Webcam light turning on when I'm not using it

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Posted Image

Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.

Posted Image

DO NOT RUN ComboFix unless requested to.

Posted Image

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

Posted Image

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Posted Image

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

2 Pages
1
2
→

You cannot start a new topic
This topic is locked

Webcam light turning on when I'm not using it I suspect remote access. Has happened multiple times.

#1 ingraise

New Member

Group: Members
Posts: 7
Joined: 29-November 11

Posted 29 November 2011 - 01:49 AM

While using Skype video chat a few days ago, a message came up saying that another application was using my webcam and my outbound video was turned off automatically. I had to click the button to re-enable the video stream.
Then today I noticed my webcam light on at a time when I was not using it. It turned off on its own later without me doing anything.
I suspect some kind of remote webcam access.

I've also been experiencing some odd behavior in recognition of my keystrokes. I can type normally in every application but when playing Starcraft II and hitting hotkeys rapidly (b,b or b,s) the keystrokes are often not registering properly. I would normally suspect my keyboard but given that the problem only occurs when I'm running the most demanding application and that the webcam issue popped up at the same time, I'm wondering if a keylogger might be the culprit.

No GMER log attached as I'm running 64-bit Windows 7. DDS is below and Attach.txt is attached as required. Thanks in advance for any help, it's much appreciated.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_29
Run by x at 6:33:05 on 2011-11-29
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.12279.9909 [GMT 0:00]
.
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Broadcom\BPowMon\BPowMon.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe
C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
C:\Program Files (x86)\AlienRespawn\sftservice.EXE
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\DSUpd.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\AlienRespawn\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
C:\Program Files\Alienware\Command Center\ThermalController.exe
C:\Windows\System32\rundll32.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Alienware\Command Center\RemotingServiceController.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Alienware\Command Center\DoorController.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Alienware\Command Center\AlienFXHook32Mngr.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Alienware\Command Center\AlienFXHook64Mngr.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe

Attached File(s)

Attach.txt (5.37K)
Number of downloads: 2

#2 HelpBot

Bleepin' Binary Bot

Group: Bots
Posts: 5,607
Joined: 05-October 07
Gender:Male

Posted 04 December 2011 - 01:50 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

Posted Image

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/429814 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

Posted Image

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
- Please do this even if you have previously posted logs for us.
- If you were unable to produce the logs originally please try once more.
- If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
- If you are unsure about any of these characteristics just post what you can and we will guide you.
Please tell us if you have your original Windows CD/DVD available.
Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
- DDS.scr
- DDS.pif
Double click on the DDS icon, allow it to run.
A small box will open, with an explanation about the tool. No input is needed, the scan is running.
Notepad will open with the results.
Follow the instructions that pop up for posting the results.
Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 ingraise

New Member

Group: Members
Posts: 7
Joined: 29-November 11

Posted 04 December 2011 - 05:42 AM

Update: After a reboot, I've not noticed either problem any more. I ran Malware Bytes Anti-Malware full scan prior to the reboot and the only 'problems' identified were a few pieces of Casino software that were identified as PUP. They are wanted programs: I work in this industry and have good reason to trust the source and content of these applications.

Running the Anti-Malware active protection has resulted in only a few blocked attempted contacts, all to uTorrent.exe. These were at times when the application was not running locally and I was not downloading/sharing files. The attempts happened quite regularly.

