Downloader.Zlob.AHRZ

Im on my niece's laptop & shes using windows vista & AVG Free.
Everytime she tries to use Internet Explorer avg reports that it has detected Downloader.Zlob.AHRZ.

It says the infected file is msqpdxwqsctmei.dll & then IE stops responding.

Ive googled this all day with no luck & i tried to download Spybot S & D but when i click install it says error.

Anybody know a way out of this as its really annoying me now.

Below is my HJT log.

Cheers.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:39:13, on 08/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\vVX3000.exe
C:\Windows\System32\rundll32.exe
C:\Windows\vVX1000.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: CleanMyPC Popup Blocker - {7A9BC6B1-7F27-47c6-A66D-13582E81E537} - D:\Program Files\CleanMyPC Popup Blocker\CleanBHO.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} - D:\Program Files\CleanMyPC Popup Blocker\CleanBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [VX3000] C:\Windows\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX1000] C:\Windows\vVX1000.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\Users\Nicola\AppData\Local\Temp\MsgPlusUninstall.exe" /Cleanup
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Clock knob fast okay] "C:\ProgramData\find two site.3cvxfut"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache...etup1.0.1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6B6982EF-2BBA-4EDD-8E37-5E4A05E9727E}: NameServer = 85.255.116.67;85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{921A67BA-8FAC-4464-894B-E4FBAA02C23E}: NameServer = 85.255.116.67;85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.67;85.255.112.90
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 7149 bytes

Please download Malwarebytes' Anti-Malware from HERE or HERE

Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan"

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.




NEXT


Please download RSIT by random/random and save it to your Desktop.

• Double click on RSIT.exe to run RSIT
• Before you click "Continue", make sure you change the List files/folders created or modified in the last 3 months
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open. Please post the contents of both log.txt and info.txt in your next reply.

NEXT


Please download GMER and unzip it to your Desktop.

• Open the program and click on the Rootkit tab.
• Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
• Click on Scan.
• When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread.

Post me these logs in your next reply.. Post each log in separate post..

1. Malwarebytes'
2. RSIT log.txt
3. RSIT info.txt
4. Attach GMER result..

Malwarebytes' Anti-Malware 1.33
Database version: 1654
Windows 6.0.6001 Service Pack 1

09/02/2009 13:10:41
mbam-log-2009-02-09 (13-10-41).txt

Scan type: Quick Scan
Objects scanned: 50896
Time elapsed: 10 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 49
Registry Values Infected: 0
Registry Data Items Infected: 6
Folders Infected: 8
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{dabf362d-d442-4402-9208-ca9ed70dd01e} (Adware.Advantage) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5ac3a9ef-c0f8-41d4-b4e2-b7cebb794151} (Adware.Advantage) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{862def42-89aa-49fa-ae1f-8a84b1b08a17} (Adware.Advantage) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f6e4845d-1d13-4bc0-942d-b9191524cc48} (Adware.Advantage) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{602d9049-b4ac-4a25-bf75-a9b54d747cba} (Adware.Advantage) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\extravideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\extravideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\extravideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.67;85.255.112.90 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6b6982ef-2bba-4edd-8e37-5e4a05e9727e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.67;85.255.112.90 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{921a67ba-8fac-4464-894b-e4fbaa02c23e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.67;85.255.112.90 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.67;85.255.112.90 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{6b6982ef-2bba-4edd-8e37-5e4a05e9727e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.67;85.255.112.90 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{921a67ba-8fac-4464-894b-e4fbaa02c23e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.67;85.255.112.90 -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin\2.5.0 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Program Files\extravideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Program Files\Advantage (Adware.Advantage) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\extravideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Users\Nicola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\extravideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
C:\Windows\System32\msqpdxwqsctmei.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\extravideo\Uninstall.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\AdVantage.htm (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\AdVUninst.exe (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\ffext.mod (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Program Files\Advantage\TR.dll (Adware.Advantage) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\extravideo\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\msqpdxnbcbcrrx.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Logfile of random's system information tool 1.05 (written by random/random)
Run by Nicola at 2009-02-10 11:18:11
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 7 GB (14%) free of 52 GB
Total RAM: 1790 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:56, on 10/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\vVX3000.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\vVX1000.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Nicola\Desktop\RSIT.exe
C:\Program Files\trend micro\Nicola.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [VX3000] C:\Windows\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX1000] C:\Windows\vVX1000.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 7085 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-02-01 1078552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2008-12-04 92504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-17 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2008-11-18 408952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-17 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2008-12-08 1067352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2008-12-08 1067352]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-02-01 1601304]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-17 136600]
"VX3000"=C:\Windows\vVX3000.exe [2007-04-10 709992]
"LifeCam"=C:\Program Files\Microsoft LifeCam\LifeExp.exe [2007-05-17 279912]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2007-12-05 86016]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-12-05 8534560]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-12-05 81920]
"VX1000"=C:\Windows\vVX1000.exe [2007-04-10 709992]
"AdobeCS4ServiceManager"=C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"=C:\Windows\system32\oobefldr.dll [2008-01-19 2153472]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2008-12-02 3882312]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2009-02-10 270128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]
C:\Program Files\AdVantage\AdVantage.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Clock knob fast okay]
C:\ProgramData\find two site.3cvxfut []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\daemon.exe [2007-12-15 482760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Nicola\AppData\Local\Google\Update\GoogleUpdate.exe /c []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648]

C:\Users\Nicola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{142f79ea-6acf-11dd-8656-001b38c6aefb}]
shell\AutoRun\command - G:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{142f79eb-6acf-11dd-8656-001b38c6aefb}]
shell\AutoRun\command - I:\RunGame.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{142f79f8-6acf-11dd-8656-001b38c6aefb}]
shell\AutoRun\command - J:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{142f7a01-6acf-11dd-8656-001b38c6aefb}]
shell\AutoRun\command - K:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d95a6f55-5a7e-11dd-a8a2-001cea41634b}]
shell\AutoRun\command - H:\Autorun.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 3 months======

