d5dlhn.exe
[2011/01/04 20:44:01 | 000,000,868 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/04 20:31:20 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\TFC.exe
[2011/01/04 19:57:06 | 000,002,485 | ---- | M] () -- C:\Users\Andrew\Desktop\HiJackThis.lnk
[2011/01/01 09:30:59 | 000,001,626 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/12/31 23:16:28 | 000,180,978 | ---- | M] () -- C:\Users\Andrew\Desktop\Tangled.docx
[2010/12/21 19:30:39 | 000,001,688 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/12/21 18:47:56 | 000,001,686 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/12/21 18:45:45 | 000,000,861 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/12/19 15:07:02 | 003,758,585 | ---- | M] () -- C:\Users\Andrew\Desktop\DSC00136.JPG
[2010/12/19 15:06:54 | 003,684,858 | ---- | M] () -- C:\Users\Andrew\Desktop\DSC00135.JPG
[2010/12/19 12:30:58 | 000,176,028 | ---- | M] () -- C:\Users\Andrew\Desktop\Christmas card 2010.jpg
[2010/12/19 12:19:08 | 002,785,645 | ---- | M] () -- C:\Users\Andrew\Desktop\SDC11985-1.JPG
[2010/12/19 12:10:27 | 002,686,895 | ---- | M] () -- C:\Users\Andrew\Desktop\SDC11985.JPG
[2010/12/19 11:57:41 | 000,000,774 | ---- | M] () -- C:\Users\Public\Desktop\PhotoCardMaker.lnk
[2010/12/17 19:54:06 | 000,019,706 | ---- | M] () -- C:\Users\Andrew\Documents\Someday.docx
[2010/12/16 17:52:56 | 001,830,400 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/12/13 22:11:05 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2010/12/13 17:16:20 | 000,041,943 | ---- | M] () -- C:\Users\Andrew\Documents\AcademicPlanMARY ROSS.pdf
[2010/12/13 10:03:18 | 000,026,064 | ---- | M] () -- C:\Users\Andrew\Documents\env1 final review.xps
[2010/12/12 18:30:18 | 000,236,032 | ---- | M] () -- C:\Users\Andrew\Documents\PFAFrequentlyAskedQuestions2010.doc
[2010/12/12 18:30:18 | 000,236,032 | ---- | M] () -- C:\Users\Andrew\Desktop\PFAFrequentlyAskedQuestions2010.doc
[2010/12/08 17:22:35 | 000,011,298 | ---- | M] () -- C:\Users\Andrew\Documents\Candy Cane Lane.docx
[2010/12/06 18:47:39 | 000,012,713 | ---- | M] () -- C:\Users\Andrew\Documents\critical thnking 10.docx
[2010/12/06 18:35:40 | 000,012,807 | ---- | M] () -- C:\Users\Andrew\Documents\final essay english1b.docx

piperca · Jan 5, 2011

OTL.txt log (part 2):

========== Files Created - No Company Name ==========

[2011/01/04 21:49:01 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/01/04 21:49:01 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/01/04 21:49:01 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/01/04 21:49:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/01/04 21:49:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/01/04 21:47:36 | 004,148,657 | R--- | C] () -- C:\Users\Andrew\Desktop\ComboFix.exe
[2011/01/04 21:43:40 | 000,080,384 | ---- | C] () -- C:\Users\Andrew\Desktop\MBRCheck.exe
[2011/01/04 21:05:53 | 000,624,128 | ---- | C] () -- C:\Users\Andrew\Desktop\dds.scr
[2011/01/04 21:01:25 | 000,296,448 | ---- | C] () -- C:\Users\Andrew\Desktop\x6d5dlhn.exe
[2011/01/04 19:51:23 | 000,002,485 | ---- | C] () -- C:\Users\Andrew\Desktop\HiJackThis.lnk
[2010/12/31 23:17:43 | 000,236,032 | ---- | C] () -- C:\Users\Andrew\Documents\PFAFrequentlyAskedQuestions2010.doc
[2010/12/31 23:17:04 | 000,001,626 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/12/31 23:16:27 | 000,180,978 | ---- | C] () -- C:\Users\Andrew\Desktop\Tangled.docx
[2010/12/21 19:30:39 | 000,001,688 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/12/21 18:45:45 | 000,000,861 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2010/12/19 12:30:57 | 000,176,028 | ---- | C] () -- C:\Users\Andrew\Desktop\Christmas card 2010.jpg
[2010/12/19 12:19:07 | 002,785,645 | ---- | C] () -- C:\Users\Andrew\Desktop\SDC11985-1.JPG
[2010/12/19 12:10:27 | 002,686,895 | ---- | C] () -- C:\Users\Andrew\Desktop\SDC11985.JPG
[2010/12/19 11:57:41 | 000,000,774 | ---- | C] () -- C:\Users\Public\Desktop\PhotoCardMaker.lnk
[2010/12/19 11:53:32 | 003,758,585 | ---- | C] () -- C:\Users\Andrew\Desktop\DSC00136.JPG
[2010/12/19 11:53:31 | 003,684,858 | ---- | C] () -- C:\Users\Andrew\Desktop\DSC00135.JPG
[2010/12/13 17:16:19 | 000,041,943 | ---- | C] () -- C:\Users\Andrew\Documents\AcademicPlanMARY ROSS.pdf
[2010/12/13 10:03:17 | 000,026,064 | ---- | C] () -- C:\Users\Andrew\Documents\env1 final review.xps
[2010/12/12 18:30:17 | 000,236,032 | ---- | C] () -- C:\Users\Andrew\Desktop\PFAFrequentlyAskedQuestions2010.doc
[2010/12/08 17:22:35 | 000,011,298 | ---- | C] () -- C:\Users\Andrew\Documents\Candy Cane Lane.docx
[2010/12/06 18:47:38 | 000,012,713 | ---- | C] () -- C:\Users\Andrew\Documents\critical thnking 10.docx
[2010/08/07 18:58:16 | 000,000,245 | ---- | C] () -- C:\Users\Andrew\AppData\Local\RAExpertHistory.xml
[2010/07/24 14:29:20 | 000,038,427 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\Comma Separated Values (DOS).ADR
[2010/05/31 11:41:10 | 000,064,542 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010/05/31 11:40:39 | 000,064,542 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/12/04 19:25:35 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009/12/04 10:44:05 | 000,000,034 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\pcouffin.log
[2009/12/04 10:42:22 | 000,007,887 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\pcouffin.cat
[2009/12/04 10:42:22 | 000,001,144 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\pcouffin.inf
[2009/11/25 21:06:34 | 000,000,000 | ---- | C] () -- C:\Windows\iPlayer.INI
[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/05/30 08:17:54 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/05/14 14:29:30 | 000,008,520 | ---- | C] () -- C:\Windows\System32\ractrlkeyhook.dll
[2008/12/25 19:18:54 | 000,027,043 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\UserTile.png
[2008/11/21 07:35:59 | 000,717,296 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2008/10/15 20:09:56 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/10/15 20:09:56 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008/04/12 11:51:11 | 000,000,000 | ---- | C] () -- C:\Windows\ka.ini
[2008/01/21 12:51:00 | 000,001,361 | ---- | C] () -- C:\Windows\System32\WLAN.INI
[2007/10/25 13:14:03 | 000,010,240 | ---- | C] () -- C:\Users\Andrew\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/10/18 18:01:05 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2007/10/07 11:55:58 | 000,023,040 | ---- | C] () -- C:\Windows\System32\drivers\DCDisk.sys
[2007/10/06 20:32:13 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2007/10/06 20:17:44 | 000,000,000 | ---- | C] () -- C:\Users\Andrew\AppData\Roaming\wklnhst.dat
[2007/08/21 04:27:59 | 000,015,143 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2007/08/21 04:08:08 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom24.dll
[2007/08/21 04:08:08 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes24.dll
[2007/06/28 16:09:04 | 000,258,048 | ---- | C] () -- C:\Windows\System32\SDL.dll
[2007/06/18 22:13:02 | 000,760,531 | ---- | C] () -- C:\Windows\System32\avformat-51.dll
[2007/06/18 22:12:56 | 000,097,358 | ---- | C] () -- C:\Windows\System32\avutil-49.dll
[2007/06/18 16:56:40 | 002,041,856 | ---- | C] () -- C:\Windows\System32\avcodec-51.dll
[2007/06/18 16:56:02 | 000,141,824 | ---- | C] () -- C:\Windows\System32\swscale-0.dll
[2007/03/06 00:47:24 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2007/01/12 06:07:48 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2007/01/12 06:07:48 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/11/02 04:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/01 23:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/01/22 09:30:38 | 014,855,290 | ---- | M] () -- C:\184-001310-00_Rev_A_GVCSetup32_4.2.6.0305.zip
[2007/08/21 04:36:12 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
[2009/04/10 22:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2007/08/21 05:00:19 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2011/01/05 16:53:54 | 000,018,078 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 13:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2007/10/07 11:56:27 | 000,000,512 | ---- | M] () -- C:\dcload.bin
[2007/10/07 11:56:27 | 000,030,860 | ---- | M] () -- C:\dcload.bio
[2010/01/01 15:10:33 | 000,000,064 | ---- | M] () -- C:\FINIS_IT.TXT
[2009/03/06 01:03:48 | 014,912,536 | ---- | M] (Microsoft Corporation) -- C:\GVCSetup32.exe
[2007/02/01 00:24:24 | 000,258,048 | ---- | M] (Hewlett-Packard) -- C:\hpzids01.dll
[2007/08/28 04:41:49 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/08/22 09:45:14 | 000,029,537 | ---- | M] () -- C:\JavaRa.log
[2010/04/30 19:38:38 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2007/08/28 04:41:49 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/12/25 18:06:19 | 000,262,144 | ---- | M] () -- C:\ntuser.dat
[2008/12/25 18:06:19 | 000,005,120 | -H-- | M] () -- C:\ntuser.dat.LOG1
[2008/12/25 18:05:25 | 000,000,000 | -H-- | M] () -- C:\ntuser.dat.LOG2
[2008/12/25 18:05:25 | 000,065,536 | -HS- | M] () -- C:\ntuser.dat{3c6c4862-d2f0-11dd-a6e3-001bb952aaf2}.TM.blf
[2008/12/25 18:05:25 | 000,524,288 | -HS- | M] () -- C:\ntuser.dat{3c6c4862-d2f0-11dd-a6e3-001bb952aaf2}.TMContainer00000000000000000001.regtrans-ms
[2008/12/25 18:05:25 | 000,524,288 | -HS- | M] () -- C:\ntuser.dat{3c6c4862-d2f0-11dd-a6e3-001bb952aaf2}.TMContainer00000000000000000002.regtrans-ms
[2008/12/25 18:06:19 | 000,065,536 | -HS- | M] () -- C:\ntuser.dat{3c6c4866-d2f0-11dd-a6e3-001bb952aaf2}.TM.blf
[2008/12/25 18:06:19 | 000,524,288 | -HS- | M] () -- C:\ntuser.dat{3c6c4866-d2f0-11dd-a6e3-001bb952aaf2}.TMContainer00000000000000000001.regtrans-ms
[2008/12/25 18:05:25 | 000,524,288 | -HS- | M] () -- C:\ntuser.dat{3c6c4866-d2f0-11dd-a6e3-001bb952aaf2}.TMContainer00000000000000000002.regtrans-ms
[2011/01/05 16:38:16 | 3466,342,400 | -HS- | M] () -- C:\pagefile.sys
[2008/10/18 22:13:52 | 000,000,477 | ---- | M] () -- C:\RHDSetup.log
[2009/04/17 20:27:28 | 000,000,302 | ---- | M] () -- C:\RUU.log
[2007/10/07 11:56:00 | 003,145,728 | ---- | M] () -- C:\spc_init
[2009/04/04 11:32:12 | 002,917,607 | ---- | M] () -- C:\spc_kern
[2007/10/07 11:56:26 | 094,371,840 | ---- | M] () -- C:\spc_root
[2009/04/04 11:32:12 | 000,000,000 | ---- | M] () -- C:\tasks.ini