I do not consider the problem resolved. Presumed remote access of my webcam is a serious issue and there's been nothing done to remove the possibility of such access. I'd like to identify and permanently fix the problem if possible. DDS log below and attach.txt is attached. Thanks.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_29
Run by x at 10:34:59 on 2011-12-04
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.12279.6984 [GMT 0:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Broadcom\BPowMon\BPowMon.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe
C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
C:\Program Files (x86)\AlienRespawn\sftservice.EXE
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\WUDFHost.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\AlienRespawn\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\DSUpd.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
C:\Program Files\Alienware\Command Center\ThermalController.exe
C:\Windows\System32\rundll32.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Pamela\Pamela.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
C:\Program Files (x86)\AlienRespawn\Toaster.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Alienware\Command Center\RemotingServiceController.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\Alienware\Command Center\DoorController.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Alienware\Command Center\AlienFXHook32Mngr.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Alienware\Command Center\AlienFXHook64Mngr.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\DllHost.exe
C:\Users\x\AppData\Roaming\Spotify\Spotify.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\StarCraft II\Versions\Base19679\SC2.exe
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://forumserver.twoplustwo.com/59/puzzles-other-games/
uDefault_Page_URL = hxxp://www.alienware.com/
mWinlogon: Userinit=userinit.exe
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [pamela.exe] "C:\Program Files (x86)\Pamela\Pamela.exe"
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun: [THX Audio Control Panel] "C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe" /r
mRun: [UpdReg] C:\Windows\UpdReg.EXE
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [<NO NAME>]
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce: [Launcher] C:\Program Files (x86)\AlienRespawn\Components\Scheduler\Launcher.exe
StartupFolder: C:\Users\x\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
IE: {809132AF-89D2-4d52-AA03-AB4E35BBDC5B} - C:\Program Files (x86)\PokerStars.TEST\PokerStarsUpdate.exe
IE: {878AC5FC-BE78-4bae-896C-7F75B790A71E} - C:\Program Files (x86)\PokerStars.BE\PokerStarsUpdate.exe
IE: {90EAE591-7E7E-434a-8E28-ECFD00071806} - C:\Program Files (x86)\PokerStars.FR\PokerStarsUpdate.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
IE: {C4046502-6524-4d87-896C-878F57D1FF07} - C:\Program Files (x86)\PokerStars.IT\PokerStarsUpdate.exe
IE: {CE9E9C20-E2C5-4dc0-8A80-CF344B557F5D} - C:\Program Files (x86)\PokerStars.ESPN\PokerStarsUpdate.exe
IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{31221730-934B-48D8-A4EB-0B136FD20986} : DhcpNameServer = 192.168.0.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO-X64: HP Print Enhancer - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [THX Audio Control Panel] "C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe" /r
mRun-x64: [UpdReg] C:\Windows\UpdReg.EXE
mRun-x64: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [(Default)]
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce-x64: [Launcher] C:\Program Files (x86)\AlienRespawn\Components\Scheduler\Launcher.exe
IE-X64: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
IE-X64: {809132AF-89D2-4d52-AA03-AB4E35BBDC5B} - C:\Program Files (x86)\PokerStars.TEST\PokerStarsUpdate.exe
IE-X64: {878AC5FC-BE78-4bae-896C-7F75B790A71E} - C:\Program Files (x86)\PokerStars.BE\PokerStarsUpdate.exe
IE-X64: {90EAE591-7E7E-434a-8E28-ECFD00071806} - C:\Program Files (x86)\PokerStars.FR\PokerStarsUpdate.exe
IE-X64: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
IE-X64: {C4046502-6524-4d87-896C-878F57D1FF07} - C:\Program Files (x86)\PokerStars.IT\PokerStarsUpdate.exe
IE-X64: {CE9E9C20-E2C5-4dc0-8A80-CF344B557F5D} - C:\Program Files (x86)\PokerStars.ESPN\PokerStarsUpdate.exe
IE-X64: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe
IE-X64: {64811787-6eb5-4248-9f1d-45c6bfc8302e} - C:\Users\x\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hero Poker\Hero Poker.lnk
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\x\AppData\Roaming\Mozilla\Firefox\Profiles\drqje82g.default\
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
.
============= SERVICES / DRIVERS ===============
.
R2 BPowMon;Broadcom Power monitoring service;C:\Program Files\Broadcom\BPowMon\BPowMon.exe [2009-10-27 117608]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-3 13336]
R2 JuniperAccessService;Juniper Unified Network Service;C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe [2010-10-22 198000]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-11-30 366152]
R2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files (x86)/PostgreSQL/8.4/data" -w --> C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 [?]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\AlienRespawn\SftService.exe [2010-11-3 705856]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-11-3 248936]
R3 AWOPFilterDriver;AWOPFilterDriver;\??\C:\Windows\system32\drivers\AWOPFilterDriver.sys --> C:\Windows\system32\drivers\AWOPFilterDriver.sys [?]
R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;C:\Windows\system32\Drivers\nx6000.sys --> C:\Windows\system32\Drivers\nx6000.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S2 AlienFusionService;Alienware Fusion Service;C:\Program Files\Alienware\Command Center\AlienFusionService.exe [2010-5-4 14648]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
.
=============== Created Last 30 ================
.
2011-12-04 10:12:04 -------- d-----w- C:\Users\x\AppData\Local\{07E407E3-B217-4EAD-9D55-64DBE7BC4D50}
2011-12-04 10:11:53 -------- d-----w- C:\Users\x\AppData\Local\{BA6F19B9-1891-44F1-A3CC-B66699FD58F6}
2011-12-03 22:11:57 -------- d-----w- C:\Users\x\AppData\Local\{D871E9DF-7391-4984-960C-AC8FF7AC285D}
2011-12-03 22:11:46 -------- d-----w- C:\Users\x\AppData\Local\{F2A01E9D-21DB-4320-B228-84502255FC73}
2011-12-03 20:24:16 -------- d-----w- C:\Users\x\AppData\Local\{50189A96-D754-4E90-907F-1981F60643F0}
2011-12-03 20:24:03 -------- d-----w- C:\Users\x\AppData\Local\{284915BD-BFF1-4BC5-BF28-833204A182AF}
2011-12-03 08:24:14 -------- d-----w- C:\Users\x\AppData\Local\{C127C093-EFA3-4C87-B9DD-691B50307074}
2011-12-03 08:24:03 -------- d-----w- C:\Users\x\AppData\Local\{A776D004-86BC-4A30-BB1B-95F077FEA2D9}
2011-12-02 20:24:14 -------- d-----w- C:\Users\x\AppData\Local\{7416D432-6F32-45BE-8962-5DE3B03EAF4C}
2011-12-02 20:24:03 -------- d-----w- C:\Users\x\AppData\Local\{360E7149-AE55-4DB1-953B-AF0E8C3B01C5}
2011-12-02 08:24:14 -------- d-----w- C:\Users\x\AppData\Local\{50422E5D-FA17-492C-9C64-51E841BFD726}
2011-12-02 08:24:03 -------- d-----w- C:\Users\x\AppData\Local\{78938A51-167B-45F3-A5F8-40FA6468D4EB}
2011-12-01 19:36:42 -------- d-----w- C:\Users\x\AppData\Local\{DD4C8921-94EA-4B87-A01E-41A73938F393}
2011-12-01 19:36:31 -------- d-----w- C:\Users\x\AppData\Local\{5EAFCAAD-BC18-42BF-9994-DE2DECD59CC4}
2011-12-01 07:36:42 -------- d-----w- C:\Users\x\AppData\Local\{E3179FB6-787E-441B-AD49-650195BE683E}
2011-12-01 07:36:31 -------- d-----w- C:\Users\x\AppData\Local\{2E235724-8B58-4D18-850A-50667A879C5B}
2011-11-30 20:12:15 -------- d-----w- C:\Users\x\AppData\Local\{0AD93B12-7A2E-4702-9C6B-E800E0C1DD24}
2011-11-30 20:11:58 -------- d-----w- C:\Users\x\AppData\Local\{CA05C3C9-F7F7-448B-95E0-8E13E848CD3F}
2011-11-30 20:08:56 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E5EA4390-C3E9-4ECB-AB6D-703188FCB116}\offreg.dll
2011-11-30 20:07:35 -------- d-----w- C:\Users\x\AppData\Local\{F48E9EBB-3A6B-473D-8395-DB0A88C745FE}
2011-11-30 20:07:20 -------- d-----w- C:\Users\x\AppData\Local\{EDC53C56-76DD-418C-AA35-806784FD286A}
2011-11-30 20:02:24 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E5EA4390-C3E9-4ECB-AB6D-703188FCB116}\mpengine.dll
2011-11-30 19:24:45 -------- d-----w- C:\Users\x\AppData\Local\{0E183C86-E5EB-4A82-A317-090006A18762}
2011-11-30 19:24:32 -------- d-----w- C:\Users\x\AppData\Local\{D5ADC75B-F33D-4969-99B6-CDEA5E69F258}
2011-11-30 10:18:53 -------- d-----w- C:\Users\x\AppData\Local\{28B8FD1B-1642-407C-8BDF-219749B04329}
2011-11-30 10:18:41 -------- d-----w- C:\Users\x\AppData\Local\{E67EE7B8-541A-4A19-949C-5062C1E22CA4}
2011-11-30 09:25:11 -------- d-----w- C:\Users\x\AppData\Local\{2CF5AB2B-1D5E-4DA4-8E9F-A18D59707323}
2011-11-30 08:08:45 -------- d-----w- C:\Users\x\AppData\Roaming\Malwarebytes
2011-11-30 08:08:38 -------- d-----w- C:\ProgramData\Malwarebytes
2011-11-30 08:08:35 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-11-30 08:08:35 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-11-30 07:24:44 -------- d-----w- C:\Users\x\AppData\Local\{DC12E14B-82D6-410E-A7C2-480388E49BEF}
2011-11-30 07:24:32 -------- d-----w- C:\Users\x\AppData\Local\{C33076B2-7274-4E33-9F08-C9F54005E08D}
2011-11-29 19:24:43 -------- d-----w- C:\Users\x\AppData\Local\{8F6F9D5B-4F4F-4667-A6E8-0BCD20F7EE54}
2011-11-29 19:24:32 -------- d-----w- C:\Users\x\AppData\Local\{C0DF0394-CE9C-4705-98A5-6260A6FAC4F2}
2011-11-29 18:05:19 -------- d-----w- C:\Users\x\AppData\Local\{54435946-50EE-4B1E-9E71-6648D36F20BC}
2011-11-29 18:05:07 -------- d-----w- C:\Users\x\AppData\Local\{AECB989C-CAE6-4B1E-81F3-C712A8088539}
2011-11-29 07:24:43 -------- d-----w- C:\Users\x\AppData\Local\{2DEEBAFC-597E-448D-9529-E786AEE1F15E}
2011-11-29 07:24:32 -------- d-----w- C:\Users\x\AppData\Local\{0516981B-537F-482B-8ABE-CB3A2F897DED}
2011-11-29 06:57:15 -------- d-----w- C:\Users\x\AppData\Local\{A5CB827C-8E5F-413C-B2ED-082CC75876DD}
2011-11-29 06:57:04 -------- d-----w- C:\Users\x\AppData\Local\{0EBFA1A0-D2F4-48BE-8A70-4B946309FB9C}
2011-11-29 06:18:52 -------- d-----w- C:\Users\x\AppData\Local\{94109EB1-9310-44B6-9887-BE0E7C702848}
2011-11-29 06:18:41 -------- d-----w- C:\Users\x\AppData\Local\{DA7B6B11-7787-4051-9DAF-E09B6FAB78A3}
2011-11-29 05:34:02 -------- d-----w- C:\Users\x\AppData\Local\{D8EC8346-CF33-44FD-9B0F-224E02A68B04}
2011-11-29 05:33:51 -------- d-----w- C:\Users\x\AppData\Local\{908385E0-4CDD-4D97-B721-8AA4C8034705}
2011-11-28 17:34:03 -------- d-----w- C:\Users\x\AppData\Local\{2B95B360-F0DE-420D-AF90-F32388DEDE78}
2011-11-28 17:33:51 -------- d-----w- C:\Users\x\AppData\Local\{6899E682-85A2-4311-A255-3D156A30524C}
2011-11-28 11:55:19 -------- d-----w- C:\Users\x\AppData\Local\{1853D697-8F2B-4952-95BA-865F4B18F974}
2011-11-28 11:55:05 -------- d-----w- C:\Users\x\AppData\Local\{E3F37F00-AA11-4447-BF37-B002806C438F}
2011-11-27 23:55:17 -------- d-----w- C:\Users\x\AppData\Local\{676AACCE-9C39-45F7-ADF2-551A40071512}
2011-11-27 23:55:05 -------- d-----w- C:\Users\x\AppData\Local\{C366B6FD-F7E2-4FF9-84AD-82920C5891BC}
2011-11-27 12:09:34 -------- d-----w- C:\Users\x\AppData\Local\{591DC125-0DE8-42BF-B141-090F2DE712C1}
2011-11-27 12:09:22 -------- d-----w- C:\Users\x\AppData\Local\{DC3A2B59-DD6B-4FA0-8113-C5DC443F1151}
2011-11-27 00:09:47 -------- d-----w- C:\Users\x\AppData\Local\{EC46CCF0-AF86-4C44-A49C-31955E2ADA92}
2011-11-27 00:09:35 -------- d-----w- C:\Users\x\AppData\Local\{FB4FA237-D6CE-418C-AE56-DD5F53C71A02}