2009-02-10 11:18:11 ----D---- C:\rsit
2009-02-09 19:04:05 ----D---- C:\ProgramData\Messenger Plus!
2009-02-09 14:34:09 ----A---- C:\Windows\system32\mshtmled.dll
2009-02-09 14:34:09 ----A---- C:\Windows\system32\icardie.dll
2009-02-09 14:34:08 ----A---- C:\Windows\system32\mshtmler.dll
2009-02-09 14:34:08 ----A---- C:\Windows\system32\jsproxy.dll
2009-02-09 14:34:08 ----A---- C:\Windows\system32\ieui.dll
2009-02-09 14:34:08 ----A---- C:\Windows\system32\admparse.dll
2009-02-09 14:34:07 ----A---- C:\Windows\system32\msls31.dll
2009-02-09 14:34:07 ----A---- C:\Windows\system32\corpol.dll
2009-02-09 14:34:06 ----A---- C:\Windows\system32\iernonce.dll
2009-02-09 14:34:06 ----A---- C:\Windows\system32\advpack.dll
2009-02-09 14:34:05 ----A---- C:\Windows\system32\imgutil.dll
2009-02-09 14:34:05 ----A---- C:\Windows\system32\ieakeng.dll
2009-02-09 14:34:04 ----A---- C:\Windows\system32\iepeers.dll
2009-02-09 14:34:04 ----A---- C:\Windows\system32\dxtrans.dll
2009-02-09 14:34:04 ----A---- C:\Windows\system32\dxtmsft.dll
2009-02-09 14:34:03 ----A---- C:\Windows\system32\occache.dll
2009-02-09 14:34:03 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-02-09 14:34:03 ----A---- C:\Windows\system32\licmgr10.dll
2009-02-09 14:34:03 ----A---- C:\Windows\system32\inseng.dll
2009-02-09 14:34:03 ----A---- C:\Windows\system32\ieaksie.dll
2009-02-09 14:34:02 ----A---- C:\Windows\system32\webcheck.dll
2009-02-09 14:34:02 ----A---- C:\Windows\system32\msrating.dll
2009-02-09 14:34:01 ----A---- C:\Windows\system32\WinFXDocObj.exe
2009-02-09 14:34:01 ----A---- C:\Windows\system32\wextract.exe
2009-02-09 14:34:01 ----A---- C:\Windows\system32\msfeedssync.exe
2009-02-09 14:34:01 ----A---- C:\Windows\system32\iesetup.dll
2009-02-09 14:34:01 ----A---- C:\Windows\system32\ieakui.dll
2009-02-09 14:33:59 ----A---- C:\Windows\system32\pngfilt.dll
2009-02-09 14:33:59 ----A---- C:\Windows\system32\mstime.dll
2009-02-09 14:33:59 ----A---- C:\Windows\system32\msfeeds.dll
2009-02-09 14:33:57 ----A---- C:\Windows\system32\ieapfltr.dll
2009-02-09 14:33:56 ----A---- C:\Windows\system32\vbscript.dll
2009-02-09 14:33:55 ----A---- C:\Windows\system32\url.dll
2009-02-09 14:33:55 ----A---- C:\Windows\system32\jscript.dll
2009-02-09 14:33:54 ----A---- C:\Windows\system32\iedkcs32.dll
2009-02-09 14:33:51 ----A---- C:\Windows\system32\mshta.exe
2009-02-09 14:33:51 ----A---- C:\Windows\system32\iexpress.exe
2009-02-09 14:33:51 ----A---- C:\Windows\system32\iesysprep.dll
2009-02-09 14:33:50 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2009-02-09 14:33:50 ----A---- C:\Windows\system32\SetDepNx.exe
2009-02-09 14:33:50 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2009-02-09 14:33:50 ----A---- C:\Windows\system32\PDMSetup.exe
2009-02-09 14:33:50 ----A---- C:\Windows\system32\ieUnatt.exe
2009-02-09 14:33:49 ----A---- C:\Windows\system32\iertutil.dll
2009-02-09 14:33:49 ----A---- C:\Windows\system32\ie4uinit.exe
2009-02-09 14:33:48 ----A---- C:\Windows\system32\wininet.dll
2009-02-09 14:33:46 ----A---- C:\Windows\system32\urlmon.dll
2009-02-09 14:33:42 ----A---- C:\Windows\system32\ieframe.dll
2009-02-09 14:33:40 ----A---- C:\Windows\system32\mshtml.dll
2009-02-09 12:57:43 ----D---- C:\Users\Nicola\AppData\Roaming\Malwarebytes
2009-02-09 12:57:35 ----D---- C:\ProgramData\Malwarebytes
2009-02-09 12:57:34 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-02-08 20:38:27 ----D---- C:\Program Files\Trend Micro
2009-02-08 04:34:18 ----D---- C:\Program Files\WinRAR
2009-02-08 00:51:41 ----D---- C:\Program Files\LimeWire
2009-02-02 08:04:52 ----D---- C:\ProgramData\342D4
2009-02-02 07:53:51 ----D---- C:\ProgramData\33379
2009-01-30 07:38:41 ----D---- C:\ProgramData\2977
2009-01-29 22:15:13 ----D---- C:\ProgramData\D14A
2009-01-28 15:57:28 ----D---- C:\ProgramData\1C4C
2009-01-28 08:04:35 ----D---- C:\ProgramData\233DD
2009-01-28 08:03:27 ----D---- C:\ProgramData\1B157
2009-01-27 07:58:00 ----D---- C:\ProgramData\01D6
2009-01-26 15:59:21 ----D---- C:\ProgramData\1530B
2009-01-25 20:34:55 ----D---- C:\Users\Nicola\AppData\Roaming\MusicNet
2009-01-25 19:19:27 ----D---- C:\ProgramData\1B1E
2009-01-25 19:19:21 ----D---- C:\ProgramData\15293
2009-01-25 19:19:12 ----D---- C:\ProgramData\C36C
2009-01-25 19:19:06 ----D---- C:\ProgramData\6129
2009-01-25 19:18:49 ----D---- C:\ProgramData\31111
2009-01-25 19:18:42 ----D---- C:\ProgramData\2A140
2009-01-25 19:13:28 ----D---- C:\ProgramData\1C250
2009-01-25 19:13:19 ----D---- C:\ProgramData\1338A
