Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Think I cleared and infection, but not 100% sure, hijacthis attached.


  • This topic is locked This topic is locked
17 replies to this topic

#1 jarheadchoag

jarheadchoag

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 14 February 2011 - 12:48 AM

I got a virus posing as anti-virus, killed it before it went nuts, but want to make sure I'm clean. Please let me know if you see anything. Here's my hijakthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:46:32 PM, on 2/13/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19019)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Windows\V0220Mon.exe
C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
C:\Program Files (x86)\AVG\AVG9\avgtray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files (x86)\iTunes\iTunes.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:18810
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [V0220Mon.exe] C:\Windows\V0220Mon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime] B:\Documents\Sex\msdtc.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [BrMfcWnd] "C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] "C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe" /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5493/mcfscan.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Unknown owner - C:\Windows\system32\AEADISRV.EXE (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9665 bytes


Thanks guys, you've always been awesome.

Edited by Blade Zephon, 14 February 2011 - 07:13 AM.
Moved to Log Forum. ~BZ


BC AdBot (Login to Remove)

 


#2 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:09 PM

Posted 19 February 2011 - 11:28 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process. Please also continue to work with me until I give you the all clear. Even if your computer appears to act better, you may still be infected.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.

Once we start working together, please reply back within 3 days or this thread may be closed so we can help others who are waiting.

We need to create an OTL report,
  • Please download OTL from this link.
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Under the Custom Scan box paste this in:

    netsvcs
    msconfig
    drivers32 /all
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\system32\*.sys /90
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
    %systemroot%\*. /mp /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    CREATERESTOREPOINT

  • Click the Quick Scan button.
  • The scan should take a few minutes.
  • Please copy and paste both logs in your reply.


In your reply, please post both OTL logs.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#3 jarheadchoag

jarheadchoag
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 19 February 2011 - 02:18 PM

Here you go, thanks.
OTL logfile created on: 2/19/2011 11:07:36 AM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Jared and Caz\Desktop
64bit-Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 48.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 186.31 Gb Total Space | 41.77 Gb Free Space | 22.42% Space Free | Partition Type: NTFS
Drive E: | 662.68 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 3.74 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: JARCAZDESKTOP | User Name: Jared and Caz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/02/19 11:06:58 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Jared and Caz\Desktop\OTL.exe
PRC - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/12/18 13:02:28 | 000,274,608 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2010/11/24 19:23:35 | 002,069,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgtray.exe
PRC - [2010/11/24 19:23:27 | 000,725,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
PRC - [2010/07/20 15:51:40 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe
PRC - [2010/07/17 19:57:50 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
PRC - [2010/05/14 10:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2010/01/15 19:09:37 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2008/01/28 10:43:32 | 000,810,320 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2007/05/28 08:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2007/04/02 23:32:52 | 001,261,568 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
PRC - [2007/03/29 11:29:10 | 003,276,800 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
PRC - [2006/11/17 01:02:00 | 000,032,768 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\V0220Mon.exe


========== Modules (SafeList) ==========

MOD - [2011/02/19 11:06:58 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Jared and Caz\Desktop\OTL.exe
MOD - [2010/12/18 13:02:41 | 000,040,448 | ---- | M] (RealNetworks, Inc.) -- C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
MOD - [2010/12/18 13:02:24 | 000,655,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada\msvcr90.dll
MOD - [2010/12/18 13:02:24 | 000,572,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada\msvcp90.dll
MOD - [2010/08/31 07:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2008/01/19 00:06:50 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2007/02/06 05:45:30 | 000,080,384 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\AEADISRV.EXE -- (AEADIFilters)
SRV - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/07/20 15:51:40 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/17 19:57:50 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2009/04/04 19:42:50 | 000,316,664 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2009/03/29 20:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/03/11 20:36:25 | 000,066,872 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2008/01/28 10:43:32 | 000,810,320 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2007/05/28 08:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2010/09/28 15:44:52 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/07/17 19:58:00 | 000,317,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgtdia.sys -- (AvgTdiA)
DRV:64bit: - [2010/07/17 19:57:44 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgldx64.sys -- (AvgLdx64)
DRV:64bit: - [2010/06/02 17:36:50 | 000,035,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\Drivers\avgmfx64.sys -- (AvgMfx64)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008/12/03 09:38:46 | 000,868,848 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd)
DRV:64bit: - [2008/01/18 23:11:31 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2008/01/18 23:09:56 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\serscan.sys -- (StillCam)
DRV:64bit: - [2008/01/18 22:47:12 | 000,046,080 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2007/09/13 20:40:34 | 000,060,184 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmXlCore.sys -- (WmXlCore)
DRV:64bit: - [2007/09/13 20:40:26 | 000,015,768 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmVirHid.sys -- (WmVirHid)
DRV:64bit: - [2007/09/13 20:40:08 | 000,034,456 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmFilter.sys -- (WmFilter)
DRV:64bit: - [2007/09/13 20:40:00 | 000,022,040 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmBEnum.sys -- (WmBEnum)
DRV:64bit: - [2007/08/15 15:19:42 | 000,208,352 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\V0220Dev.sys -- (V0220Dev)
DRV:64bit: - [2007/06/20 19:57:36 | 000,029,184 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\motmodem.sys -- (motmodem)
DRV:64bit: - [2007/04/03 15:30:46 | 000,420,864 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV:64bit: - [2007/03/05 18:55:48 | 000,012,288 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\V0220Vfx.sys -- (V0220Vfx)
DRV:64bit: - [2006/12/12 21:20:30 | 000,229,160 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\RTL8187.sys -- (RTL8187)
DRV:64bit: - [2006/11/01 05:33:34 | 000,022,832 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\siwinacc.sys -- (SiFilter)
DRV:64bit: - [2006/11/01 05:33:24 | 000,017,200 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\siremfil.sys -- (SiRemFil)
DRV:64bit: - [2006/11/01 05:33:00 | 000,109,872 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\si3132.sys -- (SI3132)
DRV:64bit: - [2006/10/31 07:23:42 | 000,015,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2006/09/18 13:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\Wbem\ntfs.mof -- (Ntfs)
DRV - [2006/12/12 21:20:30 | 000,229,160 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\rtl8187.sys -- (RTL8187)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 E0 24 54 7D 0A CB 01 [binary data]
IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:18810

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com|www.instapundit.com|http://www.facebook.com/profile.php?id=1259410483&ref=profile|http://www.google.com/ig?refresh=1|https://secure.lds.org/units/home/1,9781,600-1-7-20818,00.html"
FF - prefs.js..extensions.enabledItems: amznUWL@amazon.com:1.0
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000006
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.1
FF - prefs.js..extensions.enabledItems: enquiries@retailmenot.com:2.4
FF - prefs.js..extensions.enabledItems: AmazonHotStuff@wangtom.com:1.1.1
FF - prefs.js..extensions.enabledItems: firefox@facebook.com:1.6
FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.22.4


FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2010/11/24 19:24:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/12/18 13:02:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/02/13 20:09:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/02/13 20:09:42 | 000,000,000 | ---D | M]

[2008/08/27 21:27:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Extensions
[2011/01/16 22:35:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions
[2009/07/02 21:30:31 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/11 04:22:44 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/01/16 22:35:03 | 000,000,000 | ---D | M] (Amazon Button) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\AmazonHotStuff@wangtom.com
[2010/01/23 10:36:19 | 000,000,000 | ---D | M] (Amazon Wish List) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\amznUWL@amazon.com
[2011/01/16 22:35:04 | 000,000,000 | ---D | M] (RetailMeNot) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\enquiries@retailmenot.com
[2011/01/16 22:35:00 | 000,000,000 | ---D | M] (شريط أدوات Ùيس بوك) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\firefox@facebook.com
[2011/01/16 22:34:55 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\foxyproxy@eric.h.jung
[2009/04/05 08:24:23 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\moveplayer@movenetworks.com
[2011/02/13 20:09:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/06/10 18:52:54 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/18 06:30:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/13 08:38:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/11/24 19:24:05 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES (X86)\AVG\AVG9\FIREFOX
[2010/12/18 13:02:41 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2009/11/19 13:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/09/15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/19 13:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
[2008/09/28 09:29:27 | 000,284,248 | ---- | M] (Musicnotes, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npmusicn.dll

O1 HOSTS File: ([2009/01/07 09:26:33 | 000,229,841 | R--- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.1001-search.info
O1 - Hosts: 127.0.0.1 1001-search.info
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 8060 more lines...
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [QuickTime] B:\Documents\Sex\msdtc.exe (MS)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [V0220Mon.exe] C:\Windows\V0220Mon.exe (Creative Technology Ltd.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000..\Run: [AlcoholAutomount] C:\Program Files (x86)\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000..\Run: [WMPNSCFG] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5493/mcfscan.cab (McFreeScan Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: B:\Pictures\100_1116.JPG
O24 - Desktop BackupWallPaper: B:\Pictures\100_1116.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/08/14 08:32:04 | 000,000,000 | ---D | M] - E:\Autorun -- [ CDFS ]
O32 - AutoRun File - [2007/06/14 15:23:01 | 000,263,744 | R--- | M] (Firaxis Games) - E:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2007/07/17 09:11:01 | 000,006,299 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2006/10/05 15:20:43 | 000,000,044 | R--- | M] () - F:\Autorun.inf -- [ UDF ]
O33 - MountPoints2\{2078a8d9-2f99-11df-9d3c-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{2078a8d9-2f99-11df-9d3c-000c41e26750}\Shell\AutoRun\command - "" = R:\LaunchU3.exe -a
O33 - MountPoints2\{59d7eb5d-0aaf-11dd-aaa3-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{59d7eb5d-0aaf-11dd-aaa3-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe -- [2007/06/14 15:23:01 | 000,263,744 | R--- | M] (Firaxis Games)
O33 - MountPoints2\{6a8fcc81-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcc81-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = F:\Launch.exe -- [2006/10/05 15:20:43 | 000,126,976 | R--- | M] (Macrovision Corporation)
O33 - MountPoints2\{6a8fcca1-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca1-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = H:\Launch.exe
O33 - MountPoints2\{6a8fcca2-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca2-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = I:\autorun.exe
O33 - MountPoints2\{6a8fcca3-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca3-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = J:\Autorun\UbiAutorun.exe
O33 - MountPoints2\{6a8fcca4-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca4-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = K:\Autorun.exe
O33 - MountPoints2\{6a8fcca5-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca5-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = L:\Autorun.exe
O33 - MountPoints2\{6a8fcca6-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca6-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = M:\SETUP.EXE
O33 - MountPoints2\{6a8fcca7-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca7-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = N:\SETUP.EXE
O33 - MountPoints2\{6a8fcca8-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca8-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = O:\Autorun.exe
O33 - MountPoints2\{c53d9e7a-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e7a-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = F:\autorun.exe
O33 - MountPoints2\{c53d9e91-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e91-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = G:\Launch.exe
O33 - MountPoints2\{c53d9e92-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e92-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = H:\Autorun.exe
O33 - MountPoints2\{c53d9e93-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e93-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = I:\Autorun.exe
O33 - MountPoints2\{c53d9e94-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e94-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = J:\autorun.exe
O33 - MountPoints2\{e4aa29be-02bc-11df-8457-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{e4aa29be-02bc-11df-8457-000c41e26750}\Shell\AutoRun\command - "" = P:\autorun.exe
O33 - MountPoints2\{e5eda2bd-0ac0-11de-a718-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{e5eda2bd-0ac0-11de-a718-000c41e26750}\Shell\AutoRun\command - "" = Q:\LaunchU3.exe -a
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Launch.exe
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\Autorun.exe
O33 - MountPoints2\J\Shell - "" = AutoRun
O33 - MountPoints2\J\Shell\AutoRun\command - "" = J:\autorun.exe
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\Autorun\UbiAutorun.exe
O33 - MountPoints2\Q\Shell - "" = AutoRun
O33 - MountPoints2\Q\Shell\AutoRun\command - "" = Q:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*


MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: BitTorrent DNA - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: TkBellExe - hkey= - key= - File not found
MsConfig:64bit - State: "startup" - Reg Error: Key error.