2011-11-26 12:09:46 -------- d-----w- C:\Users\x\AppData\Local\{254D61A5-F792-48D1-BE07-47423C4C117B}
2011-11-26 12:09:35 -------- d-----w- C:\Users\x\AppData\Local\{72CD9C77-1558-4803-A800-01B8DF69E9AB}
2011-11-26 00:09:47 -------- d-----w- C:\Users\x\AppData\Local\{ED522F50-A22E-4E99-B35D-DCD2C16CCA0C}
2011-11-26 00:09:35 -------- d-----w- C:\Users\x\AppData\Local\{037FC24F-16DD-4F90-9925-CC922C87653D}
2011-11-25 12:09:47 -------- d-----w- C:\Users\x\AppData\Local\{23B59F15-388F-45CC-AC3F-1679613E7F1F}
2011-11-25 12:09:35 -------- d-----w- C:\Users\x\AppData\Local\{735670B4-BDB9-4D62-B789-078AB6778CEE}
2011-11-25 00:09:46 -------- d-----w- C:\Users\x\AppData\Local\{1B31AB10-C1B5-410F-88B9-A8CB64B0928C}
2011-11-25 00:09:35 -------- d-----w- C:\Users\x\AppData\Local\{FAED8BC4-8E9A-4C01-A8F7-708E0DCD1D7D}
2011-11-24 12:09:46 -------- d-----w- C:\Users\x\AppData\Local\{10242DA7-F8DE-4527-B2C9-E507A1EF4B4C}
2011-11-24 12:09:35 -------- d-----w- C:\Users\x\AppData\Local\{CA8D9D4F-9892-40C8-92AC-29A6A52729D9}
2011-11-24 00:09:46 -------- d-----w- C:\Users\x\AppData\Local\{C15FD17E-4386-43E7-943B-06299B2F605C}
2011-11-24 00:09:35 -------- d-----w- C:\Users\x\AppData\Local\{A96F8168-C08A-459A-BF9C-19B1FB242345}
2011-11-23 13:51:38 -------- d-----w- C:\Users\x\AppData\Local\{4B60D5EC-031D-4B4B-8F86-A7CCDCB003D4}
2011-11-23 13:51:27 -------- d-----w- C:\Users\x\AppData\Local\{3FF6E2CB-B83B-4629-B419-F6887AE9214E}
2011-11-23 01:51:38 -------- d-----w- C:\Users\x\AppData\Local\{F105B5C7-5F08-4581-9F89-C3B8348DB017}
2011-11-23 01:51:27 -------- d-----w- C:\Users\x\AppData\Local\{83E7034C-2F17-42D2-833B-C1EDACC28416}
2011-11-22 13:51:38 -------- d-----w- C:\Users\x\AppData\Local\{84011064-7110-421A-A0C9-C2597500326A}
2011-11-22 13:51:27 -------- d-----w- C:\Users\x\AppData\Local\{4B9635C6-AB17-4364-9B0F-01309AB5ECEE}
2011-11-22 11:36:52 -------- d-----w- C:\Users\x\AppData\Local\{18909B31-5826-42E7-9D16-3F0DF3EB44C5}
2011-11-22 11:36:40 -------- d-----w- C:\Users\x\AppData\Local\{378D2DFC-0C49-4D96-9FF8-D4DDA3AD4A5B}
2011-11-22 06:00:18 -------- d-----w- C:\Users\x\AppData\Local\{50EA16DE-2E70-402D-9CD4-E5569385E379}
2011-11-22 06:00:07 -------- d-----w- C:\Users\x\AppData\Local\{7A29F126-79CA-4179-9FFB-9930BB348519}
2011-11-22 02:21:07 -------- d-----w- C:\Users\x\AppData\Local\{8C56A9DE-E94D-497C-AD31-312A58E47EE8}
2011-11-22 02:20:56 -------- d-----w- C:\Users\x\AppData\Local\{A404A01D-2655-4470-99BE-C3436BD3BB90}
2011-11-21 20:05:30 -------- d-----w- C:\Users\x\AppData\Local\{4B3A45D4-9E0E-4742-B704-CE2A8EDAB3E4}
2011-11-21 20:05:19 -------- d-----w- C:\Users\x\AppData\Local\{BD753457-628A-4A93-8887-036119F3DD01}
2011-11-21 15:17:05 -------- d-----w- C:\Users\x\AppData\Local\{5ED710EB-2945-4CD5-8518-E36DE818030C}
2011-11-21 15:16:55 -------- d-----w- C:\Users\x\AppData\Local\{40D3CF81-D491-481B-A224-66208148BB0B}
2011-11-21 03:50:19 -------- d-----w- C:\Users\x\AppData\Local\{EAD3F5CE-7434-41CE-BB67-B9FF598EB775}
2011-11-21 03:50:08 -------- d-----w- C:\Users\x\AppData\Local\{F0FE7460-2D28-4912-9372-5238DDB23A28}
2011-11-21 00:12:33 -------- d-----w- C:\Users\x\AppData\Local\{FF9181D6-AF40-4F15-936D-B81683426674}
2011-11-21 00:12:21 -------- d-----w- C:\Users\x\AppData\Local\{0DF69C89-AE9A-46D0-8DF5-70B89847D956}
2011-11-20 12:12:32 -------- d-----w- C:\Users\x\AppData\Local\{B7FFFA2A-6CCD-4871-9F32-5A235BFBA6BC}
2011-11-20 12:12:21 -------- d-----w- C:\Users\x\AppData\Local\{1C7BCBA3-3FFE-4C9F-91F7-43172A266976}
2011-11-20 01:42:51 -------- d-----w- C:\Users\x\AppData\Local\{81A45A45-348A-4E73-A676-020472FB42B4}
2011-11-20 01:42:40 -------- d-----w- C:\Users\x\AppData\Local\{E6A32705-F0CF-4E83-8FA6-B4231DE457A2}
2011-11-19 23:34:30 -------- d-----w- C:\Users\x\AppData\Local\{E0C2950E-5421-4F50-A333-65341A30A19D}
2011-11-19 23:34:18 -------- d-----w- C:\Users\x\AppData\Local\{3DF1D16D-1B66-42CC-803A-09CA885EEA5C}
2011-11-19 19:42:28 -------- d-----w- C:\Users\x\AppData\Local\{6B7B81EA-DA90-421F-946E-668ECE8646C3}
2011-11-19 19:42:17 -------- d-----w- C:\Users\x\AppData\Local\{302254E1-C17D-4023-8BA2-6E7EB3A9FDEA}
2011-11-19 07:42:28 -------- d-----w- C:\Users\x\AppData\Local\{709452C2-E6ED-4A0B-BA85-F63CCF7E84C8}
2011-11-19 07:42:17 -------- d-----w- C:\Users\x\AppData\Local\{6D1613E9-DEE1-4D69-A066-18110C1AC008}
2011-11-19 00:58:11 -------- d-----w- C:\Users\x\AppData\Local\{A1A48BC6-11C6-4703-8B1A-DA26EF13B7F1}
2011-11-19 00:58:00 -------- d-----w- C:\Users\x\AppData\Local\{9AE07298-9839-4BC0-8E75-DE37F744D8E9}
2011-11-18 12:58:11 -------- d-----w- C:\Users\x\AppData\Local\{F879FC8B-C057-4ABF-9ABA-5C7C4C575BD8}
2011-11-18 12:58:00 -------- d-----w- C:\Users\x\AppData\Local\{2FDF7386-90B8-480F-AB79-642C69CCB54E}
2011-11-17 21:23:28 -------- d-----w- C:\Users\x\AppData\Local\{76A68E05-6CE3-49D6-9454-2BA5A096B22F}
2011-11-17 21:23:17 -------- d-----w- C:\Users\x\AppData\Local\{D9F08D3B-EE64-412C-9737-F4CDB84DD833}
2011-11-17 09:23:28 -------- d-----w- C:\Users\x\AppData\Local\{62FC2A96-4422-449C-8C99-6EF8E3EA83F9}
2011-11-17 09:23:17 -------- d-----w- C:\Users\x\AppData\Local\{CC8ABF1F-34FD-4849-94A1-742C8354F198}
2011-11-17 08:56:27 -------- d-----w- C:\Users\x\AppData\Local\{6BFA38B7-E2EE-499C-AD4C-B2BFD3927BC6}
2011-11-17 06:47:56 -------- d-----w- C:\Users\x\AppData\Local\Microsoft Games
2011-11-17 05:09:45 -------- d-----w- C:\Users\x\AppData\Local\{EB0DED8A-CAF9-4995-8119-5CA2150B4F81}
2011-11-17 05:09:34 -------- d-----w- C:\Users\x\AppData\Local\{DA611109-2800-486D-85A2-EEF54793BD61}
2011-11-16 17:09:45 -------- d-----w- C:\Users\x\AppData\Local\{86F3AB92-5414-4C9E-8424-6B4E54C67588}
2011-11-16 17:09:34 -------- d-----w- C:\Users\x\AppData\Local\{88C14ECF-BD94-419E-ABB9-E559A4599B68}
2011-11-16 02:39:30 -------- d-----w- C:\Users\x\AppData\Local\{3761135E-A330-4767-BF6A-C58C4AE68699}
2011-11-16 02:39:19 -------- d-----w- C:\Users\x\AppData\Local\{91301308-1FFB-46AE-A7AD-4020B111DD17}
2011-11-15 14:39:30 -------- d-----w- C:\Users\x\AppData\Local\{10879FDA-A5E4-4FFF-A246-8F84AB53F2E3}
2011-11-15 14:39:19 -------- d-----w- C:\Users\x\AppData\Local\{72AFB086-2C72-413C-B975-243938B5C5A4}
2011-11-15 02:39:30 -------- d-----w- C:\Users\x\AppData\Local\{A81E239E-06E3-4592-BCDC-490F3759DE1B}
2011-11-15 02:39:19 -------- d-----w- C:\Users\x\AppData\Local\{945207B8-6625-47E2-8F18-1BA895F40942}
2011-11-14 14:39:30 -------- d-----w- C:\Users\x\AppData\Local\{40AB5019-3900-4FA9-BD08-8D050BF87293}
2011-11-14 14:39:19 -------- d-----w- C:\Users\x\AppData\Local\{66483D3E-4E21-4051-AC6C-004D5D8E8C3E}
2011-11-14 02:39:31 -------- d-----w- C:\Users\x\AppData\Local\{94205786-8275-40C2-BBA1-3125DA81D0B3}
2011-11-14 02:39:19 -------- d-----w- C:\Users\x\AppData\Local\{3B3A0234-A95E-4BC3-9BFD-07D7974A811C}
2011-11-13 14:39:30 -------- d-----w- C:\Users\x\AppData\Local\{A0D07CA4-4965-45EA-B18E-1B218CB3D67F}
2011-11-13 14:39:19 -------- d-----w- C:\Users\x\AppData\Local\{B6BE8ADE-D9BB-4518-BEEE-63DDAEBF51FF}
2011-11-13 02:39:30 -------- d-----w- C:\Users\x\AppData\Local\{D1340229-8CBF-4109-9DC0-BD7A4D71124C}
2011-11-13 02:39:19 -------- d-----w- C:\Users\x\AppData\Local\{0FC8482C-A868-4472-84C6-A340CB25448B}
2011-11-12 14:39:44 -------- d-----w- C:\Users\x\AppData\Local\{82EAC302-BD0A-4BEF-B4ED-2777B5A090B4}
2011-11-12 14:39:32 -------- d-----w- C:\Users\x\AppData\Local\{AFD51B72-FE2E-47BD-B664-93A81FB55BD4}
2011-11-12 02:39:43 -------- d-----w- C:\Users\x\AppData\Local\{DA647BF1-D10B-4A1F-AE0A-8282A0C6E170}
2011-11-12 02:39:32 -------- d-----w- C:\Users\x\AppData\Local\{B0F98BCE-A393-475F-AE80-D832408F6EB6}
2011-11-11 14:39:43 -------- d-----w- C:\Users\x\AppData\Local\{360F20C5-56C1-484E-85B3-35EE8D6C7F3B}
2011-11-11 14:39:32 -------- d-----w- C:\Users\x\AppData\Local\{DD6B95C9-D290-4FB1-842F-B83C7FC358EA}
2011-11-11 02:39:43 -------- d-----w- C:\Users\x\AppData\Local\{F8241272-B98F-41E1-AEC6-3C79CFBFB232}
2011-11-11 02:39:32 -------- d-----w- C:\Users\x\AppData\Local\{A7B765FF-9736-425D-AB71-374ED9FA2B68}
2011-11-10 14:39:43 -------- d-----w- C:\Users\x\AppData\Local\{7AED187D-7720-495F-8AD0-90ADB4ADFFF9}
2011-11-10 14:39:32 -------- d-----w- C:\Users\x\AppData\Local\{3C63A1A0-CA5F-4254-B8BC-9B88EEFABF6A}
2011-11-10 02:39:43 -------- d-----w- C:\Users\x\AppData\Local\{93014A3A-5BE6-4AB7-8947-B8B77D05C170}
2011-11-10 02:39:32 -------- d-----w- C:\Users\x\AppData\Local\{6081C395-8A43-408E-9719-E55F73E51A61}
2011-11-10 02:27:44 -------- d-----w- C:\Users\x\AppData\Local\{1E680430-1E4C-4478-991A-35E257B00973}
2011-11-09 19:35:00 -------- d-----w- C:\Users\x\AppData\Local\{1B75C222-76A2-4310-97F7-34BEB46E638C}
2011-11-09 19:34:49 -------- d-----w- C:\Users\x\AppData\Local\{55B491F5-2E77-4B9F-8446-03FDB3F311C8}
2011-11-09 18:35:47 -------- d-----w- C:\Users\x\AppData\Local\{1F03430C-1B9D-4002-8520-55CE9624F12D}
2011-11-09 18:35:36 -------- d-----w- C:\Users\x\AppData\Local\{F18EF302-16EC-4CFD-8F2C-CC6F794A8EB4}
2011-11-09 09:28:09 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll
2011-11-09 09:28:09 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll
2011-11-09 09:28:05 1897328 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2011-11-09 09:28:04 3141120 ----a-w- C:\Windows\System32\win32k.sys
2011-11-09 06:35:49 -------- d-----w- C:\Users\x\AppData\Local\{B0079E28-47FD-4733-B710-10338C8336DE}
2011-11-09 06:35:36 -------- d-----w- C:\Users\x\AppData\Local\{959236C3-E972-4729-8210-0C605BA8F92B}
2011-11-08 18:35:47 -------- d-----w- C:\Users\x\AppData\Local\{C76801E6-7C26-4B55-ACBA-133BA7F83352}
2011-11-08 18:35:36 -------- d-----w- C:\Users\x\AppData\Local\{D09F2EC8-4120-4388-8640-1B6356847BAB}
2011-11-08 06:27:52 -------- d-----w- C:\Users\x\AppData\Local\{AE21FDDF-34BC-4E8D-B92F-D34493969555}
2011-11-08 06:27:41 -------- d-----w- C:\Users\x\AppData\Local\{93A066D4-F4BF-4804-981D-D1CCB13C5896}
2011-11-07 18:27:52 -------- d-----w- C:\Users\x\AppData\Local\{B3213772-9882-42E6-99EF-B8E4894527C5}
2011-11-07 18:27:41 -------- d-----w- C:\Users\x\AppData\Local\{F19EE369-61E9-411F-8CC5-C6C712D2411B}
2011-11-07 06:53:11 -------- d-----w- C:\Users\x\AppData\Local\{C819021D-F637-4645-898A-0F19BB9DF158}
2011-11-07 06:53:00 -------- d-----w- C:\Users\x\AppData\Local\{5E362318-2622-4F15-8CED-E850D64F15E1}
2011-11-06 18:53:11 -------- d-----w- C:\Users\x\AppData\Local\{0689A02E-4BF7-4439-ADA3-99B9A803FF15}
2011-11-06 18:53:00 -------- d-----w- C:\Users\x\AppData\Local\{DE7362F4-08C4-4AA6-9419-236BB0C77CBD}
2011-11-06 06:53:11 -------- d-----w- C:\Users\x\AppData\Local\{B4DE567E-F6D8-4CD3-ADEC-C125E56E17F5}
2011-11-06 06:53:00 -------- d-----w- C:\Users\x\AppData\Local\{B21203CC-8B97-4CD0-BE08-CA97B4640CA3}
2011-11-05 18:53:21 -------- d-----w- C:\Users\x\AppData\Local\{30C8D674-10BD-422A-9B9A-0DD1F2A5F124}
2011-11-05 18:53:10 -------- d-----w- C:\Users\x\AppData\Local\{CE57B5C7-F434-4706-A0C8-F3D8930909D8}
2011-11-05 06:53:21 -------- d-----w- C:\Users\x\AppData\Local\{0E0FBE34-626E-4D5F-992C-0ED8EF8DF77B}
2011-11-05 06:53:10 -------- d-----w- C:\Users\x\AppData\Local\{13906AA6-F6F1-420D-80FA-288B8C70567B}
2011-11-04 18:53:21 -------- d-----w- C:\Users\x\AppData\Local\{6F093702-B8B6-4A19-865E-396BB3BC4370}
2011-11-04 18:53:10 -------- d-----w- C:\Users\x\AppData\Local\{5E116BCB-F208-44A1-9F7F-71F64F6254CE}
.
==================== Find3M ====================
.
2011-10-30 23:42:45 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-03 04:06:03 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-10-01 03:21:20 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-10-01 02:59:14 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
.
============= FINISH: 10:35:28.99 ===============

