Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Audio Advert Virus


  • This topic is locked This topic is locked
20 replies to this topic

#1 jame770

jame770

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:59 AM

Posted 29 July 2010 - 03:36 AM

As requested Ive started a new topic with the relevant logs. I have an issue with my PC where I get random adverts for cleaning products coming through my PC. Ive had this for the last 5 days. Ive downloaded and used lots of free cleaners in and out of safe mode. Apparently my pc is clean. Ive know idea where this came from, ive not downloaded anything dodgy I can recall. Must have picked it up whilst surfing. Pornsites have been surfed and I downloaded some mods for a game i play, thats about it.

Ive used, spybot, avg, malwarebytes, ad-adware etc. nothing worked.

DDS (Ver_10-03-17.01) - NTFSx86
Run by James at 8:54:26.10 on 29/07/2010
Internet Explorer: 8.0.6001.18928 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.3071.1641 [GMT 1:00]

SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\wltrysvc.exe
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
svchost.exe 4
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\PnkBstrA.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Windows\system32\PnkBstrB.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
svchost.exe 4
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\James\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuze.dll
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuze.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll
BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuze.dll
BHO: Ask Toolbar BHO: {d4027c7f-154a-4066-a1ad-4243d8127440} - Ask Toolbar
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} -
TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuze.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [amd_dc_opt] c:\program files\amd\dual-core optimizer\amd_dc_opt.exe
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15110/CTPID.cab
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
AppInit_DLLs: avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\james\appdata\roaming\mozilla\firefox\profiles\rfbwza8r.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/webhp?hl=en
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\james\appdata\local\yahoo!\browserplus\2.7.1\plugins\npybrowserplus_2.7.1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-7-26 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-7-26 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-7-26 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-7-26 243024]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-26 308136]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-7-12 1352832]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-7-26 1153368]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-4-3 240232]
R3 t3;Sound Blaster X-Fi Xtreme Audio (Vista);c:\windows\system32\drivers\t3.sys [2008-10-17 404992]
S2 gupdate1c99f12c8a9d8f1;Google Update Service (gupdate1c99f12c8a9d8f1);c:\program files\google\update\GoogleUpdate.exe [2009-3-7 133104]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-7-26 430152]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\common files\creative labs shared\service\AL6Licensing.exe [2009-12-1 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2009-12-1 79360]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [2005-4-24 13225]
S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\users\james\desktop\real temp\WinRing0.sys [2010-5-8 14416]
S4 iaNvStor;Intel® Turbo Memory Controller;c:\windows\system32\drivers\iaNvStor.sys [2008-6-10 220696]
S4 ioatdma;Intel® QuickData Technology Device;c:\windows\system32\drivers\ioatdma.sys [2008-6-10 36480]
S4 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2008-6-10 34176]
S4 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2008-6-10 28800]
S4 Si3531;SiI-3531 SATA Controller;c:\windows\system32\drivers\Si3531.sys [2008-6-10 210224]
S4 wbondir;Winbond CIR Transceiver;c:\windows\system32\drivers\wbondir.sys [2008-6-10 49664]

=============== Created Last 30 ================

2010-07-29 07:48:00 20 ----a-w- c:\users\james\defogger_reenable
2010-07-27 20:43:11 0 d-----w- c:\program files\Trend Micro
2010-07-27 12:29:10 0 d-----w- c:\users\james\appdata\roaming\Malwarebytes
2010-07-27 12:28:12 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-27 12:28:11 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-27 12:28:11 0 d-----w- c:\programdata\Malwarebytes
2010-07-27 12:28:11 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-27 08:17:29 0 d--h--w- C:\$AVG
2010-07-26 22:55:27 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-26 22:55:26 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-26 22:55:21 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-26 22:55:20 0 d-----w- c:\windows\system32\drivers\Avg
2010-07-26 22:55:18 0 d-----w- c:\programdata\AVG Security Toolbar
2010-07-26 22:53:18 0 d-----w- c:\program files\AVG
2010-07-26 22:53:03 0 d-----w- c:\programdata\avg9
2010-07-26 22:27:26 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-07-26 20:18:27 0 d-----w- c:\windows\pss
2010-07-26 20:07:37 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-26 20:07:35 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-07-26 19:51:29 0 dc-h--w- c:\programdata\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-07-26 19:50:54 0 d-----w- c:\programdata\Lavasoft
2010-07-26 19:50:54 0 d-----w- c:\program files\Lavasoft
2010-07-26 19:17:38 0 d-----w- c:\programdata\Spybot - Search & Destroy
2010-07-26 19:17:38 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-07-23 10:21:47 0 d-----w- c:\program files\Mount&Blade Warband
2010-07-11 11:51:44 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-07-11 11:51:44 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-07-11 11:51:44 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-07-11 11:51:44 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-07-11 11:51:42 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-06-30 19:51:01 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-06-30 19:51:01 28672 ----a-w- c:\windows\system32\Apphlpdm.dll

==================== Find3M ====================

2010-07-26 22:46:44 86016 ----a-w- c:\windows\inf\infpub.dat
2010-07-26 22:46:44 239616 ----a-w- c:\windows\inf\infstrng.dat
2010-07-26 22:46:44 143360 ----a-w- c:\windows\inf\infstor.dat
2010-07-22 18:09:55 68923 ----a-w- c:\programdata\nvModes.dat
2010-05-26 17:06:41 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47:41 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-04 05:59:21 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55:42 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55:42 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31:05 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13:48 2037248 ----a-w- c:\windows\system32\win32k.sys
2009-11-18 03:20:06 665600 ----a-w- c:\windows\inf\drvindex.dat
2008-01-21 02:43:21 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-10-24 04:09:01 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 8:55:19.34 ===============

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-29 13:27:16
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\James\AppData\Local\Temp\kwlcypow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text C:\Windows\system32\DRIVERS\atksgt.sys section is writeable [0xA3DC4300, 0x3B638, 0xE8000020]
.text C:\Windows\system32\DRIVERS\lirsgt.sys section is writeable [0xA3E07300, 0x1BEE, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] kernel32.dll!FindResourceExA 77372575 7 Bytes JMP 28001D80 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] kernel32.dll!FindResourceA 77372653 5 Bytes JMP 28001CF0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] kernel32.dll!CreateEventA 773944C0 5 Bytes JMP 28001840 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] kernel32.dll!LockResource 773968DF 5 Bytes JMP 28001F50 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] kernel32.dll!FindResourceExW 773969FD 7 Bytes JMP 28001C60 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] kernel32.dll!LoadResource 77396ADB 7 Bytes JMP 28001E20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] kernel32.dll!FindResourceW 77397FA1 5 Bytes JMP 28001BE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] kernel32.dll!SizeofResource 77397FBF 7 Bytes JMP 28001EE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] ADVAPI32.dll!CryptDeriveKey 76B4FCAE 7 Bytes JMP 28001000 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] ADVAPI32.dll!CryptDecrypt 76B4FE91 7 Bytes JMP 28001060 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!CreateDialogParamW 76EA72A2 5 Bytes JMP 28006090 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!SetWindowPlacement 76EA7963 5 Bytes JMP 28005E10 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!SetWindowRgn 76EAA221 7 Bytes JMP 28005F50 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!LoadImageW 76EAC9E5 5 Bytes JMP 280066E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!LoadIconW 76EADA9F 5 Bytes JMP 280068D0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!CreateWindowExW 76EB1305 5 Bytes JMP 28003C60 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!GetWindowLongW 76EBF8BF 7 Bytes JMP 28006A70 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!PeekMessageW 76EC045A 5 Bytes JMP 28004630 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!TrackPopupMenuEx 76ED0CE7 5 Bytes JMP 28004F10 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] USER32.dll!MessageBoxIndirectW 76EFD5D3 5 Bytes JMP 28006280 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] WS2_32.dll!closesocket 7732330C 5 Bytes JMP 2800B8C0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] WS2_32.dll!recv 7732343A 5 Bytes JMP 2800B0E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] WS2_32.dll!WSASend 77324496 5 Bytes JMP 2800B680 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] WS2_32.dll!send 7732659B 5 Bytes JMP 2800B4A0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] WS2_32.dll!WSARecv 77328400 5 Bytes JMP 2800B280 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] SHELL32.dll!Shell_NotifyIconW 75E88626 5 Bytes JMP 280033B0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] ole32.dll!CoRegisterClassObject 771E7DB6 5 Bytes JMP 28002360 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] ole32.dll!CoCreateInstance 77229EA6 5 Bytes JMP 28002600 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] ole32.dll!CoInitializeEx 7722AD63 5 Bytes JMP 28002260 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] WININET.dll!InternetReadFile 7788654B 5 Bytes JMP 2800A090 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] WININET.dll!InternetCloseHandle 77889088 5 Bytes JMP 2800A240 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] WININET.dll!HttpOpenRequestA 7788D508 5 Bytes JMP 28009F00 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3468] WININET.dll!HttpSendRequestA 7789EE89 5 Bytes JMP 2800A170 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4304] USER32.dll!TrackPopupMenu 76EC14F3 5 Bytes JMP 66B0721D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5272] USER32.dll!CreateWindowExW 76EB1305 5 Bytes JMP 6F33DB1C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5272] USER32.dll!DialogBoxParamW 76ED10B0 5 Bytes JMP 6F2654C5 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5272] USER32.dll!DialogBoxIndirectParamW 76ED2EF5 5 Bytes JMP 6F43480F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5272] USER32.dll!DialogBoxParamA 76EE8152 5 Bytes JMP 6F4347AC C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5272] USER32.dll!DialogBoxIndirectParamA 76EE847D 5 Bytes JMP 6F434872 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5272] USER32.dll!MessageBoxIndirectA 76EFD4D9 5 Bytes JMP 6F434741 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5272] USER32.dll!MessageBoxIndirectW 76EFD5D3 5 Bytes JMP 6F4346D6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5272] USER32.dll!MessageBoxExA 76EFD639 5 Bytes JMP 6F434674 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5272] USER32.dll!MessageBoxExW 76EFD65D 5 Bytes JMP 6F434612 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!SetWindowsHookExW 76EA87AD 5 Bytes JMP 6F339AC9 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!CallNextHookEx 76EA8E3B 5 Bytes JMP 6F32D0ED C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!UnhookWindowsHookEx 76EA98DB 5 Bytes JMP 6F2A467C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!CreateWindowExW 76EB1305 5 Bytes JMP 6F33DB1C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!DialogBoxParamW 76ED10B0 5 Bytes JMP 6F2654C5 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!DialogBoxIndirectParamW 76ED2EF5 5 Bytes JMP 6F43480F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!DialogBoxParamA 76EE8152 5 Bytes JMP 6F4347AC C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!DialogBoxIndirectParamA 76EE847D 5 Bytes JMP 6F434872 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!MessageBoxIndirectA 76EFD4D9 5 Bytes JMP 6F434741 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!MessageBoxIndirectW 76EFD5D3 5 Bytes JMP 6F4346D6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!MessageBoxExA 76EFD639 5 Bytes JMP 6F434674 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] USER32.dll!MessageBoxExW 76EFD65D 5 Bytes JMP 6F434612 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] ole32.dll!OleLoadFromStream 771F1E12 5 Bytes JMP 6F434B77 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5444] ole32.dll!CoCreateInstance 77229EA6 5 Bytes JMP 6F33DB78 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[5676] ntdll.dll!LdrLoadDll 77729390 5 Bytes JMP 009D13F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

