Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browsing Issues


  • This topic is locked This topic is locked
22 replies to this topic

#1 NickJewell

NickJewell

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 06 April 2010 - 05:24 PM

Hey all.

I've been having a rather annoying browsing issue. I use Firefox, if that matters at all.

First and foremost, every time I use a link on Google, it redirects me to some other domain, which in turn redirects me to a different website altogether. This does not happen if I use the link by opening it in another tab (middle mouse button click), however, which I find curious. Regardless, it has been bothering the hell out of me and I figured it's time to do something about it. This happens occasionally when following links from other webpages, as well as very sporadically when inputting webpages directly into the address bar, but happens every time I use a link on Google. Any help with that would be appreciated.

Below, I've included my HiJackThis log. I was also going to give a Spyware Doctor report, but it cannot access the database to download new updates, which is a problem I've already posted elsewhere.

If someone could give me some guidance, I'd be most obliged.

Cheers!

- Nick

-=-=-=-=-=-=-=-=-=-=-=-=-

HiJackThis Report:

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 4:16:53 PM, on 06/04/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\vVX3000.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe
C:\Program Files\WordWeb\wweb32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\conime.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Program Files\ActivationManager\ActivationManager.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [VX3000] C:\Windows\vVX3000.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKCU\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MSSMSGS] rundll32.exe winhjr32.rom,wOTRun
O4 - HKCU\..\Run: [SaveSoldier] C:\Program Files\SaveSoldier Software\SaveSoldier\SaveSoldier.exe -min
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Civilization Registration.lnk = L:\ATR1.EXE
O4 - Startup: Impulse Now.lnk = C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O13 - Gopher Prefix:
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/SCRABBLE/Images/stg_drm.ocx
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/SCRABBLE/Images/armhelper.ocx
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4129B5DC-99F9-495A-8760-E0646DEAD679}: NameServer = 85.255.112.159,85.255.112.16
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.159,85.255.112.16
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.159,85.255.112.16
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.159,85.255.112.16
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - Unknown owner - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10707 bytes

Attached Files


Edited by Budapest, 06 April 2010 - 06:01 PM.
Moved from Web Browsing/Email and Other Internet Applications ~BP


BC AdBot (Login to Remove)

 


#2 NickJewell

NickJewell
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 06 April 2010 - 09:07 PM

Hi all.

I'm having a very similar problem to lots of people, it seems. My computer redirects links when I use Google or other search engines. Hopefully someone can lend a hand.

I'll include my HiJackThis log, as well as the DDS log. I, unfortunately, cannot attach the GMER log as GMER crashes my computer every time I run it. I suppose that's another problem in and of itself, but I can deal with that later, hopefully.

Any help would be greatly appreciated.

Cheers!

- Nick

Attached Files


Edited by Orange Blossom, 06 April 2010 - 09:16 PM.
Merged topics. ~ OB


#3 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:08 PM

Posted 10 April 2010 - 04:46 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE



Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.


  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.
-- If you encounter any problems, try running GMER in Safe Mode.
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#4 NickJewell

NickJewell
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 10 April 2010 - 09:52 PM

I've attached the DDS Log and Attach file, as well as the GMER Log below. Thanks in advance for the help!

Attached Files


Edited by NickJewell, 10 April 2010 - 09:53 PM.


#5 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:08 PM

Posted 11 April 2010 - 11:19 PM

Hello, NickJewell
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

If you do not make a reply in 5 days, we will have to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
  • Please set your system to show all files.
    Click Start, open My Computer, select the Tools menu and click Folder Options.
    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
    Uncheck: Hide file extensions for known file types
    Uncheck the Hide protected operating system files (recommended) option.
    Click Yes to confirm.




Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to before saving it to your desktop.

Link 1
Link 2



--------------------------------------------------------------------

Double click on the renamed Combofix.exe & follow the prompts.
    When finished, it will produce a report for you.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper


If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#6 NickJewell

NickJewell
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 12 April 2010 - 01:48 AM

Hi Tom. Thanks for getting back to me so quickly with this.

Two things I'd like to mention before posting the log from ComboFix. First off, I am running AVG Free 8.5 on my computer (exact version number is 8.5.437). I was unable to disable the Anti-Virus and Anti-Spyware that are attached to AVG Free 8.5, however. They seem to be built directly into the program and cannot be disabled without uninstalling the program. I ran ComboFix regardless, but I hope it wouldn't have affected the results.

Secondly, when ComboFix finished (after it had restarted my computer and had brought up the Log in the .txt file), I attempted to open both Firefox and Internet Explorer only to receive an error message saying that the files belonged to a registry key that was flagged for deletion. I restarted my computer so that I could access the internet, but I am unsure if this affected things otherwise. Any insight would be greatly appreciated.

Here's the log. Thanks again, Tom:

-=-=-=-=-=-=-=-=-=-=-=-=-=-

ComboFix 10-04-11.03 - Nick 12/04/2010 0:09.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.2.1033.18.3070.1675 [GMT -6:00]
Running from: c:\users\Nick\Desktop\schrauber.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-227845856-12066905-2617085515-500
c:\$recycle.bin\S-1-5-21-3043026271-1380955479-1757640773-500
c:\users\Nick\AppData\Roaming\inst.exe
c:\windows\system32\ReadMe.txt
c:\windows\system32\uninstall.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ESQULserv.sys
-------\Service_ESQULserv.sys


((((((((((((((((((((((((( Files Created from 2010-03-12 to 2010-04-12 )))))))))))))))))))))))))))))))
.

2010-04-12 06:19 . 2010-04-12 06:23 -------- d-----w- c:\users\Nick\AppData\Local\temp
2010-04-11 01:17 . 2010-04-11 01:17 -------- d-----w- C:\THQ
2010-04-10 15:12 . 2010-04-10 15:12 -------- d-----w- c:\programdata\Musicnotes
2010-04-10 15:11 . 2010-04-10 15:11 -------- d-----w- c:\program files\Musicnotes
2010-04-06 23:37 . 2010-04-06 23:37 -------- d-----w- c:\programdata\WindowsSearch
2010-04-06 22:36 . 2010-04-06 22:36 -------- d-----w- c:\program files\Test My Hardware
2010-04-06 22:20 . 2010-04-07 01:05 -------- d-----w- c:\windows\system32\catroot2
2010-04-06 22:20 . 2010-02-05 15:18 100136 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys
2010-04-06 22:20 . 2010-02-05 15:17 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-04-06 22:20 . 2009-10-06 22:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-04-06 22:20 . 2009-09-23 22:10 207280 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2010-04-06 22:20 . 2010-02-05 15:25 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2010-04-06 22:20 . 2010-04-07 01:54 -------- d-----w- c:\program files\Spyware Doctor
2010-04-06 22:20 . 2010-04-06 22:21 -------- d-----w- c:\program files\Common Files\PC Tools
2010-04-06 22:20 . 2010-04-06 22:20 -------- d-----w- c:\users\Nick\AppData\Roaming\PC Tools
2010-04-06 22:20 . 2010-04-06 22:20 -------- d-----w- c:\programdata\PC Tools
2010-04-06 04:13 . 2010-04-06 04:13 -------- d-----w- c:\programdata\EA Logs
2010-04-05 23:57 . 2010-04-05 23:57 -------- d-----w- c:\program files\Common Files\Stardock
2010-04-05 23:18 . 2010-04-05 23:18 -------- dc-h--w- c:\programdata\{BE672698-4DAC-4C83-9056-C07C3170F628}
2010-04-05 23:18 . 2010-04-05 23:18 -------- d-----w- c:\program files\Stardock Games
2010-04-01 00:39 . 2010-04-01 00:39 -------- d-----w- c:\program files\iPod
2010-04-01 00:39 . 2010-04-01 00:40 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-03-28 18:45 . 2010-03-28 18:45 -------- d-----w- c:\users\Nick\AppData\Roaming\Malwarebytes
2010-03-28 18:45 . 2010-03-28 18:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-28 18:45 . 2010-03-28 18:45 -------- d-----w- c:\programdata\Malwarebytes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-10 15:12 . 2007-09-02 01:46 174368 ----a-w- c:\users\Nick\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-06 21:29 . 2009-07-20 00:00 -------- d-----w- c:\programdata\Norton
2010-04-06 21:29 . 2009-06-24 00:25 -------- d-----w- c:\program files\Norton Security Scan
2010-04-06 04:14 . 2008-05-30 03:46 -------- d-----w- c:\program files\Common Files\BioWare
2010-04-06 04:14 . 2007-09-02 20:25 -------- d-----w- c:\programdata\Media Center Programs
2010-04-03 00:00 . 2007-04-25 19:25 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-01 00:40 . 2008-07-14 18:52 -------- d-----w- c:\program files\iTunes
2010-04-01 00:39 . 2007-09-12 06:14 -------- d-----w- c:\program files\Common Files\Apple
2010-04-01 00:36 . 2007-11-06 02:16 -------- d-----w- c:\program files\QuickTime
2010-03-28 00:16 . 2007-09-06 02:24 -------- d-----w- c:\users\Nick\AppData\Roaming\BitTorrent
2010-03-12 06:40 . 2007-09-16 03:57 -------- d-----w- c:\program files\Common Files\Java
2010-03-12 06:40 . 2007-09-16 03:59 -------- d-----w- c:\program files\Java
2010-03-04 02:56 . 2007-09-29 23:50 -------- d-----w- c:\program files\Common Files\Steam
2010-02-21 07:07 . 2010-02-21 07:07 -------- d-----w- c:\programdata\PopCap
2010-02-21 07:06 . 2007-11-30 22:50 -------- d-----w- c:\program files\PopCap Games
2009-08-17 22:52 . 2009-08-17 22:52 43777 ----a-w- c:\program files\Uninstall.exe
2007-09-05 00:50 . 2007-09-05 00:50 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 77824]
"VX3000"="c:\windows\vVX3000.exe" [2007-03-19 710728]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-13 517768]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2007-12-14 524288]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-03-18 2046816]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-13 642856]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-9-27 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-11-13 204800]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-12-09 365280]
R3 tap0801;Smarthide TAP driver;c:\windows\system32\DRIVERS\tap0801.sys [2007-10-12 55808]
R3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]
R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2006-11-02 251904]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-02-05 716272]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-09-23 207280]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-08-15 335240]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-05-02 108552]
S2 ACEDRV08;ACEDRV08;c:\windows\system32\drivers\ACEDRV08.sys [2007-09-20 108768]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-08-15 908056]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-08-15 297752]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2006-12-08 5120]