2009-01-25 19:13:15 ----D---- C:\ProgramData\FDF
2009-01-25 19:13:00 ----D---- C:\ProgramData\01EB
2009-01-25 14:42:43 ----D---- C:\ProgramData\2B152
2009-01-25 14:33:04 ----D---- C:\ProgramData\4276
2009-01-24 19:32:37 ----D---- C:\Program Files\iMesh Applications
2009-01-06 08:26:43 ----D---- C:\ProgramData\2B10D
2009-01-05 20:17:41 ----D---- C:\Program Files\LG PC Suite 2
2009-01-05 20:16:02 ----D---- C:\Users\Nicola\AppData\Roaming\InstallShield
2008-12-28 21:16:14 ----D---- C:\Users\Nicola\AppData\Roaming\IMVU
2008-12-28 21:16:03 ----D---- C:\Users\Nicola\AppData\Roaming\IMVUClient
2008-12-26 21:39:50 ----D---- C:\Users\Nicola\AppData\Roaming\LG Electronics
2008-12-26 21:33:47 ----D---- C:\Program Files\LG Electronics
2008-12-26 21:31:14 ----HD---- C:\Program Files\InstallShield Installation Information
2008-12-26 20:50:26 ----D---- C:\ProgramData\1A250
2008-12-26 10:57:27 ----D---- C:\ProgramData\1BA7
2008-12-25 11:58:11 ----D---- C:\ProgramData\BA6
2008-12-24 19:24:27 ----D---- C:\Program Files\iPod
2008-12-24 19:24:20 ----D---- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-24 19:24:20 ----D---- C:\Program Files\iTunes
2008-12-24 19:22:15 ----D---- C:\Program Files\Bonjour
2008-12-24 19:20:39 ----D---- C:\Program Files\QuickTime
2008-12-24 19:10:02 ----D---- C:\ProgramData\237
2008-12-23 00:22:52 ----D---- C:\Program Files\Microsoft Silverlight
2008-12-23 00:20:59 ----D---- C:\Program Files\Microsoft Sync Framework
2008-12-23 00:18:23 ----A---- C:\Windows\system32\d3dx9_32.dll
2008-12-23 00:17:32 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition
2008-12-23 00:13:48 ----D---- C:\Program Files\Microsoft
2008-12-23 00:12:36 ----D---- C:\Program Files\Windows Live SkyDrive
2008-12-23 00:08:20 ----D---- C:\Program Files\Common Files\Windows Live
2008-12-22 18:03:26 ----D---- C:\ProgramData\1A11F
2008-12-21 15:36:36 ----D---- C:\ProgramData\24356
2008-12-20 12:57:56 ----A---- C:\Windows\system32\d3dx9.dll
2008-12-20 12:57:56 ----A---- C:\Windows\system32\D3DX81ab.dll
2008-12-17 18:20:06 ----A---- C:\Windows\system32\javaws.exe
2008-12-17 18:20:06 ----A---- C:\Windows\system32\javaw.exe
2008-12-17 18:20:06 ----A---- C:\Windows\system32\deploytk.dll
2008-12-17 18:20:05 ----A---- C:\Windows\system32\java.exe
2008-12-16 15:06:14 ----D---- C:\ProgramData\E16E
2008-12-16 15:04:25 ----D---- C:\ProgramData\192DF
2008-12-11 12:38:39 ----D---- C:\Users\Nicola\AppData\Roaming\LimeWire
2008-12-11 07:52:17 ----A---- C:\Windows\system32\tzres.dll
2008-12-10 12:35:30 ----A---- C:\Windows\system32\Apphlpdm.dll
2008-12-10 12:35:27 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2008-12-10 10:59:07 ----A---- C:\Windows\system32\gdi32.dll
2008-12-10 10:53:31 ----A---- C:\Windows\system32\shell32.dll
2008-12-10 10:52:57 ----A---- C:\Windows\explorer.exe
2008-12-10 10:51:16 ----A---- C:\Windows\system32\mf.dll
2008-12-10 10:51:15 ----A---- C:\Windows\system32\WMVCORE.DLL
2008-12-10 10:51:13 ----A---- C:\Windows\system32\WMNetMgr.dll
2008-12-10 10:51:13 ----A---- C:\Windows\system32\logagent.exe
2008-12-02 22:37:20 ----A---- C:\Windows\system32\sirenacm.dll
2008-11-28 08:07:46 ----D---- C:\ProgramData\2E3C9
2008-11-27 16:50:38 ----D---- C:\ProgramData\2662
2008-11-26 07:38:30 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2008-11-26 07:38:28 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2008-11-26 07:38:27 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2008-11-26 07:38:27 ----A---- C:\Windows\system32\WindowsCodecs.dll
2008-11-26 07:38:25 ----A---- C:\Windows\system32\connect.dll
2008-11-19 07:32:20 ----A---- C:\Windows\system32\wups2.dll
2008-11-19 07:32:20 ----A---- C:\Windows\system32\wucltux.dll
2008-11-19 07:32:20 ----A---- C:\Windows\system32\wuauclt.exe
2008-11-19 07:32:19 ----A---- C:\Windows\system32\wuaueng.dll
2008-11-19 07:31:55 ----A---- C:\Windows\system32\wups.dll
2008-11-19 07:31:55 ----A---- C:\Windows\system32\wudriver.dll
2008-11-19 07:31:55 ----A---- C:\Windows\system32\wuapi.dll
2008-11-19 07:31:45 ----A---- C:\Windows\system32\wuwebv.dll
2008-11-19 07:31:45 ----A---- C:\Windows\system32\wuapp.exe
2008-11-12 08:20:42 ----D---- C:\Program Files\Adobe Media Player
2008-11-12 08:14:58 ----D---- C:\Program Files\Common Files\Adobe AIR
2008-11-11 23:20:46 ----D---- C:\Users\Nicola\AppData\Roaming\Download Manager
2008-11-11 21:26:15 ----A---- C:\Windows\system32\msxml3.dll
2008-11-11 21:26:12 ----A---- C:\Windows\system32\msxml6.dll