Attached File(s)

Attach.txt (7.23K)
Number of downloads: 1

#4 m0le

I know the drill!

Group: Malware Response Instructor
Posts: 29,125
Joined: 24-July 08
Gender:Male
Location:London, UK

Posted 05 December 2011 - 08:38 PM

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.

Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.

Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

Please reply to this post so I know you are there.

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

----------------------------------------------

The symptoms don't scream malware but your computer habits (poker, p2p) make me think there may be more to this.

Can you run OTL, a scanner, and we'll see what there is there.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

If I have helped you fix your PC then please donate. Thanks

Posted Image

m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#5 ingraise

New Member

Group: Members
Posts: 7
Joined: 29-November 11

Posted 06 December 2011 - 05:16 AM

If it doesn't scream malware, what does it scream?

OTL.txt:
OTL logfile created on: 12/6/2011 9:57:50 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\x\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

11.99 Gb Total Physical Memory | 8.86 Gb Available Physical Memory | 73.92% Memory free
23.98 Gb Paging File | 19.81 Gb Available in Paging File | 82.59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 456.19 Gb Total Space | 259.27 Gb Free Space | 56.83% Space Free | Partition Type: NTFS
Unable to calculate disk information.

Computer Name: DABOO | User Name: x | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\x\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\x\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files (x86)\Pamela\Pamela.exe (Scendix Software GmbH)
PRC - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\DSUpd.exe (SoftThinks - Dell)
PRC - C:\Program Files (x86)\AlienRespawn\Toaster.exe (SoftThinks - Dell)
PRC - C:\Program Files (x86)\AlienRespawn\Components\Scheduler\STService.exe ()
PRC - C:\Program Files (x86)\AlienRespawn\SftService.exe (SoftThinks SAS)
PRC - C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe (Juniper Networks)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Alienware\Command Center\AlienFXHook32Mngr.exe (Alienware)
PRC - C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe (Alienware Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe (PostgreSQL Global Development Group)
PRC - C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe (PostgreSQL Global Development Group)
PRC - C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\5a95ba97100404e2ab26b5a9ab9ef965\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d76221993c2fdfb991b8c12ae50a30eb\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\0e245eb9c1067cabd5673fe832d28613\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d71769228ebe7732ae31ac194fe00ff0\Accessibility.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\275680f2b9db0501d53c50ea7d7a43f0\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e9ebeb7959f1c916ebf6fca8f7077d6c\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\95b9866ab6e4437ef5dc5855ebab4e33\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll ()
MOD - C:\Program Files (x86)\Pamela\zlib.dll ()
MOD - C:\Program Files (x86)\AlienRespawn\SftBRCCPiped.dll ()
MOD - C:\Program Files (x86)\AlienRespawn\Components\Scheduler\STService.exe ()
MOD - C:\Program Files (x86)\AlienRespawn\zlib1.dll ()
MOD - C:\Program Files (x86)\AlienRespawn\STRegistry.dll ()
MOD - C:\Program Files (x86)\AlienRespawn\STPE.dll ()
MOD - C:\Program Files (x86)\AlienRespawn\STNLS.dll ()
MOD - C:\Program Files (x86)\AlienRespawn\STLog.dll ()
MOD - C:\Program Files (x86)\AlienRespawn\STFiles.dll ()
MOD - C:\Program Files (x86)\AlienRespawn\STBRCCServCLR.dll ()
MOD - C:\Program Files (x86)\AlienRespawn\libxml2.dll ()
MOD - C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienLabs.MasterIOBoard.Communication.PID0x513\1.0.90.0__bebb3c8816410241\AlienLabs.MasterIOBoard.Communication.PID0x513.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienLabs.MasterIOBoard.Communication\1.0.90.0__bebb3c8816410241\AlienLabs.MasterIOBoard.Communication.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienLabs.MasterIOBoard.Communication.Core\1.0.90.0__bebb3c8816410241\AlienLabs.MasterIOBoard.Communication.Core.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienwareAlienFXModelResources\1.0.90.0__bebb3c8816410241\AlienwareAlienFXModelResources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienwareAlienFXTools\1.0.90.0__bebb3c8816410241\AlienwareAlienFXTools.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienLabsTools\1.0.90.0__bebb3c8816410241\AlienLabsTools.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Alienlabs.CommandCenter.Tools\1.0.90.0__bebb3c8816410241\Alienlabs.CommandCenter.Tools.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x511\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x511.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x514\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x514.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x512\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x512.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x516\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x516.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x515\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x515.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LightFX\1.0.90.0__bebb3c8816410241\LightFX.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.XPS\1.0.90.0__bebb3c8816410241\AlienFX.Communication.XPS.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.DeviceDiscovery\1.0.90.0__bebb3c8816410241\AlienFX.DeviceDiscovery.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x513\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x513.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.Core\1.0.90.0__bebb3c8816410241\AlienFX.Communication.Core.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication\1.0.90.0__bebb3c8816410241\AlienFX.Communication.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll ()
MOD - C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll ()
MOD - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (AlienFusionService) -- C:\Program Files\Alienware\Command Center\AlienFusionService.exe (Alienware)
SRV:64bit: - (BPowMon) -- C:\Program Files\Broadcom\BPowMon\BPowMon.exe (Broadcom Corp.)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SftService) -- C:\Program Files (x86)\AlienRespawn\sftservice.EXE (SoftThinks SAS)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (JuniperAccessService) -- C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe (Juniper Networks)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (IAStorDataMgrSvc) Intel® -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (HPSLPSVC) -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (postgresql-8.4) -- C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe (PostgreSQL Global Development Group)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)

========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (VBoxNetAdp) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys (Oracle Corporation)
DRV:64bit: - (MSHUSBVideo) -- C:\Windows\SysNative\drivers\nx6000.sys (Microsoft Corporation)
DRV:64bit: - (AWOPFilterDriver) -- C:\Windows\SysNative\drivers\AWOPFilterDriver.sys ()
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (SI3132) -- C:\Windows\SysNative\drivers\SI3132.sys (Silicon Image, Inc)
DRV:64bit: - (SiFilter) -- C:\Windows\SysNative\drivers\SiWinAcc.sys (Silicon Image, Inc)
DRV:64bit: - (SiRemFil) -- C:\Windows\SysNative\drivers\SiRemFil.sys (Silicon Image, Inc)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.alienware.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://support.alienware.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://forumserver.twoplustwo.com/59/puzzles-other-games/
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.24

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/11/21 15:31:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/11/09 19:36:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/11/09 19:36:38 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/11/21 15:31:25 | 000,000,000 | ---D | M]