.
Contents of the 'Scheduled Tasks' folder

2010-04-11 c:\windows\Tasks\User_Feed_Synchronization-{A8E1AB27-DD1D-4ECE-96AA-9BFA5CD67F9A}.job
- c:\windows\system32\msfeedssync.exe [2008-06-02 05:33]
.
.
------- Supplementary Scan -------
.
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=73&bd=Pavilion&pf=desktop
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
FF - ProfilePath - c:\users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\twitternotifier@naan.net\platform\WINNT\components\nsTwitterFoxSign.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\Musicnotes\npmusicn.dll
FF - plugin: c:\program files\Musicnotes\NPSibelius.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-ISUSPM Startup - c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
HKCU-Run-MSSMSGS - winhjr32.rom
AddRemove-CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1 - c:\program files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1\UIU32m.exe
AddRemove-ffdshow - c:\windows\system32\uninstall.exe
AddRemove-HijackThis - c:\users\Nick\Desktop\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-12 00:24
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-227845856-12066905-2617085515-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:73,d3,0a,cd,f9,89,9e,52,cc,38,75,f0,65,a2,68,55,49,45,c6,e2,db,15,95,
70,31,22,a1,cb,7f,55,6e,9e,7b,2b,8f,9f,36,ed,a3,bf,74,c7,41,c8,f1,4b,44,e5,\
"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49

[HKEY_USERS\S-1-5-21-227845856-12066905-2617085515-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:75,58,12,4a,b9,44,7b,cb,27,fd,0c,0f,87,bd,9e,60,49,b6,e9,d6,6e,
c4,9b,f6,6a,25,1b,45,7e,3a,9d,df,6b,4f,08,48,42,95,3c,c5,44,4c,92,5b,91,f6,\
"rkeysecu"=hex:38,f1,27,96,88,a2,78,bb,13,53,a8,9e,4c,42,50,88

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\WUDFHost.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Stardock\Impulse\Now\ImpulseNow.exe
c:\program files\Microsoft Office\Office12\ONENOTEM.EXE
c:\program files\WordWeb\wweb32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-04-12 00:37:03 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-12 06:37

Pre-Run: 105,682,251,776 bytes free
Post-Run: 110,799,982,592 bytes free

- - End Of File - - 6A35CA109FE7D860BECAA744376FEEB0


#7 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:08 PM

Posted 13 April 2010 - 11:53 AM

Hi,

Looks better. Internet working?

Please update your version of malwarebytes and run a quick scan, post back with the content of the logfile.


  1. Please download OTL from one of the following mirrors:
  2. Save it to your desktop.
  3. Double click on the icon on your desktop.
  4. Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    mv61xx.sys
    /md5stop
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
  5. Push the Quick Scan button.
  6. Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#8 NickJewell

NickJewell
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 13 April 2010 - 01:08 PM

Hi Tom,

My internet is working fine now, thank you. No redirects or anything since I ran ComboFix. Thanks a lot for all your help so far!

Here's the logs this time around:

-=-=-=-=-=-=-=-=-=-

Malwarebytes Log:

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3985

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

13/04/2010 11:39:12 AM
mbam-log-2010-04-13 (11-39-12).txt

Scan type: Quick scan
Objects scanned: 110340
Time elapsed: 7 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Typelib\{831cbac2-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\DomPlayer (Trojan.Swizzor) -> No action taken.

Files Infected:
C:\Program Files\Uninstall.exe (Trojan.FakeAlert) -> No action taken.
C:\ENDORALT.ttf (Trojan.FakeAlert) -> No action taken.
C:\ENDOR___.ttf (Trojan.FakeAlert) -> No action taken.

-=-=-=-=-=-=-=-=-=-

OTL Log:

OTL logfile created on: 13/04/2010 11:40:21 AM - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Users\Nick\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 51.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 363.82 Gb Total Space | 108.60 Gb Free Space | 29.85% Space Free | Partition Type: NTFS
Drive D: | 8.79 Gb Total Space | 1.01 Gb Free Space | 11.50% Space Free | Partition Type: NTFS
Drive E: | 4.33 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 298.02 Gb Total Space | 58.23 Gb Free Space | 19.54% Space Free | Partition Type: FAT32

Computer Name: NICK-PC
Current User Name: Nick
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/04/13 11:39:29 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Users\Nick\Desktop\OTL.exe
PRC - [2010/04/02 14:32:05 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/03/19 10:49:20 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/03/18 09:41:55 | 002,046,816 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgtray.exe
PRC - [2010/03/17 14:32:10 | 000,468,272 | ---- | M] (Stardock Corporation) -- C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe
PRC - [2009/08/15 12:30:13 | 000,486,680 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgrsx.exe
PRC - [2009/08/15 12:30:12 | 000,693,016 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgcsrvx.exe
PRC - [2009/08/15 12:30:09 | 000,595,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgnsx.exe
PRC - [2009/08/15 12:30:07 | 000,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgemc.exe
PRC - [2009/08/15 12:29:57 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe
PRC - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2008/10/29 00:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/10/25 08:18:50 | 000,098,696 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2008/01/18 23:38:40 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2008/01/18 23:33:06 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008/01/15 11:26:18 | 004,874,240 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/12/14 01:29:46 | 000,524,288 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe
PRC - [2007/09/12 19:27:24 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007/03/19 13:47:58 | 000,710,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX3000.exe
PRC - [2007/03/12 19:30:14 | 000,517,768 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2007/02/15 04:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
PRC - [2007/01/27 09:42:48 | 000,044,384 | ---- | M] (Antony Lewis) -- C:\Program Files\WordWeb\wweb32.exe
PRC - [2006/09/28 07:42:24 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe
PRC - [2006/09/10 22:56:26 | 000,086,960 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010/04/13 11:39:29 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Users\Nick\Desktop\OTL.exe
MOD - [2008/01/18 23:36:26 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sfc_os.dll
MOD - [2008/01/18 23:35:12 | 002,085,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msi.dll
MOD - [2008/01/18 23:26:36 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
MOD - [2006/11/02 03:46:13 | 000,004,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sfc.dll
MOD - [2006/11/02 03:46:07 | 000,015,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msiltcfg.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (stllssvr)
SRV - File not found [Auto | Stopped] -- -- (LiveUpdate Notice Ex)
SRV - [2010/03/19 10:49:20 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/03/03 20:55:51 | 000,332,720 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/01/18 14:14:24 | 001,141,712 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2009/12/09 15:23:34 | 000,365,280 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2009/08/15 12:30:07 | 000,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc)
SRV - [2009/08/15 12:29:57 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd)
SRV - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2008/11/13 13:43:49 | 000,204,800 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe -- (LinksysUpdater)
SRV - [2008/01/18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/12 19:27:24 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007/09/12 19:27:24 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2007/03/12 19:30:14 | 000,517,768 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2006/12/14 16:00:00 | 000,544,768 | ---- | M] (Magix AG) [On_Demand | Stopped] -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Live Search"
FF - prefs.js..browser.search.defaulturl: "http://search.live.com/results.aspx?FORM=IEFM1&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.ca/"
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.9
FF - prefs.js..extensions.enabledItems: twitternotifier@naan.net:1.9.6.2
FF - prefs.js..extensions.enabledItems: {61FD08D8-A2CB-46c0-B36D-3F531AC53C12}:1.3.2009110201
FF - prefs.js..extensions.enabledItems: {ada4b710-8346-4b82-8199-5de2b400a6ae}:1.9.7
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.63
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: {0fa2149e-bb2c-4ac2-a8d3-479599819475}:1.6
FF - prefs.js..keyword.URL: "http://search.live.com/results.aspx?FORM=IEFM1&q="


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/02 14:32:07 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/02 14:32:07 | 000,000,000 | ---D | M]

[2008/06/18 00:38:35 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Mozilla\Extensions
[2010/04/13 00:41:29 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions
[2009/10/27 00:47:06 | 000,000,000 | ---D | M] (Toolbar Buttons) -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/01/12 02:33:59 | 000,000,000 | ---D | M] (URL Fixer) -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\{0fa2149e-bb2c-4ac2-a8d3-479599819475}
[2009/07/05 12:27:13 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/06 15:19:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\{61FD08D8-A2CB-46c0-B36D-3F531AC53C12}
[2009/11/16 20:26:44 | 000,000,000 | ---D | M] () -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\{64e8cc5b-20db-4212-8320-178fc5ae71f7}
[2010/02/05 23:56:29 | 000,000,000 | ---D | M] (ReminderFox) -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}
[2010/02/23 02:19:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2010/03/28 16:44:15 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010/04/08 15:55:44 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\treestyletab@piro.sakura.ne.jp
[2010/03/29 11:34:41 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\extensions\twitternotifier@naan.net
[2008/02/04 20:23:53 | 000,002,920 | ---- | M] () -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\searchplugins\daemon-search.xml
[2009/04/19 13:12:04 | 000,001,632 | ---- | M] () -- C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\ss1ca0ru.default\searchplugins\live-search.xml
[2010/03/12 00:40:17 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2008/06/18 00:38:22 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\inspector@mozilla.org
[2008/09/03 18:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
[2010/02/21 01:06:55 | 000,151,552 | ---- | M] (PopCap Games) -- C:\Program Files\Mozilla Firefox\plugins\nppopcaploader.dll

O1 HOSTS File: ([2010/04/12 00:21:55 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [VX3000] C:\Windows\vVX3000.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Civilization Registration.lnk = L:\ATR1.EXE File not found
O4 - Startup: C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Impulse Now.lnk = C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe (Stardock Corporation)
O4 - Startup: C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe (Antony Lewis)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([windowsupdate] http in Trusted sites)
O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/SCRABBLE/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/9/b...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/SCRABBLE/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.59.184.13 64.59.184.15 64.59.190.242 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - AppInit_DLLs: (C:\Windows\System32\avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: J:\Nick's Stuff\Video Games\just-cause-2-wallpaper-bullet-scorpion.jpg
O24 - Desktop BackupWallPaper: J:\Nick's Stuff\Video Games\just-cause-2-wallpaper-bullet-scorpion.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/04/25 13:12:32 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/08/12 18:36:42 | 000,664,029 | R--- | M] () - E:\Autorun.dbd -- [ UDF ]
O32 - AutoRun File - [2006/08/12 03:18:20 | 000,126,976 | R--- | M] (Macrovision Corporation) - E:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2006/08/12 03:18:20 | 000,000,043 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2006/08/12 03:18:20 | 000,000,367 | R--- | M] () - E:\AutoRun.ini -- [ UDF ]
O32 - AutoRun File - [2006/08/12 18:36:42 | 000,003,902 | R--- | M] () - E:\Autorun.txt -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2008/06/02 16:38:55 | 000,000,000 | ---D | M]
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
OTL cannot create restorepoints on Vista OSs!