======List of files/folders modified in the last 3 months======

2009-02-10 11:18:27 ----D---- C:\Windows\Prefetch
2009-02-10 11:18:18 ----D---- C:\Windows\Temp
2009-02-10 10:47:45 ----D---- C:\Users\Nicola\AppData\Roaming\uTorrent
2009-02-10 08:19:45 ----D---- C:\Program Files\Mozilla Firefox
2009-02-10 07:31:48 ----D---- C:\Windows\rescache
2009-02-10 07:27:59 ----D---- C:\Windows\winsxs
2009-02-10 07:17:49 ----D---- C:\Windows\system32\catroot
2009-02-10 07:13:14 ----D---- C:\Program Files\Windows Mail
2009-02-10 07:13:13 ----D---- C:\Program Files\Internet Explorer
2009-02-10 07:13:10 ----D---- C:\Windows\system32\migration
2009-02-10 07:13:10 ----D---- C:\Windows\system32\en-US
2009-02-10 07:13:10 ----D---- C:\Windows\PolicyDefinitions
2009-02-10 07:13:09 ----D---- C:\Windows\System32
2009-02-10 03:03:58 ----SHD---- C:\Windows\Installer
2009-02-10 03:02:43 ----D---- C:\ProgramData\Microsoft Help
2009-02-10 03:00:38 ----SHD---- C:\System Volume Information
2009-02-09 19:04:05 ----HD---- C:\ProgramData
2009-02-09 18:54:41 ----D---- C:\Program Files\Messenger Plus! Live
2009-02-09 14:47:31 ----HD---- C:\$AVG8.VAULT$
2009-02-09 14:42:58 ----D---- C:\Windows\system32\catroot2
2009-02-09 14:40:28 ----D---- C:\Windows
2009-02-09 13:13:08 ----D---- C:\Windows\system32\drivers
2009-02-09 13:10:41 ----RD---- C:\Program Files
2009-02-08 23:06:44 ----D---- C:\Windows\system32\config
2009-02-08 23:06:27 ----D---- C:\Windows\Tasks
2009-02-08 23:06:27 ----D---- C:\Windows\system32\spool
2009-02-08 23:06:26 ----DC---- C:\Windows\system32\DRVSTORE
2009-02-08 23:06:26 ----D---- C:\Windows\system32\Msdtc
2009-02-08 23:06:25 ----D---- C:\Windows\inf
2009-02-08 23:06:24 ----D---- C:\Users\Nicola\AppData\Roaming\vlc
2009-02-08 23:06:16 ----D---- C:\ProgramData\FLEXnet
2009-02-08 23:06:15 ----D---- C:\Program Files\Windows Live
2009-02-08 23:06:11 ----SHDC---- C:\Program Files\Common Files\WindowsLiveInstaller
2009-02-08 23:06:10 ----D---- C:\Program Files\Common Files\microsoft shared
2009-02-08 21:26:29 ----D---- C:\Windows\Microsoft.NET
2009-02-08 20:29:52 ----D---- C:\ProgramData\WLInstaller
2009-02-08 20:19:20 ----SD---- C:\ProgramData\Microsoft
2009-02-08 20:18:44 ----RSD---- C:\Windows\assembly
2009-02-08 03:39:15 ----D---- C:\Windows\Minidump
2009-02-04 19:13:33 ----D---- C:\Windows\system32\Tasks
2009-02-01 03:25:29 ----D---- C:\ProgramData\avg8
2009-02-01 03:24:51 ----A---- C:\Windows\system32\avgrsstx.dll
2009-01-25 19:22:40 ----A---- C:\Windows\ntbtlog.txt
2009-01-24 16:54:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-01-12 07:33:59 ----D---- C:\Windows\system32\WDI
2009-01-10 18:19:02 ----SD---- C:\Users\Nicola\AppData\Roaming\Microsoft
2009-01-10 01:35:28 ----A---- C:\Windows\system32\mrt.exe
2009-01-04 15:00:12 ----D---- C:\Windows\system32\wbem
2009-01-04 14:58:46 ----D---- C:\Windows\registration
2009-01-04 14:46:47 ----D---- C:\Windows\Logs
2008-12-24 19:24:25 ----D---- C:\Program Files\Common Files\Apple
2008-12-24 19:24:20 ----D---- C:\ProgramData\Apple Computer
2008-12-23 10:12:17 ----SD---- C:\Windows\Downloaded Program Files
2008-12-23 00:16:10 ----D---- C:\Windows\SoftwareDistribution
2008-12-23 00:08:20 ----D---- C:\Program Files\Common Files
2008-12-17 18:19:35 ----D---- C:\Program Files\Java
2008-12-16 22:32:20 ----RSD---- C:\Windows\Fonts
2008-12-16 08:29:22 ----D---- C:\Windows\system32\Macromed
2008-12-11 08:05:30 ----D---- C:\Windows\AppPatch
2008-12-05 08:18:31 ----D---- C:\Users\Nicola\AppData\Roaming\Adobe
2008-11-12 16:01:27 ----D---- C:\ProgramData\Adobe
2008-11-12 08:25:30 ----D---- C:\Program Files\Adobe
2008-11-12 08:22:24 ----D---- C:\Program Files\Common Files\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2009-02-01 325128]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\Windows\System32\Drivers\avgmfx86.sys [2009-02-01 27656]
R1 AvgTdiX;AVG8 Network Redirector; C:\Windows\System32\Drivers\avgtdix.sys [2009-02-01 107272]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-08-14 74720]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2006-11-14 37376]
R3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys [2008-07-28 116736]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-11-18 1040544]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-12-05 8241984]
R3 Pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\Pcouffin.sys [2008-08-04 47360]
R3 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928]
R3 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2005-12-22 51840]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-19 88576]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 alrf3v0g;alrf3v0g; C:\Windows\system32\drivers\alrf3v0g.sys []
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2008-07-25 19456]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2008-07-25 220160]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2008-07-25 29184]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2008-12-08 55264]
S3 MSHUSBVideo;NX6000/NX3000/VX7000 Filter Driver; C:\Windows\System32\Drivers\nx6000.sys [2007-04-12 34136]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2008-01-19 49664]
S3 s116bus;Sony Ericsson Device 116 driver (WDM); C:\Windows\system32\DRIVERS\s116bus.sys [2007-04-03 83336]
S3 usbaudio;USB Audio Driver (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
S3 usbbus;LGE Mobile Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2007-07-11 12416]
S3 USBCM;Scientific-Atlanta USB Cable Modem Driver; C:\Windows\system32\DRIVERS\Sacm2A.sys [2006-11-22 15429]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\Windows\system32\DRIVERS\lgusbdiag.sys [2007-07-11 19840]
S3 USBModem;LGE Mobile USB Modem; C:\Windows\system32\DRIVERS\lgusbmodem.sys [2007-07-11 21632]
S3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
S3 VX1000;VX-1000; C:\Windows\system32\DRIVERS\VX1000.sys [2007-04-10 1966312]
S3 VX3000;VX-3000; C:\Windows\system32\DRIVERS\VX3000.sys [2007-04-10 1966696]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 xnacc;XBOX 360 Controller For Windows Driver Service; C:\Windows\system32\DRIVERS\xnacc.sys [2008-01-19 521216]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2009-02-01 903960]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-02-01 298264]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-11-12 655624]
S3 fsssvc;Windows Live Family Safety; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2008-12-08 533344]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.05 2009-02-10 11:19:04