[2010/11/09 10:55:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x\AppData\Roaming\Mozilla\Extensions
[2010/11/09 10:55:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2010/11/09 10:55:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x\AppData\Roaming\Mozilla\Firefox\Profiles\drqje82g.default\extensions
[2011/10/27 13:52:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/11/09 19:36:38 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/12/24 02:28:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/05/14 01:53:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/10/27 13:52:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011/11/09 19:36:37 | 000,025,560 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browserdirprovider.dll
[2011/11/09 19:36:37 | 000,140,760 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\brwsrcmp.dll
[2009/11/06 16:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll
[2011/10/03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2009/11/06 16:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/11/09 19:36:37 | 000,067,032 | ---- | M] (mozilla.org) -- C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll
[2011/03/12 11:28:40 | 000,103,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll
[2010/10/27 05:24:34 | 000,001,538 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazon-en-GB.xml
[2010/10/27 05:24:34 | 000,002,193 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\answers.xml
[2010/10/27 05:24:34 | 000,000,947 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\chambers-en-GB.xml
[2010/10/27 05:24:34 | 000,001,534 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\creativecommons.xml
[2010/10/27 05:24:34 | 000,000,769 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-en-GB.xml
[2010/10/27 05:24:34 | 000,002,371 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\google.xml
[2010/10/27 05:24:34 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia.xml
[2010/10/27 05:24:34 | 000,001,135 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/06/10 21:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [AlienFX Controller] C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe (Alienware Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RunDLLEntry_EptMon] C:\Windows\SysNative\EptMon64.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [RunDLLEntry_THXCfg] C:\Windows\SysNative\THXCfg64.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [Thermal Controller] C:\Program Files\Alienware\Command Center\ThermalController.exe (Alienware Corp.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe (Google Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [THX Audio Control Panel] C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKCU..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [pamela.exe] C:\Program Files (x86)\Pamela\Pamela.exe (Scendix Software GmbH)
O4 - HKCU..\Run: [Skype] C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\AlienRespawn\Components\Scheduler\Launcher.exe (Softthinks)
O4 - Startup: C:\Users\x\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8:64bit: - Extra context menu item: Se&nd to OneNote - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: TestPokerStars.com - {809132AF-89D2-4d52-AA03-AB4E35BBDC5B} - C:\Program Files (x86)\PokerStars.TEST\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: PokerStars.be - {878AC5FC-BE78-4bae-896C-7F75B790A71E} - C:\Program Files (x86)\PokerStars.BE\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: PokerStars.fr - {90EAE591-7E7E-434a-8E28-ECFD00071806} - C:\Program Files (x86)\PokerStars.FR\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: PokerStars.it - {C4046502-6524-4d87-896C-878F57D1FF07} - C:\Program Files (x86)\PokerStars.IT\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: ESPN Poker Club - {CE9E9C20-E2C5-4dc0-8A80-CF344B557F5D} - C:\Program Files (x86)\PokerStars.ESPN\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{31221730-934B-48D8-A4EB-0B136FD20986}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29:64bit: - HKLM SecurityProviders - (credssp.dll) -C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) -C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O30:64bit: - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) -C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corp.)
O30 - LSA: Security Packages - (kerberos) -C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) -C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) -C:\Windows\SysWow64\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) -C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) -C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) -C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) -C:\Windows\SysWow64\livessp.dll (Microsoft Corp.)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/06 08:56:58 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{2DF3A59D-6B2E-4E53-A917-D1C69D097CBA}
[2011/12/06 08:56:47 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{73FCC1ED-5A71-43DB-AC5F-61591360B250}
[2011/12/05 20:56:58 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{5641144D-9CD3-48F7-A7ED-77ABA65BBCA0}
[2011/12/05 20:56:47 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{C8AC6603-2F1D-4B22-87D5-6B26FF2E10DA}
[2011/12/05 10:11:11 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{608D4BEA-C461-4A6B-A0AB-C900F666E43F}
[2011/12/05 10:10:58 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{32A503EF-A9D9-4D72-89B4-3C2FDA512B62}
[2011/12/04 23:52:17 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{9A984355-FCC5-442A-B343-D87E4FFD50D2}
[2011/12/04 23:52:04 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{1D75F3CB-C1FA-442B-9452-369A4DE8CD0A}
[2011/12/04 18:30:12 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{E4819B5A-2679-499F-B06F-3B98292CD280}
[2011/12/04 18:29:58 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{F516F60B-3CA9-4F87-AE1C-212CA08F14EC}
[2011/12/04 15:04:04 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{DBA4828D-8F98-467A-9478-03B5E0E66EC9}
[2011/12/04 15:03:53 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{9DF49F95-4081-4B88-8077-2B29CCFDB223}
[2011/12/04 10:12:04 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{07E407E3-B217-4EAD-9D55-64DBE7BC4D50}
[2011/12/04 10:11:53 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{BA6F19B9-1891-44F1-A3CC-B66699FD58F6}
[2011/12/03 22:11:57 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{D871E9DF-7391-4984-960C-AC8FF7AC285D}
[2011/12/03 22:11:46 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{F2A01E9D-21DB-4320-B228-84502255FC73}
[2011/12/03 20:24:16 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{50189A96-D754-4E90-907F-1981F60643F0}
[2011/12/03 20:24:03 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{284915BD-BFF1-4BC5-BF28-833204A182AF}
[2011/12/03 08:24:14 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{C127C093-EFA3-4C87-B9DD-691B50307074}
[2011/12/03 08:24:03 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{A776D004-86BC-4A30-BB1B-95F077FEA2D9}
[2011/12/02 20:24:14 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{7416D432-6F32-45BE-8962-5DE3B03EAF4C}
[2011/12/02 20:24:03 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{360E7149-AE55-4DB1-953B-AF0E8C3B01C5}
[2011/12/02 08:24:14 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{50422E5D-FA17-492C-9C64-51E841BFD726}
[2011/12/02 08:24:03 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{78938A51-167B-45F3-A5F8-40FA6468D4EB}
[2011/12/01 19:36:42 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{DD4C8921-94EA-4B87-A01E-41A73938F393}
[2011/12/01 19:36:31 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{5EAFCAAD-BC18-42BF-9994-DE2DECD59CC4}
[2011/12/01 07:36:42 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{E3179FB6-787E-441B-AD49-650195BE683E}
[2011/12/01 07:36:31 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{2E235724-8B58-4D18-850A-50667A879C5B}
[2011/11/30 20:12:15 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{0AD93B12-7A2E-4702-9C6B-E800E0C1DD24}
[2011/11/30 20:11:58 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{CA05C3C9-F7F7-448B-95E0-8E13E848CD3F}
[2011/11/30 20:07:35 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{F48E9EBB-3A6B-473D-8395-DB0A88C745FE}
[2011/11/30 20:07:20 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{EDC53C56-76DD-418C-AA35-806784FD286A}
[2011/11/30 19:24:45 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{0E183C86-E5EB-4A82-A317-090006A18762}
[2011/11/30 19:24:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{D5ADC75B-F33D-4969-99B6-CDEA5E69F258}
[2011/11/30 10:18:53 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{28B8FD1B-1642-407C-8BDF-219749B04329}
[2011/11/30 10:18:41 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{E67EE7B8-541A-4A19-949C-5062C1E22CA4}
[2011/11/30 09:25:11 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{2CF5AB2B-1D5E-4DA4-8E9F-A18D59707323}
[2011/11/30 08:08:45 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Roaming\Malwarebytes
[2011/11/30 08:08:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/11/30 08:08:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/11/30 08:08:35 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011/11/30 08:08:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/11/30 07:24:44 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{DC12E14B-82D6-410E-A7C2-480388E49BEF}
[2011/11/30 07:24:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{C33076B2-7274-4E33-9F08-C9F54005E08D}
[2011/11/29 19:24:43 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{8F6F9D5B-4F4F-4667-A6E8-0BCD20F7EE54}
[2011/11/29 19:24:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{C0DF0394-CE9C-4705-98A5-6260A6FAC4F2}
[2011/11/29 18:05:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{54435946-50EE-4B1E-9E71-6648D36F20BC}
[2011/11/29 18:05:07 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{AECB989C-CAE6-4B1E-81F3-C712A8088539}
[2011/11/29 07:24:43 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{2DEEBAFC-597E-448D-9529-E786AEE1F15E}
[2011/11/29 07:24:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{0516981B-537F-482B-8ABE-CB3A2F897DED}
[2011/11/29 06:57:15 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{A5CB827C-8E5F-413C-B2ED-082CC75876DD}
[2011/11/29 06:57:04 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{0EBFA1A0-D2F4-48BE-8A70-4B946309FB9C}
[2011/11/29 06:18:52 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{94109EB1-9310-44B6-9887-BE0E7C702848}
[2011/11/29 06:18:41 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{DA7B6B11-7787-4051-9DAF-E09B6FAB78A3}
[2011/11/29 05:34:02 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{D8EC8346-CF33-44FD-9B0F-224E02A68B04}
[2011/11/29 05:33:51 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{908385E0-4CDD-4D97-B721-8AA4C8034705}
[2011/11/28 17:34:03 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{2B95B360-F0DE-420D-AF90-F32388DEDE78}
[2011/11/28 17:33:51 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{6899E682-85A2-4311-A255-3D156A30524C}
[2011/11/28 11:55:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{1853D697-8F2B-4952-95BA-865F4B18F974}
[2011/11/28 11:55:05 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{E3F37F00-AA11-4447-BF37-B002806C438F}
[2011/11/27 23:55:17 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{676AACCE-9C39-45F7-ADF2-551A40071512}
[2011/11/27 23:55:05 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{C366B6FD-F7E2-4FF9-84AD-82920C5891BC}
[2011/11/27 12:09:34 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{591DC125-0DE8-42BF-B141-090F2DE712C1}
[2011/11/27 12:09:22 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{DC3A2B59-DD6B-4FA0-8113-C5DC443F1151}
[2011/11/27 00:09:47 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{EC46CCF0-AF86-4C44-A49C-31955E2ADA92}
[2011/11/27 00:09:35 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{FB4FA237-D6CE-418C-AE56-DD5F53C71A02}
[2011/11/26 12:09:46 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{254D61A5-F792-48D1-BE07-47423C4C117B}
[2011/11/26 12:09:35 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{72CD9C77-1558-4803-A800-01B8DF69E9AB}
[2011/11/26 00:09:47 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{ED522F50-A22E-4E99-B35D-DCD2C16CCA0C}
[2011/11/26 00:09:35 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{037FC24F-16DD-4F90-9925-CC922C87653D}
[2011/11/25 12:09:47 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{23B59F15-388F-45CC-AC3F-1679613E7F1F}
[2011/11/25 12:09:35 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{735670B4-BDB9-4D62-B789-078AB6778CEE}
[2011/11/25 00:09:46 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{1B31AB10-C1B5-410F-88B9-A8CB64B0928C}
[2011/11/25 00:09:35 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{FAED8BC4-8E9A-4C01-A8F7-708E0DCD1D7D}
[2011/11/24 12:09:46 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{10242DA7-F8DE-4527-B2C9-E507A1EF4B4C}
[2011/11/24 12:09:35 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{CA8D9D4F-9892-40C8-92AC-29A6A52729D9}
[2011/11/24 00:09:46 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{C15FD17E-4386-43E7-943B-06299B2F605C}
[2011/11/24 00:09:35 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{A96F8168-C08A-459A-BF9C-19B1FB242345}
[2011/11/23 13:51:38 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{4B60D5EC-031D-4B4B-8F86-A7CCDCB003D4}
[2011/11/23 13:51:27 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{3FF6E2CB-B83B-4629-B419-F6887AE9214E}
[2011/11/23 01:51:38 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{F105B5C7-5F08-4581-9F89-C3B8348DB017}
[2011/11/23 01:51:27 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{83E7034C-2F17-42D2-833B-C1EDACC28416}
[2011/11/22 13:51:38 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{84011064-7110-421A-A0C9-C2597500326A}
[2011/11/22 13:51:27 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{4B9635C6-AB17-4364-9B0F-01309AB5ECEE}
[2011/11/22 11:36:52 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{18909B31-5826-42E7-9D16-3F0DF3EB44C5}
[2011/11/22 11:36:40 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{378D2DFC-0C49-4D96-9FF8-D4DDA3AD4A5B}
[2011/11/22 06:00:18 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{50EA16DE-2E70-402D-9CD4-E5569385E379}
[2011/11/22 06:00:07 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{7A29F126-79CA-4179-9FFB-9930BB348519}
[2011/11/22 02:21:07 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{8C56A9DE-E94D-497C-AD31-312A58E47EE8}
[2011/11/22 02:20:56 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{A404A01D-2655-4470-99BE-C3436BD3BB90}
[2011/11/21 20:05:30 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{4B3A45D4-9E0E-4742-B704-CE2A8EDAB3E4}
[2011/11/21 20:05:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{BD753457-628A-4A93-8887-036119F3DD01}
[2011/11/21 15:17:05 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{5ED710EB-2945-4CD5-8518-E36DE818030C}
[2011/11/21 15:16:55 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{40D3CF81-D491-481B-A224-66208148BB0B}
[2011/11/21 03:50:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{EAD3F5CE-7434-41CE-BB67-B9FF598EB775}
[2011/11/21 03:50:08 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{F0FE7460-2D28-4912-9372-5238DDB23A28}
[2011/11/21 00:12:33 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{FF9181D6-AF40-4F15-936D-B81683426674}
[2011/11/21 00:12:21 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{0DF69C89-AE9A-46D0-8DF5-70B89847D956}
[2011/11/20 12:12:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{B7FFFA2A-6CCD-4871-9F32-5A235BFBA6BC}
[2011/11/20 12:12:21 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{1C7BCBA3-3FFE-4C9F-91F7-43172A266976}
[2011/11/20 01:42:51 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{81A45A45-348A-4E73-A676-020472FB42B4}
[2011/11/20 01:42:40 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{E6A32705-F0CF-4E83-8FA6-B4231DE457A2}
[2011/11/19 23:34:30 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{E0C2950E-5421-4F50-A333-65341A30A19D}
[2011/11/19 23:34:18 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{3DF1D16D-1B66-42CC-803A-09CA885EEA5C}
[2011/11/19 19:42:28 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{6B7B81EA-DA90-421F-946E-668ECE8646C3}
[2011/11/19 19:42:17 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{302254E1-C17D-4023-8BA2-6E7EB3A9FDEA}
[2011/11/19 07:42:28 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{709452C2-E6ED-4A0B-BA85-F63CCF7E84C8}
[2011/11/19 07:42:17 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{6D1613E9-DEE1-4D69-A066-18110C1AC008}
[2011/11/19 00:58:11 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{A1A48BC6-11C6-4703-8B1A-DA26EF13B7F1}
[2011/11/19 00:58:00 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{9AE07298-9839-4BC0-8E75-DE37F744D8E9}
[2011/11/18 12:58:11 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{F879FC8B-C057-4ABF-9ABA-5C7C4C575BD8}
[2011/11/18 12:58:00 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{2FDF7386-90B8-480F-AB79-642C69CCB54E}
[2011/11/17 21:23:28 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{76A68E05-6CE3-49D6-9454-2BA5A096B22F}
[2011/11/17 21:23:17 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{D9F08D3B-EE64-412C-9737-F4CDB84DD833}
[2011/11/17 09:23:28 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{62FC2A96-4422-449C-8C99-6EF8E3EA83F9}
[2011/11/17 09:23:17 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{CC8ABF1F-34FD-4849-94A1-742C8354F198}
[2011/11/17 08:56:27 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{6BFA38B7-E2EE-499C-AD4C-B2BFD3927BC6}
[2011/11/17 06:47:56 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\Microsoft Games
[2011/11/17 05:09:45 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{EB0DED8A-CAF9-4995-8119-5CA2150B4F81}
[2011/11/17 05:09:34 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{DA611109-2800-486D-85A2-EEF54793BD61}
[2011/11/16 17:09:45 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{86F3AB92-5414-4C9E-8424-6B4E54C67588}
[2011/11/16 17:09:34 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{88C14ECF-BD94-419E-ABB9-E559A4599B68}
[2011/11/16 02:39:30 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{3761135E-A330-4767-BF6A-C58C4AE68699}
[2011/11/16 02:39:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{91301308-1FFB-46AE-A7AD-4020B111DD17}
[2011/11/15 14:39:30 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{10879FDA-A5E4-4FFF-A246-8F84AB53F2E3}
[2011/11/15 14:39:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{72AFB086-2C72-413C-B975-243938B5C5A4}
[2011/11/15 02:39:30 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{A81E239E-06E3-4592-BCDC-490F3759DE1B}
[2011/11/15 02:39:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{945207B8-6625-47E2-8F18-1BA895F40942}
[2011/11/14 14:39:30 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{40AB5019-3900-4FA9-BD08-8D050BF87293}
[2011/11/14 14:39:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{66483D3E-4E21-4051-AC6C-004D5D8E8C3E}
[2011/11/14 02:39:31 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{94205786-8275-40C2-BBA1-3125DA81D0B3}
[2011/11/14 02:39:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{3B3A0234-A95E-4BC3-9BFD-07D7974A811C}
[2011/11/13 14:39:30 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{A0D07CA4-4965-45EA-B18E-1B218CB3D67F}
[2011/11/13 14:39:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{B6BE8ADE-D9BB-4518-BEEE-63DDAEBF51FF}
[2011/11/13 02:39:30 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{D1340229-8CBF-4109-9DC0-BD7A4D71124C}
[2011/11/13 02:39:19 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{0FC8482C-A868-4472-84C6-A340CB25448B}
[2011/11/12 14:39:44 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{82EAC302-BD0A-4BEF-B4ED-2777B5A090B4}
[2011/11/12 14:39:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{AFD51B72-FE2E-47BD-B664-93A81FB55BD4}
[2011/11/12 02:39:43 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{DA647BF1-D10B-4A1F-AE0A-8282A0C6E170}
[2011/11/12 02:39:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{B0F98BCE-A393-475F-AE80-D832408F6EB6}
[2011/11/11 14:39:43 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{360F20C5-56C1-484E-85B3-35EE8D6C7F3B}
[2011/11/11 14:39:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{DD6B95C9-D290-4FB1-842F-B83C7FC358EA}
[2011/11/11 02:39:43 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{F8241272-B98F-41E1-AEC6-3C79CFBFB232}
[2011/11/11 02:39:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{A7B765FF-9736-425D-AB71-374ED9FA2B68}
[2011/11/10 14:39:43 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{7AED187D-7720-495F-8AD0-90ADB4ADFFF9}
[2011/11/10 14:39:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{3C63A1A0-CA5F-4254-B8BC-9B88EEFABF6A}
[2011/11/10 02:39:43 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{93014A3A-5BE6-4AB7-8947-B8B77D05C170}
[2011/11/10 02:39:32 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{6081C395-8A43-408E-9719-E55F73E51A61}
[2011/11/10 02:27:44 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{1E680430-1E4C-4478-991A-35E257B00973}
[2011/11/09 19:35:00 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{1B75C222-76A2-4310-97F7-34BEB46E638C}
[2011/11/09 19:34:49 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{55B491F5-2E77-4B9F-8446-03FDB3F311C8}
[2011/11/09 18:35:47 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{1F03430C-1B9D-4002-8520-55CE9624F12D}
[2011/11/09 18:35:36 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{F18EF302-16EC-4CFD-8F2C-CC6F794A8EB4}
[2011/11/09 06:35:49 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{B0079E28-47FD-4733-B710-10338C8336DE}
[2011/11/09 06:35:36 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{959236C3-E972-4729-8210-0C605BA8F92B}
[2011/11/08 18:35:47 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{C76801E6-7C26-4B55-ACBA-133BA7F83352}
[2011/11/08 18:35:36 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{D09F2EC8-4120-4388-8640-1B6356847BAB}
[2011/11/08 06:27:52 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{AE21FDDF-34BC-4E8D-B92F-D34493969555}
[2011/11/08 06:27:41 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{93A066D4-F4BF-4804-981D-D1CCB13C5896}
[2011/11/07 18:27:52 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{B3213772-9882-42E6-99EF-B8E4894527C5}
[2011/11/07 18:27:41 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{F19EE369-61E9-411F-8CC5-C6C712D2411B}
[2011/11/07 06:53:11 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{C819021D-F637-4645-898A-0F19BB9DF158}
[2011/11/07 06:53:00 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{5E362318-2622-4F15-8CED-E850D64F15E1}
[2011/11/06 18:53:11 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{0689A02E-4BF7-4439-ADA3-99B9A803FF15}
[2011/11/06 18:53:00 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{DE7362F4-08C4-4AA6-9419-236BB0C77CBD}