---- Processes - GMER 1.0.15 ----

Process C:\Program Files\Internet Explorer\iexplore.exe (*** hidden *** ) 5272
Process C:\Program Files\Internet Explorer\iexplore.exe (*** hidden *** ) 5444

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xEE 0x62 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x20 0xD9 0x66 0xCD ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xEE 0x62 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x20 0xD9 0x66 0xCD ...

---- EOF - GMER 1.0.15 ----

Mod Edit: OP made a second reply attaching GMER log after issues with site maintenance. I removed so thread would show 0 replies and pasted GMER log here.

Attached Files


Edited by quietman7, 29 July 2010 - 08:01 AM.


BC AdBot (Login to Remove)

 


#2 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:08:59 AM

Posted 07 August 2010 - 01:43 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Please include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.
We need to create an OTL Report
  1. Please download OTL from one of the following mirrors:
  2. Save it to your desktop.
  3. Double click on the icon on your desktop.
  4. Click the "Scan All Users" checkbox.
  5. In the custom scan box paste the following:
    CODE
    msconfig
    safebootminimal
    activex
    drivers32
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    mv61xx.sys
    nvraid.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\drivers\*.sys /90
  6. Push the button.
  7. Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt<--Will be minimized

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. I suggest you do this and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#3 jame770

jame770
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:59 AM

Posted 10 August 2010 - 09:45 AM

Hi, thanks for responding. No worries for the delay. Here is the logs you requested....

OTL logfile created on: 10/08/2010 15:32:21 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\James\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 44.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 926.52 Gb Total Space | 661.65 Gb Free Space | 71.41% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 5.51 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JAMES-PC
Current User Name: James
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/08/10 15:31:13 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe
PRC - [2010/07/26 23:54:49 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/07/26 23:54:49 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/07/26 23:54:48 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/07/26 23:54:47 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/07/26 23:54:38 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/07/26 23:54:22 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/07/23 03:09:38 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/07/23 03:09:38 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/07/02 17:33:10 | 002,347,216 | ---- | M] (IObit) -- C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
PRC - [2010/04/03 16:59:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2009/07/25 05:23:09 | 000,022,816 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jp2launcher.exe
PRC - [2009/07/25 05:23:07 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\javaw.exe
PRC - [2009/07/25 05:23:05 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\java.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/23 12:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/12/19 12:13:03 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/11/24 23:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2008/11/24 23:31:08 | 000,239,968 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2008/01/11 18:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe


========== Modules (SafeList) ==========

MOD - [2010/08/10 15:31:13 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe
MOD - [2010/07/26 23:55:29 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\avgrsstx.dll
MOD - [2009/04/11 07:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/21 03:24:37 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010/07/26 23:54:22 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/04/19 10:25:38 | 000,430,152 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
SRV - [2010/04/03 16:59:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2009/12/01 02:15:18 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2009/12/01 02:05:50 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2009/11/05 02:31:00 | 000,316,664 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2009/09/25 02:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/05/27 03:27:04 | 029,262,680 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ)
SRV - [2009/04/03 20:47:07 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/02/23 12:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/11/24 23:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2008/11/24 23:31:08 | 000,239,968 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2008/11/24 23:31:08 | 000,045,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2008/11/11 10:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/11/09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Disabled | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/01/21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/11 18:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - [2010/07/26 23:55:27 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/07/26 23:55:22 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/07/26 23:55:21 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010/04/03 23:55:31 | 011,573,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/02/18 19:25:56 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009/07/06 13:01:40 | 000,281,504 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009/07/06 13:01:39 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009/04/11 05:46:08 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2009/04/11 05:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/10/17 02:43:08 | 000,404,992 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\t3.sys -- (t3) Sound Blaster X-Fi Xtreme Audio (Vista)
DRV - [2008/09/15 08:56:34 | 000,008,064 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2008/09/15 08:56:24 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2008/09/15 08:56:24 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/09/15 08:56:24 | 000,008,064 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2008/08/26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/07/26 22:30:30 | 000,014,416 | ---- | M] (OpenLibSys.org) [Kernel | On_Demand | Stopped] -- C:\Users\James\Desktop\Real Temp\WinRing0.sys -- (WinRing0_1_2_0)
DRV - [2008/04/23 11:21:08 | 000,058,416 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\sisagpx.sys -- (SISAGP)
DRV - [2008/01/29 12:55:00 | 001,042,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/01/21 03:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008/01/21 03:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008/01/21 03:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008/01/21 03:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008/01/21 03:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008/01/21 03:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008/01/21 03:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008/01/21 03:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008/01/21 03:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008/01/21 03:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel®
DRV - [2008/01/21 03:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008/01/21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008/01/21 03:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008/01/21 03:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008/01/21 03:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008/01/21 03:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008/01/21 03:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008/01/21 03:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008/01/21 03:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008/01/21 03:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008/01/21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008/01/21 03:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008/01/21 03:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008/01/21 03:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008/01/21 03:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2008/01/18 09:44:12 | 000,036,480 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ioatdma.sys -- (ioatdma) Intel®
DRV - [2008/01/17 11:52:24 | 000,134,688 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2008/01/17 11:52:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/10/02 19:53:02 | 000,220,696 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ianvstor.sys -- (iaNvStor) Intel®
DRV - [2007/09/29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastor.sys -- (iaStor)
DRV - [2007/08/30 13:27:08 | 000,006,912 | ---- | M] (JMicron ) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\jgogo.sys -- (JGOGO)
DRV - [2007/07/09 10:40:20 | 000,044,416 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\heci.sys -- (HECI) Intel®
DRV - [2007/07/07 15:13:10 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007/07/05 04:33:32 | 000,048,768 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\jraid.sys -- (JRAID)
DRV - [2007/06/29 14:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2007/05/24 12:27:54 | 000,074,800 | ---- | M] (Silicon Image, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\si3132.sys -- (SI3132)
DRV - [2007/05/09 22:51:34 | 000,041,888 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/05/09 22:47:00 | 001,276,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2007/05/09 22:46:48 | 000,014,112 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
DRV - [2007/03/20 15:59:00 | 000,049,664 | ---- | M] (Winbond Electronics Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\wbondir.sys -- (wbondir)
DRV - [2007/03/16 11:11:38 | 000,012,256 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\TBPanel.sys -- (TBPanel)
DRV - [2007/01/31 03:10:14 | 000,046,592 | ---- | M] (ENE Technology Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\esd7sk.sys -- (ESDCR)
DRV - [2007/01/31 03:10:10 | 000,061,952 | ---- | M] (ENE Technology Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\esm7sk.sys -- (ESMCR)
DRV - [2007/01/31 03:10:06 | 000,067,584 | ---- | M] (ENE Technology Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ems7sk.sys -- (EMSCR)
DRV - [2007/01/30 09:31:52 | 000,210,224 | ---- | M] (Silicon Image, Inc) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\si3531.sys -- (Si3531)
DRV - [2006/12/14 16:11:58 | 000,007,680 | ---- | M] (ATK0100) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\atkacpi.sys -- (MTsensor)
DRV - [2006/11/02 10:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 10:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 10:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 10:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 10:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 09:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 08:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/10/18 13:20:00 | 000,005,504 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\siremfil.sys -- (SiRemFil)
DRV - [2005/12/19 18:15:44 | 000,028,800 | ---- | M] (O2Micro ) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\o2sd.sys -- (O2SDRDR)
DRV - [2005/11/14 14:28:00 | 000,034,176 | ---- | M] (O2Micro ) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\o2media.sys -- (O2MDRDR)
DRV - [2005/04/24 23:43:58 | 000,013,225 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Razerlow.sys -- (Razerlow)
DRV - [2004/11/01 10:21:00 | 000,010,368 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\siwinacc.sys -- (SiFilter)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4F 80 C2 3D F4 37 CB 01 [binary data]
IE - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.845
FF - prefs.js..extensions.enabledItems: avg@igeared:4.504.019.002
FF - prefs.js..keyword.URL: "http://uk.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_uk&p="

FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/02/10 18:57:33 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/07/27 08:40:40 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/07/26 23:55:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/09 20:01:58 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/09 20:01:54 | 000,000,000 | ---D | M]

[2010/08/09 20:02:04 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Extensions
[2010/08/09 20:37:17 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\trsmo5jq.default\extensions
[2010/08/09 20:37:17 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\trsmo5jq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/09 20:01:54 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/23 01:29:54 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/07/23 01:29:54 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/07/23 01:29:54 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/07/23 01:29:54 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - Reg Error: Value error. File not found
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - Reg Error: Value error. File not found
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2343792608-1107490366-3230250957-1003..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup...15110/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\James\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\James\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008/09/11 00:07:31 | 000,000,058 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{d0ce73a6-6521-11dd-99b5-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{d0ce73a6-6521-11dd-99b5-806e6f6e6963}\Shell\AutoRun\command - "" = E:\FalloutLauncher.exe -- [2008/09/18 19:38:35 | 006,981,048 | R--- | M] (Bethesda Softworks)
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\Nvsetup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: EA Core - hkey= - key= - C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
MsConfig - StartUpReg: Messenger (Yahoo!) - hkey= - key= - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
MsConfig - StartUpReg: MsnMsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation)
MsConfig - StartUpReg: PC Suite Tray - hkey= - key= - C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
MsConfig - StartUpReg: SPIRunE - hkey= - key= - File not found
MsConfig - StartUpReg: SpybotSD TeaTimer - hkey= - key= - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
MsConfig - StartUpReg: Steam - hkey= - key= - c:\program files\steam\steam.exe (Valve Corporation)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: swg - hkey= - key= - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - StartUpReg: TBPanel - hkey= - key= - C:\Program Files\Vtune\TBPanel.exe ()
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: VolPanel - hkey= - key= - C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
MsConfig - StartUpReg: Windows Defender - hkey= - key= - File not found
MsConfig - StartUpReg: wltray.exe - hkey= - key= - File not found
MsConfig - State: "startup" - 2
MsConfig - State: "bootini" - 2
MsConfig - State: "services" - 2