Drivers32:64bit: aux - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: midi - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: midimapper - midimap.dll (Microsoft Corporation)
Drivers32:64bit: mixer - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: msacm.imaadpcm - imaadp32.acm (Microsoft Corporation)
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: msacm.msadpcm - msadp32.acm (Microsoft Corporation)
Drivers32:64bit: msacm.msg711 - msg711.acm (Microsoft Corporation)
Drivers32:64bit: msacm.msgsm610 - msgsm32.acm (Microsoft Corporation)
Drivers32:64bit: MSVideo8 - VfWWDM32.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.I420 - File not found
Drivers32:64bit: VIDC.IYUV - iyuv_32.dll (Microsoft Corporation)
Drivers32:64bit: vidc.mrle - msrle32.dll (Microsoft Corporation)
Drivers32:64bit: vidc.msvc - msvidc32.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.UYVY - msyuv.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.YUY2 - msyuv.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.YVU9 - tsbyuv.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.YVYU - msyuv.dll (Microsoft Corporation)
Drivers32:64bit: wave - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: wavemapper - msacm32.drv (Microsoft Corporation)
Drivers32: aux - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\SysWow64\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.ac3acm - C:\Windows\SysWow64\AC3ACM.acm (fccHandler)
Drivers32: msacm.alf2cd - C:\Windows\SysWow64\alf2cd.acm (NCT Company)
Drivers32: msacm.imaadpcm - C:\Windows\SysWow64\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\SysWow64\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\SysWow64\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\SysWow64\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.scg726 - C:\Windows\SysWow64\Scg726.acm (SHARP Corporation)
Drivers32: msacm.voxacm160 - C:\Windows\SysWow64\vct3216.acm (Voxware, Inc.)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\divx.dll (DivXNetworks, Inc.)
Drivers32: vidc.dvsd - C:\Windows\SysWow64\mcdvd_32.dll (MainConcept)
Drivers32: vidc.i420 - C:\Windows\SysWow64\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.iyuv - C:\Windows\SysWow64\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mp42 - C:\Windows\SysWow64\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mp43 - C:\Windows\SysWow64\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mpg4 - C:\Windows\SysWow64\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\SysWow64\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\SysWow64\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.xvid - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yuy2 - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvu9 - C:\Windows\SysWow64\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\SysWow64\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/02/19 11:07:01 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Jared and Caz\Desktop\OTL.exe
[2011/02/13 20:09:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2011/01/28 16:54:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/01/28 16:54:07 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/01/28 16:54:06 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2009/06/13 21:54:54 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Jared and Caz\AppData\Roaming\pcouffin.sys
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/02/19 11:11:10 | 000,000,434 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{2B6A9691-62FD-4ACB-8142-577060AE1D21}.job
[2011/02/19 11:06:58 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Jared and Caz\Desktop\OTL.exe
[2011/02/19 10:16:44 | 000,000,000 | ---- | M] () -- C:\Users\Jared and Caz\AppData\Local\prvlcl.dat
[2011/02/19 10:00:00 | 071,381,601 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm
[2011/02/19 09:58:23 | 000,003,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/19 09:58:23 | 000,003,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/19 09:55:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/16 21:33:31 | 000,794,634 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/02/16 21:33:31 | 000,663,486 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/02/16 21:33:31 | 000,133,302 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/02/15 22:20:41 | 000,038,191 | ---- | M] () -- C:\Users\Jared and Caz\Desktop\Rush - The Pass.gp4
[2011/02/13 20:09:45 | 000,001,817 | ---- | M] () -- C:\Users\Jared and Caz\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/02/10 18:03:04 | 000,255,168 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/02/13 20:09:45 | 000,001,817 | ---- | C] () -- C:\Users\Jared and Caz\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/11/12 18:31:00 | 000,000,255 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2010/11/12 18:31:00 | 000,000,094 | ---- | C] () -- C:\Windows\brpcfx.ini
[2010/11/12 18:30:36 | 000,000,419 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010/07/25 14:17:03 | 000,000,000 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\prvlcl.dat
[2010/04/04 14:00:02 | 000,387,142 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistMSI67C6.txt
[2010/04/04 14:00:01 | 000,010,392 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI67C6.txt
[2010/04/04 13:59:58 | 000,357,918 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistMSI67BC.txt
[2010/04/04 13:59:58 | 000,012,282 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI67BC.txt
[2010/04/04 13:59:32 | 000,011,478 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI6767.txt
[2010/04/04 13:59:29 | 000,011,694 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI675D.txt
[2010/04/04 13:50:42 | 000,381,724 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistMSI60A1.txt
[2010/04/04 13:50:41 | 000,010,624 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI60A1.txt
[2010/03/14 12:02:29 | 000,008,376 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\d3d9caps.dat
[2009/09/11 08:22:03 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009/09/11 08:20:54 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/13 21:55:05 | 000,000,033 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\pcouffin.log
[2009/06/13 21:54:54 | 000,099,384 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\inst.exe
[2009/06/13 21:54:54 | 000,007,859 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\pcouffin.cat
[2009/06/13 21:54:54 | 000,001,167 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\pcouffin.inf
[2009/01/18 17:01:40 | 000,786,632 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2008/12/14 18:46:03 | 000,000,035 | ---- | C] () -- C:\Windows\A5W.INI
[2008/12/14 18:39:43 | 000,000,035 | ---- | C] () -- C:\Windows\Tiny_Run.ini
[2008/05/17 23:33:39 | 000,524,288 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2008/05/17 23:33:39 | 000,139,264 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2008/04/10 21:42:49 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008/04/01 23:06:55 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008/03/14 23:31:42 | 000,027,421 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\UserTile.png
[2008/03/04 12:59:12 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI
[2008/02/23 11:46:58 | 000,000,136 | ---- | C] () -- C:\Windows\SysWow64\msrkbd.dll
[2008/02/23 10:13:47 | 000,000,092 | ---- | C] () -- C:\Windows\cdplayer.ini
[2008/02/23 10:04:05 | 000,055,808 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/02/22 21:31:32 | 000,024,323 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2008/02/22 21:31:20 | 000,010,288 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2008/02/22 21:24:48 | 000,001,460 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\d3d9caps64.dat
[2008/02/22 21:10:42 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2008/02/22 21:10:42 | 000,013,632 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2008/02/22 21:10:35 | 000,012,096 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2008/02/22 21:10:35 | 000,010,304 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2008/02/22 21:08:04 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2007/11/26 20:56:28 | 000,151,415 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll

========== LOP Check ==========

[2010/09/26 17:56:14 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\Amazon
[2010/03/06 17:11:32 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\App Launcher Gadget
[2009/01/07 00:46:42 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\AVSMedia
[2010/11/16 21:20:58 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\ContentGuard
[2009/01/07 00:46:42 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\DInsight
[2008/05/26 17:15:35 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\FileZilla
[2008/03/08 08:51:44 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\LimeWire
[2010/01/13 21:33:31 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\Mount&Blade
[2008/02/22 21:59:59 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\My Games
[2010/01/17 19:40:41 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\OpenOffice.org
[2009/06/13 22:00:18 | 000,000,000 | ---D | M] -- C:\Users\Jared and Caz\AppData\Roaming\Vso
[2011/02/17 21:45:46 | 000,032,580 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/02/19 11:11:10 | 000,000,434 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{2B6A9691-62FD-4ACB-8142-577060AE1D21}.job

========== Purity Check ==========



========== Custom Scans ==========


< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\system32\*.sys /90 >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %SYSTEMDRIVE%\*.* >
[2008/09/26 06:52:30 | 000,000,212 | ---- | M] () -- C:\BcBtRmv.log
[2009/04/10 22:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2007/01/01 00:44:35 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2011/02/19 09:55:16 | 312,020,991 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >

< %systemroot%\*. /mp /s >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< End of report >
OTL Extras logfile created on: 2/19/2011 11:07:36 AM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Jared and Caz\Desktop
64bit-Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 48.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 186.31 Gb Total Space | 41.77 Gb Free Space | 22.42% Space Free | Partition Type: NTFS
Drive E: | 662.68 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 3.74 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: JARCAZDESKTOP | User Name: Jared and Caz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 2B E8 D0 94 A5 9B C8 01 [binary data]
"VistaSp2" = 9A D4 1D B0 5F 4D CA 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1512967829-2763226397-4013573042-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 2