========== Files - Modified Within 30 Days ==========

[2011/12/03 09:19:52 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/03 09:19:52 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/02 19:48:11 | 000,112,226 | ---- | M] () -- C:\Users\x\Desktop\Team Online survey - LATAM-RawData.csv
[2011/12/02 18:32:21 | 000,407,138 | ---- | M] () -- C:\Users\x\Desktop\Team Online survey - LATAM VIP-RawData.csv
[2011/12/01 19:37:34 | 001,733,399 | ---- | M] () -- C:\Users\x\Desktop\VIP Club Scavenger Hunt Cards DEC1.pdf
[2011/11/30 20:11:23 | 000,713,888 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/11/30 20:11:23 | 000,619,206 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/11/30 20:11:23 | 000,107,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/11/30 20:05:53 | 000,342,000 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/11/30 20:05:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/11/30 20:05:24 | 1066,602,494 | -HS- | M] () -- C:\hiberfil.sys
[2011/11/30 08:08:38 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/29 18:10:43 | 000,053,248 | ---- | M] () -- C:\Users\x\Desktop\R Firpo Invoice 111104.pdf
[2011/11/29 06:32:35 | 000,000,000 | ---- | M] () -- C:\Users\x\defogger_reenable
[2011/11/16 19:05:54 | 000,967,258 | R--- | M] () -- C:\Users\x\Desktop\img311.jpg
[2011/11/14 20:39:55 | 000,001,057 | ---- | M] () -- C:\Users\x\Desktop\Pictures - Shortcut.lnk
[2011/11/11 11:53:58 | 000,869,438 | R--- | M] () -- C:\Users\x\Desktop\Team Online V4.jpg

========== Files Created - No Company Name ==========

[2011/12/02 18:39:23 | 000,112,226 | ---- | C] () -- C:\Users\x\Desktop\Team Online survey - LATAM-RawData.csv
[2011/12/02 18:32:20 | 000,407,138 | ---- | C] () -- C:\Users\x\Desktop\Team Online survey - LATAM VIP-RawData.csv
[2011/12/01 19:36:05 | 001,733,399 | ---- | C] () -- C:\Users\x\Desktop\VIP Club Scavenger Hunt Cards DEC1.pdf
[2011/11/30 08:08:38 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/29 18:10:43 | 000,053,248 | ---- | C] () -- C:\Users\x\Desktop\R Firpo Invoice 111104.pdf
[2011/11/29 06:32:35 | 000,000,000 | ---- | C] () -- C:\Users\x\defogger_reenable
[2011/11/16 19:05:54 | 000,967,258 | R--- | C] () -- C:\Users\x\Desktop\img311.jpg
[2011/11/16 00:07:13 | 000,104,996 | ---- | C] () -- C:\Users\x\Desktop\BAcon.jpg
[2011/11/14 20:39:55 | 000,001,057 | ---- | C] () -- C:\Users\x\Desktop\Pictures - Shortcut.lnk
[2011/11/11 11:53:58 | 000,869,438 | R--- | C] () -- C:\Users\x\Desktop\Team Online V4.jpg
[2011/03/19 22:50:35 | 000,000,000 | ---- | C] () -- C:\Windows\HMHud.INI
[2010/11/21 15:29:22 | 000,208,015 | ---- | C] () -- C:\Windows\hpoins43.dat
[2010/11/21 15:29:22 | 000,000,601 | ---- | C] () -- C:\Windows\hpomdl43.dat
[2010/11/09 11:30:51 | 000,000,268 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/11/09 11:04:57 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/11/03 07:01:40 | 000,177,664 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2010/11/03 07:01:40 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2010/11/03 07:01:40 | 000,001,264 | ---- | C] () -- C:\Windows\THXCfg_SP_APOIM.ini
[2010/11/03 07:01:40 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_HP_APOIM.ini
[2010/11/03 07:01:40 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_APOIM.ini
[2010/05/04 13:06:48 | 000,097,584 | ---- | C] () -- C:\Windows\SysWow64\CCBiosSupportAPI.dll
[2009/07/14 05:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 02:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/14 02:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/14 00:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 23:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 21:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 21:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/05/03 05:28:48 | 000,000,000 | ---D | M] -- C:\Users\x\AppData\Roaming\BitTorrent
[2011/03/19 22:41:33 | 000,000,000 | ---D | M] -- C:\Users\x\AppData\Roaming\HEM Data
[2011/03/10 18:39:44 | 000,000,000 | ---D | M] -- C:\Users\x\AppData\Roaming\Juniper Networks
[2011/03/06 19:11:34 | 000,000,000 | ---D | M] -- C:\Users\x\AppData\Roaming\Pamela
[2011/03/22 23:56:56 | 000,000,000 | ---D | M] -- C:\Users\x\AppData\Roaming\Philipp Winterberg
[2011/12/06 06:58:24 | 000,000,000 | ---D | M] -- C:\Users\x\AppData\Roaming\Spotify
[2011/12/06 10:00:24 | 000,000,000 | ---D | M] -- C:\Users\x\AppData\Roaming\uTorrent
[2011/04/10 19:19:53 | 000,000,000 | ---D | M] -- C:\Users\x\AppData\Roaming\wam.04351C371E530C3762CBA45FA283ED972DCDEFB6.1
[2010/11/09 18:59:37 | 000,000,000 | ---D | M] -- C:\Users\x\AppData\Roaming\Windows Live Writer
[2009/07/14 05:08:49 | 000,008,808 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

Extras.txt:

OTL Extras logfile created on: 12/6/2011 9:57:50 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\x\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

11.99 Gb Total Physical Memory | 8.86 Gb Available Physical Memory | 73.92% Memory free
23.98 Gb Paging File | 19.81 Gb Available in Paging File | 82.59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 456.19 Gb Total Space | 259.27 Gb Free Space | 56.83% Space Free | Partition Type: NTFS
Unable to calculate disk information.