SafeBootMin: AppMgmt - File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 8.0
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 8.0
ActiveX: {2A2E95BC-D0C1-B3DD-FD06-EA14613BAF40} - Microsoft Windows Media Player 11.0
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/08/10 15:31:10 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe
[2010/08/09 19:06:29 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Fallout3
[2010/08/09 18:29:09 | 000,000,000 | ---D | C] -- C:\Program Files\Bethesda Softworks
[2010/08/04 09:47:24 | 000,000,000 | ---D | C] -- C:\Users\James\Desktop\Xcom
[2010/07/29 08:58:04 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2010/07/27 21:43:11 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/07/27 13:29:10 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\Malwarebytes
[2010/07/27 13:28:12 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/07/27 13:28:11 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/07/27 13:28:11 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/27 13:28:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/07/27 09:17:29 | 000,000,000 | -H-D | C] -- C:\$AVG
[2010/07/27 08:30:10 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\AVG Security Toolbar
[2010/07/26 23:55:27 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\avgrsstx.dll
[2010/07/26 23:55:26 | 000,243,024 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys
[2010/07/26 23:55:21 | 000,216,400 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgldx86.sys
[2010/07/26 23:55:20 | 000,029,584 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys
[2010/07/26 23:55:20 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\Avg
[2010/07/26 23:55:18 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Security Toolbar
[2010/07/26 23:53:18 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2010/07/26 23:53:03 | 000,000,000 | ---D | C] -- C:\ProgramData\avg9
[2010/07/26 21:18:27 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010/07/26 21:07:35 | 000,095,024 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2010/07/26 20:51:48 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Sunbelt Software
[2010/07/26 20:50:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2010/07/26 20:17:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010/07/26 20:17:38 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/07/25 20:06:00 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Yahoo
[2010/07/23 11:21:47 | 000,000,000 | ---D | C] -- C:\Program Files\Mount&Blade Warband
[2010/07/16 21:10:22 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Oblivion
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\James\Documents\*.tmp files -> C:\Users\James\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/10 15:33:54 | 004,194,304 | -HS- | M] () -- C:\Users\James\ntuser.dat
[2010/08/10 15:31:13 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe
[2010/08/10 15:10:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/10 14:57:32 | 000,000,000 | ---- | M] () -- C:\Users\James\AppData\Local\prvlcl.dat
[2010/08/10 13:50:21 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/10 13:50:21 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/10 11:41:09 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010/08/10 09:54:50 | 000,819,054 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/08/10 09:54:50 | 000,689,416 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/08/10 09:54:50 | 000,141,166 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/08/10 09:53:24 | 063,176,281 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2010/08/10 09:50:25 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2010/08/10 09:50:25 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/10 09:50:25 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\AWC Startup.job
[2010/08/10 09:50:23 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/08/10 09:50:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/08/10 00:10:29 | 000,524,288 | -HS- | M] () -- C:\Users\James\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/08/10 00:10:29 | 000,065,536 | -HS- | M] () -- C:\Users\James\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/08/10 00:09:49 | 003,443,806 | -H-- | M] () -- C:\Users\James\AppData\Local\IconCache.db
[2010/08/09 20:01:55 | 000,001,754 | ---- | M] () -- C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/08/09 20:01:55 | 000,001,730 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/08/09 20:00:00 | 000,000,546 | ---- | M] () -- C:\Windows\tasks\Norton Internet Security - Run Full System Scan - James.job
[2010/08/09 19:06:17 | 000,001,095 | ---- | M] () -- C:\Users\James\Desktop\Fallout Mod Manager.lnk
[2010/08/05 11:37:28 | 000,006,619 | ---- | M] () -- C:\Users\James\Documents\James Hall CV August2010.rtf
[2010/08/04 12:10:56 | 000,001,055 | ---- | M] () -- C:\Users\James\Desktop\UFOLoader.exe - Shortcut.lnk
[2010/08/03 17:37:23 | 000,000,215 | ---- | M] () -- C:\Users\James\Desktop\Red Faction Guerrilla.url
[2010/08/03 10:02:52 | 000,005,544 | ---- | M] () -- C:\Users\James\Documents\Current C.V James Hall.rtf
[2010/08/02 08:27:28 | 000,000,914 | ---- | M] () -- C:\Users\James\Desktop\Warband Battle Sizer.lnk
[2010/08/01 02:14:00 | 000,000,456 | ---- | M] () -- C:\Windows\tasks\Driver Robot.job
[2010/07/29 09:00:51 | 000,284,915 | ---- | M] () -- C:\Users\James\Desktop\gmer.zip
[2010/07/29 08:52:17 | 000,525,824 | ---- | M] () -- C:\Users\James\Desktop\dds.scr
[2010/07/29 08:48:18 | 000,000,020 | ---- | M] () -- C:\Users\James\defogger_reenable
[2010/07/29 08:38:50 | 000,050,477 | ---- | M] () -- C:\Users\James\Desktop\Defogger.exe
[2010/07/28 08:56:56 | 000,002,529 | ---- | M] () -- C:\Users\James\Desktop\HiJackThis.lnk
[2010/07/28 08:22:17 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2010/07/27 13:28:14 | 000,000,842 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/26 23:55:29 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\avgrsstx.dll
[2010/07/26 23:55:29 | 000,001,653 | ---- | M] () -- C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2010/07/26 23:55:27 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys
[2010/07/26 23:55:22 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgldx86.sys
[2010/07/26 23:55:21 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys
[2010/07/26 23:55:20 | 000,113,461 | ---- | M] () -- C:\Windows\System32\drivers\Avg\iavichjw.avm
[2010/07/26 21:07:35 | 000,095,024 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2010/07/26 20:17:43 | 000,001,101 | ---- | M] () -- C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/07/26 20:17:43 | 000,001,077 | ---- | M] () -- C:\Users\James\Desktop\Spybot - Search & Destroy.lnk
[2010/07/23 11:23:22 | 000,000,955 | ---- | M] () -- C:\Users\James\Desktop\Mount&Blade Warband.lnk
[2010/07/22 19:09:55 | 000,068,923 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010/07/22 19:09:54 | 000,068,923 | ---- | M] () -- C:\ProgramData\nvModes.001
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\James\Documents\*.tmp files -> C:\Users\James\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/09 20:01:55 | 000,001,754 | ---- | C] () -- C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/08/09 20:01:55 | 000,001,730 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/08/09 19:06:17 | 000,001,095 | ---- | C] () -- C:\Users\James\Desktop\Fallout Mod Manager.lnk
[2010/08/04 10:19:16 | 000,001,055 | ---- | C] () -- C:\Users\James\Desktop\UFOLoader.exe - Shortcut.lnk
[2010/08/04 09:25:15 | 000,005,420 | ---- | C] () -- C:\Users\James\Desktop\UFOExtender.ini
[2010/08/04 09:20:12 | 000,095,744 | ---- | C] () -- C:\Users\James\Desktop\UFOLoader.exe
[2010/08/03 17:37:23 | 000,000,215 | ---- | C] () -- C:\Users\James\Desktop\Red Faction Guerrilla.url
[2010/08/03 12:06:59 | 000,006,619 | ---- | C] () -- C:\Users\James\Documents\James Hall CV August2010.rtf
[2010/08/02 08:27:28 | 000,000,914 | ---- | C] () -- C:\Users\James\Desktop\Warband Battle Sizer.lnk
[2010/07/29 09:02:10 | 000,293,376 | ---- | C] () -- C:\Users\James\Desktop\gmer.exe
[2010/07/29 09:00:51 | 000,284,915 | ---- | C] () -- C:\Users\James\Desktop\gmer.zip
[2010/07/29 08:52:13 | 000,525,824 | ---- | C] () -- C:\Users\James\Desktop\dds.scr
[2010/07/29 08:48:00 | 000,000,020 | ---- | C] () -- C:\Users\James\defogger_reenable
[2010/07/29 08:38:50 | 000,050,477 | ---- | C] () -- C:\Users\James\Desktop\Defogger.exe
[2010/07/28 22:14:58 | 000,000,000 | ---- | C] () -- C:\Users\James\AppData\Local\prvlcl.dat
[2010/07/28 08:22:17 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010/07/27 21:43:11 | 000,002,529 | ---- | C] () -- C:\Users\James\Desktop\HiJackThis.lnk
[2010/07/27 13:28:14 | 000,000,842 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/26 23:55:29 | 000,001,653 | ---- | C] () -- C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2010/07/26 23:55:20 | 063,176,281 | ---- | C] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2010/07/26 23:55:20 | 000,113,461 | ---- | C] () -- C:\Windows\System32\drivers\Avg\iavichjw.avm
[2010/07/26 20:17:43 | 000,001,101 | ---- | C] () -- C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/07/26 20:17:43 | 000,001,077 | ---- | C] () -- C:\Users\James\Desktop\Spybot - Search & Destroy.lnk
[2010/04/02 17:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2009/12/02 20:36:40 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg03RMi.ini
[2009/12/02 20:36:40 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg03RLI.ini
[2009/12/02 20:36:40 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg03FMi.ini
[2009/12/02 20:36:39 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg03DI.ini
[2009/12/02 20:36:39 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg02RMi.ini
[2009/12/02 20:36:39 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg02RLI.ini
[2009/12/02 20:36:38 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg02FMi.ini
[2009/12/02 20:36:38 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg02DI.ini
[2009/12/02 20:36:38 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg01Mic.ini
[2009/12/02 20:36:38 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg01LI.ini
[2009/12/02 20:36:37 | 000,000,453 | R--- | C] () -- C:\Windows\Cfg01DI.ini
[2009/09/24 03:19:54 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/04/03 20:52:58 | 002,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2009/02/10 17:50:18 | 000,000,207 | ---- | C] () -- C:\Windows\cdplayer.ini
[2008/11/21 22:47:52 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/11/21 22:45:16 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2008/11/21 22:45:16 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dpl100.dll.manifest
[2008/11/21 22:44:16 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008/10/17 03:20:56 | 000,032,528 | ---- | C] () -- C:\Windows\System32\t3.ini
[2008/10/17 02:33:50 | 000,150,528 | ---- | C] () -- C:\Windows\System32\OemSpiE.dll
[2008/09/05 11:52:57 | 000,281,504 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008/09/05 11:52:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2008/08/14 21:36:52 | 000,003,126 | ---- | C] () -- C:\Windows\System32\bcmwlhom.ini
[2008/08/08 22:16:30 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2008/08/08 09:24:47 | 000,003,923 | ---- | C] () -- C:\Windows\System32\AudioDrv.ini
[2008/08/08 09:24:36 | 000,000,049 | R--- | C] () -- C:\Windows\System32\ctzapxx.ini
[2008/08/08 09:24:03 | 000,148,480 | ---- | C] () -- C:\Windows\System32\APOMngr.DLL
[2008/08/08 09:24:03 | 000,073,728 | ---- | C] () -- C:\Windows\System32\CmdRtr.DLL
[2008/06/10 15:56:08 | 000,167,936 | ---- | C] () -- C:\Windows\System32\nvccoin.dll
[2008/06/10 15:55:59 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
[2007/07/25 09:08:56 | 000,000,818 | ---- | C] () -- C:\Windows\Cfg01APR.ini
[2007/07/04 04:37:36 | 000,000,932 | ---- | C] () -- C:\Windows\CfgHPDO.ini
[2007/07/04 04:37:28 | 000,001,436 | ---- | C] () -- C:\Windows\CfgHPSp.ini
[2007/07/04 04:37:16 | 000,000,932 | ---- | C] () -- C:\Windows\CfgHPHp.ini
[2007/07/04 04:33:42 | 000,000,725 | ---- | C] () -- C:\Windows\Cfg01Hp.ini
[2007/07/04 04:33:32 | 000,000,725 | ---- | C] () -- C:\Windows\Cfg01DO.ini
[2007/07/04 04:33:24 | 000,001,000 | ---- | C] () -- C:\Windows\Cfg01Sp.ini
[2007/07/04 03:31:14 | 000,001,091 | ---- | C] () -- C:\Windows\Cfg03Sp.ini
[2007/07/04 03:31:08 | 000,000,725 | ---- | C] () -- C:\Windows\Cfg03Hp.ini
[2007/07/04 03:30:58 | 000,000,725 | ---- | C] () -- C:\Windows\Cfg03DO.ini
[2007/07/04 03:29:22 | 000,000,725 | ---- | C] () -- C:\Windows\Cfg02DO.ini
[2007/07/04 03:29:14 | 000,001,091 | ---- | C] () -- C:\Windows\Cfg02Sp.ini
[2007/07/04 03:29:04 | 000,000,725 | ---- | C] () -- C:\Windows\Cfg02Hp.ini
[2007/07/04 03:09:48 | 000,000,932 | ---- | C] () -- C:\Windows\Cfg05DO.ini
[2007/07/04 03:09:48 | 000,000,932 | ---- | C] () -- C:\Windows\Cfg04DO.ini
[2007/07/04 03:09:40 | 000,000,930 | ---- | C] () -- C:\Windows\Cfg05Hp.ini
[2007/07/04 03:09:40 | 000,000,930 | ---- | C] () -- C:\Windows\Cfg04Hp.ini
[2007/07/04 03:08:54 | 000,001,434 | ---- | C] () -- C:\Windows\Cfg05Sp.ini
[2007/07/04 03:08:54 | 000,001,434 | ---- | C] () -- C:\Windows\Cfg04Sp.ini
[2007/06/15 01:41:40 | 000,000,453 | ---- | C] () -- C:\Windows\Cfg05FMi.ini
[2007/06/15 01:41:40 | 000,000,453 | ---- | C] () -- C:\Windows\Cfg04FMi.ini
[2007/06/15 01:41:30 | 000,000,453 | ---- | C] () -- C:\Windows\Cfg05RLI.ini
[2007/06/15 01:41:30 | 000,000,453 | ---- | C] () -- C:\Windows\Cfg04RLI.ini
[2007/06/15 01:41:16 | 000,000,453 | ---- | C] () -- C:\Windows\Cfg05RMi.ini
[2007/06/15 01:41:16 | 000,000,453 | ---- | C] () -- C:\Windows\Cfg04RMi.ini
[2007/06/15 01:40:38 | 000,000,453 | ---- | C] () -- C:\Windows\Cfg05DI.ini
[2007/06/15 01:40:38 | 000,000,453 | ---- | C] () -- C:\Windows\Cfg04DI.ini
[2007/06/01 06:18:46 | 000,000,453 | ---- | C] () -- C:\Windows\CfgHPRMi.ini
[2007/06/01 06:18:44 | 000,000,453 | ---- | C] () -- C:\Windows\CfgHPRLI.ini
[2007/06/01 06:18:38 | 000,000,453 | ---- | C] () -- C:\Windows\CfgHPFMi.ini
[2007/06/01 06:18:32 | 000,000,453 | ---- | C] () -- C:\Windows\CfgHPDI.ini
[2007/05/09 21:35:54 | 000,057,126 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2007/03/29 23:00:40 | 000,203,264 | ---- | C] () -- C:\Windows\System32\CddbCdda.dll
[2006/11/02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[1999/01/27 14:39:06 | 000,065,024 | ---- | C] () -- C:\Windows\System32\indounin.dll
[1997/06/13 08:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\Iyvu9_32.dll

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe


< MD5 for: AGP440.SYS >
[2008/01/21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008/01/21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008/01/21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006/11/02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/04/11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009/04/11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009/04/11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTOR.SYS >
[2007/09/29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\drivers\iaStor.sys
[2007/09/29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_7baf6192\iaStor.sys
[2007/09/29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_41af7b1f\iaStor.sys