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\BitTorrent\bittorrent.exe" = C:\Program Files (x86)\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"C:\Program Files (x86)\BitTorrent\bittorrent.exe" = C:\Program Files (x86)\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07DA4EAC-18A1-43F5-B584-742B9E7E0DCB}" = lport=10243 | protocol=6 | dir=in | app=system |
"{34E87499-4630-4998-AFE0-1D061434DD56}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3AA1B011-5916-4CD8-8F17-C221E0688D46}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3F02EB20-B677-41E8-980C-F2824C207498}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4F351E65-CA55-4CA3-9EED-4ABEF3DA8B2B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{508BC130-7409-4AD1-AB31-16EC61B38624}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5440372A-6137-4954-ABA5-EC2B70EE490A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6A34EDD3-CF26-420C-A4A2-1F4534FB06B3}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{B0E5B850-7EDD-42CA-ACA4-C53595B57FDF}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B16787ED-DE16-49E1-9493-6C98A844E517}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{BE566862-E0BD-4258-858D-8255A08045C8}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C4E9928D-332E-4BE3-BFF0-ABBAB9D7BA74}" = lport=54925 | protocol=17 | dir=in | name=brothernetwork scanner |
"{D089B8A7-D3DC-4031-B079-95A1731F08E4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D2C8D76E-21A1-4E6D-ACDE-268BF04C38C2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DC37FC37-1720-4A32-831D-D1D722FEBB7E}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{EEDB683A-2419-4AB2-9FCF-1FF91370B1D0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EFFB57C9-D132-4A37-8065-730FEF82D980}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{F6FD06EA-926B-4BDD-B301-5619C6E94A82}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00708185-26F3-4704-A3BB-CA9BB4281A88}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0112B3E1-61D0-4967-98B7-E6ADBE2BB68D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{013F3532-C424-4EB9-8A04-0FAFA0356F3A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{014089DD-7046-4535-8627-5FB419AE80A0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{017D981A-1422-43C4-A305-9EB45B6FD39F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0196E184-DEF2-4D40-81D9-58B92721337B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{028B078A-D1B1-4E8F-B1E9-50D581E58B76}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{02FC64BD-2AAD-47F4-B272-7F8C5A3975C4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{039A8386-DB6B-4564-8FBB-A89F2D3C36B7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0461FD88-BFB6-4FAD-AED8-387CF93F5117}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{04F0F7FC-9412-487F-AB4B-070F559D33F9}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{050093A7-FB32-4804-96CF-002CAF495DFF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{05A2523E-6786-4231-93B9-58CCE5850315}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{05B1BC83-1262-4564-B280-99F124A00628}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{06A4B128-8107-4529-A62E-F0EE2FAB0EAD}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0718E1A2-2197-4671-9558-878DFB8CFDF4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{07FCAF93-C352-4DB2-8D60-4B5A567F7CDE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{08495012-9B4D-4D13-B893-1012CCCA328F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{084FAC02-2927-4050-903A-69814D35228B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0875E2FD-FA51-42AD-8087-2D1F08022906}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0960DA27-DEA9-4A0B-8EE5-07702DC5E259}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{096C4F25-5B03-48BA-858F-20E9B31FCE24}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{09FF1715-F007-4892-B120-CB04679A79B7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0A69C081-D31A-439D-A54E-C5F2E2BF1F15}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0B0E6C4D-B4A4-40CD-AD50-76F26897D28B}" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe |
"{0B82199F-214B-4873-80C7-72ACF2571464}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0C595BF6-DCF5-4509-B4C6-3F4DFE918C87}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0D04F875-0F32-438D-BFFF-98CB0A2AF1EE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0EBD4CFC-F854-4FCD-84E8-51913DEA2E3E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0F11DD4B-F1AC-48AB-869B-C96B11694AFF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0F3A4755-4ECD-441D-869E-16792B89E11F}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{10626BA5-2103-47FF-9AE5-8366B98D9FE9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{10DDA7F7-0C71-46D4-9E5F-19D5D772B7CA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{11263CE0-9F82-44D8-9073-A81275BBDC70}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{11E49EF0-C954-4175-995E-724FDD9E2C3E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1281297A-01F1-4282-B375-342191BAA5CE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1557DD8F-1B16-4B74-812A-3985B3E6A30A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{166DB569-0866-46C6-B95B-0FCFCE984397}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{17998F7A-6EF4-4B61-85D5-59EA448A26A6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1A85D208-4242-4512-B67D-1CD53C32844B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1A945078-BBD0-4928-9AE7-F5171E303F43}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1AA1A321-D45F-4239-AEC6-CB4D3E3BC241}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1AC31441-353A-4309-86C2-6821C2C2A0AC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1BFA4CC2-5537-4F3B-8A60-76A4B3B5DB4C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1BFD112F-F511-44DC-85FA-80158742FC58}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1E611F47-E385-4827-A4A6-78FB4952116E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1E7A24A4-5934-427A-9E13-F48C69958DB0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2049842A-11B5-4C18-B0C2-7638D1E8A950}" = protocol=6 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword.exe |
"{20CB9F94-715E-4502-8157-5B4D15669053}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{20CD1C53-B436-4B91-8D16-FB192B365FB9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{21A81EE0-F3D5-4E60-BB5C-59E2AF2634B2}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{21C830B2-AD8B-40EE-ACC7-BB31D2558AA4}" = protocol=17 | dir=in | app=c:\program files (x86)\dna\btdna.exe |
"{22F3987B-BAF4-4FBC-8D85-6C96F99F87BC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{23C433B9-02A8-43DF-A6A8-D2C8A9BAC7F7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{24325623-CAC5-429C-A541-7C7F572D3C3C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{24981284-C092-4254-A7B7-FEBC870FE0B0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{25433258-08B5-43F1-8C02-17CABE58334D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{25728652-F362-422E-B4D6-6013F4B1A39C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{25F74F56-3EDE-4F71-95BD-A2193701F827}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{26F2F230-C129-4830-A748-131E0D775D89}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{286C13B0-7335-4B25-BD24-D62387340FE9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{291DF57A-63C6-4226-B585-10F295FA5452}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2937775E-0C56-4A36-B4FA-D6AB14780D4F}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{29439C8B-8715-4B8D-94B4-2C7F51E62074}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2A96A7BA-9C1B-4694-8E77-EAC97980A86F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2ADEFC63-2164-460B-A88D-276F57F3093E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2AE1A139-A909-4677-8443-65A01F914232}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2B5DE579-2320-4FAB-926F-C917A7810698}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2BE78A0D-949D-48EA-AE71-DC20AFD21D38}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2C5CD53D-3310-42A8-8D5E-3EF91F462CA3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2CCAA60E-02C5-4980-B66B-99D3DDDA95B2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2CED92DC-FB98-4F19-9037-1D2875E0F1B4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2D17E3A6-BDEF-4610-832F-18CA168E7DB8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2D1B4679-EDD8-47CF-B425-279DD5363842}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2D2759CE-BB1C-4C26-BEE3-B745DB2D8341}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2DE5D71B-B38A-4CA1-BC82-C49DAB579E07}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2E28A12C-4BB4-4BD2-ACA7-5AB776D68908}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2F0EE42F-8559-4C47-B17E-573B3CFA6E56}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{30A1B89F-1AE3-424E-A152-1AB65797F258}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3351B2EC-9000-4D83-96A5-6C3DB823EFE8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{355DEB41-4328-4872-AB95-38FC1552BC49}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{363C4DDC-E333-4EB8-8B96-A2685F78AA35}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{37AF4760-368A-4686-8C31-62CEFD00304D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{391E886F-7144-46DC-8E70-DAF05AD5D702}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{39FF5D1F-6B6B-4B03-A2B9-A71EDFAE50D9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3A332309-2FEA-4B69-85C3-7ABCB75A73FC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{3B004922-1A40-49EA-8327-331C83005FAC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3B97026E-1939-48FE-BD94-656C16AD9103}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3C556B98-EBA5-49DF-A156-A399C689870D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3CF22E7F-4A23-4362-9000-4395E5BD73E3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3D1137DD-2D64-452F-9E4F-C14B82F81EE3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3D743DAB-34A4-4408-90B3-A288F725E2A8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3D991A30-908D-475B-9055-6F9EE4FD038D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3DC5AB17-06A6-4D5D-8693-D9CCF6551DF1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3E2331CC-8CA4-433F-A6D7-C3FFF545192F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3EBC8E43-E545-4959-82A5-C3ED3ED41267}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3EC68273-20A3-4948-8091-96835B996A2D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3FFD0FA4-8583-4505-B835-97A181C27ACC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{408E5850-CEC1-418C-B186-4C560CE08048}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{40B1BC6A-ED2C-4B8E-BA7F-B5ED785C55DE}" = dir=in | app=c:\program files (x86)\avg\avg8\avgemc.exe |
"{4123603D-6607-48C6-82C0-D303EB900DF4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4208DD21-77AE-4BFF-97F6-A60F39E291B5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{43A63F71-09E9-430B-BC16-B2D06F75C279}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{443B2A4A-D3DE-4F7F-A1F9-B6002E6EECB5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{455CCCEE-8DE6-411C-B721-45CA157CE9A6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{45E9C0C8-CB52-43A8-8484-F839C5FDF043}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{46357A2F-8F6C-4406-821F-FFA2FD4339CB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4690AA29-B356-4CE7-A29B-F83C46F488B5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{469C81D3-2FFD-4ACB-8C98-DC1341A7614A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{474D5EF2-F5B9-440C-9169-06CD6EF36C61}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{484AB035-66E5-4AD5-9D2C-E8929AF53B89}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4944EF82-AF32-4E7C-8050-0FDE9C54F399}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4A0F29C2-BCAE-4089-A6AF-1DF66F6ACA70}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4AEAE4D0-F390-4A44-9F1D-409CC73FBCB3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4B3C7FBC-4399-42C0-806F-BABFB234DE05}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4B6E7B14-0E43-4BFB-ACF5-80123C18EC83}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4CC3F4EC-8CBB-47BE-9A94-10477760CDDE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4D65399D-54E3-4E5D-ADEB-502B7885502A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4DBA3137-20EB-4987-985F-925DCFFF37CD}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4DD510BA-7B81-43F6-8D2A-97CE11F3123A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4E6E81C3-6FBC-4D0E-A4A0-FAA64E88C1DA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4EE3DE34-AA91-4F6C-8A25-371982C1DDA3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4F5CDE07-7962-4E60-9C64-DCD933E66235}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4F884303-7290-40FA-9354-E38BC33D85AC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4FAFD805-5F2E-4E56-AC34-14DE876053D6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4FE15D29-1636-4EA3-AAFE-44FDA81D3BFA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{529A8846-A531-4437-9096-AA25909527E8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{53BAE6CF-DEE8-45C4-85F0-6E4F0464D481}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{53E9E379-71BC-47F9-B9A2-AF66B79B88B3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{53ED796C-23AC-4F1A-8152-0B698A1D3B29}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{53FBB143-09DB-4998-A56E-32D67332F77A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{54270345-59A0-4ED3-AD28-382B29C379ED}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{545B38DF-0516-4BBC-89F1-6F4D07C3C73A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{546C7E66-7C99-4E38-B02B-B5CDD5C124D5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{54F7EE47-7274-4DFC-B78E-79DEA6FFC6D9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{55C398DE-FF2B-4D74-BEE1-E2A81FB25AC3}" = protocol=6 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword_pitboss.exe |
"{5679FE77-53EA-4C8D-9C69-BBDEB3016D4A}" = dir=in | app=c:\program files (x86)\avg\avg8\avgnsa.exe |
"{57A6FC1A-BA9C-4856-8106-53620CFF9C03}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{57EBD9F0-C30A-4996-B8A6-A528D5694DF8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{57EF1095-FCB4-4A05-AB29-90F346073682}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{59780D78-B1CD-46B7-995D-7886073354B8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{59E107C2-DE40-4567-A8CD-245C860786D0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5A42FA3B-43AF-4072-8332-E4856D658EFD}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5B30CE9D-69C8-49A0-8A81-5732A8ACC403}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5B8862CD-1B84-43DC-9F51-59892F3C0282}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5CFCFE71-D9AA-4711-9041-C300298F3831}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5D692BF5-1009-4588-A915-96C2355DF9C3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5E1ED70F-4723-482F-B2E4-AF171EFB5210}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5E7D4F06-0496-4757-AD70-061B1BD570D5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5EBF1983-89A1-4A91-A6C3-0823D85ADAA3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5F382F63-9EAD-4538-9625-F7F0F4EBB06B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5F7386D3-BC58-41F7-A475-BFF2136F8E08}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6062A76F-C0FB-49B6-BCD8-DEFB7FA223D5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{60EC272E-1A5A-41AC-B79D-C41B7A6AB9D5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{60FD9A63-DAB6-465C-A9F4-4F49C83B2A77}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{616DB7BA-2B20-4039-9AE5-DC382836229A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{62431D62-5E5F-496E-A3EA-35069B7B7228}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{63CB5B0C-13E0-4EFD-BB75-348A1F197B30}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{657AF808-5C98-4A70-A5F6-5751BBC46BCA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6A1D2AA4-C8AE-45D1-8392-397D14EE61C4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6AA4A2EA-BBAA-4BD0-A91E-31B3F4AFADF9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6B184696-E2C6-481B-A749-071154A8A893}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6B46B28B-2307-4D1B-80D0-FF28F370B703}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6DB50825-45B8-45B5-B497-2073ABCA0EFC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6DB8C92C-0FC4-4CCF-8000-6A6915412C49}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{6E228B0B-EBE5-4ECC-A468-B8CCABE5E998}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6E81A199-AA28-4ED2-9E91-791DE86BCC8A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6EA4FB53-02F1-47B6-81AE-F918E3D01436}" = dir=in | app=c:\program files (x86)\avg\avg8\avgupd.exe |
"{6ED31FF9-8F89-45C1-85E6-EA39874ECDEB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6EEA6CA9-3A7A-4763-9EC3-62E47C3B19E2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7085C958-5B4E-42F8-BCCE-D37BD868A6D0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{71E3F88C-264C-4F41-8123-79C4405CA017}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{72C87F16-9DB7-488C-94E5-BCCEA0AF3DC7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{74078083-DDB7-40E0-B7BE-D1F213BCB6A6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{742136D6-1F9A-4AFF-B994-5748D1AF61F1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7558D818-66F8-4A4F-A1F2-A4C3DF618AD1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{75A91ECD-74C7-4C82-9102-1F7BA39C264A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{770DACF8-6BA7-4E3C-9AA6-ECEBE76211BC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{78FAFF66-4ACB-4730-B508-C259E4D09FB7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{79FDCB89-22CF-48EA-BA7B-717E9F3D0429}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7A5A29BA-7A67-471A-B750-0B1878598943}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7A73837E-380F-4ABB-BDFA-E17B7FD10DF7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7B648012-3321-44E5-998A-0ED2B2AFDB9E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7BAD85E0-45EC-480E-9B5C-AA436EFB8D33}" = protocol=6 | dir=out | app=system |
"{7BBBB6EA-6DB0-454E-8DD1-08D4AAB2513C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7D0C0EA3-567A-47F1-B39C-2E8DE35F8C22}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7E122C66-1A8F-452A-B40C-D23FAB92DE43}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7E14EAB3-77CA-495C-9F61-4371756A1BDA}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{7E498FFD-959E-4FC4-9EB4-95CD2916FC23}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7E5EF93B-72A4-429D-95AC-EC6514D7BE61}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7F70FA1E-7CB0-4716-A4E2-FAF807A90518}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7F7ADAB2-D3F0-4E6C-8EC9-D96C97BFA32C}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{81013D16-CEC3-4929-81D9-706A777265DB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{819E5C15-CD07-4D66-9CEE-3104B84B462A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{81E7FD45-8C41-46C8-8C94-D24D56357A28}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{821CB371-D943-404E-B06B-9800984505B9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{82A234C2-D430-4275-98D0-231BF192E076}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8499BA25-6C21-45E2-AA56-4BF63E054196}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{84F5A21D-1698-4824-867D-2C8A7671B53A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{86C01D09-4EB4-4571-B861-4B44BD9066A2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{87A4EFE6-88A9-462F-948A-D71CFE504F61}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{88583B41-2D46-4A86-8E43-E594ACD9E58B}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{888E1EB4-D13D-4880-B15D-8EF1419A1DA2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{88C50989-E172-4FB5-BFA2-795800423937}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{88D89FC7-BC97-4EA4-B9F4-2EC89C240CD9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{890DAD53-7F6A-4AD7-954B-DD9F5E9FA4C0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8931F990-140F-4019-BF70-4A6859CE4A37}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8A351466-A827-43CD-88EE-1ED79329FA9A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8A477391-BDFF-4882-89DC-43299F975CEF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8AA594AB-1182-4D70-A1D3-A32EEB430F13}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8AD5D970-A01E-42AF-9B15-D62C2D44ED26}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8C9DD0D2-9747-411E-8172-A85A3CC479BF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8E7AC1AB-A644-4D7C-93E7-5D3B917777B4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8ECEE057-B5CC-47C2-99EE-8C1F0D35A3A0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9029A4F5-1F0D-4D7E-8428-38BCD1364AB0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{909A83C3-FEE6-42C2-B82B-DE21C259F6AA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{90F2E23C-0ED9-4F3D-9779-48E62226BFE7}" = protocol=17 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword.exe |