< %systemroot%\Fonts\*.com >
[2006/11/02 04:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 04:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 04:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/05/30 08:29:13 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 13:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/02/02 10:26:36 | 000,273,920 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp4v2.dll
[2006/11/02 04:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 18:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 07:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2010/09/22 23:32:56 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/06/02 18:15:03 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 02:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 02:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 02:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 02:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 02:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/05/02 10:34:10 | 000,000,286 | -HS- | M] () -- C:\Users\Andrew\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/01/05 16:19:18 | 004,148,657 | R--- | M] () -- C:\Users\Andrew\Desktop\ComboFix.exe
[2011/01/04 21:43:40 | 000,080,384 | ---- | M] () -- C:\Users\Andrew\Desktop\MBRCheck.exe
[2011/01/05 18:23:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTL.exe
[2009/10/21 14:40:29 | 036,471,079 | ---- | M] (CWS ) -- C:\Users\Andrew\Desktop\RUU_STAR100_4.1.502.5_02.79.30_CWS_SHIP.exe
[2011/01/04 20:31:20 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\TFC.exe
[2011/01/04 21:01:28 | 000,296,448 | ---- | M] () -- C:\Users\Andrew\Desktop\x6d5dlhn.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2007/10/31 16:31:09 | 000,722,176 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Andrew\gotomypc_428.exe
[2008/01/30 17:20:38 | 000,724,984 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Andrew\gotomypc_437.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2009/05/30 08:49:01 | 000,008,192 | ---- | M] () -- C:\Windows\security\database\edb.chk
[2009/05/30 08:48:31 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edb.log
[2007/08/28 04:28:00 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00001.jrs
[2007/08/28 04:28:00 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00002.jrs
[2009/05/30 08:48:32 | 001,056,768 | ---- | M] () -- C:\Windows\security\database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/10/06 20:54:26 | 000,000,402 | -HS- | M] () -- C:\Users\Andrew\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2009/05/27 19:58:21 | 000,015,143 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2009/05/03 08:09:39 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2011/01/05 16:39:03 | 000,064,542 | ---- | M] () -- C:\ProgramData\nvModes.001

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:40E5AD89
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:4A9220C3

< End of report >

piperca · Jan 5, 2011

Here's the Extras.txt log (part 1 of 3):