< MD5 for: IASTORV.SYS >
[2008/01/21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008/01/21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/04/11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008/01/21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVRAID.SYS >
[2008/01/21 03:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\Windows\System32\drivers\nvraid.sys
[2008/01/21 03:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvraid.sys
[2008/01/21 03:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvraid.sys
[2006/11/02 10:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) MD5=E69E946F80C1C31C53003BFBF50CBB7C -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvraid.sys

< MD5 for: NVRD32.SYS >
[2007/04/19 13:13:00 | 000,131,368 | ---- | M] (NVIDIA Corporation) MD5=1988AF02F581EE0A0A0C4D920B7E272F -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_a8e6d559\nvrd32.sys
[2008/01/17 11:52:24 | 000,134,688 | ---- | M] (NVIDIA Corporation) MD5=685E97008A1601F49707D9A9A89874FE -- C:\Windows\System32\drivers\nvrd32.sys
[2008/01/17 11:52:24 | 000,134,688 | ---- | M] (NVIDIA Corporation) MD5=685E97008A1601F49707D9A9A89874FE -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_19cb4db8\nvrd32.sys
[2007/07/02 17:37:00 | 000,131,616 | ---- | M] (NVIDIA Corporation) MD5=ED399014A8029DE02BA5AE01DA8CC9EE -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_bbf77119\nvrd32.sys
[2007/09/11 15:19:20 | 000,123,424 | ---- | M] (NVIDIA Corporation) MD5=F2ABAB0C99237CE4E97478AF2E0438A0 -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_8225a48e\nvrd32.sys

< MD5 for: NVSTOR.SYS >
[2006/11/02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008/01/21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: NVSTOR32.SYS >
[2008/01/17 11:52:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=279F1F776D6EECFFAA09DA217B4A1C36 -- C:\Windows\System32\drivers\nvstor32.sys
[2008/01/17 11:52:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=279F1F776D6EECFFAA09DA217B4A1C36 -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_19cb4db8\nvstor32.sys
[2007/04/19 13:12:58 | 000,102,696 | ---- | M] (NVIDIA Corporation) MD5=615D79A1D2C98817FF2FDEB1B167D808 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_a195c2b5\nvstor32.sys
[2007/07/02 17:37:00 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_bbf77119\nvstor32.sys
[2008/01/17 11:52:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=76CB39BD08CD9C2933210C34E4F88A0D -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_68098fd2\nvstor32.sys
[2007/09/11 15:19:16 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=8FFB327669B980549BD318D939A34F9B -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_4b699c67\nvstor32.sys
[2007/07/02 17:37:00 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_efe24208\nvstor32.sys
[2007/09/11 15:19:18 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=AFD01721DC3297E6715C5F472DD8BCCD -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_8225a48e\nvstor32.sys
[2007/04/19 13:12:58 | 000,102,696 | ---- | M] (NVIDIA Corporation) MD5=E1C2036823B9E75535051499C61350F6 -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_a8e6d559\nvstor32.sys

< MD5 for: SCECLI.DLL >
[2008/01/21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2010/07/26 23:55:29 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) Unable to obtain MD5 -- C:\Windows\System32\avgrsstx.dll
[2009/07/25 05:23:00 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) Unable to obtain MD5 -- C:\Windows\System32\deploytk.dll
[2009/03/08 12:22:37 | 000,156,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\msls31.dll
[2009/04/11 07:28:23 | 000,286,720 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rasapi32.dll
[2008/01/21 03:24:11 | 000,071,168 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rasman.dll
[2009/04/11 07:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009/04/11 07:28:24 | 000,036,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rtutils.dll
[2006/11/02 10:46:12 | 000,008,704 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SensApi.dll
[2009/04/11 07:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
[2008/01/21 03:24:13 | 000,376,832 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\sxs.dll
[2006/11/02 10:46:13 | 000,191,488 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\tapi32.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/01/21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008/01/21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\drivers\*.sys /90 >
[2010/07/26 23:55:22 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgldx86.sys
[2010/07/26 23:55:21 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys
[2010/07/26 23:55:27 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys
[2010/07/26 21:07:35 | 000,095,024 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
< End of report >