"{910240A8-E8F5-4545-82F3-AFB9B08196D3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{91A5C90E-EC7B-4337-AC00-3897B4334AEC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{927254DA-677F-455F-95A5-36ABB4826CEB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{938BD8BA-2EBC-48AF-98AC-DFDBA6DF6FBC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9408E547-83ED-42ED-AC1B-A2D241BF9E01}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{94801215-D969-4053-B008-37D21220F781}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9497CB67-7FF1-482B-9AA7-36451F849CC2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{94AADE47-7388-41A9-A235-443915D12E93}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{95D80571-447E-4910-AD07-DEE243621ED6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{965839D1-8FD0-4E7D-8A16-BB660C56DBD1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{982A44CC-377E-4B0F-A411-0D5E5ADA9BE6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{98AE9E53-78F6-4191-8B15-96A5E74708BB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{98EAD2BD-E657-42C3-A8AA-6C9B09D28764}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9B030845-63E2-4278-9BC1-89E976B7E4B3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9D96EC5E-8FC9-4780-BFCE-DD867681BC48}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9DA67E60-843F-44B9-B0B9-85D1EDB8B98D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9DB2D009-65ED-4E83-83EF-69960A9788F5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9E8E2D09-FFB2-4E7A-B305-79F7DECA3BBA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mlb front office manager\mgr.exe |
"{9F28457C-22C8-463F-BC6F-7BBCA3D8CE2E}" = protocol=17 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword_pitboss.exe |
"{A006B595-ACEA-4298-BBE7-8644994A1105}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A00ABB8B-562B-4D75-B378-8D4F9BC3FE4C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A04B23D1-CDC5-4FA7-AE33-F73A32DF1D6D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A18E6D35-BB4C-4599-A28A-896474D58DDE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A2760CA4-14AB-48F5-A2ED-399803DA3FE4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A38C5A84-22E9-4175-B77A-3606CC31C685}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A41E84A0-D3F9-4116-A31E-FEA13D98CFC0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A4FEA14B-4E6F-4A5D-8072-B7D095D9CE3B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A50145B2-20CE-46CF-80D7-5A194A3F603B}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{A535EB26-4F1E-4446-9633-011A7A6A9235}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A5392A72-E4F6-462E-90F9-3890C93E3244}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A583B7C8-F0BE-4C0E-907D-14CC30855E71}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A62A10CE-B984-4118-B8D7-88B56FD399BF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A671E7F9-560C-405E-89EF-431FC77CB462}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A69AF76E-BD02-43DA-9671-2E1E059175E5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A76C7DC8-9B15-4ABF-B401-D75F3B0AD55A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A808F65B-C373-4E8F-8F22-BCB9097ACD7A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A98C37E6-CB36-4E6D-8378-0C4DF637AAAD}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{AB3FF518-B135-4F52-A69C-23C6763C7106}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{AB82E67E-40E4-4E3A-BB94-73A6619C3E3D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{AB87A56E-78D6-43B7-A951-36A126A340F1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{ABC9E883-FC12-4D21-841B-4C165CD8502D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{ABCB969F-C88A-47A2-90BC-41D2F6B91351}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{ABE944A1-0904-4A8D-B7A0-F65EAC9B965B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{ACBC378E-DDE8-4FF0-A4D6-E8E3FD6BC234}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{ACF0F893-6B1D-4F24-A459-A8D6EBF9C30C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{AE896331-9825-44F5-A889-15CDB46DF8FA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B02E1484-EB71-4878-BE01-24DB253620D4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B06AF0A4-61CA-4621-A793-D915BFC8B9E2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B1D71F9F-97F4-4D5D-BD4E-CD6E54856BBC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B320E9F0-71E9-4B5D-BEF0-0975BE5FC19B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B443B66E-B342-4896-A8CD-6A66ED4C5B5C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B5C8989A-7F9A-435E-BA00-0DBC1F968D43}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B6F9A72A-1DB0-4CA0-9C40-83487A70B43A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B79280E0-6CD3-4BEF-9362-9FE4E4FD1474}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B7CF1BEB-30C4-43F1-A9C0-4FA08595333F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B8766FE5-B301-4F15-B455-04E303E9C194}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B8B89CEC-B843-4E94-92E9-3CF6E3968B04}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B9218D3F-6438-4FD9-8160-8211ADA519EE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B9B51C9A-3DDF-4D24-A559-B159BCA6C665}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{BA5FFE4A-9FF2-42CC-8315-7054C1B0119D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{BBC63B63-7D14-4001-ACB5-880C95A7E1A3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{BBEF6881-49B3-4311-A8E6-DBC88352799C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{BC90F40F-4C90-4B56-B318-4C430EF2C994}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{BCA00D6D-E3BE-48B0-ADF2-08924A80C7B5}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BCD35B08-6F03-4D24-86EE-29F594815CDB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{BD829EE6-FE94-44B0-9496-11FFB0993A29}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{BE29E4EB-B311-4EE3-9176-154D85F7E98F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{BE9D69AB-225E-4EB0-A407-4F5683DBBDD7}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BF854EFE-2518-4E18-96F2-52332C1DA0D8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{BFAC57D8-865E-4655-B30D-520543F8E5DB}" = protocol=6 | dir=in | app=c:\program files (x86)\dna\btdna.exe |
"{BFFA4C2B-D1F9-4544-95C8-334F5007FF70}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C0C139DB-D88F-43BB-9766-32CB78EC8D30}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C1B8DF46-29DD-4E0E-9F3F-1CE832CE6106}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C1D5B767-501F-46CF-957F-4385E73092C1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C233B497-53EF-4E7D-9191-CAC7CD09A089}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C3617CAC-E6CD-41DC-B6ED-E7BF4EF52779}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C367CA93-3880-4442-9F29-F7291A2D403D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C3EC84CD-DFAC-496F-82AE-D753041C96BA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C3F614B6-B14B-427C-A118-B4B590BE79FA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C44B2FD0-08ED-41E2-B561-DC7EEA6CB743}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C60D06F0-3BB6-4743-B19D-EBC27B43DABB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C703D5D9-5DF0-4C3D-A6EB-2BA9CF2FF15C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C8C77F70-171B-4B06-BCF9-230809DFCC84}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C8D1E4E1-F60B-40F1-B5BD-D87F942ACB0D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C8ECD1BB-D01B-44C8-AA28-285BABEEC742}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C91E8EBB-2AC5-4BE9-932D-BC6C54E1A349}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CA1907DF-24D2-48C5-9AC2-34BE84E0B8BF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CA5F56FB-A0F8-46D0-B67D-4168EFE651D6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CB4CF802-A3DC-4D33-9331-D5189C9A1033}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CC345211-7035-4045-922C-0E484AD0348A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CC74E392-7F24-4EF7-BF60-E2765062BE26}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CC7CCEEE-874D-4679-9794-A159EF8F1D7E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CC7D3C57-AB2C-4E84-9A1F-884F6CC2ED52}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CCB1EDE7-3D3F-47EE-9D04-FADE9DCEA5CE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CCDB8A7D-FDC7-4BE4-B8B0-0D9B1DA5630E}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{CCE9AAAA-C353-46FB-9589-8547F1BABEA2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CDCA96CA-5173-4D59-8F36-7366021D13EF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CDD0771D-A209-4C87-BE5F-B0E59C12CB48}" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe |
"{CE591F8D-C407-47D0-81E4-DF7CFC958912}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D059F64E-F878-4B73-BB2F-236FB915DDFD}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D086392C-D370-48C6-BCF5-759E4D4A63D7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D1DEEECD-4942-4B9C-93EA-7FB18E35B088}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D1EDADFB-BA4A-4EAF-99D7-C5E9AEDB5B97}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D29A22DB-580C-4BA2-86F7-4EF93632857F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D337D56F-6FFB-494C-86AF-67F1BB50D312}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D3535DB4-3C21-4457-AD9F-64E79EE31518}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D444DC9C-F41C-4FBD-83EC-FB2BCD481ECE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D489D059-137B-4F52-A3FA-76AC6CAA8EA2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D4A17651-E3CE-4853-ABF3-F1D4B91D37D7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D894D05B-D8A8-44F1-8140-A5FDE31D3505}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D8F9531D-DEBC-45FC-9C2E-B311AF806B87}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D90B96D1-C867-4120-BC29-E43C02221FF3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D965B198-6C34-4C97-9C8E-A2F46D59FC5F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DA8343A3-AE67-4FAD-A530-9EDDD81F5532}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DB2DCCBC-A797-4FFC-97D9-54E70857A560}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DC159073-3ADE-4E19-8BB3-13A4B191B4D8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DC628CE9-FB91-4B7E-B6C2-2528A8D8A0A1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DC76D2CD-4EC6-4722-A6C9-44C7B01DF7C5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DC7DFB79-8F3E-487F-B542-6224C57BAF01}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DCBA7886-9DEB-41AA-B0D6-DD72293D12CB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DE2C3A49-3804-484A-81C5-81ABC2A02C63}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DE58E323-9033-4EE5-B4FF-ED165E9DC335}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DEC8B96E-A180-4167-9B61-8B85DA6946B5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{DF83D355-154D-49CC-9400-0C1B0612E95E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E072D6D8-AB59-41C8-B195-15658DA11095}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E2167735-B685-40D8-917C-C064BA8DDE60}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{E29BA0E1-A4F8-47FA-88F2-1C45567F2A37}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E2E99D95-A482-42F2-AF64-76D1E7A13CF9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E4D63B75-FA99-4159-8216-A555404D95CC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E596AC75-F7A8-4B04-A776-838059AB836D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E6AA48A9-86A0-4BAF-9029-61451496D13A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E7230AFF-596E-4DCC-9BF4-48368BF32F8F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E7777F33-BC76-4206-8E65-D20444F3A8DD}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E86DC2BA-AE5B-4A42-A4E1-C5D0354FA491}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{EAFD910D-CECE-4FE4-9DE9-1311FC9AF8A4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{EBA1DA37-1F4C-4B15-BC13-D5A8CCEC3E58}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{EBE52ABB-4565-4905-854C-39068F03C027}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{ED441E0F-7EE6-4A0A-B946-27547016A59C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{EDAC30C0-D644-43DF-AA2F-E56578F663ED}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{EF32D2CD-5B46-4211-A71A-6D93D33C7489}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F079B3B7-1F2D-4EE2-824D-D96123690FE0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F15022A6-3A13-4EDB-991E-F9B31993337B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F1C4152D-D856-4CD0-9953-386E42A5D7CB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F1EF201E-99A7-44DC-8085-0EA7DFD94A04}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F23C8465-E53A-4CB6-A820-49ECF034B8F6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F24001B2-9825-4667-A7D5-0900B0696FC6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F259ED1F-238C-495A-BFBA-99B6EAA13289}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mlb front office manager\mgr.exe |
"{F2809A07-3DC8-4333-8E18-4362E7EA77A5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F33742D2-AD61-41D5-9097-4EFC89D3C908}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F38384DA-9865-4BCF-880C-75245F9A6561}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F38E24D1-4AC3-48AA-92AB-49C58A9D8C50}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F4E28A5A-DB55-4BE0-85BE-82315364A230}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F4FDF686-0854-4750-BCFE-D5F70C92958D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F5406771-6666-4A43-B9C9-B755820462F8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F674F0BA-09A9-40B7-8DC1-EED8834D79FE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F6C58B6D-DA7F-4ADC-A070-DE9ED7879779}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F6DFC5D9-D28F-4CCC-BFD2-338CA8402467}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F6E73EBC-6ED5-4B84-BC9D-F9783224E98C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F8C25BE7-96D5-4EA4-B219-EEF4D57F160B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F92C3D9C-E706-4CC7-8C11-E57A10F7915A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F972AD46-5D4E-4B19-B417-2B8B973E05A7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F9752F02-0D4C-4949-A8E7-9338696EB8F1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FA1A5EA5-5FB7-4F91-B7AB-F6342CF71200}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FA68CC82-011F-49CD-AEED-7229E5EA5620}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FAF3B116-09B1-4089-8D6B-A7767EE07660}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FC7C3DF6-CCCB-46C8-9CB4-A9E7338916D8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FCBFC157-4E5C-4A5B-8854-CA8210E33BED}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{FDC2F4AA-1CFC-428F-96BE-22844B8E1133}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FE0630E3-86F6-4C62-92B5-7F95B36C67FD}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FE1344FA-D567-4EC2-AF48-E0F702314363}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FFF72587-9103-493B-BCDE-ACC44592BC5D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"TCP Query User{208F1901-2105-4B6B-B4D2-8D4D43DA8B8C}C:\program files (x86)\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"TCP Query User{368133E6-C53E-432B-9BFD-E6EE195AC6AF}C:\program files\bohemia interactive\arma\arma.exe" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma\arma.exe |
"TCP Query User{36DA8E2E-0A22-4BBD-BAA7-8A8170C16B89}C:\program files (x86)\philips intelligent agent\philips intelligent agent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\philips intelligent agent\philips intelligent agent.exe |
"TCP Query User{3DECFECB-0AE9-4F96-AEE4-EFC4143342C5}C:\program files (x86)\firaxis games\sid meier's civilization 4\civilization4.exe" = protocol=6 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\civilization4.exe |
"TCP Query User{3E3B5EB9-F95F-48F0-856A-AC5775A2943C}C:\program files (x86)\common files\ahead\nero web\setupx.exe" = protocol=6 | dir=in | app=c:\program files (x86)\common files\ahead\nero web\setupx.exe |
"TCP Query User{4194A4B0-D701-4C24-8D69-ACD7CCF4FA47}C:\program files (x86)\ea games\battlefield 1942\bf1942.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\battlefield 1942\bf1942.exe |
"TCP Query User{4A6E10FA-13D5-471B-9B3A-D8CC23BC0A22}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"TCP Query User{6BB633EC-A304-4348-A593-130A03643549}C:\program files (x86)\ubisoft\ghost recon advanced warfighter\graw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ghost recon advanced warfighter\graw.exe |
"TCP Query User{99169595-1D64-43A8-AAA8-967EE2C4B29C}C:\program files (x86)\ea games\battlefield 1942\bf1942.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\battlefield 1942\bf1942.exe |
"TCP Query User{AAE1B8C6-7F8D-4B95-94AF-9FAC55908A18}C:\program files (x86)\firaxis games\sid meier's civilization 4\civilization4.exe" = protocol=6 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\civilization4.exe |
"TCP Query User{C267F395-DD28-48A3-B2EA-050F424F86F2}C:\program files (x86)\ea games\battlefield vietnam\bfvietnam.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\battlefield vietnam\bfvietnam.exe |
"TCP Query User{C8E5E525-5CDD-4936-BB07-72B71C254BA4}C:\program files (x86)\ea games\battlefield 2\bf2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe |
"TCP Query User{DE77D281-3893-43C5-B455-E0E76CC882A5}C:\program files (x86)\nero\nero 7\nero home\nerohome.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nero\nero 7\nero home\nerohome.exe |
"UDP Query User{2C3E092D-6EBE-4788-9E00-9584408F73A1}C:\program files (x86)\ea games\battlefield vietnam\bfvietnam.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\battlefield vietnam\bfvietnam.exe |
"UDP Query User{31EF9F35-D163-4B40-8A45-D6D647FBED76}C:\program files (x86)\firaxis games\sid meier's civilization 4\civilization4.exe" = protocol=17 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\civilization4.exe |
"UDP Query User{3CF5D63F-51BC-4739-B190-575C7CB99FAF}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"UDP Query User{3D7582A0-D8CE-471D-A96F-7566D4203505}C:\program files (x86)\ea games\battlefield 2\bf2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe |
"UDP Query User{3DE158FE-EE43-4516-B60B-259E215DC767}C:\program files (x86)\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"UDP Query User{45378BDF-31A8-454D-9E97-29C7F83FFC46}C:\program files (x86)\philips intelligent agent\philips intelligent agent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\philips intelligent agent\philips intelligent agent.exe |
"UDP Query User{4A076F18-8E23-494E-BFBE-D124612E36D9}C:\program files (x86)\ubisoft\ghost recon advanced warfighter\graw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ghost recon advanced warfighter\graw.exe |
"UDP Query User{5797D5F2-BAC2-42DA-855D-582BA7228C29}C:\program files (x86)\nero\nero 7\nero home\nerohome.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nero\nero 7\nero home\nerohome.exe |
"UDP Query User{6E411D3D-9EEC-480B-932A-AC812151EC18}C:\program files (x86)\ea games\battlefield 1942\bf1942.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\battlefield 1942\bf1942.exe |
"UDP Query User{9E596DB5-A0A3-4354-B656-98105896F885}C:\program files (x86)\common files\ahead\nero web\setupx.exe" = protocol=17 | dir=in | app=c:\program files (x86)\common files\ahead\nero web\setupx.exe |
"UDP Query User{AC555BF6-42D1-4BDB-8EFE-38F4623E4569}C:\program files (x86)\ea games\battlefield 1942\bf1942.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\battlefield 1942\bf1942.exe |
"UDP Query User{CA5502F6-E0F6-4177-B06B-61255527E9D1}C:\program files\bohemia interactive\arma\arma.exe" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma\arma.exe |
"UDP Query User{D5DA9701-BC77-4698-A955-6F8E22E4CABC}C:\program files (x86)\firaxis games\sid meier's civilization 4\civilization4.exe" = protocol=17 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\civilization4.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{77B8B4A5-EE79-4907-A318-2DA86325B8D7}" = iTunes
"{7E69263C-626D-4C56-9CA1-3522D79FEB7F}" = Logitech Gaming Software 5.01
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E5C95CA5-4565-4B9D-97ED-05088D775614}" = Apple Mobile Device Support
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"Creative VF0220" = Creative Live! Cam Video IM Driver (1.03.02.00)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NVIDIA Drivers" = NVIDIA Drivers