========== Files/Folders - Created Within 14 Days ==========

[2010/04/13 11:39:19 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Users\Nick\Desktop\OTL.exe
[2010/04/13 11:29:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/04/13 11:29:16 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/04/13 11:29:16 | 000,000,000 | ---D | C] -- C:\Malwarebytes' Anti-Malware
[2010/04/12 03:01:06 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2010/04/12 00:37:06 | 000,000,000 | ---D | C] -- C:\Users\Nick\AppData\Local\temp
[2010/04/12 00:36:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/04/12 00:19:26 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/04/12 00:08:30 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/04/12 00:08:30 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/04/12 00:08:30 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/04/12 00:08:23 | 000,000,000 | ---D | C] -- C:\schrauber
[2010/04/12 00:03:16 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/04/12 00:03:03 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/04/11 23:51:01 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/04/10 19:17:08 | 000,000,000 | ---D | C] -- C:\THQ
[2010/04/10 09:12:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Musicnotes
[2010/04/10 09:11:20 | 000,000,000 | ---D | C] -- C:\Users\Nick\Documents\Musicnotes
[2010/04/10 09:11:14 | 000,000,000 | ---D | C] -- C:\Program Files\Musicnotes
[2010/04/06 20:08:44 | 000,000,000 | ---D | C] -- C:\Program Files\HijackThis
[2010/04/06 17:37:48 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2010/04/06 16:36:29 | 000,000,000 | ---D | C] -- C:\Program Files\Test My Hardware
[2010/04/06 16:20:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2
[2010/04/06 16:20:56 | 000,233,136 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctgntdi.sys
[2010/04/06 16:20:56 | 000,100,136 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctwfpfilter.sys
[2010/04/06 16:20:46 | 000,207,280 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTCore.sys
[2010/04/06 16:20:46 | 000,087,784 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTAppEvent.sys
[2010/04/06 16:20:33 | 000,070,408 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsg.sys
[2010/04/06 16:20:27 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/04/06 16:20:27 | 000,000,000 | ---D | C] -- C:\Users\Nick\AppData\Roaming\PC Tools
[2010/04/06 16:20:27 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2010/04/06 16:20:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2010/04/05 22:13:55 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs
[2010/04/05 17:57:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Stardock
[2010/04/05 17:18:13 | 000,000,000 | -H-D | C] -- C:\ProgramData\{BE672698-4DAC-4C83-9056-C07C3170F628}
[2010/04/05 17:18:10 | 000,000,000 | ---D | C] -- C:\Program Files\Stardock Games
[2010/03/31 18:39:22 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/03/31 18:39:19 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2007/10/09 16:56:07 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Nick\AppData\Roaming\pcouffin.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Nick\Documents\*.tmp files -> C:\Users\Nick\Documents\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/04/13 11:40:14 | 007,602,176 | -HS- | M] () -- C:\Users\Nick\ntuser.dat
[2010/04/13 11:39:29 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Users\Nick\Desktop\OTL.exe
[2010/04/13 11:31:28 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/04/13 11:31:28 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/04/13 08:21:03 | 058,857,433 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2010/04/13 03:37:57 | 000,703,448 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/04/13 03:37:57 | 000,608,270 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/04/13 03:37:57 | 000,109,138 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/04/13 03:31:28 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/04/13 03:31:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/04/13 03:31:20 | 000,521,200 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/04/13 03:29:57 | 3219,611,648 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/13 03:27:53 | 000,524,288 | -HS- | M] () -- C:\Users\Nick\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/04/13 03:27:53 | 000,065,536 | -HS- | M] () -- C:\Users\Nick\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/04/13 03:27:51 | 002,110,315 | -H-- | M] () -- C:\Users\Nick\AppData\Local\IconCache.db
[2010/04/13 02:37:18 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{A8E1AB27-DD1D-4ECE-96AA-9BFA5CD67F9A}.job
[2010/04/13 00:36:49 | 015,908,178 | ---- | M] () -- C:\Users\Nick\Desktop\untitled_folder.zip
[2010/04/12 03:39:30 | 000,174,936 | ---- | M] () -- C:\Users\Nick\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/04/12 00:22:04 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/04/12 00:21:55 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/04/11 23:46:39 | 003,912,258 | R--- | M] () -- C:\Users\Nick\Desktop\schrauber.exe
[2010/04/10 09:11:20 | 000,000,861 | ---- | M] () -- C:\Users\Public\Desktop\Musicnotes Player.lnk
[2010/04/08 23:35:15 | 003,939,266 | ---- | M] () -- C:\Users\Nick\Desktop\i'll hold onto it for you.mp3
[2010/04/08 23:24:41 | 003,887,439 | ---- | M] () -- C:\Users\Nick\Desktop\i didn't expect it from you.mp3
[2010/04/08 23:23:28 | 003,872,392 | ---- | M] () -- C:\Users\Nick\Desktop\noise apart.mp3
[2010/04/06 20:01:19 | 165,638,954 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/04/06 19:58:28 | 000,029,696 | ---- | M] () -- C:\Users\Nick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/06 17:22:14 | 000,000,176 | ---- | M] () -- C:\Users\Nick\defogger_reenable
[2010/04/05 17:31:41 | 000,001,078 | ---- | M] () -- C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Impulse Now.lnk
[2010/03/31 18:40:20 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Nick\Documents\*.tmp files -> C:\Users\Nick\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/04/13 00:34:37 | 015,908,178 | ---- | C] () -- C:\Users\Nick\Desktop\untitled_folder.zip
[2010/04/12 03:10:03 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2010/04/12 03:09:45 | 000,003,374 | ---- | C] () -- C:\Windows\System32\RacUR.xml
[2010/04/12 00:08:30 | 000,261,632 | ---- | C] () -- C:\Windows\PEV.exe
[2010/04/12 00:08:30 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/04/12 00:08:30 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/04/12 00:08:30 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/04/12 00:08:30 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/04/11 23:46:16 | 003,912,258 | R--- | C] () -- C:\Users\Nick\Desktop\schrauber.exe
[2010/04/10 09:11:20 | 000,000,861 | ---- | C] () -- C:\Users\Public\Desktop\Musicnotes Player.lnk
[2010/04/08 23:35:11 | 003,939,266 | ---- | C] () -- C:\Users\Nick\Desktop\i'll hold onto it for you.mp3
[2010/04/08 23:24:37 | 003,887,439 | ---- | C] () -- C:\Users\Nick\Desktop\i didn't expect it from you.mp3
[2010/04/08 23:23:21 | 003,872,392 | ---- | C] () -- C:\Users\Nick\Desktop\noise apart.mp3
[2010/04/06 20:00:53 | 165,638,954 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/04/06 20:00:49 | 3219,611,648 | -HS- | C] () -- C:\hiberfil.sys
[2010/04/06 17:21:58 | 000,000,176 | ---- | C] () -- C:\Users\Nick\defogger_reenable
[2010/04/06 16:20:56 | 000,007,387 | ---- | C] () -- C:\Windows\System32\drivers\pctgntdi.cat
[2010/04/06 16:20:46 | 000,007,412 | ---- | C] () -- C:\Windows\System32\drivers\PCTAppEvent.cat
[2010/04/06 16:20:46 | 000,007,383 | ---- | C] () -- C:\Windows\System32\drivers\pctcore.cat
[2010/04/06 16:20:33 | 000,007,383 | ---- | C] () -- C:\Windows\System32\drivers\pctplsg.cat
[2010/04/05 17:31:41 | 000,001,078 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Impulse Now.lnk
[2010/03/31 18:40:20 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2009/11/06 11:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2009/08/17 16:52:13 | 000,043,777 | ---- | C] () -- C:\Program Files\Uninstall.exe
[2009/08/03 01:21:54 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2009/08/03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2009/08/03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2009/08/03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2009/08/03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2009/08/03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2009/08/03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2009/08/03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2009/08/03 01:21:52 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2009/08/03 01:21:52 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2009/03/03 14:13:48 | 000,751,191 | ---- | C] () -- C:\Users\Nick\00210001.JPG
[2008/12/25 03:44:41 | 000,870,128 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\mcs.rma
[2008/12/25 03:44:41 | 000,000,004 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\92E035
[2008/10/06 23:22:05 | 000,279,712 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008/10/06 23:22:05 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2008/06/20 18:48:17 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/06/02 21:35:17 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008/05/27 02:30:32 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2008/05/08 16:09:00 | 000,022,723 | ---- | C] () -- C:\Windows\System32\sugg1l3.dll
[2008/04/12 15:55:23 | 000,104,348 | ---- | C] () -- C:\Users\Nick\iamlegend.gif
[2008/02/01 15:54:03 | 000,009,373 | ---- | C] () -- C:\Users\Nick\Red Venture Bass.aup
[2008/01/22 00:37:59 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/01/22 00:37:58 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest
[2007/12/27 15:05:28 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2007/12/22 07:16:55 | 000,000,000 | ---- | C] () -- C:\Windows\Irremote.ini
[2007/12/21 02:05:34 | 000,001,024 | ---- | C] () -- C:\Users\Nick\.rnd
[2007/12/07 12:55:30 | 000,138,464 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2007/12/07 12:55:30 | 000,022,328 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\PnkBstrK.sys
[2007/11/27 23:03:20 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2007/11/21 00:21:55 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2007/11/19 20:49:17 | 000,008,368 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2007/11/19 19:56:45 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[2007/11/09 02:30:19 | 000,027,043 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\UserTile.png
[2007/10/19 13:45:47 | 000,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
[2007/10/09 16:56:53 | 000,000,033 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\pcouffin.log
[2007/10/09 16:56:07 | 000,007,887 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\pcouffin.cat
[2007/10/09 16:56:07 | 000,001,144 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\pcouffin.inf
[2007/09/30 15:46:12 | 000,000,568 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\AutoGK.ini
[2007/09/30 13:13:29 | 000,200,704 | ---- | C] () -- C:\Windows\System32\TomsMoComp_ff.dll
[2007/09/30 13:13:29 | 000,114,688 | ---- | C] () -- C:\Windows\System32\libmpeg2_ff.dll
[2007/09/28 10:05:50 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2007/09/28 10:05:50 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dpl100.dll.manifest
[2007/09/20 17:40:25 | 000,029,696 | ---- | C] () -- C:\Users\Nick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/19 20:44:49 | 000,005,817 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2007/09/16 17:52:10 | 000,001,082 | ---- | C] () -- C:\Users\Nick\AppData\Roaming\wklnhst.dat
[2007/09/01 19:35:58 | 000,001,356 | ---- | C] () -- C:\Users\Nick\AppData\Local\d3d9caps.dat
[2007/09/01 19:35:56 | 000,000,020 | -HS- | C] () -- C:\Users\Nick\ntuser.ini
[2007/09/01 19:35:55 | 000,524,288 | -HS- | C] () -- C:\Users\Nick\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2007/09/01 19:35:54 | 000,524,288 | -HS- | C] () -- C:\Users\Nick\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2007/09/01 19:35:54 | 000,262,144 | -H-- | C] () -- C:\Users\Nick\ntuser.dat.LOG1
[2007/09/01 19:35:54 | 000,065,536 | -HS- | C] () -- C:\Users\Nick\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2007/09/01 19:35:54 | 000,000,000 | -H-- | C] () -- C:\Users\Nick\ntuser.dat.LOG2
[2007/09/01 19:35:53 | 007,602,176 | -HS- | C] () -- C:\Users\Nick\ntuser.dat
[2007/04/25 13:01:05 | 000,000,623 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2007/04/25 12:39:48 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom24.dll
[2007/04/25 12:39:48 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes24.dll
[2007/03/10 05:51:48 | 000,282,624 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2007/02/05 18:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2007/01/04 18:18:44 | 000,015,498 | ---- | C] () -- C:\Windows\VX3000.ini
[2006/11/02 06:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 01:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/02/25 12:09:38 | 001,559,040 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2005/10/14 04:56:50 | 000,921,600 | ---- | C] () -- C:\Windows\System32\VorbisEnc.dll
[2005/10/14 04:56:50 | 000,344,064 | ---- | C] () -- C:\Windows\System32\xvid.dll
[2005/10/14 04:56:50 | 000,237,568 | ---- | C] () -- C:\Windows\System32\OggDS.dll
[2005/10/14 04:56:50 | 000,188,416 | ---- | C] () -- C:\Windows\System32\vorbis.dll
[2005/10/14 04:56:50 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ogg.dll
[2005/10/14 04:56:48 | 000,077,824 | ---- | C] () -- C:\Windows\System32\MMSwitch.dll
[2002/06/17 01:04:53 | 000,259,802 | ---- | C] () -- C:\Windows\System32\libpostproc.dll
[2002/06/17 01:03:57 | 000,225,610 | ---- | C] () -- C:\Windows\System32\libavcodec.dll
[1999/01/22 19:46:58 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL
[1998/03/17 11:15:00 | 000,000,117 | ---- | C] () -- C:\Windows\smp32.dll
[1996/04/03 13:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys

========== LOP Check ==========

[2009/02/14 15:44:56 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Ableton
[2009/09/05 12:52:25 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Aim
[2009/03/21 16:58:16 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\BeatportDownloader.EE670286545758FAB4A69D4439CF6054F83E0AC2.1
[2010/03/27 18:16:15 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\BitTorrent
[2009/12/29 02:39:01 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Braid
[2007/10/18 21:32:51 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Coccinella
[2007/10/01 15:09:25 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Codemasters
[2008/02/04 20:23:53 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\DAEMON Tools
[2007/09/04 00:19:37 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Earthsim
[2007/10/09 22:04:09 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Eltima Software
[2008/02/29 17:30:30 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\EVEMon
[2007/11/29 22:24:59 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\GameHouse
[2009/02/23 22:38:52 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\GARMIN
[2008/09/07 20:33:39 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Gearbox Software
[2008/03/17 17:31:01 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\GetRightToGo
[2007/12/29 01:09:31 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\ImgBurn
[2008/06/15 01:19:05 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Leadertech
[2008/09/29 21:29:10 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\LimeWire
[2007/12/20 21:16:12 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\NCH Swift Sound
[2007/11/11 22:23:00 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\PlayFirst
[2008/09/27 01:39:59 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\PrettyMay
[2009/12/27 20:04:31 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Red Alert 3
[2007/09/01 19:45:49 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Snapfish
[2008/04/17 22:56:48 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Sony Online Entertainment
[2007/11/22 22:31:50 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\SpinTop
[2008/09/08 23:31:12 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\SPORE Creature Creator
[2009/04/14 18:39:58 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Stardock
[2007/09/16 17:52:32 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Template
[2008/07/29 22:02:31 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\The Longest Journey Demo
[2009/09/05 12:24:46 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Uniblue
[2007/10/09 16:58:11 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\Vso
[2008/02/05 18:19:23 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\WinBatch
[2007/09/29 23:37:23 | 000,000,000 | ---D | M] -- C:\Users\Nick\AppData\Roaming\WordWeb
[2010/04/13 03:28:51 | 000,032,542 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010/04/13 02:37:18 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{A8E1AB27-DD1D-4ECE-96AA-9BFA5CD67F9A}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/01/18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006/11/02 03:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\ERDNT\cache\AGP440.sys
[2006/11/02 03:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006/11/02 03:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: AHCIX86S.SYS >
[2007/12/19 15:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) MD5=0DEE2B628D4C6E23285BB91EFFDABFDE -- C:\ATI\SUPPORT\8-4_vista32_dd_ccc_wdm_enu_61008\Packages\Drivers\SBDrv\SB7xx\RAID\LH\ahcix86s.sys
[2006/12/28 17:51:56 | 000,110,592 | ---- | M] (ATI Technologies Inc.) MD5=67740F91B47434CC6173A35667A4BA66 -- C:\AMD\AMD_8.38_RC2_Vista_BR47273_May14\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys
[2006/12/28 17:51:56 | 000,110,592 | ---- | M] (ATI Technologies Inc.) MD5=67740F91B47434CC6173A35667A4BA66 -- C:\AMD\ATI_8.401.1_BioShock_HotFix_Vista\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys
[2006/12/28 17:51:56 | 000,110,592 | ---- | M] (ATI Technologies Inc.) MD5=67740F91B47434CC6173A35667A4BA66 -- C:\ATI\SUPPORT\7-10_vista64_dd_ccc_wdm_enu_53254\Driver\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys
[2006/12/28 17:51:56 | 000,110,592 | ---- | M] (ATI Technologies Inc.) MD5=67740F91B47434CC6173A35667A4BA66 -- C:\ATI\SUPPORT\7-8_vista32_dd_ccc_wdm_enu_50974\Driver\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys
[2006/12/28 17:51:56 | 000,110,592 | ---- | M] (ATI Technologies Inc.) MD5=67740F91B47434CC6173A35667A4BA66 -- C:\ATI\SUPPORT\8-4_vista32_dd_ccc_wdm_enu_61008\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys
[2008/04/02 13:40:48 | 000,175,632 | ---- | M] (AMD Technologies Inc.) MD5=844A6734E8BB3530FB1444ED698087BD -- C:\ATI\SUPPORT\8-6_vista32_dd_ccc_wdm_enu_64789\Packages\Drivers\SBDrv\SB7xx\RAID\LH\ahcix86s.sys
[2008/01/16 18:27:56 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=8DC09F3B54DDCAEB52E0DCFA1D55B26A -- C:\ATI\SUPPORT\8-5_vista32_dd_ccc_wdm_enu_63036\Packages\Drivers\SBDrv\SB7xx\RAID\LH\ahcix86s.sys
[2007/04/16 16:16:34 | 000,119,296 | ---- | M] (ATI Technologies Inc.) MD5=A5AC7B705166BF7CD07BB054BEEA8D03 -- C:\ATI\SUPPORT\8-5_vista32_dd_ccc_wdm_enu_63036\Packages\Drivers\SBDrv\SB6xx\RAID\LH64A\ahcix86s.sys
[2007/04/16 16:16:34 | 000,119,296 | ---- | M] (ATI Technologies Inc.) MD5=A5AC7B705166BF7CD07BB054BEEA8D03 -- C:\ATI\SUPPORT\8-6_vista32_dd_ccc_wdm_enu_64789\Packages\Drivers\SBDrv\SB6xx\RAID\LH64A\ahcix86s.sys

< MD5 for: ATAPI.SYS >
[2009/04/11 00:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\ERDNT\cache\atapi.sys
[2008/01/18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008/01/18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 03:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/02/13 17:14:43 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/02/13 17:14:43 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/02/13 17:14:42 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 03:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll
[2006/11/02 03:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006/11/02 03:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2008/01/18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 03:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 03:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 03:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009/04/11 00:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008/01/18 23:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\ERDNT\cache\netlogon.dll
[2008/01/18 23:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008/01/18 23:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVRD32.SYS >
[2007/10/26 11:51:26 | 000,131,616 | ---- | M] (NVIDIA Corporation) MD5=049E81B6FB41C73619ED3FE4DF7D8638 -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_0f6358b4\nvrd32.sys