OTL Extras logfile created on: 10/08/2010 15:32:21 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\James\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 44.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 926.52 Gb Total Space | 661.65 Gb Free Space | 71.41% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 5.51 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JAMES-PC
Current User Name: James
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2343792608-1107490366-3230250957-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{486610A3-3883-43EF-97D9-5E1EE1427C1C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{7F678276-823E-4A4A-8BFE-1C404AC897DE}" = lport=2869 | protocol=6 | dir=in | app=system |
"{882FA634-7582-4F01-8E07-FCF617293F35}" = lport=2869 | protocol=6 | dir=in | app=system |
"{9AE6F950-6D97-467D-85FF-D9A83830F12F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{CFEA3709-5417-4BCF-BAD3-85EE915FEDA1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{029B39BF-BD22-4294-BF9F-C1763850DCED}" = dir=in | app=c:\program files\avg\avg9\avgupd.exe |
"{03D694F9-F952-4B18-BE48-402A4EFE56E7}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe |
"{069320C6-087E-4402-8236-C94A2E8BF877}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{0B7B99AD-0519-4D17-84B3-358667B029CE}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{0C16465B-ED94-4090-AB6E-776B82D27474}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's pirates!\pirates!.exe |
"{0FCF7357-0F36-41F0-8DFF-0BDA52506C23}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\silent hunter 3\sh3.exe |
"{13D2C781-5CC6-4471-B4B2-7580F7974F6C}" = protocol=17 | dir=in | app=c:\program files\ubisoft\assassin's creed\assassinscreed_launcher.exe |
"{13D89433-3E54-43FD-BE62-0099EEA2E000}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\mountblade warband\mb_warband.exe |
"{172A4152-10D3-4E5D-833C-CBFAAAD4D2DC}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's pirates!\pirates!.exe |
"{1BB8B56D-1E8A-43F4-BD2D-C4B41DF9C87F}" = protocol=6 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe |
"{21156DA9-8D26-4292-8A93-DA1D1E5014F8}" = protocol=6 | dir=in | app=c:\clear sky\s.t.a.l.k.e.r. - clear sky\bin\dedicated\xrengine.exe |
"{24DF6E8E-F818-480B-9C99-ADA925B8841A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\red faction guerrilla\rfg_launcher.exe |
"{28586838-1D0F-4976-83F4-51E623B0C0F6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\tropico 3\tropico3.exe |
"{2984A28D-B4DB-4837-818F-1EC815CD3B0A}" = protocol=6 | dir=in | app=c:\program files\ubisoft\the settlers 7 - paths to a kingdom\data\base\_dbg\bin\release\settlers7r.exe |
"{2B36149C-230B-44A1-9FEC-7ED997C3A8F2}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\xcom ufo defense\dosbox.exe |
"{2CEEBAE3-BD99-4D2F-BE73-1E7AE66056DF}" = protocol=6 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe |
"{2DDB731F-D447-46F1-8233-3732C22CAA30}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\europa universalis rome\romegame.exe |
"{2ED90FAE-32DA-45AD-9C3A-FBDFAB4E663D}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{33FEF21D-B454-48EB-8A9C-2F5FCE4AA9BD}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
"{343C4BC7-CD68-417B-BFB3-F4F238B15B0C}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\red faction guerrilla\rfg_launcher.exe |
"{3CD15E8B-55E4-409C-A8B2-21B8AE1ED1ED}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{3D7A8F69-09BB-4226-B90C-774591FAC57A}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{3DAE3811-AB89-4238-8EE9-959862A0C2F1}" = protocol=17 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe |
"{490D4D7E-745A-4A0B-87B8-5546384DF079}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\europa universalis rome\romegame.exe |
"{4E271355-4E45-49E9-A891-C2F21BFF1988}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{4E2D239B-7C5E-42AF-A940-214E7CA57245}" = protocol=17 | dir=in | app=c:\clear sky\s.t.a.l.k.e.r. - clear sky\bin\dedicated\xrengine.exe |
"{4E3FE9B2-4FBA-4953-AE85-828B2BCBC8CD}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{4F530411-3CF6-4B66-8D49-3B042291D58A}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\xcom ufo defense\dosbox.exe |
"{51E9C8A6-40C8-4B46-B1C3-4FE2CEB0FC85}" = protocol=17 | dir=in | app=c:\program files\ubisoft\assassin's creed\assassinscreed_dx10.exe |
"{52173025-F372-419B-AA28-94C59E6A4DE5}" = protocol=17 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe |
"{5595899C-3C4E-45A6-B96B-C4D3DD09C963}" = protocol=17 | dir=in | app=c:\program files\ubisoft\assassin's creed\assassinscreed_dx9.exe |
"{58F6881C-18E0-40BA-A4CB-EB75CCBD3F1F}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{5FD74B3F-77FD-47B9-BE11-0C59E8077156}" = protocol=17 | dir=in | app=c:\clear sky\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe |
"{651EE16B-967E-4193-9B46-F2258235FCDD}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{67F7930B-49C1-4F0F-8A9D-D99E1A06B473}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\crysis warhead\bin32\crysis.exe |
"{682FA5DB-98D8-4F91-90BA-51DCC1D13C1B}" = protocol=6 | dir=in | app=c:\s.t.a.l.k.e.r. - clear sky\bin\dedicated\xrengine.exe |
"{69045DBC-1EE2-4917-822E-F7DA771B471B}" = dir=in | app=c:\program files\avg\avg9\avgnsx.exe |
"{6D665E9A-2330-4702-BB2B-355D507E45D3}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{6E1AF700-0E6F-4E26-ABEF-F3A58D21404E}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\europa universalis iii - complete\eu3game.exe |
"{72997E77-6278-4A0A-8E67-C368621F2981}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{79632B70-7982-4C5B-A04F-88A46EB646B4}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{7ED5A03F-5276-42AB-AB7B-1401E4AE28AA}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\silent hunter 3\sh3.exe |
"{901F0763-9B52-47A1-BD02-50D7A836A92A}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\silent hunters wolves of the pacific\sh4.exe |
"{959F7D6B-0DF8-4F4C-A871-928DBC0FDB3C}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\tropico 3\tropico3.exe |
"{9809B436-E93A-458B-883E-7DDC49F598A9}" = protocol=17 | dir=in | app=c:\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe |
"{A3391F0F-44C0-42A9-93C9-F6ACC1F626B6}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{A451B7A8-6178-454C-A345-5B64D4537DF0}" = protocol=6 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe |
"{A8949FA6-96EF-4B6C-838F-36D841DAAF55}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{AB21549C-F3A4-4571-8176-846C38538DFB}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{AB3C79F2-36D8-4538-82EC-FD837FA9001E}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{ABAAC5F2-0EFA-47F4-A7BF-374F2274EB8A}" = protocol=6 | dir=in | app=c:\program files\ubisoft\assassin's creed\assassinscreed_launcher.exe |
"{B0C403C5-19D5-4EB1-8CBE-C6809F2AC707}" = protocol=17 | dir=in | app=c:\program files\ubisoft\the settlers 7 - paths to a kingdom\data\base\_dbg\bin\release\settlers7r.exe |
"{B44FE1A4-9F2A-4336-985B-DB9226EB28E0}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{B4B95E67-AE45-4539-83CA-305A7DC47160}" = protocol=6 | dir=in | app=c:\clear sky\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe |
"{BA9D2E65-AAF8-4800-9F8B-C1A36C340517}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{BCFF4524-4216-4BAC-A891-2CC6881226D0}" = protocol=17 | dir=in | app=c:\program files\deep silver\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe |
"{C77B143B-124F-4DC9-BB58-BEACE1FB8FE7}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\crysis warhead\bin32\crysis.exe |
"{C8464A54-612C-4253-9AD9-4090F82B37CE}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's pirates!\pirates!.exe |
"{C8C5AE26-702D-4EB7-8CA9-28854A69FAEB}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's pirates!\pirates!.exe |
"{CC5E511D-6A95-47D5-9B1C-0E8E933101BB}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\silent hunters wolves of the pacific\sh4.exe |
"{D105D1AD-2921-4CA4-9D53-1C54D76ADF17}" = protocol=6 | dir=in | app=c:\s.t.a.l.k.e.r. - clear sky\bin\xrengine.exe |
"{D17CE4E7-F96B-47BC-9E67-3F0416B720C8}" = protocol=17 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe |
"{D1F05AAB-E242-4F83-B37B-F731E73FA45D}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{D948BBE9-C3AB-472A-A863-DC6F0F32B850}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\mountblade warband\mb_warband.exe |
"{DA741D7F-462A-4965-9B42-018F820A3933}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\jameshall766\counter-strike source\hl2.exe |
"{DF8D5295-FDD8-408F-A3AD-D67D36FB4EDB}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{DFB23F04-DA48-4E6A-9023-06F4D57DCD52}" = protocol=6 | dir=in | app=c:\program files\ubisoft\assassin's creed\assassinscreed_dx10.exe |
"{E215ED04-E47A-4134-9D07-ED29AEDCC09A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\europa universalis iii - complete\eu3game.exe |
"{E40C81C8-CF1D-4610-8931-6DD32987C1B2}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{E96A6251-E251-471E-9F87-7D8EFD5F62EF}" = protocol=6 | dir=in | app=c:\program files\ubisoft\assassin's creed\assassinscreed_dx9.exe |
"{EDAA5678-C3F6-4750-8346-6E9FDBA48CD7}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{F0083BCF-C979-4388-8016-00F20BC3D168}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe |
"{F6D836C9-44D8-4209-938C-69F973BDBA5A}" = protocol=6 | dir=in | app=c:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe |
"{F9EB5B2F-4DA4-4F09-B284-952E36D4039E}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\jameshall766\counter-strike source\hl2.exe |
"{FB059BA5-948F-4F72-9A07-FCC7484AD635}" = protocol=17 | dir=in | app=c:\s.t.a.l.k.e.r. - clear sky\bin\dedicated\xrengine.exe |
"{FC40B742-41AA-4EF2-9C7E-43C8591438F6}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{FDC2E20A-BAA9-4382-9FDA-F85F86CC1792}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"TCP Query User{060125CE-A7FE-43F7-AF93-FAF27C4926A8}C:\program files\steam\steamapps\common\red faction guerrilla\rfg.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\red faction guerrilla\rfg.exe |
"UDP Query User{CD76DF53-20C4-4B31-90C7-5A1985E9E43C}C:\program files\steam\steamapps\common\red faction guerrilla\rfg.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\red faction guerrilla\rfg.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}" = Medieval II Total War : Kingdoms : Crusades
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0C9D0200-FA32-44B7-BBB3-7C03F700C4A0}" = Sound Blaster X-Fi
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{0FD0FF9D-C87C-47C4-AEC5-98C760E783E7}" = BT Voyager Wireless Utility
"{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}" = Nokia Connectivity Cable Driver
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 15
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}" = Adobe Flash Video Encoder
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{3898934B-05AE-41CD-96BE-70DA9BFBCE1F}" = Microsoft XNA Framework Redistributable 3.0
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}" = Nokia PC Suite
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B52140A-F189-4945-BFFC-DB3F00B8C589}" = Adobe Flash CS3
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75983B66-804C-40D1-BA13-64DAF652A6F1}" = Medieval II Total War : Kingdoms : Americas
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}" = Medieval II Total War : Kingdoms : Teutonic
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{9C916142-C18C-429D-BFED-40094A7E0BEB}" = The Settlers 7 - Paths to a Kingdom
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A5D65411-8E73-4C85-AD80-9FE8B7391CF9}" = Rome Total War - patch 1.3
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}" = Medieval II Total War : Kingdoms : Britannia
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{D848D140-41C3-4A53-86D8-E866A100B4CD}" = PC Connectivity Solution
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFC1ADE3-944B-4231-894E-3903C37271D2}" = Adobe Setup
"0C5EDC3653FED5B121F464339EAC12534D253B25" = Windows Driver Package - Nokia Modem (02/15/2007 3.1)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"5986551A16FD8E9B1B4C89E7AAD17C1BB3196D28" = Windows Driver Package - Nokia Modem (10/27/2008 7.01.0.1)
"6D296974BAB6CA8429D5E687B292A6DA3E9FBD4A" = Windows Driver Package - Nokia Modem (10/27/2008 3.9)
"7-Zip" = 7-Zip 4.57
"8461-7759-5462-8226" = Vuze
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_c3c7fe8b09d497ab2b3fd91c9353390" = Adobe Flash CS3 Professional
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"ALchemy" = Creative ALchemy
"AudioCS" = Creative Audio Control Panel
"AVG9Uninstall" = AVG Free 9.0
"B726756F5B5A5AA9D798B399386FC6205A45F19E" = Windows Driver Package - Nokia Modem (02/15/2007 3.1)
"Broken Crescent" = Broken Crescent
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"CCleaner" = CCleaner
"CD8424B9400BFF7D34AA18F816C71322AC4BDAA7" = Windows Driver Package - Nokia Modem (05/24/2007 6.84.0.1)
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties" = Creative Sound Blaster Properties
"DivX Setup.divx.com" = DivX Setup
"EADM" = EA Download Manager
"EB Trivial Script_is1" = EB Trivial Script 0.125
"EVE" = EVE Online (remove only)
"EVEMon" = EVEMon
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Fallout Mod Manager_is1" = Fallout Mod Manager 0.12.3
"Game Booster_is1" = Game Booster
"Google Updater" = Google Updater
"Host OpenAL" = Host OpenAL
"IL Download Manager" = IL Download Manager
"Logitech Print Service" = Logitech Print Service
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mount&Blade Warband" = Mount&Blade Warband
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PoiZone" = PoiZone
"PROHYBRIDR" = 2007 Microsoft Office system
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 6.0" = RealPlayer
"Shockwave" = Shockwave
"Steam App 15200" = Silent Hunter: Wolves of the Pacific
"Steam App 15210" = Silent Hunter III
"Steam App 20500" = Red Faction: Guerrilla
"Steam App 23420" = Europa Universalis: Rome - Gold Edition
"Steam App 23440" = Europa Universalis: Rome - Vae Victis
"Steam App 23490" = Tropico 3 - Steam Special Edition
"Steam App 240" = Counter-Strike: Source
"Steam App 25800" = Europa Universalis III: Complete
"Steam App 3920" = Sid Meier's Pirates!
"Steam App 48700" = Mount&Blade: Warband
"Steam App 550" = Left 4 Dead 2
"Steam App 7760" = X-COM: UFO Defense
"SystemRequirementsLab" = System Requirements Lab
"The Eagle and the Radiant Cross" = The Eagle and the Radiant Cross Ch. 3
"Toxic Biohazard" = Toxic Biohazard
"Unofficial Oblivion Patch_is1" = Unofficial Oblivion Patch v3.0.0
"v1.0.9" = v1.0.9 of A Proper Empire: Terra Incognita
"Vtune_is1" = Vtune 6.4
"Vuze_Remote Toolbar" = Vuze_Remote Toolbar
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Xenocide" = Xenocide 0.4
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2343792608-1107490366-3230250957-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"DLV Europa Part 1" = DLV Europa Part 1
"DLV Europa Part 2" = DLV Europa Part 2
"Stainless_Steel_6.0_Part1of2" = Stainless_Steel_6.0_Part1of2
"Stainless_Steel_6.0_Part2of2" = Stainless_Steel_6.0_Part2of2
"Terra Nova mod" = Terra Nova mod