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2™
"{06FE1146-4FF8-45DF-B0D9-CBA8E38C708C}" = REALTEK RTL8187 Wireless LAN Driver
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{127B684B-A002-44C8-99A7-6CF8F1E26873}" = PunkBuster for Battlefield 1942
"{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{22DE1881-9D24-4981-B5CC-EC7E9F2F4D52}" = Rhapsody Player Engine
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 22
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{32E4F0D2-C135-475E-A841-1D59A0D22989}" = Sid Meier's Civilization 4 - Beyond the Sword
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E868D3D-6EEB-4273-926C-2287236B5B79}" = 3DVIA player 5.0
"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}" = Brother MFL-Pro Suite MFC-255CW
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}" = Microsoft Games for Windows - LIVE Redistributable
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe 1.4.136.1
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.6
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6C2569C-E2AA-4AB9-8C26-AC2487A2BFFC}" = Sid Meier's Civilization 4
"{B73B4A99-4173-4747-BBEC-0F05E966F9D2}" = Battlefield 1942: Secret Weapons of WWII
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D057AA08-8CBF-42E3-9EAB-23B8FED1C279}" = Battlefield 1942: The Road To Rome
"{D07643A3-CE41-4286-8C78-EB9C83E76DDB}" = PunkBuster for Battlefield Vietnam
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D89EF3B3-6F17-4665-B7A9-A4235A6DC787}" = Ghost Recon
"{DE29025A-091F-4998-AD2D-24C84421190F}" = Railroad Tycoon 3
"{E35B3C63-E958-4E31-A178-95D22024109A}" = Battlefield Vietnam™
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EFC97089-04D6-42CE-A707-A343B4A7D2CD}" = Ghost Recon Advanced Warfighter
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7338FA3-DAB5-49B2-900D-0AFB5760C166}" = PC Probe II
"{F989306B-9287-444F-AE73-E30C7E4AF0F5}" = Battlefield Vietnam: WW2 Mod
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"AGEIA PhysX v2.3.3" = AGEIA PhysX v2.3.3
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"ArmA" = ArmA Uninstall
"ArmA 2" = ArmA 2 Uninstall
"AVG9Uninstall" = AVG Free 9.0
"AVS DVDMenu Editor_is1" = AVS DVDMenu Editor 1.2.1.19
"AVS Video Tools 5_is1" = AVS Video Tools 5.6
"CCleaner" = CCleaner
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"Defraggler" = Defraggler
"DVD Shrink_is1" = DVD Shrink 3.2
"Google Updater" = Google Updater
"Guitar Pro 5_is1" = Guitar Pro 5.0
"HijackThis" = HijackThis 2.0.2
"Host OpenAL (ADI)" = Host OpenAL (ADI)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mount&Blade" = Mount&Blade
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"OpenAL" = OpenAL
"Philips Intelligent Agent_is1" = Philips Intelligent Agent
"Project Reality Core_is1" = Project Reality 0856 Core
"RealPlayer 12.0" = RealPlayer
"Starcraft" = Starcraft
"Steam App 7780" = MLB Front Office Manager
"Zinio Reader" = Zinio Reader