< MD5 for: NVSTOR.SYS >
[2006/11/02 03:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 03:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: NVSTOR32.SYS >
[2007/03/19 07:58:50 | 000,101,672 | ---- | M] (NVIDIA Corporation) MD5=019054D997F65358DCA63ECAE5103F97 -- C:\hp\DRIVERS\NVIDIA_Serial_ATA\nvstor32.sys
[2007/03/19 07:58:50 | 000,101,672 | ---- | M] (NVIDIA Corporation) MD5=019054D997F65358DCA63ECAE5103F97 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_1306af02\nvstor32.sys
[2007/10/26 11:51:24 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=7EBA6C9A0A295B1559EFB9062E701218 -- C:\Windows\System32\drivers\nvstor32.sys
[2007/10/26 11:51:24 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=7EBA6C9A0A295B1559EFB9062E701218 -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_0f6358b4\nvstor32.sys

< MD5 for: SCECLI.DLL >
[2008/01/18 23:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\ERDNT\cache\scecli.dll
[2008/01/18 23:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008/01/18 23:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 03:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009/04/11 00:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/10/28 20:21:55 | 000,425,984 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\System32\ATIDEMGX.dll
[2008/01/18 23:34:10 | 000,347,136 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll
[2008/01/18 23:34:10 | 000,214,528 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll
[2008/01/18 23:38:04 | 000,242,744 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2008/01/18 23:36:12 | 000,225,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 04:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 04:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 04:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 04:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 04:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

========== Alternate Data Streams ==========

@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:2BDCFAD6
@Alternate Data Stream - 158 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:8CE646EE
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:2D5907B8
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:D1B5B4F1
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8
< End of report >

-=-=-=-=-=-=-=-=-=-=-

Extras Log:

OTL Extras logfile created on: 13/04/2010 11:40:21 AM - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Users\Nick\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 51.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 363.82 Gb Total Space | 108.60 Gb Free Space | 29.85% Space Free | Partition Type: NTFS
Drive D: | 8.79 Gb Total Space | 1.01 Gb Free Space | 11.50% Space Free | Partition Type: NTFS
Drive E: | 4.33 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 298.02 Gb Total Space | 58.23 Gb Free Space | 19.54% Space Free | Partition Type: FAT32