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 13/01/2010 23:20:39 | Computer Name = James-PC | Source = WinMgmt | ID = 10
Description =

Error - 16/01/2010 11:31:01 | Computer Name = James-PC | Source = WinMgmt | ID = 10
Description =

Error - 16/01/2010 11:54:52 | Computer Name = James-PC | Source = WinMgmt | ID = 10
Description =

Error - 17/01/2010 02:49:10 | Computer Name = James-PC | Source = Google Update | ID = 20
Description =

Error - 17/01/2010 03:49:10 | Computer Name = James-PC | Source = Google Update | ID = 20
Description =

Error - 17/01/2010 04:49:10 | Computer Name = James-PC | Source = Google Update | ID = 20
Description =

Error - 17/01/2010 05:49:10 | Computer Name = James-PC | Source = Google Update | ID = 20
Description =

Error - 17/01/2010 06:49:10 | Computer Name = James-PC | Source = Google Update | ID = 20
Description =

Error - 17/01/2010 07:49:10 | Computer Name = James-PC | Source = Google Update | ID = 20
Description =

Error - 22/01/2010 23:19:38 | Computer Name = James-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 09/08/2010 04:38:50 | Computer Name = James-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 09/08/2010 14:47:14 | Computer Name = James-PC | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 09/08/2010 14:47:28 | Computer Name = James-PC | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 09/08/2010 14:47:52 | Computer Name = James-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 09/08/2010 14:51:01 | Computer Name = James-PC | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 09/08/2010 14:51:12 | Computer Name = James-PC | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 09/08/2010 14:51:23 | Computer Name = James-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 10/08/2010 04:50:01 | Computer Name = James-PC | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 10/08/2010 04:50:16 | Computer Name = James-PC | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 10/08/2010 04:50:30 | Computer Name = James-PC | Source = Service Control Manager | ID = 7026
Description =


< End of report >


#4 jame770

jame770
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:59 AM

Posted 10 August 2010 - 09:54 AM

A quick recap on the problems and ways Ive tried to resolve them.

I get random audio adverts playing from an unkown source. These adverts appear more often when i use online streaming, or at least it appears that way.

I have used many free virus/maleware removers to try and fix this. This hasnt worked despite them telling me my system is clean.

Since I have made my first post here I havnt really made any more attempts to fix this so my pc logs should be about the same. I have run programs for general cleaning purposes.

Thats about it, thanks again for the help.

#5 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:08:59 AM

Posted 10 August 2010 - 11:14 AM

Hi,

please run MBRCheck next:
Please download MBRCheck.exe to your desktop.
  1. Double click to run it
  2. It will prompt you with some text
  3. Left click on title bar (where program name and path is written)
  4. From menu chose Edit -> Select All
  5. Now just click Enter key on keyboard to copy selected text
  6. Now paste that text here for me.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#6 jame770

jame770
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:59 AM

Posted 11 August 2010 - 11:32 AM

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Micro-Star International Co.,LTD
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: Micro-Star International Co.,LTD
System Product Name: MS-7510
Logical Drives Mask: 0x00000015

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000001`40100000 (NTFS)

Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0

#7 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:08:59 AM

Posted 12 August 2010 - 04:11 PM

Hi,

was this the complete log you got? Or did it get cut off?

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#8 jame770

jame770
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:59 AM

Posted 12 August 2010 - 04:24 PM

That is all i get from it. Im also unable to close it when Im finished...?

#9 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:08:59 AM

Posted 12 August 2010 - 04:33 PM

Hi,

it seems that the program is unable to complete the run. I'll see what I can find out.

Please run this instead:
Download Bootkit Remover to your desktop.
Note: This is a rar file if you do not have a program to open it then download and install Peazip
  • Extract Remover.exe to your desktop
  • Right click Remover.exe and select Run as Administrator (Vista) or Double click Remover.exe to run it (XP) <--- remove the one you don't need
  • It will show a Black screen with some data on it
  • Right click on the screen and select > Select All
  • Press Control + C <--- This will copy the contents of the screen to your clipboard.
  • Go to Start > Run > Notepad.exe (followed by enter) and press Control + V to paste the contents of your clipboard into the notepad window.
  • Post the resultant log here please.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#10 jame770

jame770
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:59 AM

Posted 13 August 2010 - 04:06 AM

Hi

I just noticed a file saved on the desktop. I think its the MRBcheck log you requested. Although the program seemed to not work as instructed, it must have worked and saved the log automaticaly to the desktop. So here it is....

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Micro-Star International Co.,LTD
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: Micro-Star International Co.,LTD
System Product Name: MS-7510
Logical Drives Mask: 0x00000015