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/22/2010 8:22:30 PM | Computer Name = Jarcazdesktop | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 9/22/2010 11:34:07 PM | Computer Name = Jarcazdesktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 9/22/2010 11:34:07 PM | Computer Name = Jarcazdesktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1108

Error - 9/22/2010 11:34:07 PM | Computer Name = Jarcazdesktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1108

Error - 9/23/2010 1:28:40 AM | Computer Name = Jarcazdesktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 9/23/2010 1:28:40 AM | Computer Name = Jarcazdesktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1809

Error - 9/23/2010 1:28:40 AM | Computer Name = Jarcazdesktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1809

Error - 9/23/2010 10:30:35 PM | Computer Name = Jarcazdesktop | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\WinSxS\amd64_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_c46a533c8a667ee7\MFC80U.DLL".
Dependent
Assembly Microsoft.VC80.MFCLOC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 9/24/2010 12:05:20 PM | Computer Name = Jarcazdesktop | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\WinSxS\amd64_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_c46a533c8a667ee7\MFC80U.DLL".
Dependent
Assembly Microsoft.VC80.MFCLOC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 9/24/2010 12:05:29 PM | Computer Name = Jarcazdesktop | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

[ System Events ]
Error - 2/15/2011 8:53:20 PM | Computer Name = Jarcazdesktop | Source = DCOM | ID = 10016
Description =

Error - 2/16/2011 8:50:26 PM | Computer Name = Jarcazdesktop | Source = Print | ID = 19
Description = The print spooler failed to share printer hp deskjet 5550 series (HPA)
with shared resource name hp deskjet 5550 series (HPA). Error 2114. The printer
cannot be used by others on the network.

Error - 2/16/2011 8:50:26 PM | Computer Name = Jarcazdesktop | Source = Print | ID = 19
Description = The print spooler failed to share printer Brother MFC-255CW Printer
with shared resource name Brother MFC-255CW Printer. Error 2114. The printer cannot
be used by others on the network.

Error - 2/16/2011 8:51:25 PM | Computer Name = Jarcazdesktop | Source = DCOM | ID = 10016
Description =

Error - 2/17/2011 8:58:04 PM | Computer Name = Jarcazdesktop | Source = Print | ID = 19
Description = The print spooler failed to share printer hp deskjet 5550 series (HPA)
with shared resource name hp deskjet 5550 series (HPA). Error 2114. The printer
cannot be used by others on the network.

Error - 2/17/2011 8:58:04 PM | Computer Name = Jarcazdesktop | Source = Print | ID = 19
Description = The print spooler failed to share printer Brother MFC-255CW Printer
with shared resource name Brother MFC-255CW Printer. Error 2114. The printer cannot
be used by others on the network.

Error - 2/17/2011 8:59:04 PM | Computer Name = Jarcazdesktop | Source = DCOM | ID = 10016
Description =

Error - 2/19/2011 1:55:55 PM | Computer Name = Jarcazdesktop | Source = Print | ID = 19
Description = The print spooler failed to share printer hp deskjet 5550 series (HPA)
with shared resource name hp deskjet 5550 series (HPA). Error 2114. The printer
cannot be used by others on the network.

Error - 2/19/2011 1:55:55 PM | Computer Name = Jarcazdesktop | Source = Print | ID = 19
Description = The print spooler failed to share printer Brother MFC-255CW Printer
with shared resource name Brother MFC-255CW Printer. Error 2114. The printer cannot
be used by others on the network.

Error - 2/19/2011 1:56:52 PM | Computer Name = Jarcazdesktop | Source = DCOM | ID = 10016
Description =


< End of report >

Attached Files


Edited by jarheadchoag, 19 February 2011 - 02:21 PM.


#4 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:09 PM

Posted 20 February 2011 - 10:55 AM

Hello, jarheadchoag.

OK, there are some leftovers we can take care of. First, let's scan with MBAM.






Registry Cleaner Warning


I also see that you have a Ccleaner installed. It is a great tool that I use. However, be careful of the registry cleaning functionality (versus file cleaning), Here at BC, we do not recommend using registry cleaners as they don't speed up your computer and they can do more harm than good if they remove a legitimate entry. If you do use it, make sure to use a tool like ERUNT to back up your registry first. Merely backing it up yourself via regedit wont' help you if you can't boot up as a result!

See here for more information:
http://www.bleepingcomputer.com/forums/index.php?showtopic=238799&st=0&p=1326578&#entry1326578











Step 1

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#5 jarheadchoag

jarheadchoag
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 20 February 2011 - 10:06 PM

Thanks!

Please find the log below:

alwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5825

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

2/20/2011 7:06:02 PM
mbam-log-2011-02-20 (19-06-02).txt

Scan type: Quick scan
Objects scanned: 159501
Time elapsed: 3 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\g043oqxanu (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#6 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:09 PM

Posted 21 February 2011 - 10:00 AM

Hello, jarheadchoag.


Step 1

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Please click this link-->Jotti

When the jotti page has finished loading, click the Browse button and navigate to the following file and click Submit.

B:\Documents\Sex\msdtc.exe

Please post back the results of the scan in your next post.

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/



Step 2

Install ERUNT
This tool will create a complete backup of your registry. After every reboot, a new backup is created to ensure we have a safety net after each step. Do not delete these backups until we are finished.
  • Please download erunt-setup.exe to your desktop.
  • Double click erunt-setup.exe. Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes. You can delete the installation file after use.
  • Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.

The automatic part won't work with Vista or W7. Please backup manually using ERUNT with the following instructions:
  • Please locate the ERUNT icon on the desktop. If it is not there, click Start and type ERUNT into the search box.
  • Right click the ERUNT icon in the desktop or the Start menu, and select Run as Administrator
  • Click OK at the first message box.
  • Ensure the checkboxes for both "system registry" and "current user registry" are checked. Leave the default save location in there.
  • Click OK.
  • Click Yes to create the new folder.
  • You'll get a window saying "registry backup complete" once it's done. Click OK. If you get an error message, please STOP here and let me know. Do not proceed with any additional instructions until you check back with me.



Step 3

Please pull anything out of the recycle bin that you want to save. Part of this fix will empty temp files, and that does include the recycle bin.

We need run an OTL Script
  • Please download OTL from one of the following mirrors if you do not still have it.
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Paste the following code under the Custom Scans/Fixes box at the bottom.
    :OTL
    IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:18810
    O4 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000..\Run: [WMPNSCFG] File not found
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
    O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
    :commands
    [EmptyTemp]
    
    
  • Click the Run Fix button at the top.
  • let the program run unhindered and reboot when it is done.
  • You will get a log when it is done, please post that in your reply.
  • Please then create a new OTL report....
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • A report will open, copy and paste it in a reply here.



Step 4

I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image

etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#7 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:09 PM

Posted 24 February 2011 - 06:52 PM

Still with me?