Computer Name: DABOO | User Name: x | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86416020FF}" = Java™ 6 Update 20 (64-bit)
"{48C0866E-57EB-444C-8371-8E4321066BC3}" = Network64
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{68550918-63B5-4762-85CB-3C160AA4B213}" = HP Photosmart C4700 All-in-One Driver Software 14.0 Rel. 6
"{688758A2-8520-4470-8FA6-765BAC86FC53}" = Broadcom Management Programs
"{82E3FBCE-9BA2-44E3-9FF9-EFE9E8B70131}" = Oracle VM VirtualBox 4.0.4
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{AE1E0DFB-A3D9-451C-AA7F-46FD390400D4}" = Command Center
"{BE930E38-7BB3-45B6-85B2-5251F374F844}" = 64 Bit HP CIO Components Installer
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Shop for HP Supplies" = Shop for HP Supplies

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{010A785B-F920-4350-821B-6309909C20BB}" = THX TruStudio PC
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = Google Gmail Notifier
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = AlienRespawn
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool Help
"{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 29
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{537DB9D6-1AB1-4CE9-8DE7-312256B49A98}" = PS_AIO_06_C4700_SW_Min
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}" = SolutionCenter
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6b1f979c-ab05-4fc3-9393-3ca8d605cfaa}" = Nero 9 Essentials
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{820B6609-4C97-3A2B-B644-573B06A0F0CC}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express Help
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = AlienRespawn - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B4F3A360-E1E2-479D-ADE7-9BE3B07F4539}" = NVIDIA PhysX
"{B5978DF3-8A04-4F22-AF67-8CCE52E04B13}" = C4700
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C07B10DE-B7ED-E5D7-6D03-076E99A2D4C2}" = Winamax Poker
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed Help
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{ce96f5a5-584d-4f8f-aa3e-9baed413db72}" = Nero CoverDesigner Help
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{dba84796-8503-4ff0-af57-1747dd9a166d}" = Nero Online Upgrade
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E07B7A31-E160-466D-A003-3BB7B8989D52}" = Full Tilt Poker.Net
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed Help
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter
"{f6bdd7c5-89ed-4569-9318-469aa9732572}" = Nero BurnRights Help
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Betfair Poker JPC_is1" = Betfair Poker JPC 1.0.0
"Betfair Poker_is1" = Betfair Poker
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"ESPN Poker Club" = ESPN Poker Club
"HoldemManager" = Holdem Manager
"HP Photo Creations" = HP Photo Creations
"HyperSnap 6" = HyperSnap 6
"InstallShield_{AE1E0DFB-A3D9-451C-AA7F-46FD390400D4}" = Command Center
"Juniper_Setup_Client Activex Control" = Juniper Networks Setup Client Activex Control
"MailStore Home_is1" = MailStore Home 4.1.0.4598
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"mflGameDay_is1" = myfantasyleague.com Game Day 2011
"Mozilla Firefox (3.6.24)" = Mozilla Firefox (3.6.24)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"Pamela" = Pamela Pro 4.7
"PartyPoker" = PartyPoker
"PokerStars" = PokerStars
"PokerStars.be" = PokerStars.be
"PokerStars.fr" = PokerStars.fr
"PokerStars.it" = PokerStars.it
"PokerStars.net" = PokerStars.net
"PostgreSQL 8.4" = PostgreSQL 8.4
"RarZilla Free Unrar" = RarZilla Free Unrar
"Spotify" = Spotify
"StarCraft II" = StarCraft II
"TestPokerStars.com" = TestPokerStars.com
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.5
"wam.04351C371E530C3762CBA45FA283ED972DCDEFB6.1" = Winamax Poker
"WinLiveSuite" = Windows Live Essentials
"WinMerge_is1" = WinMerge 2.12.4

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Chilipoker" = Chilipoker
"Hero Poker" = Hero Poker
"Juniper Secure Meeting 7.0.0" = Juniper Networks Secure Meeting 7.0.0
"Juniper_Setup_Client" = Juniper Networks Setup Client
"Titan Poker" = Titan Poker
"William Hill Poker" = William Hill Poker

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/30/2011 10:24:17 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 8/30/2011 10:24:17 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 8/30/2011 10:24:17 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 8/30/2011 10:24:17 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 8/30/2011 10:24:17 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 8/30/2011 10:24:18 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 8/30/2011 10:24:18 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 8/30/2011 10:24:18 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 8/30/2011 10:29:42 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 8/30/2011 10:29:42 PM | Computer Name = daboo | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

[ Dell Events ]
Error - 12/6/2010 6:24:58 PM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 1/7/2011 11:43:14 PM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 1/7/2011 11:43:14 PM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 1/12/2011 4:44:12 AM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 1/12/2011 4:44:12 AM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 1/30/2011 11:47:27 AM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 1/30/2011 11:47:27 AM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 3/26/2011 4:58:36 AM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 3/26/2011 4:58:36 AM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 3/26/2011 5:16:45 PM | Computer Name = daboo | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

[ System Events ]
Error - 11/19/2011 7:33:06 PM | Computer Name = daboo | Source = EventLog | ID = 6008
Description = The previous system shutdown at 23:31:38 on ?19/?11/?2011 was unexpected.

Error - 11/19/2011 7:33:42 PM | Computer Name = daboo | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Alienware
Fusion Service service to connect.

Error - 11/19/2011 7:33:42 PM | Computer Name = daboo | Source = Service Control Manager | ID = 7000
Description = The Alienware Fusion Service service failed to start due to the following
error: %%1053

Error - 11/19/2011 7:34:15 PM | Computer Name = daboo | Source = DCOM | ID = 10016
Description =

Error - 11/30/2011 4:00:35 PM | Computer Name = daboo | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Update for Windows 7 for x64-based Systems (KB982018).

Error - 11/30/2011 4:00:36 PM | Computer Name = daboo | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Security Update for Windows 7 for x64-based Systems (KB2532531).

Error - 11/30/2011 4:00:36 PM | Computer Name = daboo | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Update for Windows 7 for x64-based Systems (KB2529073).

Error - 11/30/2011 4:06:34 PM | Computer Name = daboo | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Alienware
Fusion Service service to connect.

Error - 11/30/2011 4:06:34 PM | Computer Name = daboo | Source = Service Control Manager | ID = 7000
Description = The Alienware Fusion Service service failed to start due to the following
error: %%1053

Error - 11/30/2011 4:07:38 PM | Computer Name = daboo | Source = DCOM | ID = 10016
Description =

< End of report >

#6 m0le

I know the drill!

Group: Malware Response Instructor
Posts: 29,125
Joined: 24-July 08
Gender:Male
Location:London, UK

Posted 06 December 2011 - 06:24 PM

Not sure what it does scream to be honest. Malware can switch on a webcam but the logs I've seen so far are clean.

Let's clear up some old registry values and settings. Open OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"

Then click the Run Fix button at the top

Let the program run unhindered.

When done it will say "Fix Complete press ok to open the log"
Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Now I'm looking for leftover traces of malware that may have already been caught

I'd like us to scan your machine with ESET OnlineScan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
Check
Click the button.
Accept any security warnings from your browser.
Under scan settings, check and check Remove found threats
Click Advanced settings and select the following:
- Scan potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
Copy and paste the resulting log in your next reply

If no log is generated that means nothing was found. Please let me know if this happens.

If I have helped you fix your PC then please donate. Thanks

Posted Image

m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#7 ingraise

New Member

Group: Members
Posts: 7
Joined: 29-November 11

Posted 06 December 2011 - 09:23 PM

I've been a heavy computer user for a long, long time...25 years ago my family had a Tandy 1000. Despite not using any firewalling or active virus scanning until I got this Windows 7 computer a year ago, I've only gotten malware on my comps twice (well now maybe 3 times?)

1) 18 years ago From a set of six 3.5" floppies that housed a .rar archive with a pirated copy of DOOM. They had a boot sector virus that seemed harmless but could only be removed by F-PROT out of all the virus programs I tried.

2) A few years back I drunkenly downloaded .rar archive via torrent and tried to open it like a moron. I knew what I'd done immediately though. That was a nasty one -- never got rid of it fully despite many hours invested. The hardware gave out a year or two later anyways and I only used it while travelling.

Long story short, I don't consider myself to be a high risk internet user. I guess it's possible I've gotten something from torrenting but I only torrent .avi files, never .zip or .rar, and don't open any other files that come with. I know the poker applications look suspicious to you but I can assure you that they're completely legit. I know the companies that these applications come from; they're either from my employer or from our competitors.

Something has to be accessing the webcam though, right? Your help in figuring out WHAT is appreciated.

Anyways, first the log from OTL:
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\\""|""%1" %*" /E : value set successfully!

OTL by OldTimer - Version 3.2.31.0 log created on 12062011_234248

And here's the ESET results:

C:\Program Files (x86)\AlienRespawn\hstart.exe a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined
C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined
C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\UpdateWorkingDirectory\DSL\hstart.exe a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined
C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\UpdateWorkingDirectory\DSL\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined

This post has been edited by ingraise: 06 December 2011 - 09:23 PM

#8 m0le

I know the drill!

Group: Malware Response Instructor
Posts: 29,125
Joined: 24-July 08
Gender:Male
Location:London, UK

Posted 07 December 2011 - 06:37 PM

As you are no doubt aware, some poker programs are often installed with spyware or adware but if you know the programs then it's not a problem.

Alien Respawn seems to be infected with Hidden Start and this riskware has a nice list of attacks that it facilitates - some of which square with monitoring the user. Programs that are detected in the Riskware category are not directly malicious, but are often used in conjunction with Malware.

Riskware can be commercial monitoring tools, Password recovery tools, Commercial remote control tools and other tools which are built to kill processes, hide windows or read system internals automatically.

With that riskware removed we need to run some scans for other malware

Please download

Malwarebytes Anti-Malware and save it to your desktop.

Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application or, if you are using Vista, right-click and select Run As Administrator on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
If MBAM won't update then download and update MBAM on a clean computer then save the rules.ref folder to a memory stick. This file is found here: 'C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware' then transfer it across to the infected computer.
On the Scanner tab:
- Make sure the "Perform Full Scan" option is selected.
- Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

Then SAS

Download Superantispyware

Load Superantispyware and click the check for updates button.
Once the update is finished click the scan your computer button.
Check Perform Complete Scan and then next.
Superantispyware will now scan your computer and when its finished it will list all the infections it has found.
Make sure that they all have a check next to them and press next.
Click finish and you will be taken back to the main interface.
Click Preferences and then click the statistics/logs tab. Click the dated log and press view log and a text file will appear.
Copy and paste the log onto the forum.

If I have helped you fix your PC then please donate. Thanks

Posted Image

m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#9 ingraise

New Member

Group: Members
Posts: 7
Joined: 29-November 11

Posted 08 December 2011 - 04:14 AM

Here's the mbam-log... I didn't 'remove selected' though:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8331

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

08/12/2011 9:13:11 AM
mbam-log-2011-12-08 (09-13-05).txt

Scan type: Full scan (C:\|D:\|F:\|)
Objects scanned: 681856
Time elapsed: 1 hour(s), 12 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Chilipoker (PUP.Casino) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Titan Poker (PUP.Casino) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\William Hill Poker (PUP.Casino) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Poker\chilipoker\_setupcasino_4a50.exe (PUP.Casino) -> No action taken.
c:\Poker\titan poker\_titanpsetup_9f5a9d.exe (PUP.Casino) -> No action taken.
c:\Poker\william hill poker\_setuppoker_f066d_en.exe (PUP.Casino) -> No action taken.
c:\Poker\william hill poker\_setuppoker_ff1acd_en.exe (PUP.Casino) -> No action taken.
c:\Users\x\downloads\setupcasino_4a50.exe (PUP.Casino) -> No action taken.
c:\Users\x\downloads\setuppoker_ff1acd_en.exe (PUP.Casino) -> No action taken.
c:\Users\x\downloads\titanpsetup_9f5a9d.exe (PUP.Casino) -> No action taken.