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}
Adobe Bridge CS4-->MsiExec.exe /I{83877DB1-8B77-45BC-AB43-2BAC22E093E0}
Adobe CMaps CS4-->MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191}
Adobe Color - Photoshop Specific CS4-->MsiExec.exe /I{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
Adobe Color EU Extra Settings CS4-->MsiExec.exe /I{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}
Adobe Color JA Extra Settings CS4-->MsiExec.exe /I{0D6013AB-A0C7-41DC-973C-E93129C9A29F}
Adobe Color NA Recommended Settings CS4-->MsiExec.exe /I{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}
Adobe Color Video Profiles CS CS4-->MsiExec.exe /I{63C24A08-70F3-4C8E-B9FB-9F21A903801D}
Adobe CSI CS4-->MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF}
Adobe Default Language CS4-->MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683}
Adobe Device Central CS4-->MsiExec.exe /I{67F0E67A-8E93-4C2C-B29D-47C48262738A}
Adobe Drive CS4-->MsiExec.exe /I{16E16F01-2E2D-4248-A42F-76261C147B6C}
Adobe ExtendScript Toolkit CS4-->MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}
Adobe Extension Manager CS4-->MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All-->MsiExec.exe /I{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}
Adobe Linguistics CS4-->MsiExec.exe /I{931AB7EA-3656-4BB7-864D-022B09E3DD67}
Adobe Media Player-->msiexec /qb /x {39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Media Player-->MsiExec.exe /I{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Output Module-->MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A}
Adobe PDF Library Files CS4-->MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353}
Adobe Photoshop CS4 Support-->MsiExec.exe /I{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}
Adobe Photoshop CS4-->C:\Program Files\Common Files\Adobe\Installers\faf656ef605427ee2f42989c3ad31b8\Setup.exe --uninstall=1
Adobe Photoshop CS4-->MsiExec.exe /I{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}
Adobe Photoshop CS4-->MsiExec.exe /I{E4848436-0345-47E2-B648-8B522FCDA623}
Adobe Search for Help-->MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA}
Adobe Service Manager Extension-->MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
Adobe Setup-->MsiExec.exe /I{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}
Adobe Shockwave Player 11-->C:\Windows\system32\adobe\SHOCKW~1\UNWISE.EXE C:\Windows\system32\Adobe\SHOCKW~1\Install.log
Adobe Type Support CS4-->MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}
Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}
Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
AdobeColorCommonSetCMYK-->MsiExec.exe /I{68243FF8-83CA-466B-B2B8-9F99DA5479C4}
AdobeColorCommonSetRGB-->MsiExec.exe /I{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}
AdVantage (Powering DAEMON Tools)-->"C:\Program Files\AdVantage\AdVUninst.exe" /r DAEM /d "AdVantage (Powering DAEMON Tools)" /m "AdVantage is safe advertising software that supports Freeze.com.\nAdVantage is certified by TRUSTe as a Trusted Download.\n\nAre you sure you want to uninstall AdVantage support for DAEMON Tools?"
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
AVG Free 8.0-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Cheat Engine 5.3-->"D:\Program Files\Cheat Engine\unins000.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Connect-->MsiExec.exe /I{B29AD377-CC12-490A-A480-1452337C618D}
ConvertXtoDVD 3.1.3.40-->"C:\Program Files\VSO\ConvertX\3\unins000.exe"
DC++ 0.707-->"C:\Program Files\DC++\uninstall.exe"
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
iMesh-->C:\Program Files\iMesh Applications\iMesh\UninstallSurvey.exe C:\Program Files\iMesh Applications\iMesh\UnwiseLauncher.exe /A C:\PROGRA~1\IMESHA~1\iMesh\INSTALL.LOG
iPod Messenger-->\uninstallipod.exe
iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
Java™ 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java™ 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Junk Mail filter update-->MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}
kuler-->MsiExec.exe /I{098727E1-775A-4450-B573-3F441F1CA243}
LG PC Suite-->C:\Program Files\InstallShield Installation Information\{993960EE-CA4D-443F-8F88-E24260DD5FD2}\setup.exe -runfromtemp -l0x0009 -removeonly
LG USB Modem driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C3ABE126-2BB2-4246-BFE1-6797679B3579}\setup.exe" -l0x9 LG -removeonly
MagicDisc 2.7.105-->C:\PROGRA~1\MAGICD~1\UNWISE.EXE C:\PROGRA~1\MAGICD~1\INSTALL.LOG
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live & Sponsor (CiD)-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft LifeCam-->MsiExec.exe /X{63AFACBC-4795-4A1B-8037-5085DC03FC54}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Search Enhancement Pack-->MsiExec.exe /I{299CF645-48C7-4FA1-8BCD-5CE200CF180D}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0.6)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
PDF Settings CS4-->MsiExec.exe /I{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}
Photoshop Camera Raw-->MsiExec.exe /I{CC75AB5C-2110-4A7F-AF52-708680D22FE8}
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
Scientific-Atlanta WebSTAR 2000 series Cable Modem-->UNDPX2A.EXE
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
Security Update for Microsoft Office OneNote 2007 (KB950130)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
Suite Shared Configuration CS4-->MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434}
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
The Sims 2 Family Fun Stuff-->D:\Program Files\EA GAMES\The Sims 2 Family Fun Stuff\EAUninstall.exe
The Sims 2 Glamour Life Stuff-->D:\Program Files\EA GAMES\The Sims 2 Glamour Life Stuff\EAUninstall.exe
The Sims 2 Nightlife-->D:\Program Files\EA GAMES\The Sims 2 Nightlife\EAUninstall.exe
The Sims 2 Pets-->D:\Program Files\EA GAMES\The Sims 2 Pets\EAUninstall.exe
The Sims 2 University-->D:\Program Files\EA GAMES\The Sims 2 University\EAUninstall.exe
The Sims 2-->D:\Programs\EAUninstall.exe
The Sims™ 2 Apartment Life-->D:\Program Files\EA GAMES\The Sims 2 Apartment Life\EAUninstall.exe
The Sims™ 2 Bon Voyage-->D:\Program Files\EA GAMES\The Sims 2 Bon Voyage\EAUninstall.exe
The Sims™ 2 Celebration! Stuff-->D:\Program Files\EA GAMES\The Sims 2 Celebration! Stuff\EAUninstall.exe
The Sims™ 2 FreeTime-->D:\Program Files\EA GAMES\The Sims 2 FreeTime\EAUninstall.exe
The Sims™ 2 H&M® Fashion Stuff-->D:\Program Files\EA GAMES\The Sims 2 H&M® Fashion Stuff\EAUninstall.exe
The Sims™ 2 IKEA® Home Stuff-->D:\Program Files\EA GAMES\The Sims 2 IKEA® Home Stuff\EAUninstall.exe
The Sims™ 2 Kitchen & Bath Interior Design Stuff-->D:\Program Files\EA GAMES\The Sims 2 Kitchen & Bath Interior Design Stuff\EAUninstall.exe
The Sims™ 2 Seasons-->D:\Program Files\EA GAMES\The Sims 2 Seasons\EAUninstall.exe
Update for Microsoft Office 2007 Help for Common Features (KB957244)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {C8C72583-C907-4D20-8973-C3858D96BD9E}
Update for Microsoft Office Access 2007 Help (KB957241)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {D670F9B9-3E84-47B5-8A4A-618B65DB1593}
Update for Microsoft Office Excel 2007 Help (KB957242)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {51864046-74C8-487B-97CD-6167A4B1DB56}
Update for Microsoft Office InfoPath 2007 Help (KB957243)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {766DF26B-5F03-48ED-9307-5326F2790ED0}
Update for Microsoft Office OneNote 2007 Help (KB957245)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {7332DE60-DC79-4578-A60A-A5EA0D6E032B}
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {6F0E4983-E419-4591-B7DD-EFB0073D3E47}
Update for Microsoft Office PowerPoint 2007 Help (KB957247)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {B20E2C59-EEC5-4102-9E50-5DBB2093C37D}
Update for Microsoft Office Publisher 2007 Help (KB957249)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4E140A5A-4A90-404A-B955-10C2D98CD3EE}
Update for Microsoft Office Word 2007 Help (KB957252)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {54DF3345-0720-4224-9740-C7E00303F565}
Update for Microsoft Script Editor Help (KB957253)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {F21BF703-548C-47B2-B92A-6876E9566C42}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb959141)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {CC6191C2-B0CE-473C-AD77-61EA3497D796}
VLC media player 0.9.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live Call-->MsiExec.exe /I{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}
Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{D9D754A1-EAC5-406C-A28B-C49B1E846711}
Windows Live Family Safety-->MsiExec.exe /X{DC509FE5-1445-46C9-827C-6120429CB942}
Windows Live Mail-->MsiExec.exe /I{63C1109E-D977-49ED-BCE3-D00D0BF187D6}
Windows Live Messenger-->MsiExec.exe /X{0AAA9C97-74D4-47CE-B089-0B147EF3553C}
Windows Live Photo Gallery-->MsiExec.exe /X{F73A5B18-EB75-4B2C-B32D-9457576E2417}
Windows Live Sign-in Assistant-->MsiExec.exe /I{505DF7A3-88D5-4DD6-9AD5-C98C2ED0CEC4}
Windows Live Sync-->MsiExec.exe /X{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}
Windows Live Toolbar-->MsiExec.exe /X{2B4C7E1E-E446-4740-ADB5-9842E742EE8A}
Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Live Writer-->MsiExec.exe /X{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Security center information======

AV: AVG Anti-Virus Free
AS: AVG Anti-Virus Free (disabled)
AS: Windows Defender

System event log

Computer Name: Nicola-PC
Event Code: 6008
Message: The previous system shutdown at 03:49:33 on 08/02/2009 was unexpected.
Record Number: 91644
Source Name: EventLog
Time Written: 20090208035304.000000-000
Event Type: Error
User:

Computer Name: Nicola-PC
Event Code: 6009
Message: Microsoft ® Windows ® 6.00. 6001 Service Pack 1 Multiprocessor Free.
Record Number: 91645
Source Name: EventLog
Time Written: 20090208035304.000000-000
Event Type: Information
User:

Computer Name: Nicola-PC
Event Code: 6005
Message: The Event log service was started.
Record Number: 91646
Source Name: EventLog
Time Written: 20090208035304.000000-000
Event Type: Information
User:

Computer Name: Nicola-PC
Event Code: 6013
Message: The system uptime is 44 seconds.
Record Number: 91647
Source Name: EventLog
Time Written: 20090208035304.000000-000
Event Type: Information
User:

Computer Name: NICOLA-PC
Event Code: 263
Message: The service 'TabletInputService' may not have unregistered for device event notifications before it was stopped.
Record Number: 91648
Source Name: PlugPlayManager
Time Written: 20090208035305.000000-000
Event Type: Warning
User:

Application event log

Computer Name: Nicola-PC
Event Code: 1001
Message: Fault bucket 1050292128, type 1
Event Name: APPCRASH
Response: None
Cab Id: 0

Problem signature:
P1: wltuser.exe
P2: 14.0.8052.1208
P3: 493dc2be
P4: wltuser.exe
P5: 14.0.8052.1208
P6: 493dc2be
P7: c0000005
P8: 0000ffd9
P9:
P10:

Attached files:
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report12243288\WER9E3.tmp.version.txt
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report12243288\WER9F3.tmp.appcompat.txt
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report12243288\WERA33.tmp.hdmp
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report12243288\WER2EE3.tmp.mdmp

These files may be available here:
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report13243778
Record Number: 19603
Source Name: Windows Error Reporting
Time Written: 20090210105337.000000-000
Event Type: Information
User:

Computer Name: Nicola-PC
Event Code: 1000
Message: Faulting application wltuser.exe, version 14.0.8052.1208, time stamp 0x493dc2be, faulting module wltuser.exe, version 14.0.8052.1208, time stamp 0x493dc2be, exception code 0xc0000005, fault offset 0x0000ffd9, process id 0x13fc, application start time 0x01c98b6dd3530044.
Record Number: 19604
Source Name: Application Error
Time Written: 20090210105338.000000-000
Event Type: Error
User:

Computer Name: Nicola-PC
Event Code: 1000
Message: Faulting application wltuser.exe, version 14.0.8052.1208, time stamp 0x493dc2be, faulting module wltuser.exe, version 14.0.8052.1208, time stamp 0x493dc2be, exception code 0xc0000005, fault offset 0x0000ffd9, process id 0x1524, application start time 0x01c98b6dd8e9d154.
Record Number: 19605
Source Name: Application Error
Time Written: 20090210105347.000000-000
Event Type: Error
User:

Computer Name: Nicola-PC
Event Code: 1001
Message: Fault bucket 1050292128, type 1
Event Name: APPCRASH
Response: None
Cab Id: 0

Problem signature:
P1: wltuser.exe
P2: 14.0.8052.1208
P3: 493dc2be
P4: wltuser.exe
P5: 14.0.8052.1208
P6: 493dc2be
P7: c0000005
P8: 0000ffd9
P9:
P10:

Attached files:
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report14f058cd\WER39E8.tmp.version.txt
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report14f058cd\WER39E9.tmp.appcompat.txt
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report14f058cd\WER3A28.tmp.hdmp
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report14f058cd\WER570B.tmp.mdmp

These files may be available here:
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report15d45d40
Record Number: 19606
Source Name: Windows Error Reporting
Time Written: 20090210105347.000000-000
Event Type: Information
User:

Computer Name: Nicola-PC
Event Code: 1001
Message: Fault bucket 1050292128, type 1
Event Name: APPCRASH
Response: None
Cab Id: 0

Problem signature:
P1: wltuser.exe
P2: 14.0.8052.1208
P3: 493dc2be
P4: wltuser.exe
P5: 14.0.8052.1208
P6: 493dc2be
P7: c0000005
P8: 0000ffd9
P9:
P10:

Attached files:
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report15947df9\WER5DBC.tmp.version.txt
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report15947df9\WER5DCD.tmp.appcompat.txt
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report15947df9\WER5E0C.tmp.hdmp
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportQueue\Report15947df9\WER7C57.tmp.mdmp

These files may be available here:
C:\Users\Nicola\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report157c8079
Record Number: 19607
Source Name: Windows Error Reporting
Time Written: 20090210105356.000000-000
Event Type: Information
User:

Security event log

Computer Name: Nicola-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 32968
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090210111852.241805-000
Event Type: Audit Failure
User:

Computer Name: Nicola-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 32969
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090210111852.320805-000
Event Type: Audit Failure
User:

Computer Name: Nicola-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 32970
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090210111852.413805-000
Event Type: Audit Failure
User:

Computer Name: Nicola-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 32971
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090210111852.526805-000
Event Type: Audit Failure
User:

Computer Name: Nicola-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 32972
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090210111852.609805-000
Event Type: Audit Failure
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 104 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=6801
"NUMBER_OF_PROCESSORS"=2
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-02-10 12:06:04
Windows 6.0.6001 Service Pack 1


---- System - GMER 1.0.14 ----

INT 0x53 ? 86094F00
INT 0x63 ? 86094F00
INT 0x72 ? 846C6BF8
INT 0x82 ? 846C6BF8
INT 0x92 ? 846C6BF8
INT 0x92 ? 846C6BF8
INT 0x92 ? 86094F00
INT 0x92 ? 846C6BF8
INT 0x93 ? 86094F00

---- Kernel code sections - GMER 1.0.14 ----

? System32\Drivers\spxg.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload 87B7F46F 5 Bytes JMP 860944E0
.text alrf3v0g.SYS 8BB79000 22 Bytes [ 26, 72, 21, 82, 10, 71, 21, ... ]
.text alrf3v0g.SYS 8BB79017 159 Bytes [ 00, 32, 67, D1, 82, 3D, 65, ... ]
.text alrf3v0g.SYS 8BB790B7 22 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text alrf3v0g.SYS 8BB790CE 80 Bytes [ 00, 00, 26, 00, 00, 00, E0, ... ]
.text alrf3v0g.SYS 8BB7911F 194 Bytes [ 7E, 38, 40, 39, 82, 3B, C4, ... ]
.text ...