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#8 jarheadchoag

jarheadchoag
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 25 February 2011 - 08:20 PM

Yeah, still here, haven't been on the computer for a while. I will post proabbly tomorrow

#9 jarheadchoag

jarheadchoag
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 26 February 2011 - 04:46 PM

Ok here are the results:

Jotti:
[ArcaVir]
2011-02-22 Found nothing
[G DATA]
2011-02-22 Found nothing
[Avast! antivirus]
2011-02-21 Found nothing
[Ikarus]
2011-02-22 Trojan-Spy.Win32.IamBigBrother
[Grisoft AVG Anti-Virus]
2011-02-21 Found nothing
[Kaspersky Anti-Virus]
2011-02-22 Found nothing
[Avira AntiVir]
2011-02-21 TR/Dropper.Gen
[ESET NOD32]
2011-02-21 Found nothing
[Softwin BitDefender]
2011-02-22 Found nothing
[Panda Antivirus]
2011-02-21 Found nothing
[ClamAV]
2011-02-22 Found nothing
[Quick Heal]
2011-02-21 Found nothing
[CPsecure]
2011-02-22 Found nothing
[Sophos]
2011-02-22 Found nothing
[Dr.Web]
2011-02-22 Found nothing
[VirusBlokAda VBA32]
2011-02-20 Found nothing
[Frisk F-Prot Antivirus]
2011-02-21 Found nothing
[VirusBuster]
2011-02-21 Found nothing
[F-Secure Anti-Virus]
2011-02-22 Found nothing


(I know what file this is, there is a reason it's there. )

ERUNT: Done.

OTL: Fix Log:

All processes killed
========== OTL ==========
HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1512967829-2763226397-4013573042-1000\Software\Microsoft\Windows\CurrentVersion\Run\\WMPNSCFG deleted successfully.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}\ not found.
File {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype-ie-addon-data\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91774881-D725-4E58-B298-07617B9B86A8}\ deleted successfully.
File {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03C514A3-1EFB-4856-9F99-10D7BE1653C0}\ not found.
File {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jared and Caz
->Temp folder emptied: 566026586 bytes
->Temporary Internet Files folder emptied: 20420477 bytes
->Java cache emptied: 73269228 bytes
->FireFox cache emptied: 44839370 bytes
->Flash cache emptied: 2006641 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 782336 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11226609 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 262747511 bytes

Total Files Cleaned = 936.00 mb


OTL by OldTimer - Version 3.2.20.6 log created on 02212011_210028

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


OTL rescan log:

OTL logfile created on: 2/26/2011 1:39:55 PM - Run 2
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Jared and Caz\Desktop
64bit-Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 46.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 186.31 Gb Total Space | 40.97 Gb Free Space | 21.99% Space Free | Partition Type: NTFS
Drive E: | 662.68 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 3.74 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: JARCAZDESKTOP | User Name: Jared and Caz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/02/25 16:56:23 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
PRC - [2011/02/25 16:56:21 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2011/02/19 11:06:58 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Jared and Caz\Desktop\OTL.exe
PRC - [2011/01/25 16:09:24 | 000,546,464 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
PRC - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/12/18 13:02:28 | 000,274,608 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2010/11/24 19:23:35 | 002,069,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgtray.exe
PRC - [2010/11/24 19:23:27 | 000,725,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
PRC - [2010/07/20 15:51:40 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe
PRC - [2010/07/17 19:57:50 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
PRC - [2010/05/14 10:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2008/09/26 11:02:04 | 002,356,088 | R--- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\Updater5\AdobeUpdater.exe
PRC - [2008/01/28 10:43:32 | 000,810,320 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2007/05/28 08:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2007/04/02 23:32:52 | 001,261,568 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
PRC - [2007/03/29 11:29:10 | 003,276,800 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
PRC - [2006/11/17 01:02:00 | 000,032,768 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\V0220Mon.exe


========== Modules (SafeList) ==========

MOD - [2011/02/19 11:06:58 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Jared and Caz\Desktop\OTL.exe
MOD - [2010/12/18 13:02:41 | 000,040,448 | ---- | M] (RealNetworks, Inc.) -- C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
MOD - [2010/12/18 13:02:24 | 000,655,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada\msvcr90.dll
MOD - [2010/12/18 13:02:24 | 000,572,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada\msvcp90.dll
MOD - [2010/08/31 07:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2008/01/19 00:06:50 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2007/02/06 05:45:30 | 000,080,384 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\AEADISRV.EXE -- (AEADIFilters)
SRV - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/07/20 15:51:40 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/17 19:57:50 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2009/04/04 19:42:50 | 000,316,664 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2009/03/29 20:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/03/11 20:36:25 | 000,066,872 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2008/01/28 10:43:32 | 000,810,320 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2007/05/28 08:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2010/09/28 15:44:52 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/07/17 19:58:00 | 000,317,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgtdia.sys -- (AvgTdiA)
DRV:64bit: - [2010/07/17 19:57:44 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgldx64.sys -- (AvgLdx64)
DRV:64bit: - [2010/06/02 17:36:50 | 000,035,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\Drivers\avgmfx64.sys -- (AvgMfx64)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008/12/03 09:38:46 | 000,868,848 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd)
DRV:64bit: - [2008/01/18 23:11:31 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2008/01/18 23:09:56 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\serscan.sys -- (StillCam)
DRV:64bit: - [2008/01/18 22:47:12 | 000,046,080 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2007/09/13 20:40:34 | 000,060,184 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmXlCore.sys -- (WmXlCore)
DRV:64bit: - [2007/09/13 20:40:26 | 000,015,768 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmVirHid.sys -- (WmVirHid)
DRV:64bit: - [2007/09/13 20:40:08 | 000,034,456 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmFilter.sys -- (WmFilter)
DRV:64bit: - [2007/09/13 20:40:00 | 000,022,040 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmBEnum.sys -- (WmBEnum)
DRV:64bit: - [2007/08/15 15:19:42 | 000,208,352 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\V0220Dev.sys -- (V0220Dev)
DRV:64bit: - [2007/06/20 19:57:36 | 000,029,184 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\motmodem.sys -- (motmodem)
DRV:64bit: - [2007/04/03 15:30:46 | 000,420,864 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV:64bit: - [2007/03/05 18:55:48 | 000,012,288 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\V0220Vfx.sys -- (V0220Vfx)
DRV:64bit: - [2006/12/12 21:20:30 | 000,229,160 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\RTL8187.sys -- (RTL8187)
DRV:64bit: - [2006/11/01 05:33:34 | 000,022,832 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\siwinacc.sys -- (SiFilter)
DRV:64bit: - [2006/11/01 05:33:24 | 000,017,200 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\siremfil.sys -- (SiRemFil)
DRV:64bit: - [2006/11/01 05:33:00 | 000,109,872 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\si3132.sys -- (SI3132)
DRV:64bit: - [2006/10/31 07:23:42 | 000,015,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2006/09/18 13:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\Wbem\ntfs.mof -- (Ntfs)
DRV - [2006/12/12 21:20:30 | 000,229,160 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\rtl8187.sys -- (RTL8187)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 E0 24 54 7D 0A CB 01 [binary data]
IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com|www.instapundit.com|http://www.facebook.com/profile.php?id=1259410483&ref=profile|http://www.google.com/ig?refresh=1|https://secure.lds.org/units/home/1,9781,600-1-7-20818,00.html"
FF - prefs.js..extensions.enabledItems: amznUWL@amazon.com:1.0
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000006
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.1
FF - prefs.js..extensions.enabledItems: enquiries@retailmenot.com:2.4
FF - prefs.js..extensions.enabledItems: AmazonHotStuff@wangtom.com:1.1.1
FF - prefs.js..extensions.enabledItems: firefox@facebook.com:1.6
FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.22.4


FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2010/11/24 19:24:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/12/18 13:02:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/02/25 17:23:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/02/25 16:56:28 | 000,000,000 | ---D | M]

[2008/08/27 21:27:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Extensions
[2011/01/16 22:35:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions
[2009/07/02 21:30:31 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/11 04:22:44 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/01/16 22:35:03 | 000,000,000 | ---D | M] (Amazon Button) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\AmazonHotStuff@wangtom.com
[2010/01/23 10:36:19 | 000,000,000 | ---D | M] (Amazon Wish List) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\amznUWL@amazon.com
[2011/01/16 22:35:04 | 000,000,000 | ---D | M] (RetailMeNot) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\enquiries@retailmenot.com
[2011/01/16 22:35:00 | 000,000,000 | ---D | M] (شريط أدوات فيس بوك) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\firefox@facebook.com
[2011/01/16 22:34:55 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\foxyproxy@eric.h.jung
[2009/04/05 08:24:23 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Jared and Caz\AppData\Roaming\Mozilla\Firefox\Profiles\va6dlf9z.default\extensions\moveplayer@movenetworks.com
[2011/02/13 20:09:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/06/10 18:52:54 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/18 06:30:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/13 08:38:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/11/24 19:24:05 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES (X86)\AVG\AVG9\FIREFOX
[2010/12/18 13:02:41 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2009/11/19 13:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/09/15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/19 13:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
[2008/09/28 09:29:27 | 000,284,248 | ---- | M] (Musicnotes, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npmusicn.dll