OTL Extras logfile created on: 1/5/2011 6:24:31 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Andrew\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 363.74 Gb Total Space | 193.13 Gb Free Space | 53.10% Space Free | Partition Type: NTFS
Drive D: | 8.87 Gb Total Space | 1.00 Gb Free Space | 11.27% Space Free | Partition Type: NTFS
Drive E: | 156.23 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ANDREWPC | User Name: Andrew | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1000]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2458283796-1752821054-3561936673-1001]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04B5D28F-79EA-44C3-AD72-0A5294C10DF0}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{1112E794-68DA-4A05-8172-8157EF078250}" = lport=137 | protocol=17 | dir=in | app=system |
"{1192E760-82E9-4AEF-9E5B-467A8535BB30}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{17B79BF1-A5EE-4DA5-8720-5EEADDE4C571}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{1C961607-CD04-41E8-914A-0FD3B6903842}" = lport=16130 | protocol=17 | dir=in | name=bitcomet 16130 udp |
"{1DC87D1B-1225-4AF3-9BAF-EC47FC9BF5A9}" = lport=139 | protocol=6 | dir=in | app=system |
"{1F84FAE9-0830-44C5-9C39-A5C67829A262}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{2D15E076-0B95-4795-A12F-5EBC2F4BA0A4}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{349675F4-DE91-40FB-9E88-446F95D09CE0}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |
"{34BE3F51-36E3-47A2-8778-54D117E27195}" = lport=2869 | protocol=6 | dir=in | app=system |
"{3709BC26-D304-42C3-86F7-156E606B57CF}" = rport=137 | protocol=17 | dir=out | app=system |
"{3985BD4D-8694-4E67-AEA7-A983F3A7E4F4}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{3B5A24D5-6A0D-4AA6-BD42-D5C608022EDB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{41AAAD28-F8D0-438E-B5CE-5B185D52CE78}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{420E94B2-F8F7-4299-B46F-E13A79E07016}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{429075AA-F088-4785-B4C2-37B217CF46C2}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{49906ED6-24CA-423E-8002-6E44A78DB24D}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{51E6B943-E2B2-47F3-BFB0-63CD90A747AA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{594EECF1-8AE4-4E9C-9643-CDB000A02CF9}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{5A50454E-3273-4752-AD9B-393FFFE02E40}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6412BEA6-92CC-4535-93DA-9FC744540F4B}" = lport=10243 | protocol=6 | dir=in | app=system |
"{66921918-CC2C-4804-8991-B1CD040E41F6}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{67AC3AB4-950D-4C3B-A1D7-1EAAE6C83475}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6F76D109-D08E-4D5F-B62A-AEAA7F611C47}" = rport=138 | protocol=17 | dir=out | app=system |
"{7015C3B6-A862-4C48-B3F3-112D2AD19BCB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7810A45E-FCF1-47A4-B95C-9B9A6F85DFF2}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{7D22C87B-C41E-4E8D-B843-0967C720F1F2}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{7D92524C-7CF5-47EC-BD9B-7A98A455C5E9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7DDEC37B-2770-4EBC-932A-455A27CDF281}" = lport=445 | protocol=6 | dir=in | app=system |
"{7FEC2FEC-F77F-4F09-A195-098BFF98277A}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{8438484B-C3DB-479B-8A04-077628CFC163}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{85F00A56-4DBC-40F6-9E85-70BD744888B3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{88BC6AEE-293B-4ADA-8394-B793B2A2E85A}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{8A7B4400-0B5A-403B-8FDC-78ADDF31F563}" = lport=16130 | protocol=6 | dir=in | name=bitcomet 16130 tcp |
"{8C92A045-E02F-4225-B054-3A9C2E679877}" = lport=138 | protocol=17 | dir=in | app=system |
"{91EDBEF3-785F-41FE-BBE0-3F9ADFA68C44}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{96C12D21-09C6-458E-8D01-E916082BD86F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{977EBB44-D171-46C1-A807-A2BB04043D7A}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{979434A0-7BC2-454D-B78C-D528F15FEADF}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |
"{98A046CD-FE43-4795-A08B-DF762D2D649C}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{A1C36454-F319-4BCA-B783-FDD6EC01AA7C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C0D76A66-DAD5-4083-82AF-F92B5050E21C}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{CD9CD83C-BE87-4863-B298-68B9DECBF21D}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{D0BCEFB1-3FD7-48D1-848B-F416DE4A6493}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{D8F7F1AB-1BBD-4E13-AE79-4406F1021377}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{DE238D8E-2312-43A4-9B8E-A11588F6194D}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{DE6A47ED-3467-4566-B44C-AD5CA961BEE9}" = rport=10243 | protocol=6 | dir=out | app=system |
"{E820A291-7769-41AD-B65D-B3109F122671}" = rport=139 | protocol=6 | dir=out | app=system |
"{F28150B7-D6BA-486F-9A83-A006B7EB1DF5}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{F6502306-AD3C-4052-9C71-867013A7D709}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{F7459F53-2441-463A-8860-B5D91EB15A1D}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{FE226EC6-F57B-4296-9FB0-743E9F569CF6}" = rport=445 | protocol=6 | dir=out | app=system |

piperca · Jan 5, 2011

Extras.txt log (page 2 of 3):