---- User code sections - GMER 1.0.14 ----

.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] kernel32.dll!FindResourceExA 76CD08DD 7 Bytes JMP 28001D80 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] kernel32.dll!FindResourceA 76CD09A5 5 Bytes JMP 28001CF0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] kernel32.dll!CreateEventA 76CE4AD8 5 Bytes JMP 28001840 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] kernel32.dll!LockResource 76CE7F1F 5 Bytes JMP 28001F50 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] kernel32.dll!FindResourceExW 76CE813B 1 Byte [ E9 ]
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] kernel32.dll!FindResourceExW + 2 76CE813D 5 Bytes [ 9B, 31, B1, CC, CC ]
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] kernel32.dll!LoadResource 76CE8213 7 Bytes JMP 28001E20 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] kernel32.dll!FindResourceW 76CE97C7 5 Bytes JMP 28001BE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] kernel32.dll!SizeofResource 76CE97E5 7 Bytes JMP 28001EE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] ADVAPI32.dll!CryptDeriveKey 764DE6F6 7 Bytes JMP 28001000 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] ADVAPI32.dll!CryptDecrypt 764DE8D9 7 Bytes JMP 28001060 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!SetWindowPlacement 767279BB 5 Bytes JMP 28005DC0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!SetWindowRgn 767295E2 7 Bytes JMP 28005F00 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!LoadImageW 7672D61D 5 Bytes JMP 28006690 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!LoadIconW 7672EC94 5 Bytes JMP 28006880 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!CreateWindowExW 76733D67 5 Bytes JMP 28003CA0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!GetWindowLongW 7673F67F 7 Bytes JMP 28006A20 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!PeekMessageW 7673FD9F 5 Bytes JMP 280045E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!TrackPopupMenuEx 76750F4D 5 Bytes JMP 28004EC0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!CreateDialogParamW 76751C58 3 Bytes JMP 28006040 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!CreateDialogParamW + 4 76751C5C 1 Byte [ B1 ]
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] USER32.dll!MessageBoxIndirectW 7677D56B 5 Bytes JMP 28006230 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] WS2_32.dll!closesocket 77B2330C 5 Bytes JMP 2800BC20 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] WS2_32.dll!recv 77B2343A 5 Bytes JMP 2800B440 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] WS2_32.dll!WSASend 77B24496 5 Bytes JMP 2800B9E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] WS2_32.dll!send 77B2659B 5 Bytes JMP 2800B800 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] WS2_32.dll!WSARecv 77B28400 5 Bytes JMP 2800B5E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] SHELL32.dll!Shell_NotifyIconW 7701C808 5 Bytes JMP 28003400 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] ole32.dll!CoRegisterClassObject 767F45AC 5 Bytes JMP 28002360 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] ole32.dll!CoInitializeEx 7682B89A 5 Bytes JMP 28002260 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] WININET.dll!InternetCloseHandle 765B47AD 5 Bytes JMP 2800A600 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] WININET.dll!HttpOpenRequestA 765B782B 5 Bytes JMP 2800A2C0 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] WININET.dll!InternetReadFile 765BDF1F 5 Bytes JMP 2800A450 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[676] WININET.dll!HttpSendRequestA 765C9522 5 Bytes JMP 2800A530 C:\Program Files\Messenger Plus! Live\MsgPlusLive1.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Users\Nicola\AppData\Local\Temp\Rar$EX00.492\gmer.exe[1952] kernel32.dll!LoadLibraryExW + 6 76CC30C9 1 Byte [ CC ]

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [82C0F6A4] \SystemRoot\System32\Drivers\spxg.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [82C0F046] \SystemRoot\System32\Drivers\spxg.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [82C0F7CE] \SystemRoot\System32\Drivers\spxg.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [82C0F0C4] \SystemRoot\System32\Drivers\spxg.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [82C0F142] \SystemRoot\System32\Drivers\spxg.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [82C1AD7A] \SystemRoot\System32\Drivers\spxg.sys
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortNotification] F73BFF33
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortWritePortUchar] B85F0B75
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortWritePortUlong] FFFFFFFE
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 08C25D5E
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 5D8B5300
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortGetScatterGatherList] 74DF3B0C
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortReadPortUchar] 01FB8311
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortStallExecution] 5F5B0C74
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortGetParentBusType] FFFFFEB8
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortRequestCallback] C25D5EFF
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 7E390008
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortGetUnCachedExtension] C7077524
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortCompleteRequest] 71642446
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortMoveMemory] 7E398BB8
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] C7077528
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 71902846
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 468B8BB8
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortReadPortUshort] 244E8B2C
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 7468016A
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortInitialize] 500000FA
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortGetDeviceBase] C73BD1FF
IAT \SystemRoot\System32\Drivers\alrf3v0g.SYS[ataport.SYS!AtaPortDeviceStateChange] 5F5B0C75

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 850591F8
Device \Driver\netbt \Device\NetBT_Tcpip_{6B6982EF-2BBA-4EDD-8E37-5E4A05E9727E} 871D9500
Device \Driver\volmgr \Device\VolMgrControl 846C81F8
Device \Driver\usbohci \Device\USBPDO-0 85FEF1F8
Device \Driver\usbehci \Device\USBPDO-1 85FF01F8
Device \Driver\usbohci \Device\USBPDO-2 85FEF1F8
Device \Driver\usbehci \Device\USBPDO-3 85FF01F8

AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Tcp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)

Device \Driver\volmgr \Device\HarddiskVolume1 846C81F8
Device \Driver\volmgr \Device\HarddiskVolume2 846C81F8
Device \Driver\cdrom \Device\CdRom0 860C91F8
Device \Driver\volmgr \Device\HarddiskVolume3 846C81F8
Device \Driver\cdrom \Device\CdRom1 860C91F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 850571F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-3 850571F8
Device \Driver\atapi \Device\Ide\IdePort0 850571F8
Device \Driver\atapi \Device\Ide\IdePort1 850571F8
Device \Driver\atapi \Device\Ide\IdePort2 850571F8
Device \Driver\atapi \Device\Ide\IdePort3 850571F8
Device \Driver\cdrom \Device\CdRom2 860C91F8
Device \Driver\sptd \Device\1215137124 spxg.sys
Device \Driver\netbt \Device\NetBt_Wins_Export 871D9500
Device \Driver\Smb \Device\NetbiosSmb 872431F8
Device \Driver\PCI_PNP5112 \Device\0000004d spxg.sys
Device \Driver\netbt \Device\NetBT_Tcpip_{921A67BA-8FAC-4464-894B-E4FBAA02C23E} 871D9500
Device \Driver\iScsiPrt \Device\RaidPort0 860FA1F8

AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Udp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)

Device \Driver\usbohci \Device\USBFDO-0 85FEF1F8
Device \Driver\usbehci \Device\USBFDO-1 85FF01F8
Device \Driver\usbohci \Device\USBFDO-2 85FEF1F8
Device \Driver\usbehci \Device\USBFDO-3 85FF01F8
Device \Driver\alrf3v0g \Device\Scsi\alrf3v0g1 860DE1F8
Device \Driver\alrf3v0g \Device\Scsi\alrf3v0g1Port6Path0Target0Lun0 860DE1F8

---- Services - GMER 1.0.14 ----

Service system32\drivers\msqpdxnbcbcrrx.sys (*** hidden *** ) [SYSTEM] msqpdxserv.sys <-- ROOTKIT !!!