Computer Name: NICK-PC
Current User Name: Nick
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DisableUnicastResponsesToMulticastBroadcast" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{085FA804-FD30-48D9-97E8-14E277E0218F}" = lport=3724 | protocol=6 | dir=in | name=blizzard dl |
"{09EE2AB0-77D9-4988-B6B6-0ADDEF8D84FB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{355C9F3B-AF98-4281-B9FB-B725DF0B3AB6}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |
"{383E8FE8-A956-4D51-AE6A-DDF72A947D6B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{5B3B13D0-1D85-4A51-9D79-2B364A69B8C1}" = lport=10243 | protocol=6 | dir=in | app=system |
"{61DC7349-48C2-4452-AAAD-FF611A566D85}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{693AB01A-BA0C-4074-BCF0-90EF8C4CBA03}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6D0545A3-B3DD-4810-B005-D9305AB3FE83}" = rport=10243 | protocol=6 | dir=out | app=system |
"{704778E3-95BC-4723-8676-FCE4EEEE8FD0}" = lport=6112 | protocol=6 | dir=in | name=blizzard dl |
"{79FEF8FC-FCF6-4657-85DC-02CDCA23D61B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7ADCE8E2-09B8-4098-8CF9-B2672F662C07}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AEE44880-980A-4351-857D-A7C1E04A2053}" = lport=6881 | protocol=6 | dir=in | name=blizzard dl |
"{BE40D64B-DE95-4F2A-B131-EE1C7A729F50}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{E5FF8CD4-1498-472B-9E2E-1D1256F6A129}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{E708A982-D8B1-4B5B-95C5-AAB863F4CBB7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01DE4B25-B122-49C7-932A-AA436512E713}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{02446B07-0D79-41AD-9A09-C5D675956AF0}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe |
"{09D59A5A-CDB5-41C0-B40A-D0211F339F87}" = protocol=6 | dir=in | app=c:\mass effect\binaries\masseffect.exe |
"{0B02C3C8-21F9-41E0-90CC-8328B951B3AB}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{10222C92-D9E4-464F-B912-7D3D6B5649F3}" = protocol=6 | dir=in | app=c:\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe |
"{10C15DF1-CFE2-4529-B94C-EE2AC9E6EA4F}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{11A50AA2-F8DE-4BDB-8040-DD771413EF8B}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe |
"{11CEDC10-23C8-4B7B-B0B6-E019AE82B0B8}" = protocol=17 | dir=in | app=c:\turbine\turbine download manager\turbinemessageservice.exe |
"{1395A94E-E1A4-4BA8-865F-6481078B76AF}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\crysis warhead\bin32\crysis.exe |
"{1854E30A-50AD-4114-A419-1262398EFE12}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1D487956-9D34-43AB-843F-AFE3E1B87BEC}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\machinarium\machinarium.exe |
"{1E29A611-B06B-4190-8302-D18E865284BD}" = protocol=6 | dir=in | app=c:\program files\stardock games\demigod\bin\demigod.exe |
"{1EA8DE75-4A01-441B-83F1-A06CED9509E8}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{21A12F03-522E-4F48-89DF-F164532CC08F}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\multiwinia\multiwinia.exe |
"{2271913D-B3A4-42C1-9EF9-F3CFBCFBEDB4}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe |
"{2377A3D0-94C8-40AC-B75C-19680E409492}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{2783E9D9-E837-408C-8BAB-448D36E4E323}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{2833BE3C-99CA-4259-BE3E-5E874E3451FB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2C6FDBB5-0897-4C58-9A8E-0555084C87E6}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |
"{34DF3382-6CA9-4B98-911A-6F48176FC3E4}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\left 4 dead\left4dead.exe |
"{35C5308C-DB4A-408D-9431-8A41CA109EC7}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{38C7D160-E8EB-4303-8135-68D229C0B369}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{3C94E89B-57B6-4EAF-9898-361249ED9BA8}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{4095F47F-8757-43F5-8361-0C8DCF5DF684}" = protocol=17 | dir=in | app=c:\program files\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe |
"{40AB4C75-A0A8-42DA-8F3F-518215FC45CE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{41C701C7-4C79-4558-8A4D-81DB287DDBCA}" = protocol=6 | dir=in | app=c:\turbine\turbine download manager\turbinenetworkservice.exe |
"{4383E124-AD4F-4BA8-9C72-AC917DCA94CF}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orb.exe |
"{44ADE006-375A-401D-B15A-D76CD65F6381}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orb.exe |
"{48C826B7-0E92-43C1-B82F-D31DFDAA9D40}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{4A57F9C1-1BD3-4DEB-A03D-E7EA2885C177}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{50B6D533-270E-41F0-A86D-CDFB9FD1230F}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{527EC571-3486-449A-99BF-5E0EC813E3D7}" = protocol=17 | dir=in | app=c:\firaxis games\sid meier's civilization 4\civilization4.exe |
"{5302F308-1DFD-4AA3-9309-5F668F68B561}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{5510E244-82CB-4908-A60A-4471CC500FCE}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\world of goo\worldofgoo.exe |
"{57482544-4EBB-4C60-BCDD-34C44F785784}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\multiwinia\multiwinia.exe |
"{599B01F0-D6CF-4074-8B0B-D24B2B7A1D1E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5B76552B-246D-4801-BF7B-79E5600C7ACA}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\crysis warhead\bin32\crysis.exe |
"{5EB8E41A-2B06-485F-A06A-2652109FA805}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{651AE00A-41C1-4C2F-A2BE-B8FD257D0012}" = protocol=6 | dir=in | app=c:\microsoft games\rise of nations\thrones.exe |
"{68F79F36-6977-4BA9-9374-04BEB4FDCADA}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe |
"{72F1FE6C-706D-43F8-94CA-5E755E4D341A}" = protocol=17 | dir=in | app=c:\stardock games\demigod\bin\demigod.exe |
"{73C31BF1-F4C1-4AD9-A438-C8894B5906AE}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{749B5700-5FB5-4ACD-BAFB-10E7503429F8}" = protocol=6 | dir=in | app=c:\firaxis games\sid meier's civilization 4\civilization4.exe |
"{74D99341-94F6-4998-8412-EEE011ABDA5A}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{75250D72-7EA8-45FF-8204-1B38FC0C9F7C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{759481E8-CC4A-4BF5-B6C9-09BE24248E6B}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\world of goo\worldofgoo.exe |
"{766844D1-0497-40BD-A0CB-FC17C4E852E6}" = protocol=17 | dir=in | app=c:\microsoft games\rise of nations\thrones.exe |
"{76A331A8-7B7E-4D97-8F8B-173A8257C786}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{783DD9C3-54CF-4E99-B14E-59BE9554B4BA}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{7BB5BB1F-2626-4B26-87F0-BF5BB4C4CE78}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{7BBCCEF5-35FF-403E-A341-249C4348F0D1}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\max payne 2 the fall of max payne\maxpayne2.exe |
"{7BF9B032-426F-48EF-870F-10CB7D648E04}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\shattered_horizon\client_exe\shattered_horizon.exe |
"{7EFE6B36-681C-4FDE-BEED-6D6BB8211CAF}" = protocol=17 | dir=in | app=c:\mass effect\binaries\masseffect.exe |
"{83FF7ECF-659E-4F81-8EAB-056DF9AABB8F}" = protocol=6 | dir=in | app=c:\program files\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe |
"{84ABA0F6-1010-470A-98D1-52088BB1011E}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{8704BCA1-F9DB-45A4-8601-E43864ADFECC}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\left 4 dead\left4dead.exe |
"{883E028A-8ABD-4EE5-9685-E311A4438A54}" = protocol=17 | dir=in | app=c:\stardock games\sins of a solar empire\sins of a solar empire.exe |
"{8912249A-6F17-4492-A3E3-7679682F8496}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\max payne\maxpayne.exe |
"{8B077D5C-E878-46A7-9BE8-1A0EA22C466B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{8E03DD08-5082-4136-90D8-9E3E305F87AA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{915C829C-60CD-4FD4-B105-3B62DA64F73D}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{94D3630D-73AE-48FB-A917-6BEBAD861563}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\max payne\maxpayne.exe |
"{951A029F-C06F-4F65-9ACF-1FEFA7F936F2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{95C7BF6E-2AB6-494E-A46F-4A7B9BF51957}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\shattered_horizon\client_exe\shattered_horizon.exe |
"{960CB1BE-FAAF-427E-BCF6-79739E9F6A58}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{97F1873B-A514-4FC9-AC13-E06F5705B6E5}" = protocol=17 | dir=in | app=c:\program files\electronic arts\crytek\crysis\bin32\crysis.exe |
"{997FAEEB-7C0D-4E2D-BC46-B61A528EF8FD}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |
"{9B8DD8E8-2231-43CB-8035-D0D5946473BB}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe |
"{9F88FE11-4A2A-43D8-956C-CC75CD3259C6}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{A41B08B0-CABB-4FAD-957D-F8D8D3F1E010}" = protocol=6 | dir=in | app=c:\mass effect\masseffectlauncher.exe |
"{A8E778DF-2365-4ABD-9134-09D200D15386}" = protocol=6 | dir=in | app=c:\stardock games\sins of a solar empire\sins of a solar empire.exe |
"{ACB23519-A8E1-497E-9302-F6CC4DC12F62}" = protocol=17 | dir=in | app=c:\turbine\turbine download manager\turbinenetworkservice.exe |
"{AFA23981-6E30-4A68-8A34-341E67C0DA67}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\machinarium\machinarium.exe |
"{B351C3CE-FCF7-4046-9D3D-10947E8817D2}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{BF1A2201-5736-4DDB-973C-F39C8A3970B8}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{BF317CC9-94B1-4271-8248-74436801ECA2}" = protocol=6 | dir=out | app=system |
"{C117ACB3-CC43-4371-8BF0-6D8A0C1D1D8A}" = protocol=6 | dir=in | app=c:\stardock games\demigod\bin\demigod.exe |
"{CA20AA4D-C568-450F-8BF6-B8CA532082BB}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{D1A19315-CC3C-40B2-99DD-AFCDBDFA6C20}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D587415A-799D-4FB3-83D5-4AF9E1111566}" = protocol=6 | dir=in | app=c:\program files\electronic arts\crytek\crysis\bin32\crysis.exe |
"{D5A0537B-FE9D-46D8-B426-FD1E51DBC508}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{D5A7E520-8A4F-4342-8FAC-B3CEDD2EB710}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D8351FAD-D692-4A8A-86B1-90FCC50F0FBA}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\left 4 dead\left4dead.exe |
"{D8AA1429-7495-4A5A-8EA3-5121FC6A06B8}" = protocol=17 | dir=in | app=c:\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe |
"{DC334C05-E3F9-47C7-A839-B74670FF2403}" = protocol=6 | dir=in | app=c:\steam\steamapps\common\max payne 2 the fall of max payne\maxpayne2.exe |
"{DC6BF912-F88A-447A-9D02-0C90E93C8076}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{DE63C9B9-2768-4E8E-88D4-666561A062DC}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"{DE98B382-3A06-439B-8082-B24BC41B1A80}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{E0E99827-D2F5-47C2-B190-02782C4BD999}" = protocol=17 | dir=in | app=c:\mass effect\masseffectlauncher.exe |
"{E0F913DB-5705-4E25-860F-61D113D34641}" = protocol=6 | dir=in | app=c:\electronic arts\the battle for middle-earth ii\game.dat |
"{E2D3F1FA-74E7-488A-84B5-2F8F8B1DBAF5}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{E5406287-5ECE-411B-939F-60AEC601E383}" = protocol=17 | dir=in | app=c:\program files\stardock games\demigod\bin\demigod.exe |
"{E7A7F29A-E16C-49E3-9FF5-1A57C2E1AC9E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ECBE6A1A-864B-4392-838A-084102EFF649}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ED12F201-1817-420B-8336-98CA956E1B4F}" = protocol=6 | dir=in | app=c:\turbine\turbine download manager\turbinemessageservice.exe |
"{EF4B86EE-0662-4248-9868-0BE51792A2B1}" = protocol=17 | dir=in | app=c:\electronic arts\the battle for middle-earth ii\game.dat |
"{F4271D8E-27EA-425B-824C-8C12D4E22435}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe |
"{FB1205AF-CC4F-4E90-80B1-D035C0C4BB2D}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{FEC0D1F6-8844-4A74-914F-60A6F65A913B}" = protocol=17 | dir=in | app=c:\steam\steamapps\common\left 4 dead\left4dead.exe |
"TCP Query User{04E3AEFE-A99A-4E47-B8A4-FC2929204D8C}C:\users\nick\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\nick\program files\dna\btdna.exe |
"TCP Query User{08EFB864-D8CC-4341-9CD9-7B4FEEC1A3D7}C:\program files\winamp remote\bin\orbtray.exe" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe |
"TCP Query User{0AC94ED9-7BE6-460B-A7FB-06D7123A0563}C:\bittorrent downloads\system shock 2 modded\system shock 2 modded\shock2.exe" = protocol=6 | dir=in | app=c:\bittorrent downloads\system shock 2 modded\system shock 2 modded\shock2.exe |
"TCP Query User{13CD57DB-4EB5-418C-928D-0B9F3679CAB0}C:\program files\last.fm\lastfm.exe" = protocol=6 | dir=in | app=c:\program files\last.fm\lastfm.exe |
"TCP Query User{1EB7FCD2-23BB-4D40-A041-C976B9FBBDFD}C:\steam\steamapps\tundrawolf666\source sdk base\hl2.exe" = protocol=6 | dir=in | app=c:\steam\steamapps\tundrawolf666\source sdk base\hl2.exe |
"TCP Query User{39BF4D88-7873-4CAB-8467-7FB7D19A53BA}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{403B53E5-63E5-476E-B82A-8E9C052168AD}C:\users\nick\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\users\nick\program files\bittorrent\bittorrent.exe |
"TCP Query User{40E8C28A-8FD3-4D3F-8BD9-F4D5FE805905}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{60A3A2F5-2714-47AC-BAF4-AE7722CCECD2}C:\users\nick\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\users\nick\program files\bittorrent\bittorrent.exe |
"TCP Query User{67134286-FD2B-460E-B01F-6F6D7612A89E}C:\steam\steamapps\tundrawolf666\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\steam\steamapps\tundrawolf666\team fortress 2\hl2.exe |
"TCP Query User{6D7E14F2-109D-4D31-91B9-1257DA1138E8}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{6E8FB4DB-8A05-4D7A-A3F4-1CDE55BE309D}C:\thq\company of heroes\bugreport\bugreport.exe" = protocol=6 | dir=in | app=c:\thq\company of heroes\bugreport\bugreport.exe |
"TCP Query User{7C92DD6A-0F90-4AAA-971D-9C16714F18B2}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"TCP Query User{83697B32-412A-49B1-99BE-87CC24FB91C0}C:\thq\dawn of war\w40k.exe" = protocol=6 | dir=in | app=c:\thq\dawn of war\w40k.exe |
"TCP Query User{93ECE95A-40D0-4E64-B192-9C5FDCCE59D1}C:\thq\dawn of war\w40kwa.exe" = protocol=6 | dir=in | app=c:\thq\dawn of war\w40kwa.exe |
"TCP Query User{9C10E17A-4ECC-4C9F-A461-645C7BD2FFE0}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{9D587F70-FFFA-4F41-99BA-009F00CAD0F1}J:\freespace 2\fs2_open_3_6_9.exe" = protocol=6 | dir=in | app=j:\freespace 2\fs2_open_3_6_9.exe |
"TCP Query User{9DF225D7-62DB-4028-AB32-1283F5C92B1C}C:\users\nick\desktop\wowclient-downloader.exe" = protocol=6 | dir=in | app=c:\users\nick\desktop\wowclient-downloader.exe |