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00D9358F-3E5E-4A47-BD46-14E7187481A9}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{0147E956-6283-43D1-820B-19109D3A7209}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{019E59F0-8FAC-4C6D-A2CD-F26E78F20D44}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{02072FDC-1EBB-422D-AE76-B09EEBB8D2AD}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{02467B63-4229-4412-A7FB-7696DFE1232F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{0277B8B0-557B-4F38-9F49-77B03CC71F17}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{02811CF0-5227-4719-A193-1EAD51A508DB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{03728E03-A395-45D1-AFDA-D63786AF5CE7}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{04DC5B01-98F3-4C1B-B27A-25F6BD4DBDC0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{04E269E8-D74F-477C-8C4D-10DDFF694E16}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{0510D2B5-C8E5-4B39-B49F-BF6B156393C4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0559A56E-7BEA-4872-8BB7-516DC2BF1FBF}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{05AA88DB-DFAC-4518-8CCF-68274B5240B1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{05FAD389-75A6-41D9-9991-6F8FBD8C1534}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{064040FB-079D-4A8F-A58E-7200E9A01CB0}" = protocol=17 | dir=in | app=c:\program files\shareaza\shareaza.exe |
"{091E8BC1-7617-40CB-8E09-B3C3A3D800AD}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{098927D0-8226-4784-8F2C-7BCE3026F769}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{09E33C22-2B99-4F7F-9EDD-D72DCA58625E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0A163290-AA07-4B80-83E9-47FCFA76FF72}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0B140977-3F77-45F2-9198-1E858D186F7F}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{0BC2124A-DC40-4A1E-8681-A856E2B29792}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0C12879E-7929-4870-8F95-7552FF26D0D9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0C2981FE-F56F-4AC3-B3DA-8CD3FF22F441}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{0C5C0F1A-322C-449B-BBE0-2A24CE2DDFE8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0F7E515D-4F12-4160-A318-24C375A5A066}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0FB61AE3-DF8F-45F3-9835-C6340FBAC764}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{101E2B2C-A15B-4CCD-A0C8-0728193F5A2A}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{102669D9-0062-4373-AF82-C39EBC16383D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{10B2DB94-5708-4AF1-9B79-4C183D777C6D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{10DE2351-684A-46ED-BBF3-0FC0078C943B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{11277668-869B-42FA-A824-DDC40A63F44A}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{1165E751-DDB8-44BD-A053-E51D2307F4C7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{11D06F14-91B7-4F1B-A4AF-ECE360B239C8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{11E42F3B-1EEA-418A-9ACE-D47FC51D6C7C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{12B8D90D-0A74-40CF-AEF3-C674813C6A02}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{12D123B3-BFD9-471E-9F01-FA18FAF5781F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{139F7695-DA64-4A9C-835C-008F7B275CB6}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{1410DBFD-5CFC-4586-B691-B23F567F099B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{14A22E91-3E56-45AB-80D1-A60D3BA95A95}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{152C13D4-A652-492A-9586-8A9DAEA9C2A7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1574C1C5-CE43-4619-A634-946A6B053F50}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{158C99AD-FAC1-4169-989E-D8482EEFBABD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{15D97676-3FAD-4E85-9454-74172B8FA33A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1655ACD7-25D4-4FD8-8435-CF428D0E2D03}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{16D2E7AC-CDB4-494F-9D13-A6C629D25231}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{18A38170-6948-431C-BE64-848E8A93BAA3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1AA12916-8533-41BB-811C-2711E9A240BA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1B0A671B-B1E5-4BB1-AA7A-E4C243BB1FCF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1B401531-AF36-4A1F-A566-FFEEF1A5F86D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1B86BFA0-EBFA-4DC2-848C-6E189996BBD9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1C46A195-C204-4C63-8C63-236F45188A90}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1C618E66-BD51-430B-B0A8-ACD6D26D40F4}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{1CCE999A-2AE4-4812-9A93-1074D1FBFD93}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1CFA7F7D-EE4F-4554-8A46-513CC9EED813}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1DBA194F-BD97-4FA9-AE3C-7190770AE6F0}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{1E1E4C0C-A8D3-4732-853A-A54776F8BF17}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1E259B13-E4DC-4679-8FD8-33FF1973DACD}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{1E304E48-352A-499D-80EC-9B65FE620E35}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1E4662AB-5ADB-4C1E-9A15-6EA9587A955F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1F99D85F-D237-4CDF-8123-8DE3F1889F0E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1FFA4DA5-8544-4C67-BA72-A3DAF16D1E2C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{20D2E6BE-BE10-4F18-AB9A-3DAD552E9466}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{21071667-3125-4C7E-BAC2-8EEC7B10DC1B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{21921669-B923-4C4E-BDB6-9EC68C500547}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{23D3105E-7CB4-4A7A-8481-9B84120F67DA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2571CEE3-F436-46B8-AEFD-3E41C262B9F7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{25BBE837-100A-4096-BC76-BA090E12BA24}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{26814056-9B17-49D0-B1C2-68AAD6B52FDE}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{26D0AD26-5759-4AB3-958F-B7E9B7A5C714}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2BB4E2BC-13F4-48D2-B7C2-D7D0E21B0D13}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{2CB02493-D684-4447-8246-F0EAEF8FE806}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{2D43D2F4-75CF-46EC-B760-0AE8CC877641}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2D6F8EE9-7A88-4667-8010-AB5B0F5A3742}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2D9BE95F-B3A6-41B2-A4E4-F26207CF67F5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2E3F7263-BFA6-4A8C-ACCC-0E15AA01D5FD}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{2ECCD72B-398F-474C-AA20-1640DBF454DA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{307115AA-8AEA-4BED-BF3F-9AA8CC658AAC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{310FC37D-05E6-48B7-A8A4-114A013B1A6D}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{318687E6-6C1B-452F-8671-DCB31B5018FC}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{31A84E2C-5F67-487E-917F-4AB11A87916B}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{3227AD6B-C9ED-42CB-A464-03238B49ED07}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{32319EC2-2DE3-4958-960D-E662D7E7611D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{325936FD-ABB3-442C-828A-90FE30BD99D9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{327DE811-1847-4E6B-9100-949EBA500232}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{33564C4B-8874-4E78-8F9B-D7DF00D6A7D2}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{33DECDF5-8BCE-4BD8-8D42-4CB6FC8762D4}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{35AB31F8-2851-41D8-933D-9465EFD47019}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{35AD1376-191C-49A5-971D-E2423F58ACA3}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{393F5259-5132-499B-A25B-2BBA1714D0B7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3A2ABED5-1F2D-4BA2-B57B-549D12D62E47}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3A989BFF-6533-4D24-A99A-A5786EC3E106}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3B0EFF77-030E-48F8-B19F-D9F71333C4F8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3B2369EC-3AD6-457B-ACB3-D98B68AF06E0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3B3A0A9E-8CF7-4E02-8B18-5CD23172BD96}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3F6A0FD6-8AF7-4E21-85DD-D2D4F21F8E9E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3FB26936-124A-48B7-81D6-5FD678FAE08D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{40FFBF5A-9501-4315-89E9-1610751898F3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4179F81D-EB4C-4827-8F6C-C889413F1FFC}" = protocol=6 | dir=in | app=c:\users\andrew\appdata\local\tversity\media server\mediaserver.exe |
"{41A8131C-6328-41E6-87D4-718B4588EE44}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{41CE177F-9A0F-4C98-A3AD-FFE2C152C264}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{41F80443-227B-484A-B348-553CAB7BE3E1}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{42281F0A-5CD2-4410-9EA5-EBEC8B1746A9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{42758453-EEE4-4F63-9304-1474A4AEEAFD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{42A2A144-05F2-4165-8E7F-3721ED0C84E6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{432B4AF8-1A44-4C57-AE20-8EFE6EE4B3C6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{441448B1-C121-42D6-A500-D6366D4438BF}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{44293DC4-EBF3-4161-9FC1-7260B591DFB2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{44AC26AE-5D1D-483E-BBC2-8C85F8092E25}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4514D44D-CAF0-4B16-BEA6-AC506F2DC552}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{451CC22D-3A1C-4AA5-B72D-0DEFB0B9794D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{462A1A0B-D6E6-415C-A20B-C138274D8F51}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{464DB161-EA3C-4251-9910-FF6C5E0D136C}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{465F6A60-4C69-4294-BFE7-540D80611260}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{46FB3A2C-4B90-4E48-B737-6FF5B7DDC462}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{49B9A635-A13A-45DC-81B3-3897D5AB70A9}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{49C5863A-CD67-4258-95DF-EA48CA3DC68E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{49E774F0-C7A5-4CC5-A489-DE50EA97A623}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4A0EE9E1-9F75-432E-AFF1-BB66E820EFD1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4A40730F-D7EC-4BF5-85F5-53920D6D6E61}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4A8F123A-E0F8-4FB7-9924-D0520258B963}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{4B7148DC-EB82-4604-A7C5-B28B64B9ECBD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4B9EB9BF-9126-4BB2-9AEB-96C248ACB4B3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4FA2C524-CD5E-4228-9259-C10BDE63C09B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{507955A9-0C12-4F5B-B5B6-B0C860AC0AEF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5079A743-D3B2-4595-9898-9AE66780EAAC}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{516E4568-8456-466C-8EF8-CC2EE2005BDE}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{522C91F4-F136-4EE8-8CA2-7FCF6C2CB5FC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{525C6AA1-9D81-41E1-847D-28CBAC29A294}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{52882EC7-639C-4891-8E35-A9221FC3FDC2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5290EFB1-071E-459F-8CBC-49015BB9693C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{52EE63B0-FE83-4FDA-9064-C5C787B969D1}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{5382795A-A80C-4888-9DD4-1FDCC38CC0D1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{54747F5F-6711-444C-927D-9CC42C7745F9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{54878134-5B1C-408D-BC71-303C7551ADCD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{548E0E51-012F-49F5-8D20-E6CF4A8226BB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{554A156A-1566-4E49-BF1D-AEF38F4E8D7C}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{558C1EDA-42C5-4945-9117-5CE017A3088E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{573614CC-BD8F-40E8-8580-80CCD5747E6D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{582D8FBC-7A71-4930-9A1C-E5A0E40AA2A3}" = protocol=17 | dir=in | app=c:\users\andrew\appdata\local\tversity\media server\mediaserver.exe |
"{595B23DF-4A34-44B7-803D-0978F21E740E}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{59F39F1F-913E-4DF9-87D4-8F150931FB00}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5A73E01D-683E-46E2-AD8E-5D77C690A298}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{5B7D684C-EAB0-47EA-BECC-FBCAFA636905}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{5CE2129E-3649-45FA-A1C5-B88A2D016FF9}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{5D9F9A86-B2AB-4CB9-BD5A-8A742922B752}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5DDD70C1-E679-435B-8B97-3A1BDD58681A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5E4D06E1-433F-46E2-AE13-FF47583D29A0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5EC6C00B-9823-433F-9E5F-55840FC23544}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5F5A727F-C2F8-4EFB-A2A0-546FF1FAC40F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5FB66504-8BE8-4571-B21E-E214D07D036D}" = protocol=6 | dir=out | app=system |