O1 HOSTS File: ([2009/01/07 09:26:33 | 000,229,841 | R--- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.1001-search.info
O1 - Hosts: 127.0.0.1 1001-search.info
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 8060 more lines...
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [QuickTime] B:\Documents\Sex\msdtc.exe (MS)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [V0220Mon.exe] C:\Windows\V0220Mon.exe (Creative Technology Ltd.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000..\Run: [AlcoholAutomount] C:\Program Files (x86)\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - Startup: C:\Users\Jared and Caz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-1512967829-2763226397-4013573042-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5493/mcfscan.cab (McFreeScan Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: B:\Pictures\100_1116.JPG
O24 - Desktop BackupWallPaper: B:\Pictures\100_1116.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/08/14 08:32:04 | 000,000,000 | ---D | M] - E:\Autorun -- [ CDFS ]
O32 - AutoRun File - [2007/06/14 15:23:01 | 000,263,744 | R--- | M] (Firaxis Games) - E:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2007/07/17 09:11:01 | 000,006,299 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2006/10/05 15:20:43 | 000,000,044 | R--- | M] () - F:\Autorun.inf -- [ UDF ]
O33 - MountPoints2\{2078a8d9-2f99-11df-9d3c-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{2078a8d9-2f99-11df-9d3c-000c41e26750}\Shell\AutoRun\command - "" = R:\LaunchU3.exe -a
O33 - MountPoints2\{59d7eb5d-0aaf-11dd-aaa3-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{59d7eb5d-0aaf-11dd-aaa3-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe -- [2007/06/14 15:23:01 | 000,263,744 | R--- | M] (Firaxis Games)
O33 - MountPoints2\{6a8fcc81-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcc81-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = F:\Launch.exe -- [2006/10/05 15:20:43 | 000,126,976 | R--- | M] (Macrovision Corporation)
O33 - MountPoints2\{6a8fcca1-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca1-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = H:\Launch.exe
O33 - MountPoints2\{6a8fcca2-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca2-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = I:\autorun.exe
O33 - MountPoints2\{6a8fcca3-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca3-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = J:\Autorun\UbiAutorun.exe
O33 - MountPoints2\{6a8fcca4-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca4-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = K:\Autorun.exe
O33 - MountPoints2\{6a8fcca5-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca5-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = L:\Autorun.exe
O33 - MountPoints2\{6a8fcca6-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca6-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = M:\SETUP.EXE
O33 - MountPoints2\{6a8fcca7-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca7-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = N:\SETUP.EXE
O33 - MountPoints2\{6a8fcca8-c161-11dd-92ba-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{6a8fcca8-c161-11dd-92ba-000c41e26750}\Shell\AutoRun\command - "" = O:\Autorun.exe
O33 - MountPoints2\{c53d9e7a-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e7a-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = F:\autorun.exe
O33 - MountPoints2\{c53d9e91-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e91-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = G:\Launch.exe
O33 - MountPoints2\{c53d9e92-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e92-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = H:\Autorun.exe
O33 - MountPoints2\{c53d9e93-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e93-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = I:\Autorun.exe
O33 - MountPoints2\{c53d9e94-1599-11dd-85d8-001e8c50e4a5}\Shell - "" = AutoRun
O33 - MountPoints2\{c53d9e94-1599-11dd-85d8-001e8c50e4a5}\Shell\AutoRun\command - "" = J:\autorun.exe
O33 - MountPoints2\{e4aa29be-02bc-11df-8457-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{e4aa29be-02bc-11df-8457-000c41e26750}\Shell\AutoRun\command - "" = P:\autorun.exe
O33 - MountPoints2\{e5eda2bd-0ac0-11de-a718-000c41e26750}\Shell - "" = AutoRun
O33 - MountPoints2\{e5eda2bd-0ac0-11de-a718-000c41e26750}\Shell\AutoRun\command - "" = Q:\LaunchU3.exe -a
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Launch.exe
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\Autorun.exe
O33 - MountPoints2\J\Shell - "" = AutoRun
O33 - MountPoints2\J\Shell\AutoRun\command - "" = J:\autorun.exe
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\Autorun\UbiAutorun.exe
O33 - MountPoints2\Q\Shell - "" = AutoRun
O33 - MountPoints2\Q\Shell\AutoRun\command - "" = Q:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/02/21 21:08:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011/02/21 21:00:28 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/02/21 20:57:35 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/02/21 20:51:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2011/02/21 20:51:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT
[2011/02/19 11:07:01 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Jared and Caz\Desktop\OTL.exe
[2011/02/13 20:09:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2011/02/09 17:21:26 | 000,456,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shlwapi.dll
[2011/02/09 17:21:19 | 000,710,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011/02/09 17:21:19 | 000,252,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2011/02/09 17:21:19 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2011/02/09 17:21:19 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011/02/09 17:21:19 | 000,072,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2011/02/09 17:21:19 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2011/02/09 17:21:18 | 001,538,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2011/02/09 17:21:18 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2011/02/09 17:21:18 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2011/02/09 17:21:18 | 000,479,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2011/02/09 17:21:18 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2011/02/09 17:21:18 | 000,206,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2011/02/09 17:21:18 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2011/02/09 17:21:18 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe
[2011/02/09 17:21:18 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011/02/09 17:21:18 | 000,162,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2011/02/09 17:21:18 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2011/02/09 17:21:18 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2011/02/09 17:21:18 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2011/02/09 17:21:18 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011/02/09 17:21:18 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2011/02/09 17:21:18 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2011/02/09 17:21:18 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2011/02/09 17:21:18 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011/02/09 17:21:18 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2011/02/09 17:21:18 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2011/02/09 17:21:18 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2011/02/09 17:21:18 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2011/02/09 17:21:15 | 004,699,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2011/02/09 17:21:14 | 001,585,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2011/02/09 17:21:11 | 000,367,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll
[2011/02/09 17:21:11 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll
[2011/02/09 17:21:11 | 000,048,128 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll
[2011/02/09 17:21:11 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll
[2011/01/28 16:54:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/01/28 16:54:07 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/01/28 16:54:06 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2009/06/13 21:54:54 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Jared and Caz\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2011/02/26 13:41:37 | 000,000,434 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{2B6A9691-62FD-4ACB-8142-577060AE1D21}.job
[2011/02/26 12:46:36 | 000,000,000 | ---- | M] () -- C:\Users\Jared and Caz\AppData\Local\prvlcl.dat
[2011/02/26 12:17:53 | 000,003,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/26 12:17:53 | 000,003,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/26 10:23:50 | 071,789,767 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm
[2011/02/26 10:20:47 | 000,008,376 | ---- | M] () -- C:\Users\Jared and Caz\AppData\Local\d3d9caps.dat
[2011/02/26 10:17:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/21 20:57:10 | 000,000,958 | ---- | M] () -- C:\Users\Jared and Caz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/02/19 11:06:58 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Jared and Caz\Desktop\OTL.exe
[2011/02/16 21:33:31 | 000,794,634 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/02/16 21:33:31 | 000,663,486 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/02/16 21:33:31 | 000,133,302 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/02/15 22:20:41 | 000,038,191 | ---- | M] () -- C:\Users\Jared and Caz\Desktop\Rush - The Pass.gp4
[2011/02/13 20:09:45 | 000,001,817 | ---- | M] () -- C:\Users\Jared and Caz\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/02/10 18:03:04 | 000,255,168 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2011/02/21 20:57:10 | 000,000,958 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/02/13 20:09:45 | 000,001,817 | ---- | C] () -- C:\Users\Jared and Caz\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/11/12 18:31:00 | 000,000,255 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2010/11/12 18:31:00 | 000,000,094 | ---- | C] () -- C:\Windows\brpcfx.ini
[2010/11/12 18:30:36 | 000,000,419 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010/07/25 14:17:03 | 000,000,000 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\prvlcl.dat
[2010/04/04 14:00:02 | 000,387,142 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistMSI67C6.txt
[2010/04/04 14:00:01 | 000,010,392 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI67C6.txt
[2010/04/04 13:59:58 | 000,357,918 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistMSI67BC.txt
[2010/04/04 13:59:58 | 000,012,282 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI67BC.txt
[2010/04/04 13:59:32 | 000,011,478 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI6767.txt
[2010/04/04 13:59:29 | 000,011,694 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI675D.txt
[2010/04/04 13:50:42 | 000,381,724 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistMSI60A1.txt
[2010/04/04 13:50:41 | 000,010,624 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\dd_vcredistUI60A1.txt
[2010/03/14 12:02:29 | 000,008,376 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\d3d9caps.dat
[2009/09/11 08:22:03 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009/09/11 08:20:54 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/13 21:55:05 | 000,000,033 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\pcouffin.log
[2009/06/13 21:54:54 | 000,099,384 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\inst.exe
[2009/06/13 21:54:54 | 000,007,859 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\pcouffin.cat
[2009/06/13 21:54:54 | 000,001,167 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\pcouffin.inf
[2009/01/18 17:01:40 | 000,786,632 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2008/12/14 18:46:03 | 000,000,035 | ---- | C] () -- C:\Windows\A5W.INI
[2008/12/14 18:39:43 | 000,000,035 | ---- | C] () -- C:\Windows\Tiny_Run.ini
[2008/05/17 23:33:39 | 000,524,288 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2008/05/17 23:33:39 | 000,139,264 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2008/04/10 21:42:49 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008/04/01 23:06:55 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008/03/14 23:31:42 | 000,027,421 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Roaming\UserTile.png
[2008/03/04 12:59:12 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI
[2008/02/23 11:46:58 | 000,000,136 | ---- | C] () -- C:\Windows\SysWow64\msrkbd.dll
[2008/02/23 10:13:47 | 000,000,092 | ---- | C] () -- C:\Windows\cdplayer.ini
[2008/02/23 10:04:05 | 000,055,808 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/02/22 21:31:32 | 000,024,323 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2008/02/22 21:31:20 | 000,010,288 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2008/02/22 21:24:48 | 000,001,460 | ---- | C] () -- C:\Users\Jared and Caz\AppData\Local\d3d9caps64.dat
[2008/02/22 21:10:42 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2008/02/22 21:10:42 | 000,013,632 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2008/02/22 21:10:35 | 000,012,096 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2008/02/22 21:10:35 | 000,010,304 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2008/02/22 21:08:04 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2007/11/26 20:56:28 | 000,151,415 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2006/03/20 11:43:15 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll

< End of report >


ESET Result: No threats found.



Thanks for all the help!

#10 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:09 PM

Posted 26 February 2011 - 07:09 PM

Hello, jarheadchoag.

I will warn you that file is a data stealing trojan.

Trojan-Spy.Win32.IamBigBrother


I'll leave it be per your request.


Step 1

Next, we need to update Java.
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 24..
  • Save it to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) or Java™ in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version(s) shown below:
    Java 6 Update 3
    Java 6 Update 5
    Java 6 Update 7
    Java 6 Update 22
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u24-windows-i586-s.exe to install the newest version.




Step 2

You are using and outdated version of Adobe Reader. Adobe has since been updated and the update closes many security holes and provides new features.

First, uninstall earlier versions of Adobe Reader.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all versions of Adobe Reader.
  • Check (highlight) any item with Adobe Reader in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Adobe Reader version.

Please download the latest version from:
http://get.adobe.com/reader/download/

And install it. Once installed, launch it, select Help --> Check for Updates and install any updates.


You may also try the free Foxit PDF reader if you prefer:
http://www.foxitsoftware.com/pdf/reader/



Step 3


Your Firefox is out of date as well. The current version is 3.6.13 that closes known security holes viruses take advantage of when compared with your version of 3.6.0. To update, please launch Firefox and select Help --> Check for Updates.




Step 4

How is your computer running at this point?

etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#11 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:09 PM

Posted 04 March 2011 - 06:42 PM

still with me?


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#12 jarheadchoag

jarheadchoag
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 06 March 2011 - 08:41 PM

Yeah, been fighting a virus on my wife's computer, so I got sidetracked. Computer is running better, funny you mentioned that my firefox was out of date, as when I looked it gave me the correct version. Doesn't matter. It's all good now. Thanks for all the help. If only I could find a way to clear out the junk in my registry now. Thanks again for the help.

#13 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:09 PM

Posted 07 March 2011 - 06:04 PM

Often when we clear viruses updates get 'unstuck', so it likely auto-updated. No worries. What junk in your registry are you referring to? We don't recommend automatic registry cleaners are there isn't much benefit and there is risk of an unbootable machine if it gets overzealous.

Let me know and I can help, or we can just clean up.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#14 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:09 PM

Posted 10 March 2011 - 06:41 PM

still with me?


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#15 jarheadchoag

jarheadchoag
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 11 March 2011 - 01:16 AM

I am so sorry I thought I had replied. I am referring to how my computer has gotten slower over time, especially on reboot. It's just annoying and I really am too lazy to format and start over. Wish there was an easier way to go about cleaning it up. If you've got some tips I am all ears and eyes




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users