"TCP Query User{A4932617-B608-45F5-AF50-6D9F9FBF48CC}C:\steam\steamapps\common\tshb\hyperbol_demo.exe" = protocol=6 | dir=in | app=c:\steam\steamapps\common\tshb\hyperbol_demo.exe |
"TCP Query User{AAFD0353-948C-45D3-878D-2C363BA74EF6}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{AFAD1929-4EA2-42D6-B278-2926FC429865}C:\steam\steamapps\common\dawn of war 2\dow2.exe" = protocol=6 | dir=in | app=c:\steam\steamapps\common\dawn of war 2\dow2.exe |
"TCP Query User{B1BA67DD-12FE-42D6-9139-60F8CFD27C0B}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{B53F6CBE-9AF4-4905-9D3B-138D155E17DD}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{C5C06F5F-F84A-4EDC-A298-60EC9AADEED9}C:\program files\winamp remote\bin\orb.exe" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orb.exe |
"TCP Query User{CAC44D4B-AAB3-4047-9AB3-7A94C8D5AEF3}C:\program files\xfire\xfire.exe" = protocol=6 | dir=in | app=c:\program files\xfire\xfire.exe |
"TCP Query User{CC562DF0-C498-4C5E-930A-A0BF22E9CE0B}C:\program files\veoh networks\veoh\veohclient.exe" = protocol=6 | dir=in | app=c:\program files\veoh networks\veoh\veohclient.exe |
"TCP Query User{CD19E77A-0EB6-4A5A-BE19-F88C846F6D58}C:\program files\sony\station\launchpad\launchpad.exe" = protocol=6 | dir=in | app=c:\program files\sony\station\launchpad\launchpad.exe |
"TCP Query User{D72E46AE-D84F-46B3-A9FE-FB45B0A37ABB}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{DC419BFF-AC0C-4859-8F5D-795D298ED717}J:\freespace 2\fs2_open_3_6_9.exe" = protocol=6 | dir=in | app=j:\freespace 2\fs2_open_3_6_9.exe |
"TCP Query User{E3036430-4B1A-44DC-AE84-C908CD8718E0}C:\users\nick\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\nick\program files\dna\btdna.exe |
"TCP Query User{E4A02A8B-16A1-41A7-815F-D39ABDCDB20E}C:\program files\winamp remote\bin\orbir.exe" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe |
"TCP Query User{E89EB32D-A2C2-4AB0-BFFB-BF70DDE5765C}C:\users\nick\desktop\2moons_downloader_us_3-28-2008.exe" = protocol=6 | dir=in | app=c:\users\nick\desktop\2moons_downloader_us_3-28-2008.exe |
"TCP Query User{F0D36D47-358C-4872-8393-9EDB84E9861B}C:\users\nick\desktop\anarchyonline_17.9.1-large.exe" = protocol=6 | dir=in | app=c:\users\nick\desktop\anarchyonline_17.9.1-large.exe |
"TCP Query User{F1D73216-FA11-4EA3-BE7A-D4AA0CE07758}C:\steam\steamapps\tundrawolf666\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\steam\steamapps\tundrawolf666\team fortress 2\hl2.exe |
"TCP Query User{F415A279-1E06-4AB1-8E92-CCE5F87D2969}C:\ccp\eve\bin\exefile.exe" = protocol=6 | dir=in | app=c:\ccp\eve\bin\exefile.exe |
"UDP Query User{128AF103-650B-4AB6-9889-9E0DC8C011D4}C:\thq\dawn of war\w40kwa.exe" = protocol=17 | dir=in | app=c:\thq\dawn of war\w40kwa.exe |
"UDP Query User{1396A961-59E6-4CA2-98D9-A9E9DB3F5FEB}C:\users\nick\desktop\anarchyonline_17.9.1-large.exe" = protocol=17 | dir=in | app=c:\users\nick\desktop\anarchyonline_17.9.1-large.exe |
"UDP Query User{1B2DB701-FA84-47A7-A9A7-52F754E05503}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{1E91456B-6DD1-43C9-BB44-706F155CFF27}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{24405A3E-0EF3-4E15-BE31-DBD180455598}C:\program files\winamp remote\bin\orbtray.exe" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe |
"UDP Query User{2FEA3084-D3A6-48DB-840A-82C177E80363}C:\thq\dawn of war\w40k.exe" = protocol=17 | dir=in | app=c:\thq\dawn of war\w40k.exe |
"UDP Query User{37516B64-5E59-4851-9181-1156A59D2CFA}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{3F4B348E-70B5-4FB3-B167-2A3268102363}C:\thq\company of heroes\bugreport\bugreport.exe" = protocol=17 | dir=in | app=c:\thq\company of heroes\bugreport\bugreport.exe |
"UDP Query User{44659607-A397-4F0B-A820-F76AA751AC74}C:\users\nick\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\users\nick\program files\bittorrent\bittorrent.exe |
"UDP Query User{4C8099BA-AC4E-43FF-A5DE-0A8B6797A874}C:\program files\sony\station\launchpad\launchpad.exe" = protocol=17 | dir=in | app=c:\program files\sony\station\launchpad\launchpad.exe |
"UDP Query User{528487B4-3A79-41A0-B8DF-14384A7303D5}C:\steam\steamapps\tundrawolf666\source sdk base\hl2.exe" = protocol=17 | dir=in | app=c:\steam\steamapps\tundrawolf666\source sdk base\hl2.exe |
"UDP Query User{52C3E0AF-A14F-4FA7-AC18-AFB7FDD8D356}C:\steam\steamapps\common\dawn of war 2\dow2.exe" = protocol=17 | dir=in | app=c:\steam\steamapps\common\dawn of war 2\dow2.exe |
"UDP Query User{592CB53D-250A-4E46-9011-AD929B600B37}C:\users\nick\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\users\nick\program files\bittorrent\bittorrent.exe |
"UDP Query User{5D307404-DC29-4159-AC15-E1D9494C562E}C:\users\nick\desktop\2moons_downloader_us_3-28-2008.exe" = protocol=17 | dir=in | app=c:\users\nick\desktop\2moons_downloader_us_3-28-2008.exe |
"UDP Query User{6872CB4B-92A8-43B5-A4CF-42340F5CADE8}C:\users\nick\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\nick\program files\dna\btdna.exe |
"UDP Query User{6B5C35A1-68C3-4C64-92D4-27C330C549EC}C:\ccp\eve\bin\exefile.exe" = protocol=17 | dir=in | app=c:\ccp\eve\bin\exefile.exe |
"UDP Query User{6F579A20-3307-4630-A732-D196F56B23B4}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{7F527F55-2B0B-4F67-AFC6-796583A37677}C:\steam\steamapps\tundrawolf666\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\steam\steamapps\tundrawolf666\team fortress 2\hl2.exe |
"UDP Query User{8CDD74F9-129E-4597-A4EE-B9EE464E2C2D}C:\steam\steamapps\tundrawolf666\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\steam\steamapps\tundrawolf666\team fortress 2\hl2.exe |
"UDP Query User{8E60382B-4429-4574-A823-58BD4F2665D8}C:\users\nick\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\nick\program files\dna\btdna.exe |
"UDP Query User{8F502B86-D92C-4B20-B714-0D6E0BB79A24}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"UDP Query User{97297027-11D1-499D-B690-CE9A6DC2F2C6}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{97A79620-7958-47E6-BC3A-6A817D6458F9}J:\freespace 2\fs2_open_3_6_9.exe" = protocol=17 | dir=in | app=j:\freespace 2\fs2_open_3_6_9.exe |
"UDP Query User{A673EABB-89C3-4863-8378-06B50DF07426}C:\program files\veoh networks\veoh\veohclient.exe" = protocol=17 | dir=in | app=c:\program files\veoh networks\veoh\veohclient.exe |
"UDP Query User{B2710AC5-C957-418D-AB4D-B65D4DA8E573}C:\program files\winamp remote\bin\orbir.exe" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe |
"UDP Query User{B2BED75F-7733-48E9-A010-0E429CC8CFEF}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"UDP Query User{B37D76C9-F812-4058-8996-5C3881C9C321}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"UDP Query User{BB54D6A3-FE80-470E-95C6-723816C05517}C:\users\nick\desktop\wowclient-downloader.exe" = protocol=17 | dir=in | app=c:\users\nick\desktop\wowclient-downloader.exe |
"UDP Query User{CBD45311-F8EB-4FA7-B322-C4A4F02C721C}C:\program files\winamp remote\bin\orb.exe" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orb.exe |
"UDP Query User{CCB9BD0E-6B16-4057-BECD-88E8D4E0CCFA}C:\program files\last.fm\lastfm.exe" = protocol=17 | dir=in | app=c:\program files\last.fm\lastfm.exe |
"UDP Query User{D044856A-C579-4093-ABA3-1E38EAF6676F}C:\program files\xfire\xfire.exe" = protocol=17 | dir=in | app=c:\program files\xfire\xfire.exe |
"UDP Query User{D269F542-CA25-4588-8F22-377E65898F6C}J:\freespace 2\fs2_open_3_6_9.exe" = protocol=17 | dir=in | app=j:\freespace 2\fs2_open_3_6_9.exe |
"UDP Query User{D91B10C6-9396-4C94-8E16-1053B95691F9}C:\steam\steamapps\common\tshb\hyperbol_demo.exe" = protocol=17 | dir=in | app=c:\steam\steamapps\common\tshb\hyperbol_demo.exe |
"UDP Query User{F2C9910F-3371-407D-8B8C-6EC726F382FF}C:\bittorrent downloads\system shock 2 modded\system shock 2 modded\shock2.exe" = protocol=17 | dir=in | app=c:\bittorrent downloads\system shock 2 modded\system shock 2 modded\shock2.exe |
"UDP Query User{F85BA56C-8597-4975-B6BB-2C84B49B4BF9}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00040409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Disc 2
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis®
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable
"{0166E190-92D7-482A-A220-DE8B7354383A}" = Demigod
"{02EBDBB9-4600-41D3-B566-40CB861511D2}" = World of Warcraft FREE Trial
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06A419C1-0509-4967-87F9-8761D8D6765D}" = ccc-core-static
"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC
"{0CFD3BAF-9F4D-4D70-BD0B-638EA2504C25}" = PSSWCORE
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{162F8A0F-3EBF-4E2A-A37C-E8E29C261C25}" = Garmin City Navigator North America NT 2009.11 Update
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1EBE1FE9-A341-3E9B-84C2-ABBB25F313E7}" = Catalyst Control Center Graphics Full New
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 18
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java™ 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5DAA9C36-8F8B-462F-8CCA-E205BC3751F5}" = HP Active Support Library
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{61EE011A-A8D9-C1BD-962D-6342A371B1DB}" = ccc-utility
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A179A95-BA3E-8E61-D15F-A1DCC6ADBFD9}" = Catalyst Control Center Graphics Previews Vista
"{6AF49698-949A-4C89-9B31-041D2CCB5FBD}" = muvee autoProducer 6.0
"{6D3DB611-D5E8-4E4B-8952-0D3F549F9CC6}" = HP Active Support Library 32 bit components
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6F481C0F-B941-5E3F-CABD-0F23E718DF2C}" = Catalyst Control Center Core Implementation
"{73A43E42-3658-4DD9-8551-FACDA3632538}" = HP Advisor
"{75E71ADD-042C-4F30-BFAC-A9EC42351313}" = Python 2.4.3
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{80B55F0E-5933-B1E8-4F05-4C386A2E61BD}" = Catalyst Control Center InstallProxy
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{82C0D164-1456-0361-4F39-58435427AFCB}" = Catalyst Control Center Graphics Full Existing
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8BCD9811-1084-4941-0222-F993DB70F182}" = ATI Catalyst Install Manager
"{8CEA85DE-955B-4BF4-87F2-0BAA62821633}" = HP Photosmart Essential2.5
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A1C962E2-2426-49C6-A38B-9A07E40D607C}" = Microsoft Games for Windows - LIVE
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A72E0107-CFC5-16FB-BEA6-A74B94425ADD}" = CCC Help English
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.1
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B57A7B53-0662-4AC0-9352-2AE2D8212A9F}" = Garmin Communicator Plugin
"{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes
"{BCA02FAD-2C86-4C8C-A815-51C09F4E51FF}" = Dual-Core Optimizer
"{BF2A74BF-8D12-47F1-8B19-22B30AF6B0D1}" = Linksys EasyLink Advisor
"{BF313243-28F5-2434-0B5B-FAA0B8B30B1C}" = Catalyst Control Center Graphics Light
"{C34FAEF3-4241-4C4E-9CFF-7BBD8BCEABE7}" = WebEx Support Manager for Internet Explorer
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding
"{D45EC259-4A19-4656-B588-C2C360DD18EA}" = Half-Life® 2
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{D6F8B656-4127-D525-8893-8653D72DD136}" = Catalyst Control Center Graphics Previews Common
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DB4DF8B5-E448-45E5-1C6C-0C276F828E10}" = Skins
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DE6A3D43-B716-9973-9E2E-4620237464C4}" = Catalyst Control Center HydraVision Full
"{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}" = tooltips
"{EA450D5D-95EA-4FD0-B8B0-6D8E68FBE2C7}" = Impulse
"{ECCA8FE7-767A-4C8A-9DAA-BAB60F877C41}" = Sins of a Solar Empire
"{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FBDBC490-089D-4476-BF72-1F7A6368200A}" = Pure Networks Platform
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer
"AoA Audio Extractor_is1" = AoA Audio Extractor 1.0
"Audacity_is1" = Audacity 1.2.6
"AVG8Uninstall" = AVG 8.5
"Bookworm Adventures Deluxe 1.0" = Bookworm Adventures Deluxe 1.0
"CDisplay_is1" = CDisplay 1.8
"Cool's_Codec_pack_4.12" = Codec Pack - All In 1 6.0.3.0
"CutePDF Writer Installation" = CutePDF Writer 2.7
"DBFrontend_is1" = DOSBox Frontend
"Demigod" = Demigod
"DVD Flick_is1" = DVD Flick
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Photosmart Essential" = HP Photosmart Essential 2.0
"ImgBurn" = ImgBurn
"Impulse" = Impulse
"InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty® 4 - Modern Warfare™ 1.3 Patch
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty® 4 - Modern Warfare™ 1.4 Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare™ 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare™ 1.7 Patch
"InstallShield_{AFAE2B15-89A0-4215-A030-F7B5B478886B}" = Call of Duty® - World at War™ 1.1 Patch
"InstallShield_{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.6.5 Full
"LastFM_is1" = Last.fm 1.5.4.24567
"Linksys EasyLink Advisor" = Linksys EasyLink Advisor
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Musicnotes Combined Installer_is1" = Musicnotes Software Suite 1.4.4
"NVIDIA Drivers" = NVIDIA Drivers
"oggcodecs" = oggcodecs 0.71.0946
"On the Rain-Slick Precipice of Darkness, Episode One" = On the Rain-Slick Precipice of Darkness, Episode One
"On the Rain-Slick Precipice of Darkness, Episode Two" = On the Rain-Slick Precipice of Darkness, Episode Two
"OpenAL" = OpenAL
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"PopCap Browser Plugin" = PopCap Browser Plugin
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 6.0" = RealPlayer
"Rhapsody" = Rhapsody
"RiseOfNationsExpansion 1.0" = Rise of Nations
"Riva FLV Encoder 2.0_is1" = Riva FLV Encoder 2.0
"Samsung CLP-300 Series" = Samsung CLP-300 Series
"Sins of a Solar Empire" = Sins of a Solar Empire
"Spyware Doctor" = Spyware Doctor 7.0
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 12140" = Max Payne
"Steam App 12150" = Max Payne 2: The Fall of Max Payne
"Steam App 1500" = Darwinia
"Steam App 1530" = Multiwinia
"Steam App 17330" = Crysis Warhead
"Steam App 18110" = Shattered Horizon
"Steam App 215" = Source SDK Base
"Steam App 22000" = World of Goo
"Steam App 26810" = Braid Demo
"Steam App 340" = Half-Life 2: Lost Coast
"Steam App 380" = Half-Life 2: Episode One
"Steam App 400" = Portal
"Steam App 40700" = Machinarium
"Steam App 420" = Half-Life 2: Episode Two
"Steam App 440" = Team Fortress 2
"Steam App 500" = Left 4 Dead
"Steam App 9740" = Indigo Prophecy
"Switch" = Switch Sound File Converter
"Test My Hardware_is1" = Test My Hardware 3.0
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WordWeb" = WordWeb
"XiphQT" = Xiph QuickTime Components
"XviD MPEG4 Video Codec" = XviD MPEG4 Video Codec (remove only)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 24/03/2009 1:19:52 AM | Computer Name = Nick-PC | Source = Application Error | ID = 1000
Description = Faulting application winamp.exe, version 5.5.4.2165, time stamp 0x4896392e,
faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception
code 0xc0000005, fault offset 0x0003cfc0, process id 0x17a8, application start time
0x01c9ac34e7ad899e.