"{5FFF36A1-CE4B-4E3C-AA9D-E2348F0746D2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{60A6D53F-1612-4A81-99D4-09B86F089C84}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6371220A-FEAE-43FB-8999-61A45F0A7970}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{63AE574D-708C-4460-BB42-FCBB7F828537}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{650BC8F1-F462-4EBE-B5B2-2586688C0FE9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{65B4BA42-510F-40DA-A186-32E513C5CB6E}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{664F9178-5CBF-4BBD-B7FF-D70023A1A0CD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{66C5CF81-B0F4-4D6E-B913-15933E1B4E14}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{68605D8E-3D15-4892-8BBB-B64622C7BBF1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{696C56AF-0E92-4B2B-AC21-214159E9F4E3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6995682A-5417-4F5B-B453-E9B9C5723C57}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6A74A1C5-E74A-4E97-ACF0-98EEA3028D49}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6B02A77B-5FCF-4518-B418-645B2B240336}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6BBCC6AB-CDF8-4774-BF6E-C82128608D9A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6BDD06B0-478A-454B-B998-5A2ECC53956F}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{6BF58162-20E1-40C9-8264-42B6ABD49123}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6CC0847E-3062-4579-938F-4A1312C8BC9B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6CF19052-DB6B-45FB-AF40-B0CB1EC9E3E4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{6D460FB9-38B7-4B24-B7E4-A28E6743A8EA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6D874597-B351-4D64-8A92-1927DB9D6240}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{6F0A2460-3212-4C4E-9C95-D120D09CDF05}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6F51CED8-7BA0-4303-A1FF-738409C402E9}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{6F53379A-A895-49BB-8585-8C38673DEECC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{70C76A01-9FB4-4943-B75E-DF614435B749}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{71BCF4B8-7786-4F29-BCEE-128EFEDFD533}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{73660543-6411-46E0-A2DF-50FAEB4D3C71}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{738B1489-2D24-4F15-859B-8F7AB3F5712F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{74B83038-AC4B-4EB9-AEC1-799FB0205758}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{74D864E7-8789-46B2-9988-E06C2988926E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{75087198-81AA-4805-B909-4E0132EBF258}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7613D0A3-92EE-49E6-BC4D-07CD41B8906B}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{77678A44-20ED-4F12-9AD9-71A97D160693}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{77834B9A-76BD-45EC-B884-25E03EAD4B3A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7968376C-CB1C-42E3-8210-BFEB0FCC4B7E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{79F6BB86-BCB6-41AC-BEBB-7113861E89F6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7A615D71-96F8-4FB0-8131-E523B4879ED4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7AE21A06-96E3-4ED6-B001-0F7E890F6E0D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7AE52608-AB67-4B6D-B246-413EEF023FDB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7B7EB5AB-8FB9-49B8-A25C-14D7116FE45D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7C0F2B86-001B-43F1-829A-5E072C380A17}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{7FCB1489-A4E9-461B-818B-A7B7F7CFC2C4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8036F1CE-078A-4817-B234-9825A2DF540A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{808531D6-AD86-459D-8C8B-45C28DEAAB4F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{809EA909-BEB8-4DAF-BAD7-25B2EDD6AEDF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{82524198-FB61-45FC-99F5-739AC61A8B64}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{830D0F9B-C06D-467C-AEAD-2C06626EE237}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{83701AC9-0ADC-4F40-A204-97A200DBC403}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{83EDC4CF-B039-440C-BF55-74809401FB23}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{85D0C4C2-38C7-4590-A017-CE205D2BF9A3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{86F021B9-9A91-4DB4-B173-EFFDC45B7E73}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{873E8FDC-8DAA-4801-B37D-07089E1409AE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8742E1A1-9D59-4E12-A741-504F9A8395C1}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{8787981C-C9B0-485F-9DA4-EACD539B325B}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{885D00A5-828F-4CDF-B8B0-B47CA138F121}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{89231BF6-3770-4CA2-8A06-23184CE83431}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{899172AF-3780-415B-95A9-05F6E1713868}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{89A471ED-18F0-461C-AC8C-23B926E9260A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8A914425-532A-42DC-8610-B8FDFC478D35}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8A9DDEDB-EC8F-479B-9E71-CC6EC0D47D8C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8CBC951C-33D4-40B5-84A9-275C287FBADB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8CBF42AF-46C1-4FB1-B455-8184EA893A6E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8D5A0453-F7CA-43EE-AC2E-ED2B7AB9E18D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8D5E4094-D662-4271-B272-8CECF2CABFB0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8D890B0A-BF3E-4120-84FE-FA82F691F0A0}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{8E292724-BBA8-47E5-BE59-37905B63F502}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{8EE1B916-B350-4CE1-A0DA-0129C1B8F493}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8F4FE155-B2B9-449C-BBF9-E98773F2637B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8FC5BBEC-530A-4762-8C38-78002D84BDC8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9008BFD2-098C-4E7B-9DCE-5C317D018863}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{90EECA9E-F096-49A6-BED2-9696EE8D0181}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9165F7CA-6146-4096-91C0-2C8BCFDDC2A1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{91BB0415-9FA2-4089-8B0A-A06AE52AA8D9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{91C552E7-4A52-46B0-8BB8-2267953398B5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{92CA5283-5587-4B86-A20E-9D6D9F43F0E2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9367D880-9EBD-4310-B6EF-EF9032A6F224}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{93B793F0-4322-4FED-B7CA-F4B4FCA03879}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{94BCD3AA-229D-4EE8-9FDA-2E52B766F71D}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{9525723E-DE43-47A0-BDC5-C69A399D5E97}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{95645974-D5B1-4CA5-B274-2EAE5C80930C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{956482EA-73BD-4A5D-BF43-D12E464C614E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{962459C4-00D0-414E-8BDE-F71442C8F5B9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{97000786-D8DA-4F67-ABD0-DA2C22D444CC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{977263F4-EC40-436D-BA88-665F0CF6C481}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{97D5CF8B-CD45-48A1-806E-FB07A0DEBD88}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{985C2970-33B3-4CA5-907D-0A8F1CC72271}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{99C27F10-3791-4AEF-8E0F-22D26ADB23D6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9A5E8634-019A-4DA5-86C1-92762C920327}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9A8F925D-5FA4-4E64-9551-4349DE065CA6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9B29EA99-C03C-4607-80DF-97C58FAFFC1B}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{9B70F0DB-CC56-4F86-B52E-B22812A61AA2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9BFD656A-6AB4-4157-B8B0-B386941142DC}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |
"{9C147B79-34B2-4629-BBFB-4888FBCE6540}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9C2ECE3E-7251-489D-AF98-F4951A0EDCC2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9C72B945-6243-4FB4-93B4-F8738D27964E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9CA99C5C-4B9E-41BA-B1C9-4BE47DB66CBF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9DDF7F5D-188B-465F-819C-9545F8735E30}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{9DE615C1-D0E6-47D3-BCA1-ECDE8C6EF672}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9E023A3B-D975-48B4-9902-28B690D10492}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9EB6670B-8E47-4FC5-ADAC-CB6380A13277}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{9EC1FBBE-542D-47D3-A331-6CFD59E5EB0B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9F6C843A-91EC-458F-B920-930014A4871F}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{9FF0967F-38C2-417F-BFD4-BDCCDAC8DFCF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A049F9F9-3CDD-4BDC-8313-B08F6B2F79A6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A22581D6-8555-49AF-B39B-C4E6D24258F0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A249CB2D-4AD6-40CA-B225-459E137AEC1A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A449EABC-67F1-4734-AAAB-8A50727824B5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A58CB830-D85F-4AD0-88F0-F6E8DD7BD817}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A5E5AA17-081F-4FA2-A595-A2DAA3EF0DCC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A5E5C302-8F7B-44E3-92DA-D00B1E174D2E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AA6632BC-F665-4BD9-8FC6-BF9C04D57118}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AAFB4C08-F031-4410-A193-C8CAC5352DC6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AB50C49D-7DC0-49BD-BE5B-5D5D329740CE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AC8E3167-41B9-47D9-B169-F96B4D00D089}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AD69669F-B015-4B14-81F6-3BDE4AD42FC6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AD797931-C20E-474F-9B99-A76249527673}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AE52E7AB-5EE1-4AA0-83D1-EF12A0E93718}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AF00AC51-2A34-4CBD-9EDD-93573E4CF8F6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B07046DA-F5C4-4201-8BEC-A7C2370C4DD8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B0914F99-3A75-4C10-87BB-06492001DFBF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{B0AE0878-BA36-4696-BF5E-C4330E88287D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B19781D2-27CF-4B90-BB06-D4485F2CD828}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B212FA0F-F683-4445-BDF9-99B9C3869BA6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B2264336-8730-4CDF-B2BF-3D76F62004EF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B2D849DF-68FD-4A4D-8B93-9EE8B642CCCD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B323F918-29C4-409D-A9EC-5141BD283D3E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B37F87B9-BA0F-4E80-9CA0-3CC3FD91A677}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{B398EDE2-C431-433B-B139-8449B1F77134}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B3A20987-B5D5-4C09-92C3-D70520C38737}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{B3FB9B36-09E6-42DA-ABE1-6F2660C5E882}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B58974A5-6A4E-4639-A335-A2F37596E8CF}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{B58F23E2-4745-426C-8CD0-8C44C6CDB100}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B5A1B03F-0DC0-4673-BC87-2433DC09692F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{B5EA3933-9B3D-475E-965C-E89AFEDB66F3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B6F1D458-E37C-46A3-B96C-411225D62527}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B71108B3-2208-429E-8983-0EAD9919F3AD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B737F64D-DF40-4040-B6B1-FF66C8201E9A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B7411853-7818-4CF4-BE2A-2EF4E995CC08}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B870E344-0915-4FD3-8591-547AC9CBBCB3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B8C3C6B8-2C63-4A08-9EC3-B0B6C43877FA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BA4729A6-B288-4F1F-B89A-71E5E93D1089}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BA91EBD9-9900-419A-B5E2-9825EB7C5428}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BAAA51DC-BD6B-4FC5-9DBD-84FB3042E7C8}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{BB0282F4-A874-4EE7-A780-599044150F59}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BB6D1773-3DAC-488E-B95C-A26549281EBF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BBE617F3-B7B9-4FD1-A5B8-F35AF1C670E6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BCB2A926-BACB-40EF-A536-BB4F13C5F29F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BCF36210-E368-4675-93A7-041AD7D04227}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BD4FF7A8-9DF9-4B84-910A-6816722A2913}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{BD57511E-FBDA-4680-846B-FFB686074A12}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{BDB10B48-BA36-4123-AC83-9697A4B6DAEF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BF171506-71C5-493D-BA5E-695C2E37CF14}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BF332CA8-16A7-4631-AD43-639E9D3C4482}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BF7CA69E-DAF5-4A36-A625-69C0C0538BB5}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{C05F9D5D-D5A6-4085-AF97-E3EB1AA36723}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{C0686CAD-F115-45B2-A3BB-3EBCE5A5E5BC}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{C0983677-AD7E-4B46-8776-4F1A05AADBF4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C0D69813-2726-4710-AB0D-2B45A3B289D3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C1A4DB4A-4076-47F2-852E-98649B255B14}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C1AB288D-56D4-4FD0-84F6-E634C65E1BAD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C2108334-AD7D-4180-B779-C916D9CF6363}" = protocol=6 | dir=in | app=c:\program files\shareaza\shareaza.exe |