#10 ingraise

New Member

Group: Members
Posts: 7
Joined: 29-November 11

Posted 08 December 2011 - 05:13 AM

SAS log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/08/2011 at 10:10 AM

Application Version : 5.0.1136

Core Rules Database Version : 8027
Trace Rules Database Version: 5839

Scan type : Complete Scan
Total Scan Time : 00:44:14

Operating System Information
Windows 7 Home Premium 64-bit (Build 6.01.7600)
UAC On - Limited User

Memory items scanned : 681
Memory threats detected : 0
Registry items scanned : 75371
Registry threats detected : 1
File items scanned : 64226
File threats detected : 134

Adware.Tracking Cookie
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@adecn[2].txt [ /adecn ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@adlegend[2].txt [ /adlegend ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@ads.pointroll[1].txt [ /ads.pointroll ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@adxpose[1].txt [ /adxpose ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@apmebf[2].txt [ /apmebf ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@citi.bridgetrack[2].txt [ /citi.bridgetrack ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@doubleclick[2].txt [ /doubleclick ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@earlyexperience.partyaccount[2].txt [ /earlyexperience.partyaccount ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@imrworldwide[2].txt [ /imrworldwide ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@insightexpressai[1].txt [ /insightexpressai ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@insightexpressai[3].txt [ /insightexpressai ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@mediaplex[1].txt [ /mediaplex ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@microsoftwllivemkt.112.2o7[1].txt [ /microsoftwllivemkt.112.2o7 ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@pmamedia.sitescout[1].txt [ /pmamedia.sitescout ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@pointroll[2].txt [ /pointroll ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\x@zedo[1].txt [ /zedo ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\31I73CLP.txt [ /mediaplex.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\JGPQJ9G5.txt [ /c.atdmt.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\FN6I2ZZP.txt [ /zedo.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\SOCMY7CW.txt [ /questionmarket.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\CWIE4OQ9.txt [ /pointroll.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\YOF2CHH4.txt [ /invitemedia.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\MEFBR47I.txt [ /ad.yieldmanager.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\BGY55YX2.txt [ /atdmt.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\6AHIZF5G.txt [ /serving-sys.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\6APWSPJN.txt [ /ads.pointroll.com ]
C:\Users\x\AppData\Roaming\Microsoft\Windows\Cookies\932EUOKY.txt [ /bs.serving-sys.com ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\MDUCY7CR.txt [ Cookie:x@mediaplex.com/ ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\x@apmebf[1].txt [ Cookie:x@apmebf.com/ ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\UDLNBAJD.txt [ Cookie:x@adsonar.com/adserving ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\OGDX6P6T.txt [ Cookie:x@zedo.com/ ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\WSETSJ4Y.txt [ Cookie:x@yieldmanager.net/ ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\DH8069AG.txt [ Cookie:x@specificclick.net/ ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\44F212LJ.txt [ Cookie:x@invitemedia.com/ ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\KZOO1J76.txt [ Cookie:x@ad.yieldmanager.com/ ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\NSPSO92O.txt [ Cookie:x@atdmt.com/ ]
C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\SKH27688.txt [ Cookie:x@doubleclick.net/ ]
C:\USERS\X\Cookies\31I73CLP.txt [ Cookie:x@mediaplex.com/ ]
C:\USERS\X\Cookies\x@apmebf[2].txt [ Cookie:x@apmebf.com/ ]
C:\USERS\X\Cookies\x@citi.bridgetrack[2].txt [ Cookie:x@citi.bridgetrack.com/ ]
C:\USERS\X\Cookies\JGPQJ9G5.txt [ Cookie:x@c.atdmt.com/ ]
C:\USERS\X\Cookies\FN6I2ZZP.txt [ Cookie:x@zedo.com/ ]
C:\USERS\X\Cookies\CWIE4OQ9.txt [ Cookie:x@pointroll.com/ ]
C:\USERS\X\Cookies\YOF2CHH4.txt [ Cookie:x@invitemedia.com/ ]
C:\USERS\X\Cookies\MEFBR47I.txt [ Cookie:x@ad.yieldmanager.com/ ]
C:\USERS\X\Cookies\BGY55YX2.txt [ Cookie:x@atdmt.com/ ]
C:\USERS\X\Cookies\x@doubleclick[2].txt [ Cookie:x@doubleclick.net/ ]
C:\USERS\X\Cookies\6APWSPJN.txt [ Cookie:x@ads.pointroll.com/ ]
C:\USERS\X\Cookies\x@insightexpressai[3].txt [ Cookie:x@insightexpressai.com/ ]
C:\USERS\X\Cookies\x@adxpose[1].txt [ Cookie:x@adxpose.com/ ]
C:\USERS\X\Cookies\x@microsoftwllivemkt.112.2o7[1].txt [ Cookie:x@microsoftwllivemkt.112.2o7.net/ ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@AD.YIELDMANAGER[1].TXT [ /AD.YIELDMANAGER ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@ADBRITE[2].TXT [ /ADBRITE ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@ADECN[1].TXT [ /ADECN ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@ADECN[2].TXT [ /ADECN ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@CONTENT.YIELDMANAGER[3].TXT [ /CONTENT.YIELDMANAGER ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@ATDMT[1].TXT [ /ATDMT ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@CITI.BRIDGETRACK[2].TXT [ /CITI.BRIDGETRACK ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@CONTENT.YIELDMANAGER[2].TXT [ /CONTENT.YIELDMANAGER ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@DOUBLECLICK[2].TXT [ /DOUBLECLICK ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@IMRWORLDWIDE[2].TXT [ /IMRWORLDWIDE ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@INSIGHTEXPRESSAI[1].TXT [ /INSIGHTEXPRESSAI ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@MEDIA6DEGREES[2].TXT [ /MEDIA6DEGREES ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@MEDIABRANDSWW[1].TXT [ /MEDIABRANDSWW ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@QUESTIONMARKET[2].TXT [ /QUESTIONMARKET ]
C:\USERS\X\APPDATA\LOCAL\TEMP\COOKIES\X@TRADEDOUBLER[1].TXT [ /TRADEDOUBLER ]
a.ads2.msads.net [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
ad.insightexpressai.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
ads2.msads.net [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
b.ads2.msads.net [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
cdn.eyewonder.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
cloud.video.unrulymedia.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
ds.serving-sys.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
ec.atdmt.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
i.adultswim.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
ia.media-imdb.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
macromedia.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media-vimg-net.vimg.net [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.bimvid.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.cnbc.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.hamptonroads.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.king5.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.kyte.tv [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.lvrj.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.miamiherald.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.mtvnservices.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.nbcbayarea.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.nbcchicago.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.nbcconnecticut.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.nbcmiami.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.nbcnewyork.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.nbcsandiego.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.nbcwashington.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.npr.org [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.nwcn.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.perthnow.com.au [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.scanscout.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.theonion.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.tv20detroit.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.vmixcore.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.wfaa.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media.zie.nl [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media1.break.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media10.washingtonpost.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
media2.myfoxny.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
msnbcmedia.msn.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
objects.tremormedia.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
s0.2mdn.net [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
secure-uk.imrworldwide.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
secure-us.imrworldwide.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
spe.atdmt.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
us.media.blizzard.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
www.77tracking.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
www.clickorlando.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
www.deucescracked.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
www.naiadsystems.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
www.partypoker.com [ C:\USERS\X\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FRUZAV6Q ]
earlyexperience.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYCASINO\COOKIES.TXT ]
.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
earlyexperience.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
ad.yieldmanager.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
secure.partyaccount.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]

Adware.PTech
(x86) HKU\S-1-5-21-2966951246-1525381913-1993853326-1001\Software\PTech

#11 m0le

I know the drill!

Group: Malware Response Instructor
Posts: 29,125
Joined: 24-July 08
Gender:Male
Location:London, UK

Posted 08 December 2011 - 09:10 PM

Quote

Here's the mbam-log... I didn't 'remove selected' though:

Fair enough :lol:

Is PTech something you know about too?

Can you tell me if the webcam has been playing tricks since we removed the riskware?

If I have helped you fix your PC then please donate. Thanks

Posted Image

m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#12 ingraise

New Member

Group: Members
Posts: 7
Joined: 29-November 11

Posted 09 December 2011 - 03:28 AM

I didn't know about PTech, no. Googled a bit and didn't find much detail. It doesn't sound like anything that would have been causing this problem though. Note that it came up in the SAS scan and I *DID* action removal in SAS, just not in MBAM.

Something interesting DID happen today though. I've been running Malwarebytes' Anti-Malware protection module for several days. I noticed some outbound connections from skype being blocked. I checked logs for 11-30 through 12-08 and found no such activity, but I'd not seen any webcam problems then either.

Here's protection-log-2011-12-09.txt:

00:10:39 x IP-BLOCK 62.45.175.113 (Type: incoming, Port: 23397, Process: skype.exe)
00:10:39 x IP-BLOCK 62.45.175.113 (Type: incoming, Port: 23397, Process: skype.exe)
00:10:47 x IP-BLOCK 62.45.175.113 (Type: incoming, Port: 23397, Process: skype.exe)
00:15:20 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:15:20 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:15:20 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:16:17 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:16:25 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:16:33 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:27:23 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:27:23 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:27:31 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:37:56 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:37:56 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:37:56 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:48:13 x IP-BLOCK 91.211.118.22 (Type: outgoing, Port: 23397, Process: skype.exe)
00:48:13 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:48:13 x IP-BLOCK 91.211.118.22 (Type: outgoing, Port: 23397, Process: skype.exe)
00:48:21 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:48:21 x IP-BLOCK 91.211.118.22 (Type: outgoing, Port: 23397, Process: skype.exe)
00:48:21 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
00:51:02 x IP-BLOCK 62.45.108.12 (Type: outgoing, Port: 23397, Process: skype.exe)
00:51:10 x IP-BLOCK 62.45.108.12 (Type: outgoing, Port: 23397, Process: skype.exe)
00:51:10 x IP-BLOCK 62.45.108.12 (Type: outgoing, Port: 23397, Process: skype.exe)
01:19:20 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
01:19:28 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
01:19:36 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
01:50:28 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
01:50:36 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
01:50:36 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
01:50:53 x IP-BLOCK 62.45.175.33 (Type: outgoing, Port: 56255, Process: firefox.exe)
02:33:28 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
02:33:28 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
02:33:36 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
03:03:54 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
03:04:02 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
03:04:10 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
03:14:27 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
03:14:35 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
03:35:08 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
03:35:08 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
03:35:16 x IP-BLOCK 62.45.175.113 (Type: outgoing, Port: 23397, Process: skype.exe)
05:20:13 x MESSAGE Scheduled update executed successfully
05:20:45 x MESSAGE IP Protection stopped
05:20:46 x MESSAGE Database updated successfully
05:20:47 x MESSAGE IP Protection started successfully

The IPs involved don't yield anything interesting to me when I did a reverse DNS lookup. They're both from the netherlands but otherwise uninteresting. Note that the logs prior today are REALLY uninteresting. Here's what yesterday's looks like:
01:53:28 x MESSAGE Database updated successfully
19:14:42 x MESSAGE Protection started successfully
19:14:47 x MESSAGE IP Protection started successfully

I leave town in 24 hours for the holidays. My computer will remain here. I'll shut it down so it won't be altered at all but I won't be able to run tests. I will take whatever steps you recommend tonight, but after I respond I suppose you'll have to lock my thread. Hopefully you'll agree to reopen it in response to a PM when I return home after Christmas.

#13 m0le

I know the drill!

Group: Malware Response Instructor
Posts: 29,125
Joined: 24-July 08
Gender:Male
Location:London, UK

Posted 10 December 2011 - 05:21 PM

Quote

but after I respond I suppose you'll have to lock my thread. Hopefully you'll agree to reopen it in response to a PM when I return home after Christmas.

Yes, that's no problem.

KABELFOON looks like a website from a media company. Good to hear that we've had no further webcam problems too.

It looks like riskware was the problem but I think we'll try something a bit more powerful to make sure

Please download ComboFix from one of these locations:

* IMPORTANT !!! Save ComboFix.exe to your Desktop making sure you rename it comfix.exe

Disable your AntiVirus and AntiSpyware applications including Firewalls, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Comfix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

If I have helped you fix your PC then please donate. Thanks

Posted Image

m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)