Error - 24/03/2009 1:23:21 AM | Computer Name = Nick-PC | Source = EventSystem | ID = 4621
Description =

Error - 25/03/2009 2:04:23 AM | Computer Name = Nick-PC | Source = EventSystem | ID = 4621
Description =

Error - 25/03/2009 4:36:59 PM | Computer Name = Nick-PC | Source = Application Error | ID = 1000
Description = Faulting application Shock2.exe, version 1.0.0.0, time stamp 0x37d87290,
faulting module Shock2.exe, version 1.0.0.0, time stamp 0x37d87290, exception code
0xc0000005, fault offset 0x001b5278, process id 0x124c, application start time 0x01c9ad89703a9c0e.

Error - 25/03/2009 7:45:10 PM | Computer Name = Nick-PC | Source = Application Hang | ID = 1002
Description = The program Shock2.exe version 1.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 1604 Start Time: 01c9ad896130aa1e Termination Time: 8

Error - 25/03/2009 8:56:20 PM | Computer Name = Nick-PC | Source = Application Hang | ID = 1002
Description = The program Shock2.exe version 1.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 17d4 Start Time: 01c9ada3c7e11f0e Termination Time: 19

Error - 26/03/2009 5:29:58 AM | Computer Name = Nick-PC | Source = EventSystem | ID = 4621
Description =

Error - 26/03/2009 12:39:35 PM | Computer Name = Nick-PC | Source = VSS | ID = 8194
Description =

Error - 26/03/2009 1:29:38 PM | Computer Name = Nick-PC | Source = EventSystem | ID = 4621
Description =

Error - 27/03/2009 12:14:04 AM | Computer Name = Nick-PC | Source = EventSystem | ID = 4621
Description =

[ Media Center Events ]
Error - 16/11/2007 6:54:25 PM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 16/11/2007 8:54:13 PM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 22/11/2007 12:54:55 AM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 22/11/2007 2:53:08 AM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 16/04/2008 12:53:28 PM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 23/07/2008 11:43:22 PM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 27/04/2009 11:53:31 PM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 09/06/2009 4:01:19 PM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 25/10/2009 3:32:21 PM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 07/04/2010 1:31:31 PM | Computer Name = Nick-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 12/04/2010 5:38:48 AM | Computer Name = Nick-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 13/04/2010 5:10:39 AM | Computer Name = Nick-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 13/04/2010 5:10:40 AM | Computer Name = Nick-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 13/04/2010 5:10:40 AM | Computer Name = Nick-PC | Source = DCOM | ID = 10005
Description =

Error - 13/04/2010 5:10:40 AM | Computer Name = Nick-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 13/04/2010 5:10:40 AM | Computer Name = Nick-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 13/04/2010 5:31:29 AM | Computer Name = Nick-PC | Source = HTTP | ID = 15016
Description =

Error - 13/04/2010 5:31:53 AM | Computer Name = Nick-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 13/04/2010 5:31:53 AM | Computer Name = Nick-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 13/04/2010 5:32:09 AM | Computer Name = Nick-PC | Source = Service Control Manager | ID = 7034
Description =


< End of report >


#9 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:08 PM

Posted 13 April 2010 - 04:02 PM

Hi,

Please re-run Malwarebytes and delete the threats found by the tool.



Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. NOT supported for use in 9x or ME

Upgrading Java:
  • Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 19.
  • Click the "Download" button to the right.
  • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-6u19-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u18-windows-i586.exe and select "Run as an Administrator.")





I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the icon on your desktop.
  • Check
  • Click the button.
  • Accept any security warnings from your browser.
  • Check
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push
  • Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the button.
  • Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#10 NickJewell

NickJewell
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 13 April 2010 - 05:56 PM

Hi Tom,

Malwarebytes run once again and infections removed. Uninstalled all Java RE and installed new one. However, I got stuck on the ESET program.

I opened the install file and let it run, only to have it immediately give me an error saying: "Can not get update. Is proxy configured?" I turned off AVG and it proceeded to run, only to get all the way to the end of the update and receive the error: "Unexpected error 2002". It will not proceed further than this, and the Support database on the ESET website says nothing about it. Any advice on what to do?

#11 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:08 PM

Posted 14 April 2010 - 01:26 PM

Hi,

Please try this one:


Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      Extended (if available otherwise Standard)
    • Scan Options:
      Scan Archives
      Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
      Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#12 NickJewell

NickJewell
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 16 April 2010 - 12:35 AM

Hi Tom,

Scan is running tonight. I've had a busy few days so I'll get it up as soon as possible. Just giving you a heads-up that it might take me a day or two. Thanks for all your help and I'll get back to you as soon as possible.

Cheers!

#13 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:08 PM

Posted 17 April 2010 - 03:24 AM

OK smile.gif
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#14 NickJewell

NickJewell
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 17 April 2010 - 10:13 AM

Hey Tom,

Here's the Kaspersky report. Sorry it took so long to get back to you.

-=-=-=-=-=-=-=-=-=-=-

KASPERSKY ONLINE SCANNER 7.0: scan report
Saturday, April 17, 2010
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, April 17, 2010 06:14:27
Records in database: 3950774
Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes
Scan area My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
Scan statistics
Objects scanned 292387
Threats found 0
Infected objects found 0
Suspicious objects found 0
Scan duration 05:18:03

No threats found. Scanned area is clean.
Selected area has been scanned.

#15 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:08 PM

Posted 18 April 2010 - 02:32 PM

Good,

Please post back with a fresh OTL logfile and tell me how your system is running smile.gif
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users