"{C243E6BB-E27F-4E27-AED5-FB87F629D2AF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C3852C90-E6B6-41C6-B148-5E34D5BC1A24}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{C38CB4F8-2DE7-4A9A-9773-46A32B0DBEEC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C3F5929B-6E23-4C4B-BACE-39C0A700CF5F}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{C40B2D5B-F950-49D8-9BB7-609016AF5951}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C5A56904-F25E-43DB-8746-340B55AEA785}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C6484CB5-75E0-4CDA-AD52-3022573189CA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C6BC7290-EBC3-4EEE-AE1B-3EAF8B4BE15C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C7C50D16-11D6-4D4D-8B0C-E5752EC90E9F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C7F61A26-6E2A-4922-8DAD-0C8870A4F3C7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C849A1DD-C285-4FD3-918D-03B6EED44B81}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{C866EE75-C656-4277-B3C5-F89F2F075EB2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C92D66C8-D802-4B04-9746-92B7C87C73E3}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{C9E0A3C9-F928-44F1-A131-2C41155CE996}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{C9EE4FCA-5D52-48C0-948D-C093968B8426}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CA05238E-EE1D-4E8F-8CA4-F9E40241F40D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CA3CB567-C589-48D5-B6BD-63929DE7BD32}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{CADCB6E7-36EC-43E8-A899-CA4419B191D6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CBA452B3-36C8-4805-AF6D-1AF9ECFD4F4B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CC708721-2715-44CF-B1D5-3242DC4718C5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CCA80F47-0F1A-4C38-90C4-5BE6B7AEDBCB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CCD9355E-F750-4AC0-B886-F473EC672640}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{CCFE5340-1C5E-4D93-B8C7-5171B0437754}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CF401254-01DA-467E-8EB5-04D92F99B3C0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D20BA50C-B13F-4567-9869-B1F04EEE3C81}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D236F020-4BBB-43C2-B35A-4C83CE836B8E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D266969D-567D-4C41-BAE5-8B2D03A495B9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D27BC5C7-E15E-43DB-A976-196A97A6F659}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D2883758-07FB-4F14-9730-8D0DE56F8627}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D2A8BDB8-3A22-4A3C-B359-B40F99E565A7}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{D2D815F8-CE33-4397-A0C4-971AD9CAB1CE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D31B6AC6-0C7D-482C-8BEE-E49882FD797C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D386C199-1B6D-422C-945E-05D1E795A75A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D44FEB0E-5C21-4DE1-AFB5-2645DD5DDFB6}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{D5A61B3D-E4FA-4F08-A9DE-0EFCE5F5D648}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{D5F501AE-D7DC-4DB0-B37D-BCA08EDDA0B3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D619ABC8-2947-4E87-B050-EB476A38E08D}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{D63F5024-BE26-44C1-A9BA-0BD934D8F3FB}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{D674C34C-BAF1-4162-B299-F23D04201FF7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D715E8E1-50DC-4D0A-8AD7-706B3A764A7D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D732E77A-1A9A-4A19-9626-1A69029FDC90}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D794E86C-7F41-4EE9-B069-AFEFE9FE5B6B}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{D7FD258B-AAA0-4139-97D8-83D469705EEC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D85B0CE2-CD4C-4CDA-BBD6-E51588162499}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D9B7ABA6-805E-424B-863D-1890C9428919}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DA0794A7-A851-4A00-B3DC-87AB72FF5ED9}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DA58B396-23A8-403B-BA0C-3A99C4D41729}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DA8E67C8-7A30-4064-9938-8794AF9DF9A3}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DAC70677-AE3F-46A3-8874-851751319E07}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{DAD906E0-45BA-4686-A2AE-CD101B649BF4}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DB459A46-6896-47DF-A3C2-54DB46DD589B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DC5E346D-2D2A-4F94-9200-897750108C94}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DC7E6CEA-8913-44AA-9195-30DD60B7E800}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DC8C6925-984B-4AC9-B7DA-E05C58504AFC}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DCB3DDB4-0D15-4FE8-9CC8-831448535677}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |
"{DD5C8005-6081-4CBD-A485-486C25CAC2E4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DDFCE1E6-4856-41EC-A9D5-79CA9B828FCE}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DE449342-C6D6-43D7-8121-1A80AF7918D1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{DE7A3CA7-B964-4285-9C29-ECA1E5C4C024}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DF7B0DBC-7289-42B3-9D73-43BB9CEEEF66}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DFFDB256-80A3-4A47-B0E1-4EA9AC377F54}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{E047E463-76D9-46C6-860E-4310E15BC347}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E0D3F93F-C5EA-405C-983B-BF0255FA875B}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{E1007923-0D7D-438F-A6D6-4C605901A882}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E1C0BA56-6905-4D25-8085-A97770EA7DD5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E254EC35-55D1-4127-9388-D96ED6D000F3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E2683C36-9C56-4B7C-8279-9306FA7FFCA8}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E26BCA03-640B-4348-9F49-D0A6AE8E9679}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E3807B1C-4011-4857-BF67-302F149B6C46}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E386472E-D4F4-4D88-B3A7-ED6C3800EB1E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E3A2B99C-AA0A-46CC-A945-20AF037B300B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E446945D-763C-4C87-926E-D8DCB5B3ACEC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E5B44E8D-ACF2-4A45-B5DC-452C40D31849}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E5E89EAB-7045-47B9-96FA-C9F10FDD25A8}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{E79C66E5-DB0F-4EB7-8B2C-A1854F024D2F}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{E887F7BE-45EC-4A38-9E39-FBA5FE0797DF}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E998319E-33C0-4715-B994-8B25D81A8A6C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EB9AE955-F48D-4F26-AAFD-66DE47368EB1}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{EB9FC8A3-FFA1-418D-A6E3-259A846418FB}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{EBB883D0-8FB1-477A-AAB9-9E33AA12A5A3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EBCF4D9B-2A6B-421C-83F0-F4CAB3131114}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EC9E81A3-C5C8-4DA4-8811-1552F50A0FE4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{ECA90B90-C519-4D8A-9A94-B32DA6E38A1A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EDA6E09B-D359-4DF8-8437-FE28280D518C}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{EDCB6D80-D148-4376-B117-AF6DDD4926A2}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{EE1F21D1-80F4-4A8A-9C48-5933E8D2F2D6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F0664D69-2975-4642-905B-AFC9DC73BD0F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F24FF478-551B-44F8-91F7-9856AC367E4D}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{F2701D68-DC1E-4C4F-A2D1-A5285299F4F7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F2A5D748-7A66-46AE-AF15-157CAC79EB3E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F2C8A7E3-1780-4E13-8590-A49C7EBC52CC}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{F2DE334F-6068-49E3-8998-BA70C6B16382}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{F30356B6-94CE-4D31-BCCF-9DCE1C08ED50}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F3EBC232-CA64-4E61-A06B-309FCEA3E898}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F3F2FCC1-48DE-4375-91E6-E2E371AB4E28}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F43BF510-4036-4C17-B9CE-A1C6A5F295CA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F45E8D90-07F2-4948-A991-15555CC2AC57}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F49EBB97-E02C-4156-8C45-1066F606FC7C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F5D33AF1-BDB2-4D1B-A794-24A7AEB7AB62}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F79CA28A-6790-4EB8-B2DC-95062F9F3933}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{F7C15373-4741-4632-B3CE-EBF7A1F8C599}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{F9BB112D-1BE3-407D-82CA-08A39A5FECAD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F9BC5895-93B3-4B38-BAF2-FE4960A97C3F}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{FA3D1323-E147-46C3-9E1F-649587777DFB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FB2B8839-695F-4146-912D-BA245865FB86}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FB41E4AD-1AA8-4595-B19F-E110C0DD100C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FB450D0C-25F0-4470-A11F-10CB1FB4639A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FBC94BFE-9437-4304-B1BD-2EBAF84BAD98}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FD0D66CA-FCDE-45D1-97F5-74F915831813}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FD10C720-29BF-4356-BF97-F59F0E179BAA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FD2D577B-DC7F-485B-87D4-81A19778690E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FD96996F-E337-4EBF-8247-D794464AFAD8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FEBE1470-59D2-46D3-B164-B06A7AF170EF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FFF4B509-8667-43ED-8A0A-CF397C7619AA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{11A5FEDE-BE8B-4612-89E3-D8D1069B9E87}C:\windows\ehome\ehexthost.exe" = protocol=6 | dir=in | app=c:\windows\ehome\ehexthost.exe |
"TCP Query User{179A29C7-7009-4F13-9A2E-4EF2DD1170E2}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=6 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
"TCP Query User{3DD0C1BE-AEF3-4CCD-8D0F-9793E25A9CAA}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{41ECC000-25C2-4ACF-BE9E-9C95BCF7887B}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=6 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
"TCP Query User{6F62AEA3-4265-4088-83D3-E810CD4935B2}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{7C588D54-4CBF-461D-B96E-3704D89BB061}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe |
"TCP Query User{BB281A61-207B-4874-9D16-19C8BE6C9726}C:\program files\bitcomet\bitcomet.exe" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"TCP Query User{DB9FB2E1-3B1F-4E6F-B0FD-004EF22DB9A5}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{EA5200E8-2C42-4C1A-939A-A7F57525D87A}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{F9AE9B21-419C-4763-831F-D3CDFF8D50CB}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe |
"UDP Query User{0DB8F9B0-8F26-4692-8F8D-BC9050F91A42}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{6D3DA6A1-E597-4151-A125-E09BE4EAC24B}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe |
"UDP Query User{8FB1280E-A3E1-4535-BB4E-300BAEF4DC65}C:\program files\bitcomet\bitcomet.exe" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"UDP Query User{A28CB58B-D167-4AA8-8765-6B3D6865CC9E}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{A46F7D95-D559-41F0-9D89-40476B8CCE99}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe |
"UDP Query User{C31A3F99-1CB7-4FA6-9772-DE7C830DD36A}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=17 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
"UDP Query User{E30ACB5E-1502-4C1E-B8E2-EFB8CDAC2306}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{F5891625-E02A-4D0E-A3A0-C81793028026}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=17 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe |
"UDP Query User{F6449D53-5BF3-43DE-A05A-38E2499B9CA8}C:\windows\ehome\ehexthost.exe" = protocol=17 | dir=in | app=c:\windows\ehome\ehexthost.exe |

piperca · Jan 5, 2011

Extras.txt log (page 3 of 3):

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{08D5F667-E1D7-4792-9FFD-5888C8D4A0DF}" = Garmin Training Center
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CFD3BAF-9F4D-4D70-BD0B-638EA2504C25}" = PSSWCORE
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{282E5AB2-8E47-4571-B6FA-6B512555B557}" = HP Photosmart.All-In-One Driver Software 8.0 .A
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{2A03B9F8-BE6D-43C6-A16A-B9998A194AF0}" = Garmin Training Center
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MYMOVIES)
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2FB5E6F3-AE50-45D9-8AE4-DD331FDD7C84}" = My Movies for Windows Media Center
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{324CEC09-007A-48eb-90E0-9D42D4D5EB0A}" = NetDeviceManager
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{39CB30DB-27F8-4dd4-A294-CB4AE3B584FD}" = Copy
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{40624553-811E-400E-B69B-38D8926A66BD}" = SonicWALL Global VPN Client
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{44F5A980-8A6B-4aca-8D85-EFCE5D67D379}" = AIO_CDA_ProductContext
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{47A3FE80-528F-482B-8143-B3A4645557FC}" = Microsoft LifeCam
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4EF6FDB0-3B11-4820-9860-8E08E9965195}" = Snapfish Media Detector
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5B48A8D9-D1AD-4424-BD4D-E462737099DF}" = SportTracks 3.0
"{5C474A83-A45F-470C-9AC8-2BD1C251BF9A}" = Skype™ 4.2
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FDFCCA0-59EC-4162-B0B8-632EEE3DF787}" = WebIQ Technology Engine
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{625386A4-B6B6-4911-A6E8-23189C3F2D15}" = Microsoft .NET Compact Framework 2.0 SP1
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6AF49698-949A-4C89-9B31-041D2CCB5FBD}" = muvee autoProducer 6.0
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{73A43E42-3658-4DD9-8551-FACDA3632538}" = HP Advisor
"{7410AD7D-468D-4D3E-B6D1-ED7836B0AE16}" = Enermax
"{75E71ADD-042C-4F30-BFAC-A9EC42351313}" = Python 2.4.3
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7FE3214C-283E-40C6-A8D5-CB773110090C}" = Linksys EasyLink Advisor
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86D6A20D-3910-4441-A3E5-EB6977251C86}" = Samsung USB Driver
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{888FFC82-688D-46AB-A776-B417885432B6}" = Zune
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C5FAD77-F678-4758-A296-C12F08D179E0}" = Microsoft IntelliPoint 6.2
"{8CEA85DE-955B-4BF4-87F2-0BAA62821633}" = HP Photosmart Essential2.5
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile Device Center
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{938B1CD7-7C60-491E-AA90-1F1888168240}" = Roxio MyDVD Basic v9
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C1EED58-1790-45C4-ADBC-5D45FCA7292E}" = Pure Networks Platform
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A5436728-2DFD-4221-B4D7-F49F740134C9}" = c5100_Help
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7DEBAA4-B211-4D1A-A6B3-E52BFAAA1D0C}" = Garmin Communicator Plugin
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}" = Wizard101
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ADC7FA12-E165-428a-AF13-4CE686E030AA}" = C5100
"{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}" = Samsung Master
"{AF1C9345-B53D-4110-BFBF-A0DD83AEAB83}" = AIO_CDA_Software
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B7C7A59F-CF70-481E-A94F-7C2563AA5ADD}" = Sony DVD Architect Studio 4.5
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C15B6175-689A-4D97-A42C-7225353F60A7}" = Linksys Updater
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}" = Microsoft Outlook Personal Folders Backup
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D76D1828-BBA0-4BD9-8181-5ACC617DC5F2}" = Virtual Earth 3D (Beta)
"{DA507A38-4B2A-40C0-90AC-E30AAA0B757C}" = Vegas Movie Studio Platinum 9.0
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E0783143-EAE2-4047-A8D6-E155523C594C}" = Garmin WebUpdater
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E6FA148F-1E7D-4A42-A9A2-7DFABC2C6A2B}" = SportTracks 2.1
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile Device Center Driver Update
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ED3F469E-D9EC-4DF1-968F-5812CE2F30F8}" = HP Driver Diagnostics
"{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F6BA8EF2-A9F8-45B7-BD59-0A15DA9F7D68}" = Omron Health Management Software
"{F7B9B60F-DBB3-4116-967B-BA93E278331E}" = ActivePerl 5.10.1 Build 1007
"{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}" = Eraser
"{FCAFEEB3-3520-4539-89AF-4B743D2DFAEC}" = HTC Sync
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.7 (Unicode)
"avast5" = avast! Free Antivirus
"AviSynth" = AviSynth 2.5
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"Disney Toontown Online" = Disney Toontown Online
"DVDFab 6_is1" = DVDFab 6.2.0.5 (11/11/2009)
"eMule" = eMule
"Eraser" = Eraser
"ffdshow_is1" = ffdshow [rev 1723] [2007-12-24]
"Google Chrome" = Google Chrome
"Google Updater" = Google Updater
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Photosmart Essential" = HP Photosmart Essential 2.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"InstallShield_{7410AD7D-468D-4D3E-B6D1-ED7836B0AE16}" = Enermax
"InstallShield_{7FE3214C-283E-40C6-A8D5-CB773110090C}" = Linksys EasyLink Advisor
"InterActual Player" = InterActual Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MVApplication1" = Memorex exPressit Label Design Studio
"MyCamera" = Canon Utilities MyCamera
"NVIDIA Drivers" = NVIDIA Drivers
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"PC-Doctor 5 for Windows" = Hardware Diagnostic Tools
"PhotoCardMaker_is1" = PhotoCardMaker 1.0.3
"Picasa 3" = Picasa 3
"PROR" = Microsoft Office Professional 2007
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Revo Uninstaller" = Revo Uninstaller 1.88
"Secunia PSI" = Secunia PSI (2.0.0.1003)
"ShanghaiDynastyUninstallKey" = Shanghai Dynasty
"Shop for HP Supplies" = Shop for HP Supplies
"SP6" = Logitech SetPoint 6.15
"Switch" = Switch
"SystemRequirementsLab" = System Requirements Lab
"TeamViewer 6" = TeamViewer 6
"UnityWebPlayer" = Unity Web Player
"WildTangent hpdesktop Master Uninstall" = My HP Games
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Yahoo! Companion" = Yahoo! Toolbar
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
"Zune" = Zune

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 4/6/2008 12:12:20 PM | Computer Name = Andrew-PC | Source = avast! | ID = 33554522
Description =

Error - 4/7/2008 2:26:42 AM | Computer Name = Andrew-PC | Source = avast! | ID = 33554522
Description =

Error - 4/7/2008 10:39:41 AM | Computer Name = Andrew-PC | Source = avast! | ID = 33554522
Description =

Error - 12/26/2008 1:14:44 AM | Computer Name = Andrew-PC | Source = avast! | ID = 33554522
Description =

Error - 4/25/2009 12:10:58 AM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
Description =

Error - 2/6/2010 6:46:50 PM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
Description =

Error - 2/6/2010 6:46:56 PM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
Description =

Error - 2/6/2010 6:47:01 PM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
Description =

Error - 2/6/2010 6:47:33 PM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
Description =

Error - 2/14/2010 3:07:41 AM | Computer Name = AndrewPC | Source = avast! | ID = 33554522
Description =

[ Application Events ]
Error - 12/24/2010 10:57:33 PM | Computer Name = AndrewPC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 8.0.6001.18999 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 428 Start Time: 01cba3d3e7fc2700 Termination Time: 0

Error - 12/26/2010 8:10:15 PM | Computer Name = AndrewPC | Source = Application Error | ID = 1000
Description = Faulting application Dynasty.exe, version 0.0.0.0, time stamp 0x349b8a1c,
faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821, exception
code 0xc0000005, fault offset 0x0006803d, process id 0x1824, application start time
0x01cba5594e51fee0.

Error - 12/27/2010 10:36:46 PM | Computer Name = AndrewPC | Source = Application Error | ID = 1000
Description = Faulting application Dynasty.exe, version 0.0.0.0, time stamp 0x349b8a1c,
faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821, exception
code 0xc0000005, fault offset 0x000675ff, process id 0xb74, application start time
0x01cba636e7b33f80.

Error - 1/1/2011 3:15:04 AM | Computer Name = AndrewPC | Source = Bonjour Service | ID = 100
Description = 456: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 1/1/2011 3:15:04 AM | Computer Name = AndrewPC | Source = Bonjour Service | ID = 100
Description = 440: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 1/1/2011 3:15:04 AM | Computer Name = AndrewPC | Source = Bonjour Service | ID = 100
Description = 448: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 1/1/2011 3:15:04 AM | Computer Name = AndrewPC | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 1/1/2011 10:13:24 PM | Computer Name = AndrewPC | Source = Perflib | ID = 1010
Description =

Error - 1/1/2011 10:13:27 PM | Computer Name = AndrewPC | Source = Perflib | ID = 1008
Description =

Error - 1/3/2011 11:36:19 AM | Computer Name = AndrewPC | Source = Application Error | ID = 1000
Description = Faulting application Dynasty.exe, version 0.0.0.0, time stamp 0x349b8a1c,
faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821, exception
code 0xc0000005, fault offset 0x000675ff, process id 0x19a8, application start time
0x01cbab59927037f5.

[ Media Center Events ]
Error - 8/17/2009 5:38:12 PM | Computer Name = AndrewPC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 12/2/2009 11:49:30 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 12/4/2009 4:15:56 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 12/4/2009 4:27:05 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.WaitForUploadComplete failed. Please
try to ping www.msn.com prior to filing a bug.; Win32 GetLastError returned 10000109
Process: DefaultDomain Object Name: Media Center Guide

Error - 12/4/2009 6:16:06 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.WaitForUploadComplete failed. Please
try to ping www.msn.com prior to filing a bug.; Win32 GetLastError returned 10000109
Process: DefaultDomain Object Name: Media Center Guide

Error - 12/4/2009 6:25:34 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerAccumulate failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 12/4/2009 6:25:34 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerAccumulate failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 12/4/2009 9:35:10 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.WaitForUploadComplete failed. Please
try to ping www.msn.com prior to filing a bug.; Win32 GetLastError returned 10000109
Process: DefaultDomain Object Name: Media Center Guide

Error - 12/4/2009 9:39:18 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerAccumulate failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 5/19/2010 4:57:50 PM | Computer Name = AndrewPC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

[ System Events ]
Error - 1/5/2011 8:18:40 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/5/2011 8:19:44 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/5/2011 8:24:40 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7034
Description =

Error - 1/5/2011 8:24:42 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/5/2011 8:36:15 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/5/2011 8:36:30 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/5/2011 8:41:06 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7022
Description =

Error - 1/5/2011 8:41:07 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7022
Description =

Error - 1/5/2011 8:41:07 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7026
Description =

Error - 1/5/2011 8:43:45 PM | Computer Name = AndrewPC | Source = Service Control Manager | ID = 7009
Description =

< End of report >

piperca · Jan 5, 2011

I noticed when running OTL that there was a box that was not ticked that said "scan all users." Should I have ticked that box?

Broni · Jan 5, 2011

That's fine....

Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.

=====================================================================

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:40E5AD89
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:4A9220C3


:Services

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" =-


:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

=====================================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
IMPORTANT! UN-check Remove found threats
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

piperca · Jan 5, 2011

OTL fix log:

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
ADS C:\ProgramData\TEMP:40E5AD89 deleted successfully.
ADS C:\ProgramData\TEMP:4A9220C3 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\\DisableMonitoring deleted successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Andrew
->Temp folder emptied: 7853 bytes
->Temporary Internet Files folder emptied: 10792745 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 1024 bytes

User: Cathie
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Lilly
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Lilly.Andrew-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3085258 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 13.00 mb

[EMPTYFLASH]

User: All Users

User: Andrew
->Flash cache emptied: 0 bytes

User: Cathie
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Lilly

User: Lilly.Andrew-PC
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.20.1 log created on 01052011_192934

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

piperca · Jan 5, 2011

Security Check log:

Results of screen317's Security Check version 0.99.7
Windows Vista Service Pack 2 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 23
Out of date Java installed!
Adobe Flash Player 10.1.102.64
Adobe Reader 9.4.1
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.13)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Alwil Software Avast5 AvastSvc.exe
Alwil Software Avast5 AvastUI.exe
``````````End of Log````````````

Broni · Jan 5, 2011

Update Adobe Reader

You can download it from https://www.techspot.com/downloads/2083-adobe-reader-dc.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
On this page:

make sure, you have both boxes UN-checked AND (important!) click on Decline button

piperca · Jan 6, 2011

Okay, I've done everything, but the Eset scan. It took way too long and I have to go to bed, so I'll give it another shot tomorrow. I got about 50 percent done and had nothing showing up.

A couple of things:

My desktop now has a few transparent icons that say "desktop.ini" and one file containing a couple of photographs that is also transparent. Inside the folder, with the photos, is another .ini file. Where did they come from and how do I correct this?

Now that I've downloaded all of these programs, what is the best way to remove all remnants of them?

And lastly; what on earth was causing the issues with my PC? I suspect the "SGPSA" file had something to do with it ... what the heck is this?

Short of sparking this thing up tomorrow evening and having it crash, I think you done a fine job of fixing this for me. I would like to thank you very much for your assistance ... you have a fine website here!

I will complete the Eset scan tomorrow and give you an update on the overall health of the computer.

Thanks again!

Solved Internet Explorer not responding properly ... very slow!

Posts: 24 +0

Posts: 56,041 +516

Posts: 24 +0

Posts: 24 +0

Posts: 24 +0

Posts: 24 +0

Posts: 24 +0

Posts: 56,041 +516

Posts: 24 +0

Posts: 24 +0

Posts: 24 +0

Posts: 56,041 +516

Posts: 24 +0

Posts: 56,041 +516

Posts: 24 +0

Posts: 24 +0

Posts: 24 +0

Posts: 24 +0

Posts: 24 +0

Posts: 24 +0

Posts: 56,041 +516

Posts: 24 +0

Posts: 24 +0

Posts: 56,041 +516

Posts: 24 +0

Similar threads