Kernel Drivers (total 157):
0x82048000 \SystemRoot\system32\ntoskrnl.exe
0x82015000 \SystemRoot\system32\hal.dll
0x82804000 \SystemRoot\system32\kdcom.dll
0x8280B000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8287B000 \SystemRoot\system32\PSHED.dll
0x8288C000 \SystemRoot\system32\BOOTVID.dll
0x82894000 \SystemRoot\system32\CLFS.SYS
0x828D5000 \SystemRoot\system32\CI.dll
0x829B5000 \SystemRoot\system32\drivers\Wdf01000.sys
0x82A31000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x82A3E000 \SystemRoot\system32\drivers\acpi.sys
0x82A84000 \SystemRoot\system32\drivers\WMILIB.SYS
0x82A8D000 \SystemRoot\system32\drivers\msisadrv.sys
0x82A95000 \SystemRoot\system32\drivers\pci.sys
0x82ABC000 \SystemRoot\System32\drivers\partmgr.sys
0x82ACB000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x82ACE000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x82AD8000 \SystemRoot\system32\drivers\volmgr.sys
0x82AE7000 \SystemRoot\System32\drivers\volmgrx.sys
0x82B31000 \SystemRoot\system32\drivers\pciide.sys
0x82B38000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x82B46000 \SystemRoot\system32\drivers\nvrd32.sys
0x82B69000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x82B8A000 \SystemRoot\System32\drivers\mountmgr.sys
0x82B9A000 \SystemRoot\system32\drivers\nvraid.sys
0x82BB5000 \SystemRoot\system32\drivers\atapi.sys
0x82BBD000 \SystemRoot\system32\drivers\ataport.SYS
0x82BDB000 \SystemRoot\system32\drivers\nvstor32.sys
0x8A405000 \SystemRoot\system32\drivers\storport.sys
0x8A446000 \SystemRoot\system32\DRIVERS\jraid.sys
0x8A452000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x8A478000 \SystemRoot\system32\drivers\fltmgr.sys
0x8A4AA000 \SystemRoot\system32\drivers\fileinfo.sys
0x8A4BA000 \SystemRoot\system32\drivers\siwinacc.sys
0x8A4BD000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8A52E000 \SystemRoot\system32\drivers\ndis.sys
0x8A639000 \SystemRoot\system32\drivers\msrpc.sys
0x8A664000 \SystemRoot\system32\drivers\NETIO.SYS
0x8A69F000 \SystemRoot\System32\drivers\tcpip.sys
0x8A789000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8A806000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8A916000 \SystemRoot\system32\drivers\wd.sys
0x8A91E000 \SystemRoot\system32\drivers\volsnap.sys
0x8A957000 \SystemRoot\system32\DRIVERS\uagp35.sys
0x8A968000 \SystemRoot\System32\Drivers\spldr.sys
0x8A970000 \SystemRoot\system32\drivers\siremfil.sys
0x8A972000 \SystemRoot\System32\Drivers\mup.sys
0x8A981000 \SystemRoot\system32\drivers\jgogo.sys
0x8A983000 \SystemRoot\System32\drivers\ecache.sys
0x8A9AA000 \SystemRoot\system32\drivers\disk.sys
0x8A9BB000 \SystemRoot\system32\drivers\crcdisk.sys
0x8A9D1000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8A9DC000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8A9E5000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8EC0D000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8F715000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x8F717000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8F7B8000 \SystemRoot\System32\drivers\watchdog.sys
0x8F7C4000 \SystemRoot\system32\DRIVERS\serial.sys
0x8F7DE000 \SystemRoot\system32\DRIVERS\serenum.sys
0x8F7E8000 \SystemRoot\system32\DRIVERS\fdc.sys
0x8F7F3000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8A9F4000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8AA32000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8AA41000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8AA59000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
0x8AB56000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8AB66000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8FC0F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8FC9C000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8FCCB000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8FCD6000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8FCED000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8FCF8000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8FD1B000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8FD2A000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8FD3E000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8FD53000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8FD63000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8FD6E000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8FD79000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8FD7B000 \SystemRoot\system32\DRIVERS\ks.sys
0x8FDA5000 \SystemRoot\system32\DRIVERS\AmdLLD.sys
0x8FDB4000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8FDBE000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8FDCB000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0x8FDD5000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8FE0A000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8FE26000 \SystemRoot\system32\drivers\t3.sys
0x8FE8D000 \SystemRoot\system32\drivers\portcls.sys
0x8FEBA000 \SystemRoot\system32\drivers\drmk.sys
0x8FEDF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8FEE8000 \SystemRoot\System32\Drivers\Null.SYS
0x8FEEF000 \SystemRoot\System32\Drivers\Beep.SYS
0x8FF12000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8FF19000 \SystemRoot\System32\Drivers\Razerlow.sys
0x8FF1D000 \SystemRoot\System32\drivers\vga.sys
0x8FF29000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8FF4A000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8FF53000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8FF63000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8FF65000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8FF6D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8FF75000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8FF7D000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8FF88000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8FF96000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8FF9F000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8FFB5000 \SystemRoot\system32\DRIVERS\smb.sys
0x8AB74000 \SystemRoot\System32\Drivers\avgtdix.sys
0x8FFC9000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8FFE0000 \SystemRoot\system32\drivers\LVUSBSta.sys
0x9080F000 \SystemRoot\system32\DRIVERS\LV302V32.SYS
0x90946000 \SystemRoot\System32\DRIVERS\netbt.sys
0x90978000 \SystemRoot\system32\DRIVERS\lv302af.sys
0x9097A000 \SystemRoot\system32\drivers\afd.sys
0x909C2000 \SystemRoot\system32\drivers\usbaudio.sys
0x909D4000 \SystemRoot\system32\DRIVERS\pacer.sys
0x909EA000 \SystemRoot\system32\DRIVERS\netbios.sys
0x909F8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x90A0B000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x90A47000 \SystemRoot\system32\drivers\nsiproxy.sys
0x90A51000 \SystemRoot\System32\Drivers\dfsc.sys
0x90A68000 \SystemRoot\System32\Drivers\avgmfx86.sys
0x90A6E000 \SystemRoot\System32\Drivers\avgldx86.sys
0x90AA2000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x90AAB000 \SystemRoot\system32\DRIVERS\udfs.sys
0x93070000 \SystemRoot\System32\win32k.sys
0x90AF3000 \SystemRoot\System32\drivers\Dxapi.sys
0x90AFD000 \SystemRoot\system32\DRIVERS\monitor.sys
0x93290000 \SystemRoot\System32\TSDDD.dll
0x932B0000 \SystemRoot\System32\cdd.dll
0x90B0C000 \SystemRoot\system32\drivers\luafv.sys
0x90B27000 \SystemRoot\system32\drivers\spsys.sys
0x90BD7000 \SystemRoot\system32\DRIVERS\AegisP.sys
0x90BDB000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8ABAE000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x90BEB000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8FFE9000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x90BF5000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0xA3005000 \SystemRoot\system32\drivers\HTTP.sys
0xA3072000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xA308F000 \SystemRoot\system32\DRIVERS\bowser.sys
0xA30A8000 \SystemRoot\System32\drivers\mpsdrv.sys
0xA30BD000 \SystemRoot\system32\drivers\mrxdav.sys
0xA30DE000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA30FD000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xA3136000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA314E000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA3175000 \SystemRoot\System32\DRIVERS\srv.sys
0xA31C3000 \SystemRoot\System32\Drivers\TBPanel.SYS
0xA31C5000 \SystemRoot\system32\DRIVERS\atksgt.sys
0xA3208000 \SystemRoot\system32\DRIVERS\lirsgt.sys
0xA320D000 \SystemRoot\system32\drivers\peauth.sys
0xA32EB000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA32F5000 \SystemRoot\System32\drivers\tcpipreg.sys
0x77C70000 \Windows\System32\ntdll.dll

Processes (total 70):
0 System Idle Process
4 System
412 C:\Windows\System32\smss.exe
480 csrss.exe
548 C:\Windows\System32\wininit.exe
560 csrss.exe
568 C:\Program Files\AVG\AVG9\avgchsvx.exe
576 C:\Program Files\AVG\AVG9\avgrsx.exe
648 C:\Program Files\AVG\AVG9\avgcsrvx.exe
688 C:\Windows\System32\winlogon.exe
720 C:\Windows\System32\services.exe
732 C:\Windows\System32\lsass.exe
916 C:\Windows\System32\lsm.exe
1076 C:\Windows\System32\svchost.exe
1200 C:\Windows\System32\svchost.exe
1244 C:\Windows\System32\nvvsvc.exe
1276 C:\Windows\System32\svchost.exe
1420 C:\Windows\System32\svchost.exe
1444 C:\Windows\System32\svchost.exe
1456 C:\Windows\System32\svchost.exe
1532 C:\Windows\System32\svchost.exe
1556 C:\Windows\System32\audiodg.exe
1580 C:\Windows\System32\svchost.exe
1596 C:\Windows\System32\SLsvc.exe
1628 C:\Windows\System32\svchost.exe
1740 C:\Windows\System32\nvvsvc.exe
1864 C:\Windows\System32\svchost.exe
2044 C:\Windows\System32\wltrysvc.exe
208 C:\Windows\System32\bcmwltry.exe
540 C:\Windows\System32\spoolsv.exe
704 C:\Windows\System32\svchost.exe
2096 C:\Program Files\AVG\AVG9\avgwdsvc.exe
2256 C:\Windows\System32\dwm.exe
2284 C:\Windows\System32\taskeng.exe
2320 C:\Windows\System32\taskeng.exe
2336 C:\Windows\explorer.exe
2460 C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
2504 C:\Program Files\Bonjour\mDNSResponder.exe
2540 C:\Program Files\Creative\Shared Files\CTAudSvc.exe
2552 C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
2896 C:\Windows\System32\PnkBstrA.exe
2928 C:\Windows\System32\PnkBstrB.exe
2940 C:\Windows\System32\svchost.exe
2996 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
3012 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
3048 C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
3080 C:\Windows\System32\svchost.exe
3112 C:\Windows\System32\svchost.exe
3156 C:\Windows\System32\SearchIndexer.exe
3340 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
3472 C:\Program Files\AVG\AVG9\avgnsx.exe
332 C:\Program Files\AVG\AVG9\avgtray.exe
2172 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
2032 C:\Program Files\Windows Sidebar\sidebar.exe
436 C:\Windows\ehome\ehtray.exe
1404 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
2580 C:\Program Files\Windows Media Player\wmpnscfg.exe
2528 C:\Windows\ehome\ehmsas.exe
3596 C:\Program Files\Windows Media Player\wmpnetwk.exe
4396 C:\Windows\System32\wbem\unsecapp.exe
4424 WmiPrvSE.exe
5484 C:\Program Files\Mozilla Firefox\firefox.exe
5844 C:\Program Files\Windows Live\Contacts\wlcomm.exe
6020 C:\Program Files\Steam\Steam.exe
4672 C:\Windows\System32\svchost.exe
4240 C:\Program Files\Mozilla Firefox\plugin-container.exe
5408 C:\Windows\System32\SearchProtocolHost.exe
4836 C:\Windows\System32\SearchFilterHost.exe
4968 C:\Windows\System32\dllhost.exe
4136 C:\Users\James\Downloads\MBRCheck(2).exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000001`40100000 (NTFS)

PhysicalDrive0 Model Number: NVIDIASTRIPE 931.52G, Rev:

Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0

#11 jame770

jame770
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:59 AM

Posted 13 August 2010 - 04:11 AM

Here is the Bootkit Remover info.

Bootkit Remover
© 2009 eSage Lab
www.esagelab.com

Program version: 1.1.0.0
OS Version: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6
002), 32-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000001`40100000
Boot sector MD5 is: 5771aa7e72a3c465a71c7cdc26527472

Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>


Done;
Press any key to quit...


#12 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:08:59 AM

Posted 13 August 2010 - 09:23 AM

Hi,

thanks for running that. smile.gif

I would like you to run the following tool and post the log it creates: http://ad13.geekstogo.com/MBRCheck_beta.exe

It should hopefully give us an explanation as to why MBRCheck is hanging.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#13 jame770

jame770
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:59 AM

Posted 13 August 2010 - 11:15 AM

Log edited out at author's request

Edited by myrti, 13 August 2010 - 03:46 PM.


#14 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:08:59 AM

Posted 13 August 2010 - 03:52 PM

Thanks for posting! smile.gif

I have contacted the author and will let you know about the next step shortly.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#15 jame770

jame770
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:59 AM

Posted 16 August 2010 - 01:23 PM

Hi, I believe my computer is all fixed now. On the weekend I managed to accidently screw up my pc so bad I had to pay someone £60 to fix it. I mentioned this audio virus and the guy said my pc has been completely wiped clean now, so it shouldnt be an issue anymore.

If it does reappear, I expect I'd have to start a new thread with new logs as its all changed.

Either way, thanks for the help you gave me.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users