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\000461879275
Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\000ee7501c7d
Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\000ee7501c7d@0021fbc4df41 0x65 0x58 0xE7 0xFA ...
Reg HKLM\SYSTEM\ControlSet001\Services\msqpdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\msqpdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\msqpdxserv.sys@imagepath \systemroot\system32\drivers\msqpdxnbcbcrrx.sys
Reg HKLM\SYSTEM\ControlSet001\Services\msqpdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\msqpdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet001\Services\msqpdxserv.sys\modules@msqpdxserv \systemroot\system32\drivers\msqpdxnbcbcrrx.sys
Reg HKLM\SYSTEM\ControlSet001\Services\msqpdxserv.sys\modules@msqpdxl \systemroot\system32\msqpdxwqsctmei.dll
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDA 0xAA 0x53 0x58 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xC3 0x3F 0xEC 0x66 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x65 0xF2 0xC2 0x76 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000461879275
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000ee7501c7d
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000ee7501c7d@0021fbc4df41 0x65 0x58 0xE7 0xFA ...
Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys@imagepath \systemroot\system32\drivers\msqpdxnbcbcrrx.sys
Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules@msqpdxserv \systemroot\system32\drivers\msqpdxnbcbcrrx.sys
Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules@msqpdxl \systemroot\system32\msqpdxwqsctmei.dll
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDA 0xAA 0x53 0x58 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xC3 0x3F 0xEC 0x66 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x65 0xF2 0xC2 0x76 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000461879275
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000ee7501c7d
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000ee7501c7d@0021fbc4df41 0x65 0x58 0xE7 0xFA ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys@imagepath \systemroot\system32\drivers\msqpdxnbcbcrrx.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys\modules@msqpdxserv \systemroot\system32\drivers\msqpdxnbcbcrrx.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys\modules@msqpdxl \systemroot\system32\msqpdxwqsctmei.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDA 0xAA 0x53 0x58 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xC3 0x3F 0xEC 0x66 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x65 0xF2 0xC2 0x76 ...
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\3968183216\Groups@best people you will ever meet :-) \x20393 0
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\3968183216\Groups@family :-) \x20393 0
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\3968183216\Groups@girls :-) \x20393 0
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\3968183216\Groups@boys :-) \x20393 1
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\3968183216\Groups@plainly rejected :-) \x2039/3 0
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\Nicola\Documents\Downloads\The Sims 2 (Missing Stuff Packs)\The Sims\x2122 2 Happy Holiday Stuff\setup.exe 1

---- Files - GMER 1.0.14 ----

File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums) 0 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987) 0 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\01 Welcome To The Jungle.mp3 6570612 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\02 It's So Easy.mp3 4874116 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\03 Nightrain.mp3 6447732 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\04 Out Ta Get Me.mp3 6336764 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\05 Mr. Brownstone.mp3 5497920 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\06 Paradise City.mp3 9754834 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\07 My Michelle.mp3 5282253 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\08 Think About You.mp3 5563122 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\09 Sweet Child O' Mine.mp3 8557381 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\10 You're Crazy.mp3 4736816 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\11 Anything Goes.mp3 4956872 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\12 Rocket Queen.mp3 8958622 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Appetite For Destruction (1987)\guns_n_roses_-_appetite_for_destruction.jpg 60218 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008) 0 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\01 Chinese Democracy.mp3 6801408 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\02 Shackler's Revenge.mp3 5210112 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\03 Better.mp3 7172096 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\04 Street Of Dreams.mp3 6885376 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\05 If The World.mp3 7069696 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\06 There Was A Time.mp3 9629696 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\07 Catcher In The Rye.mp3 8476672 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\08 Scraped.mp3 5062656 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\09 Riad N' The Bedouins.mp3 6008832 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\10 Sorry.mp3 8992768 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\11 I.R.S..mp3 6455296 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\12 Madagascar.mp3 8114176 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\13 This I Love.mp3 8028160 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\14 Prostitute.mp3 9023488 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Chinese Democracy (2008)\up-1guns.jpg 70861 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989) 0 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989)\01 Reckless Life.mp3 6471808 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989)\02 Nice Boys.mp3 5805581 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989)\03 Move To The City.mp3 7076177 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989)\04 Mama Kin.mp3 7469059 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989)\05 Patience.mp3 11249917 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989)\06 Used To Love Her.mp3 6100660 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989)\07 You're Crazy.mp3 7934665 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989)\08 One In A Million.mp3 11682087 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Lies (1989)\gnrliesqi4.jpg 111527 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993) 0 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\01 Since I Don't Have You.mp3 8281571 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\02 New Rose.mp3 5066629 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\03 Down On The Farm.mp3 6636032 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\04 Human Being.mp3 13047142 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\05 Raw Power.mp3 6115707 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\06 Ain't It Fun.mp3 9725202 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\07 Buick Makane (Big Dumb Sex).mp3 5068301 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\08 Hair Of The Dog.mp3 7482433 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\09 Attitude.mp3 2756987 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\10 Black Leather.mp3 7898721 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\11 You Can't Put Your Arms Around A Memory.mp3 6827073 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\12 I Don't Care About You.mp3 9165137 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - The Spaghetti Incident (1993)\guns_n_roses_the_spaghetti.jpg 187307 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991) 0 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\09 Double Talkin' Jive.mp3 4887908 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\01 Right Next Door To Hell.mp3 4374446 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\02 Dust N' Bones.mp3 7157427 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\03 Live And Let Die.mp3 4418331 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\04 Don't Cry (Original).mp3 6836434 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\05 Perfect Crime.mp3 3449711 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\06 You Ain't The First.mp3 3751895 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\07 Bad Obsession.mp3 7881541 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\08 Back Off bleep.mp3 7284068 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\10 November Rain.mp3 12905828 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\11 The Garden.mp3 7733584 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\12 Garden Of Eden.mp3 3882299 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\13 Don't Damn Me.mp3 7655216 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\14 Bad Apples.mp3 6443344 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\15 Dead Horse.mp3 6185045 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\16 Coma.mp3 14730220 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use Your Illusion I (1991)\Guns_N_Roses-Use_Your_Illusion_I-Frontal.jpg 202702 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991) 0 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\01 Civil War.mp3 14618668 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\02 14 Years.mp3 8247299 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\03 Yesterdays.mp3 6116543 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\04 Knockin' On Heaven's Door.mp3 10678985 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\05 Get In The Ring.mp3 10761741 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\06 Shotgun Blues.mp3 6387380 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\07 Breakdown.mp3 13511912 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\08 Pretty Tied Up.mp3 9094920 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\09 Locomotive.mp3 16492797 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\10 So Fine.mp3 7815129 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\11 Estranged.mp3 17938100 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\12 You Could Be Mine.mp3 10920566 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\13 Don't Cry (Alt. Lyrics).mp3 9017179 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\14 My World.mp3 2533797 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\Guns N' Roses - Use your Illusion II (1991)\60010701.jpg 67007 bytes
File C:\Users\Nicola\Documents\Downloads\Burn 2 Disc\Guns N' Roses Discography (6 Studio Albums)\guns-n-roses.jpg 29140 bytes

---- EOF - GMER 1.0.14 ----




Cheers for the help m8

Seems to be running a bit better now :D

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given..

Please download ComboFix by sUBs from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.

If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest..

When finished, it shall produce a log for you. Post that log and a fresh HijackThis log in your next reply..

Note: DON'T do anything with your computer while ComboFix is running.. Let ComboFix finishes its job..

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic