Hi Sweet Tech,
No worries about the delayed reply. I'm just happy to get some help. I haven't used any financial websites since I got infected. However I'll be changing my email passwords. I'll probably reformat down the line, but I'm at a busy stage of my academic semester so for right now I'll try and solve as is. The first time I tried to run OTM it froze after getting to the last command [createrestorepoint]. Up until that point it had gotten rid of somewhere around 714MB of stuff. However, because it crashed the first report simply stated this:
Files moved on Reboot...
Registry entries deleted on Reboot...
I tried it for a second time, and it worked, but of course nothing was removed or 'moved,' since it had just happened already. Can't get my head around whether the machine is running better now, but my gut feeling is that its running better,but that stuff is probually still lurking around somewhere.
Cheers,
Ryan
TDSS Killer REPORT
2011/02/25 19:04:16.0765 2316 TDSS rootkit removing tool 2.4.18.0 Feb 21 2011 11:08:08
2011/02/25 19:04:18.0395 2316 ================================================================================
2011/02/25 19:04:18.0395 2316 SystemInfo:
2011/02/25 19:04:18.0395 2316
2011/02/25 19:04:18.0395 2316 OS Version: 6.0.6002 ServicePack: 2.0
2011/02/25 19:04:18.0395 2316 Product type: Workstation
2011/02/25 19:04:18.0395 2316 ComputerName: RYAN-PC
2011/02/25 19:04:18.0396 2316 UserName: Ryan
2011/02/25 19:04:18.0396 2316 Windows directory: C:\Windows
2011/02/25 19:04:18.0396 2316 System windows directory: C:\Windows
2011/02/25 19:04:18.0396 2316 Processor architecture: Intel x86
2011/02/25 19:04:18.0396 2316 Number of processors: 2
2011/02/25 19:04:18.0396 2316 Page size: 0x1000
2011/02/25 19:04:18.0396 2316 Boot type: Normal boot
2011/02/25 19:04:18.0396 2316 ================================================================================
2011/02/25 19:04:18.0980 2316 Initialize success
2011/02/25 19:04:37.0619 5812 ================================================================================
2011/02/25 19:04:37.0619 5812 Scan started
2011/02/25 19:04:37.0619 5812 Mode: Manual;
2011/02/25 19:04:37.0619 5812 ================================================================================
2011/02/25 19:04:38.0368 5812 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/02/25 19:04:38.0477 5812 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/02/25 19:04:38.0577 5812 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/02/25 19:04:38.0668 5812 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/02/25 19:04:38.0777 5812 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/02/25 19:04:38.0908 5812 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/02/25 19:04:38.0980 5812 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/02/25 19:04:39.0049 5812 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/02/25 19:04:39.0134 5812 aliide (3a99cb23a2d326fd532618705d6e3048) C:\Windows\system32\drivers\aliide.sys
2011/02/25 19:04:39.0208 5812 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/02/25 19:04:39.0277 5812 amdide (4333c133dbd71c7d7fe4fb1b83f9ee3e) C:\Windows\system32\drivers\amdide.sys
2011/02/25 19:04:39.0370 5812 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/02/25 19:04:39.0436 5812 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2011/02/25 19:04:39.0648 5812 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/02/25 19:04:39.0742 5812 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/02/25 19:04:39.0824 5812 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/02/25 19:04:39.0896 5812 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/02/25 19:04:40.0087 5812 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\Windows\System32\Drivers\avgldx86.sys
2011/02/25 19:04:40.0186 5812 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\Windows\System32\Drivers\avgmfx86.sys
2011/02/25 19:04:40.0470 5812 AvgTdiX (22e3b793c3e61720f03d3a22351af410) C:\Windows\System32\Drivers\avgtdix.sys
2011/02/25 19:04:40.0597 5812 BCM43XV (746f59822a5187510471fc46889b8cc9) C:\Windows\system32\DRIVERS\bcmwl6.sys
2011/02/25 19:04:40.0665 5812 BCM43XX (746f59822a5187510471fc46889b8cc9) C:\Windows\system32\DRIVERS\bcmwl6.sys
2011/02/25 19:04:40.0731 5812 bcm4sbxp (cd4646067cc7dcba1907fa0acf7e3966) C:\Windows\system32\DRIVERS\bcm4sbxp.sys
2011/02/25 19:04:40.0822 5812 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/02/25 19:04:40.0939 5812 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/02/25 19:04:41.0016 5812 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/02/25 19:04:41.0092 5812 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/02/25 19:04:41.0193 5812 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/02/25 19:04:41.0264 5812 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/02/25 19:04:41.0373 5812 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/02/25 19:04:41.0874 5812 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/02/25 19:04:41.0923 5812 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/02/25 19:04:42.0003 5812 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/02/25 19:04:42.0105 5812 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/02/25 19:04:42.0183 5812 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/02/25 19:04:42.0290 5812 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/02/25 19:04:42.0432 5812 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/02/25 19:04:42.0543 5812 cmdide (dfb94a6fc3a26972b0461ab5f1d8272b) C:\Windows\system32\drivers\cmdide.sys
2011/02/25 19:04:42.0606 5812 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/02/25 19:04:42.0722 5812 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/02/25 19:04:42.0876 5812 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/02/25 19:04:43.0043 5812 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
2011/02/25 19:04:43.0275 5812 CVPNDRVA (c23025ac5ae45a105d63bd6e2408edd4) C:\Windows\system32\Drivers\CVPNDRVA.sys
2011/02/25 19:04:43.0415 5812 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/02/25 19:04:43.0498 5812 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/02/25 19:04:43.0592 5812 DNE (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys
2011/02/25 19:04:43.0739 5812 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/02/25 19:04:43.0853 5812 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys
2011/02/25 19:04:43.0999 5812 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/02/25 19:04:44.0108 5812 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/02/25 19:04:44.0202 5812 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/02/25 19:04:44.0351 5812 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/02/25 19:04:44.0449 5812 fanio (0dd24dabb0b8c4ac0d8f2ebf0492276a) C:\Windows\system32\drivers\fanio.sys
2011/02/25 19:04:44.0549 5812 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/02/25 19:04:44.0613 5812 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/02/25 19:04:44.0722 5812 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/02/25 19:04:44.0815 5812 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/02/25 19:04:44.0893 5812 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/02/25 19:04:44.0976 5812 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/02/25 19:04:45.0088 5812 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys
2011/02/25 19:04:45.0155 5812 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/02/25 19:04:45.0254 5812 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/02/25 19:04:45.0316 5812 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/02/25 19:04:45.0539 5812 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/02/25 19:04:45.0643 5812 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/02/25 19:04:45.0756 5812 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/02/25 19:04:45.0817 5812 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/02/25 19:04:45.0955 5812 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/02/25 19:04:46.0103 5812 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/02/25 19:04:46.0167 5812 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/02/25 19:04:46.0246 5812 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
2011/02/25 19:04:46.0451 5812 HssDrv (4f28652ec514fa1ba473bc1a695a5c98) C:\Windows\system32\DRIVERS\HssDrv.sys
2011/02/25 19:04:46.0697 5812 HTTP (0eeeca26c8d4bde2a4664db058a81937) C:\Windows\system32\drivers\HTTP.sys
2011/02/25 19:04:46.0839 5812 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/02/25 19:04:47.0009 5812 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/02/25 19:04:47.0134 5812 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/02/25 19:04:47.0210 5812 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/02/25 19:04:47.0280 5812 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/02/25 19:04:47.0320 5812 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/02/25 19:04:47.0367 5812 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/02/25 19:04:47.0560 5812 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/02/25 19:04:47.0679 5812 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/02/25 19:04:47.0823 5812 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/02/25 19:04:47.0921 5812 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/02/25 19:04:48.0039 5812 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/02/25 19:04:48.0124 5812 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/02/25 19:04:48.0220 5812 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/02/25 19:04:48.0275 5812 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/02/25 19:04:48.0346 5812 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/02/25 19:04:48.0520 5812 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/02/25 19:04:48.0938 5812 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/02/25 19:04:49.0189 5812 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/02/25 19:04:49.0371 5812 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/02/25 19:04:49.0458 5812 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/02/25 19:04:49.0522 5812 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/02/25 19:04:49.0638 5812 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/02/25 19:04:49.0700 5812 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/02/25 19:04:49.0771 5812 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/02/25 19:04:49.0880 5812 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/02/25 19:04:49.0934 5812 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/02/25 19:04:50.0011 5812 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/02/25 19:04:50.0104 5812 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/02/25 19:04:50.0188 5812 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/02/25 19:04:50.0294 5812 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/02/25 19:04:50.0361 5812 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/02/25 19:04:50.0481 5812 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/02/25 19:04:50.0535 5812 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/02/25 19:04:50.0643 5812 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/02/25 19:04:50.0731 5812 msahci (f0ec3a4e0693a34b148723b4da31668c) C:\Windows\system32\drivers\msahci.sys
2011/02/25 19:04:50.0819 5812 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/02/25 19:04:50.0979 5812 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/02/25 19:04:51.0054 5812 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/02/25 19:04:51.0161 5812 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/02/25 19:04:51.0234 5812 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/02/25 19:04:51.0335 5812 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/02/25 19:04:51.0440 5812 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/02/25 19:04:51.0514 5812 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/02/25 19:04:51.0602 5812 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/02/25 19:04:51.0656 5812 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/02/25 19:04:51.0811 5812 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/02/25 19:04:51.0911 5812 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/02/25 19:04:52.0025 5812 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/02/25 19:04:52.0077 5812 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/02/25 19:04:52.0142 5812 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/02/25 19:04:52.0205 5812 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/02/25 19:04:52.0275 5812 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/02/25 19:04:52.0448 5812 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2011/02/25 19:04:52.0549 5812 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/02/25 19:04:52.0635 5812 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/02/25 19:04:52.0726 5812 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/02/25 19:04:52.0833 5812 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/02/25 19:04:52.0943 5812 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/02/25 19:04:53.0010 5812 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/02/25 19:04:53.0448 5812 nvlddmkm (8fe5350fa6a9f0b6633aee811c468954) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/02/25 19:04:53.0990 5812 nvraid (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys
2011/02/25 19:04:54.0089 5812 nvstor (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys
2011/02/25 19:04:54.0208 5812 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/02/25 19:04:54.0414 5812 OEM02Dev (19cac780b858822055f46c58a111723c) C:\Windows\system32\DRIVERS\OEM02Dev.sys
2011/02/25 19:04:54.0480 5812 OEM02Vfx (86326062a90494bdd79ce383511d7d69) C:\Windows\system32\DRIVERS\OEM02Vfx.sys
2011/02/25 19:04:54.0537 5812 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/02/25 19:04:54.0711 5812 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/02/25 19:04:54.0784 5812 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/02/25 19:04:54.0828 5812 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/02/25 19:04:54.0929 5812 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/02/25 19:04:55.0002 5812 pciide (20b869152448f80ac49cf10264e91f5e) C:\Windows\system32\drivers\pciide.sys
2011/02/25 19:04:55.0065 5812 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/02/25 19:04:55.0169 5812 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/02/25 19:04:55.0442 5812 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/02/25 19:04:55.0504 5812 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/02/25 19:04:55.0583 5812 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/02/25 19:04:55.0709 5812 qcusbmdm6k (eea75ef65e3eea3f4a18ac21ef241a0f) C:\Windows\system32\DRIVERS\qcusbmdm6k.sys
2011/02/25 19:04:55.0793 5812 qcusbnmea (eea75ef65e3eea3f4a18ac21ef241a0f) C:\Windows\system32\DRIVERS\qcusbnmea.sys
2011/02/25 19:04:55.0860 5812 qcusbpcsync (eea75ef65e3eea3f4a18ac21ef241a0f) C:\Windows\system32\DRIVERS\qcusbpcsync.sys
2011/02/25 19:04:55.0972 5812 qcusbser6k (eea75ef65e3eea3f4a18ac21ef241a0f) C:\Windows\system32\DRIVERS\qcusbser6k.sys
2011/02/25 19:04:56.0118 5812 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/02/25 19:04:56.0258 5812 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/02/25 19:04:56.0331 5812 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/02/25 19:04:56.0420 5812 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/02/25 19:04:56.0524 5812 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/02/25 19:04:56.0609 5812 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/02/25 19:04:56.0696 5812 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/02/25 19:04:56.0773 5812 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/02/25 19:04:56.0886 5812 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/02/25 19:04:56.0980 5812 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/02/25 19:04:57.0087 5812 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/02/25 19:04:57.0150 5812 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/02/25 19:04:57.0280 5812 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys
2011/02/25 19:04:57.0365 5812 rimsptsk (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\DRIVERS\rimsptsk.sys
2011/02/25 19:04:57.0418 5812 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\DRIVERS\rixdptsk.sys
2011/02/25 19:04:57.0476 5812 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/02/25 19:04:57.0575 5812 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/02/25 19:04:57.0696 5812 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
2011/02/25 19:04:57.0796 5812 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/02/25 19:04:57.0877 5812 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/02/25 19:04:57.0962 5812 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/02/25 19:04:58.0109 5812 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/02/25 19:04:58.0216 5812 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/02/25 19:04:58.0263 5812 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/02/25 19:04:58.0299 5812 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/02/25 19:04:58.0363 5812 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/02/25 19:04:58.0510 5812 Sftfs (cc895997c0995a07b6b2779a3b21918b) C:\Windows\system32\DRIVERS\Sftfslh.sys
2011/02/25 19:04:58.0719 5812 Sftplay (cf5e9798637795db59697f5e40fca993) C:\Windows\system32\DRIVERS\Sftplaylh.sys
2011/02/25 19:04:58.0854 5812 Sftredir (4c8076ff8938b365eeec9123969e0350) C:\Windows\system32\DRIVERS\Sftredirlh.sys
2011/02/25 19:04:58.0955 5812 Sftvol (6095a5f221eca9dada2c9ee80ec0d92d) C:\Windows\system32\DRIVERS\Sftvollh.sys
2011/02/25 19:04:59.0051 5812 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/02/25 19:04:59.0096 5812 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/02/25 19:04:59.0144 5812 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/02/25 19:04:59.0220 5812 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/02/25 19:04:59.0347 5812 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/02/25 19:04:59.0426 5812 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\System32\Drivers\sptd.sys
2011/02/25 19:04:59.0554 5812 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys
2011/02/25 19:04:59.0598 5812 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys
2011/02/25 19:04:59.0641 5812 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys
2011/02/25 19:04:59.0831 5812 STHDA (3cfea727795243364bb6a7f9a091faa3) C:\Windows\system32\drivers\stwrt.sys
2011/02/25 19:04:59.0897 5812 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/02/25 19:05:00.0060 5812 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/02/25 19:05:00.0164 5812 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/02/25 19:05:00.0268 5812 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/02/25 19:05:00.0356 5812 tap0901 (34f1bcb847a924a161422f106a79b9ff) C:\Windows\system32\DRIVERS\tap0901.sys
2011/02/25 19:05:00.0409 5812 taphss (0c3b2a9c4bd2dd9a6c2e4084314dd719) C:\Windows\system32\DRIVERS\taphss.sys
2011/02/25 19:05:00.0472 5812 tapvpn (27a2c318cd28cfb3eb2200fd96af1e58) C:\Windows\system32\DRIVERS\tapvpn.sys
2011/02/25 19:05:00.0569 5812 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys
2011/02/25 19:05:00.0670 5812 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys
2011/02/25 19:05:00.0717 5812 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
2011/02/25 19:05:00.0774 5812 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/02/25 19:05:00.0839 5812 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/02/25 19:05:00.0909 5812 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/02/25 19:05:00.0973 5812 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/02/25 19:05:01.0119 5812 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/02/25 19:05:01.0214 5812 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/02/25 19:05:01.0294 5812 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/02/25 19:05:01.0359 5812 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/02/25 19:05:01.0425 5812 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/02/25 19:05:01.0495 5812 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/02/25 19:05:01.0554 5812 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/02/25 19:05:01.0639 5812 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/02/25 19:05:01.0716 5812 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/02/25 19:05:01.0840 5812 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/02/25 19:05:01.0955 5812 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\Windows\system32\Drivers\usbaapl.sys
2011/02/25 19:05:02.0115 5812 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys
2011/02/25 19:05:02.0192 5812 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/02/25 19:05:02.0271 5812 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/02/25 19:05:02.0352 5812 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/02/25 19:05:02.0388 5812 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/02/25 19:05:02.0453 5812 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/02/25 19:05:02.0514 5812 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/02/25 19:05:02.0583 5812 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/02/25 19:05:02.0632 5812 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/02/25 19:05:02.0684 5812 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/02/25 19:05:02.0751 5812 usbvideo (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys
2011/02/25 19:05:02.0886 5812 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/02/25 19:05:02.0977 5812 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/02/25 19:05:03.0036 5812 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/02/25 19:05:03.0110 5812 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/02/25 19:05:03.0194 5812 viaide (58c8d5ac5c3eef40e7e704a5ced7987d) C:\Windows\system32\drivers\viaide.sys
2011/02/25 19:05:03.0260 5812 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/02/25 19:05:03.0346 5812 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/02/25 19:05:03.0417 5812 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/02/25 19:05:03.0483 5812 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/02/25 19:05:03.0567 5812 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/02/25 19:05:03.0640 5812 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/25 19:05:03.0663 5812 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/25 19:05:03.0720 5812 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/02/25 19:05:03.0806 5812 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/02/25 19:05:03.0931 5812 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
2011/02/25 19:05:04.0052 5812 WinUSB (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\WinUSB.sys
2011/02/25 19:05:04.0209 5812 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/02/25 19:05:04.0347 5812 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/02/25 19:05:04.0444 5812 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/02/25 19:05:04.0566 5812 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/02/25 19:05:04.0726 5812 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/02/25 19:05:04.0732 5812 ================================================================================
2011/02/25 19:05:04.0732 5812 Scan finished
2011/02/25 19:05:04.0732 5812 ================================================================================
2011/02/25 19:05:04.0750 4960 Detected object count: 1
2011/02/25 19:05:38.0186 4960 \HardDisk0 - will be cured after reboot
2011/02/25 19:05:38.0187 4960 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/02/25 19:05:44.0932 4520 Deinitialize success
OTM Report
All processes killed
========== PROCESSES ==========
========== FILES ==========
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
[EMPTYTEMP]
User: Admin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Family
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
User: Ryan
->Temp folder emptied: 98620 bytes
->Temporary Internet Files folder emptied: 32969 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 17015431 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: TEMP
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 3031174 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 19.00 mb
Restore point Set: OTM Restore Point
OTM by OldTimer - Version 3.1.17.2 log created on 02252011_192330
Files moved on Reboot...
Registry entries deleted on Reboot...
OTL Report
OTL logfile created on: 2/25/2011 7:32:47 PM - Run 1
OTL by OldTimer - Version 3.2.21.0 Folder = C:\Users\Ryan\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146.00 Gb Total Space | 25.33 Gb Free Space | 17.35% Space Free | Partition Type: NTFS
Computer Name: RYAN-PC | User Name: Ryan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ========== PRC - File not found --
PRC - [2011/02/25 19:17:32 | 000,577,024 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe
PRC - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/12/11 22:07:09 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/11/30 20:19:06 | 000,268,848 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe
PRC - [2010/11/24 13:54:14 | 000,725,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/10/15 18:42:14 | 000,326,704 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\hsswd.exe
PRC - [2010/10/14 09:23:33 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
PRC - [2010/09/23 10:36:19 | 000,621,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/09/22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010/07/20 18:33:17 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010/07/19 13:31:28 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/07/19 13:31:26 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/07/19 13:30:25 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/04/24 01:10:54 | 000,209,768 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2010/04/24 01:10:44 | 000,483,688 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/02/28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE
PRC - [2010/02/26 05:10:20 | 021,979,992 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2009/11/17 04:07:46 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2009/04/11 06:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2007/03/06 17:38:28 | 000,090,112 | ---- | M] (SigmaTel, Inc.) -- C:\Windows\System32\stacsv.exe
PRC - [2007/02/16 16:58:12 | 000,856,064 | ---- | M] (Christian Diefer) -- C:\Program Files\I8kfanGUI\I8kfanGUI.exe
========== Modules (SafeList) ========== MOD - [2011/02/25 19:17:32 | 000,577,024 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe
MOD - [2010/08/31 15:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
========== Win32 Services (SafeList) ========== SRV - [2011/01/06 10:36:11 | 003,129,432 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\netsession_win_dbc0250.dll -- (Akamai)
SRV - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/11/30 20:20:50 | 000,057,640 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2010/11/30 20:19:06 | 000,268,848 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)
SRV - [2010/10/15 18:42:14 | 000,326,704 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2010/10/15 18:35:30 | 000,352,304 | ---- | M] (AnchorFree Inc.) [Disabled | Stopped] -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2010/10/06 10:31:48 | 000,517,448 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
SRV - [2010/09/22 23:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010/09/22 15:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010/09/22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2010/07/20 18:33:17 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/19 13:31:26 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/04/24 01:10:54 | 000,209,768 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2010/04/24 01:10:44 | 000,483,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/03/18 17:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 17:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/11/17 04:07:46 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2009/09/25 01:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/12/12 17:41:18 | 005,117,568 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2008/12/12 17:41:08 | 000,243,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2008/01/19 07:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/03/06 17:38:28 | 000,090,112 | ---- | M] (SigmaTel, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV)
========== Driver Services (SafeList) ========== DRV - [2010/09/22 23:21:24 | 000,039,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV - [2010/09/22 19:19:02 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hssdrv.sys -- (HssDrv)
DRV - [2010/07/19 13:31:29 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/07/19 13:31:28 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010/07/19 13:30:25 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/05/26 12:08:13 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010/04/24 01:10:54 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV - [2010/04/24 01:10:52 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV - [2010/04/24 01:10:50 | 000,195,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV - [2010/04/24 01:10:44 | 000,550,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV - [2009/11/17 04:07:06 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2009/09/15 20:04:58 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2009/07/22 19:13:20 | 000,028,592 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
DRV - [2009/06/16 18:59:00 | 009,768,640 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/04/11 04:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/04/11 04:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUSB)
DRV - [2008/11/16 10:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008/01/23 21:25:32 | 000,027,136 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tapvpn.sys -- (tapvpn)
DRV - [2007/10/10 22:03:00 | 000,235,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Dev.sys -- (OEM02Dev)
DRV - [2007/10/02 21:30:32 | 000,065,024 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qcusbser6k.sys -- (qcusbser6k)
DRV - [2007/10/02 21:30:32 | 000,065,024 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qcusbpcsync.sys -- (qcusbpcsync)
DRV - [2007/10/02 21:30:32 | 000,065,024 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qcusbnmea.sys -- (qcusbnmea)
DRV - [2007/10/02 21:30:32 | 000,065,024 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qcusbmdm6k.sys -- (qcusbmdm6k)
DRV - [2007/03/21 16:33:46 | 000,534,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2007/03/21 16:33:46 | 000,534,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XV)
DRV - [2007/03/06 17:38:52 | 000,323,584 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/03/05 23:45:00 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
DRV - [2007/02/21 19:48:56 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2007/02/21 19:48:56 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2007/02/21 19:48:56 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007/02/16 09:05:48 | 000,014,464 | ---- | M] (Christian Diefer) [Kernel | System | Running] -- C:\Windows\System32\drivers\fanio.sys -- (fanio)
DRV - [2007/01/18 12:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2007/01/06 05:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2007/01/06 05:59:34 | 000,086,096 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) NVIDIA nForce
DRV - [2006/11/21 09:25:44 | 000,045,568 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/11/15 05:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/15 00:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/14 22:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/11/02 09:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 09:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 09:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 09:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 09:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 09:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 09:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 09:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 09:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 09:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 09:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 09:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 09:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 09:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 09:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 09:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 09:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 09:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 09:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 09:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 09:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 09:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 09:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 09:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 09:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 09:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 09:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 09:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 09:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 09:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 08:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 08:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 08:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 08:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 08:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 08:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 07:41:50 | 000,987,648 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTDPV3.SYS -- (HSF_DPV)
DRV - [2006/11/02 07:41:49 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2006/11/02 07:41:48 | 000,654,336 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTCNXT3.SYS -- (winachsf)
DRV - [2006/11/02 07:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 07:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel®
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://www.google.com/ieIE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
http://www.google.comIE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
http://uk.msn.com/?rd=1IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CC B4 35 02 D8 CB CB 01 [binary data]
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
http://www.google.com/ieIE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
http://www.google.com/ieIE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: {F807FACD-E46A-4793-B345-D58CB177673C}:3.5.3.3
FF - prefs.js..extensions.enabledItems: reader_plugin@ebrary.com:3.2.3.0
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: avg@igeared:6.010.006.004
FF - prefs.js..keyword.URL: "
http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p="FF - prefs.js..network.proxy.type: 0
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/11/24 14:09:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2010/03/06 05:03:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/10/26 09:19:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/20 20:31:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/18 00:07:05 | 000,000,000 | ---D | M]
[2009/09/05 09:46:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Extensions
[2011/02/25 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions
[2010/04/07 06:41:35 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010/04/28 01:25:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/04 08:31:22 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/01/09 23:05:06 | 000,000,000 | ---D | M] (ScribeFire) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
[2009/09/05 10:16:12 | 000,000,000 | ---D | M] (LogMeIn, Inc. Remote Access Plugin) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\LogMeInClient@logmein.com
[2010/03/23 06:48:31 | 000,000,000 | ---D | M] (EBrary Reader Plugin) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\reader_plugin@ebrary.com
[2009/09/05 08:29:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles(125)\23fscdza.default\extensions
[2009/09/05 07:34:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles(125)\23fscdza.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/25 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/22 20:14:27 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/11/24 14:09:28 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
[2010/10/26 09:19:18 | 000,000,000 | ---D | M] ("urn:mozilla:install-manifest" em:id="avg@igeared" em:name="AVG Security Toolbar" em:version="6.010.006.004" em:displayname="AVG Security Toolbar" em:iconURL="chrome://tavgp/skin/logo.ico" em:creator="AVG Technologies" em:description="AVG Security Toolbar" em:homepageURL="
http://www.avg.com" >) -- C:\PROGRAM FILES\AVG\AVG9\TOOLBAR\FIREFOX\AVG@IGEARED
[2010/03/06 05:03:00 | 000,000,000 | ---D | M] (Google Gears) -- C:\PROGRAM FILES\GOOGLE\GOOGLE GEARS\FIREFOX
O1 HOSTS File: ([2011/02/25 19:23:30 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll (AnchorFree Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [{CD869620-BE88-771E-03A9-9345E09944A5}] C:\Users\Ryan\AppData\Roaming\Izipy\duisy.exe (Ueuhtaxhu Owychxl)
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe (Christian Diefer)
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Ryan\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Ryan\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Ryan\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/05/26 12:52:19 | 000,000,000 | ---D | M] - C:\Autorun -- [ NTFS ]
O33 - MountPoints2\{17bd1282-9c7f-11de-ba60-001c238cee27}\Shell\AutoRun\command - "" = wd_windows_tools\setup.exe
O33 - MountPoints2\{2e360a4b-e9ac-11df-90f2-c26bb38aaee3}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bot.vbs
O33 - MountPoints2\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\Shell\AutoRun\command - "" = E:\xedex.exe
O33 - MountPoints2\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\Shell\open\Command - "" = E:\xedex.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ========== [2011/02/25 19:17:26 | 000,577,024 | ---- | C] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe
[2011/02/25 19:11:55 | 000,000,000 | ---D | C] -- C:\_OTM
[2011/02/25 19:10:59 | 000,519,680 | ---- | C] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTM.exe
[2011/02/25 19:03:59 | 001,372,248 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Ryan\Desktop\TDSSKiller.exe
[2011/02/23 12:07:46 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Desktop\www1360.megaupload.com
[2011/02/20 09:24:43 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2011/02/15 09:13:16 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/02/15 00:31:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/02/15 00:30:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011/02/15 00:30:53 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/02/13 12:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate
[2011/02/13 12:30:33 | 000,000,000 | ---D | C] -- C:\Program Files\Seagate
[2011/02/13 12:26:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2011/02/13 11:07:02 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2011/02/13 11:06:58 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSSTDFMT.DLL
[2011/02/13 11:06:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2011/02/13 11:06:57 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
[2011/02/13 10:34:30 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011/02/10 14:06:50 | 000,000,000 | ---D | C] -- C:\Program Files\BBC iPlayer Desktop(0)
[2011/02/07 20:35:13 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\Maritime Terrorism
[2011/02/05 13:31:48 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\28 Days Later Soundtrack
[2011/02/02 13:25:03 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\Flight of the Conchords
[2011/01/28 18:44:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/01/28 18:43:13 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/01/28 18:43:09 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[8 C:\Users\Ryan\Desktop\*.tmp files -> C:\Users\Ryan\Desktop\*.tmp -> ]
[12 C:\Users\Ryan\Documents\*.tmp files -> C:\Users\Ryan\Documents\*.tmp -> ]
========== Files - Modified Within 30 Days ========== [2011/02/25 19:32:08 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2011/02/25 19:29:38 | 000,232,698 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/02/25 19:29:38 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/25 19:29:37 | 000,232,698 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/02/25 19:29:15 | 000,003,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/25 19:29:15 | 000,003,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/25 19:29:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/25 19:23:30 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011/02/25 19:17:32 | 000,577,024 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe
[2011/02/25 19:11:01 | 000,519,680 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTM.exe
[2011/02/25 19:03:17 | 001,257,772 | ---- | M] () -- C:\Users\Ryan\Desktop\tdsskiller.zip
[2011/02/25 19:01:50 | 000,002,377 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/02/25 18:45:02 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3993292540-1094406474-1489134255-1000UA.job
[2011/02/25 18:45:02 | 000,000,000 | ---- | M] () -- C:\Users\Ryan\AppData\Local\prvlcl.dat
[2011/02/25 18:44:33 | 071,738,447 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2011/02/25 18:28:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/25 00:42:17 | 000,309,038 | ---- | M] () -- C:\Users\Ryan\Desktop\Institutional_theories._Pre-draft.pdf
[2011/02/25 00:42:12 | 000,303,779 | ---- | M] () -- C:\Users\Ryan\Desktop\amenta-ramsey-institutional-theory-1.pdf
[2011/02/25 00:42:03 | 000,089,996 | ---- | M] () -- C:\Users\Ryan\Desktop\HayWincot1998.pdf
[2011/02/25 00:41:56 | 000,101,935 | ---- | M] () -- C:\Users\Ryan\Desktop\HalyTaylor1996.pdf
[2011/02/25 00:41:51 | 000,113,523 | ---- | M] () -- C:\Users\Ryan\Desktop\givepeaceachancefinal.pdf
[2011/02/24 23:36:26 | 000,204,024 | ---- | M] () -- C:\Users\Ryan\Desktop\download.pdf
[2011/02/24 23:27:51 | 000,229,490 | ---- | M] () -- C:\Users\Ryan\Desktop\annurev.polisci.11.060606.pdf
[2011/02/24 20:45:01 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3993292540-1094406474-1489134255-1000Core.job
[2011/02/24 14:04:42 | 000,169,892 | ---- | M] () -- C:\Users\Ryan\Desktop\gr3.pdf
[2011/02/24 13:57:49 | 000,271,245 | ---- | M] () -- C:\Users\Ryan\Desktop\2001035663.pdf
[2011/02/24 13:43:50 | 015,134,542 | ---- | M] () -- C:\Users\Ryan\Desktop\540710427.pdf
[2011/02/24 13:39:06 | 000,227,714 | ---- | M] () -- C:\Users\Ryan\Desktop\mcginnis.pdf
[2011/02/24 13:38:56 | 000,229,715 | ---- | M] () -- C:\Users\Ryan\Desktop\DTEP 215.pdf
[2011/02/24 13:32:33 | 004,097,296 | ---- | M] () -- C:\Users\Ryan\Desktop\3117505.pdf
[2011/02/24 13:32:16 | 003,598,086 | ---- | M] () -- C:\Users\Ryan\Desktop\4145329.pdf
[2011/02/23 19:46:33 | 000,001,307 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
[2011/02/23 00:41:01 | 265,047,391 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/02/22 23:55:40 | 000,000,020 | ---- | M] () -- C:\Users\Ryan\defogger_reenable
[2011/02/21 11:09:14 | 001,372,248 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Ryan\Desktop\TDSSKiller.exe
[2011/02/20 21:01:06 | 000,090,112 | ---- | M] () -- C:\Users\Ryan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/20 02:28:02 | 000,429,885 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110220-104535.backup
[2011/02/20 00:39:45 | 000,020,596 | ---- | M] () -- C:\Users\Ryan\Documents\In 2009.docx
[2011/02/17 20:26:23 | 000,000,162 | -H-- | M] () -- C:\Users\Ryan\Desktop\~$ssertation Final.doc
[2011/02/15 00:34:20 | 000,429,885 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110220-022802.backup
[2011/02/15 00:31:02 | 000,001,079 | ---- | M] () -- C:\Users\Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/02/15 00:31:02 | 000,001,055 | ---- | M] () -- C:\Users\Ryan\Desktop\Spybot - Search & Destroy.lnk
[2011/02/13 11:12:37 | 000,001,356 | ---- | M] () -- C:\Users\Ryan\AppData\Local\d3d9caps.dat
[2011/02/13 11:06:58 | 000,000,812 | ---- | M] () -- C:\Users\Ryan\Desktop\SpywareBlaster.lnk
[2011/02/13 02:10:33 | 000,052,736 | ---- | M] () -- C:\Users\Ryan\Documents\Writing Sample 3.doc
[2011/02/12 22:17:25 | 001,019,689 | ---- | M] () -- C:\Users\Ryan\Documents\University of Edinburgh Transcript.pdf
[2011/02/12 21:34:29 | 000,033,605 | ---- | M] () -- C:\Users\Ryan\Documents\Writing Sample 3.docx
[2011/02/12 21:33:01 | 000,051,200 | ---- | M] () -- C:\Users\Ryan\Documents\Writing Sample 2 (Excerpt).doc
[2011/02/12 21:30:18 | 000,036,864 | ---- | M] () -- C:\Users\Ryan\Documents\Writing Sample 1.doc
[2011/02/12 21:29:29 | 000,024,425 | ---- | M] () -- C:\Users\Ryan\Documents\Sanctioned Sin.docx
[2011/02/12 17:15:57 | 000,035,644 | ---- | M] () -- C:\Users\Ryan\Documents\New CV.docx
[2011/02/12 17:15:25 | 000,241,353 | ---- | M] () -- C:\Users\Ryan\Documents\Ryan Jacobs CV.pdf
[2011/02/12 16:33:17 | 000,034,200 | ---- | M] () -- C:\Users\Ryan\Documents\Reality or Hype.docx
[2011/02/12 16:33:13 | 000,031,238 | ---- | M] () -- C:\Users\Ryan\Documents\Diss Writing Sample.docx
[2011/02/07 01:35:37 | 000,045,568 | ---- | M] () -- C:\Users\Ryan\Documents\Political Islam Essay.doc
[2011/02/06 20:25:25 | 000,178,568 | -H-- | M] () -- C:\Windows\System32\mlfcache.dat
[2011/02/02 17:11:20 | 000,222,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2011/01/31 10:44:34 | 000,610,360 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/01/31 10:44:34 | 000,106,470 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/01/28 18:44:29 | 000,001,664 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/01/27 20:24:23 | 000,000,006 | R--- | M] () -- C:\Users\Ryan\Desktop\Sovereignty as a Sacred Cow.docx
[8 C:\Users\Ryan\Desktop\*.tmp files -> C:\Users\Ryan\Desktop\*.tmp -> ]
[12 C:\Users\Ryan\Documents\*.tmp files -> C:\Users\Ryan\Documents\*.tmp -> ]
========== Files Created - No Company Name ========== [2011/02/25 19:03:13 | 001,257,772 | ---- | C] () -- C:\Users\Ryan\Desktop\tdsskiller.zip
[2011/02/25 00:42:17 | 000,309,038 | ---- | C] () -- C:\Users\Ryan\Desktop\Institutional_theories._Pre-draft.pdf
[2011/02/25 00:42:12 | 000,303,779 | ---- | C] () -- C:\Users\Ryan\Desktop\amenta-ramsey-institutional-theory-1.pdf
[2011/02/25 00:42:03 | 000,089,996 | ---- | C] () -- C:\Users\Ryan\Desktop\HayWincot1998.pdf
[2011/02/25 00:41:56 | 000,101,935 | ---- | C] () -- C:\Users\Ryan\Desktop\HalyTaylor1996.pdf
[2011/02/25 00:41:51 | 000,113,523 | ---- | C] () -- C:\Users\Ryan\Desktop\givepeaceachancefinal.pdf
[2011/02/24 23:36:26 | 000,204,024 | ---- | C] () -- C:\Users\Ryan\Desktop\download.pdf
[2011/02/24 23:27:51 | 000,229,490 | ---- | C] () -- C:\Users\Ryan\Desktop\annurev.polisci.11.060606.pdf
[2011/02/24 14:04:42 | 000,169,892 | ---- | C] () -- C:\Users\Ryan\Desktop\gr3.pdf
[2011/02/24 13:57:49 | 000,271,245 | ---- | C] () -- C:\Users\Ryan\Desktop\2001035663.pdf
[2011/02/24 13:43:50 | 015,134,542 | ---- | C] () -- C:\Users\Ryan\Desktop\540710427.pdf
[2011/02/24 13:39:06 | 000,227,714 | ---- | C] () -- C:\Users\Ryan\Desktop\mcginnis.pdf
[2011/02/24 13:38:56 | 000,229,715 | ---- | C] () -- C:\Users\Ryan\Desktop\DTEP 215.pdf
[2011/02/24 13:32:33 | 004,097,296 | ---- | C] () -- C:\Users\Ryan\Desktop\3117505.pdf
[2011/02/24 13:32:15 | 003,598,086 | ---- | C] () -- C:\Users\Ryan\Desktop\4145329.pdf
[2011/02/24 01:09:12 | 000,039,424 | ---- | C] () -- C:\Users\Ryan\Desktop\Korean War Sophie, Ryan.doc
[2011/02/23 01:52:18 | 000,296,448 | ---- | C] () -- C:\Users\Ryan\Desktop\gmer.exe
[2011/02/23 00:33:10 | 265,047,391 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/02/22 23:55:17 | 000,000,020 | ---- | C] () -- C:\Users\Ryan\defogger_reenable
[2011/02/19 15:54:40 | 000,020,596 | ---- | C] () -- C:\Users\Ryan\Documents\In 2009.docx
[2011/02/17 20:26:23 | 000,000,162 | -H-- | C] () -- C:\Users\Ryan\Desktop\~$ssertation Final.doc
[2011/02/15 00:31:02 | 000,001,079 | ---- | C] () -- C:\Users\Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/02/15 00:31:02 | 000,001,055 | ---- | C] () -- C:\Users\Ryan\Desktop\Spybot - Search & Destroy.lnk
[2011/02/13 11:06:58 | 000,000,812 | ---- | C] () -- C:\Users\Ryan\Desktop\SpywareBlaster.lnk
[2011/02/12 22:17:21 | 001,019,689 | ---- | C] () -- C:\Users\Ryan\Documents\University of Edinburgh Transcript.pdf
[2011/02/12 21:34:46 | 000,052,736 | ---- | C] () -- C:\Users\Ryan\Documents\Writing Sample 3.doc
[2011/02/12 21:34:28 | 000,033,605 | ---- | C] () -- C:\Users\Ryan\Documents\Writing Sample 3.docx
[2011/02/12 21:32:59 | 000,051,200 | ---- | C] () -- C:\Users\Ryan\Documents\Writing Sample 2 (Excerpt).doc
[2011/02/12 21:30:16 | 000,036,864 | ---- | C] () -- C:\Users\Ryan\Documents\Writing Sample 1.doc
[2011/02/07 02:03:19 | 000,031,238 | ---- | C] () -- C:\Users\Ryan\Documents\Diss Writing Sample.docx
[2011/02/07 01:35:36 | 000,045,568 | ---- | C] () -- C:\Users\Ryan\Documents\Political Islam Essay.doc
[2011/02/06 20:25:25 | 000,178,568 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011/01/28 18:44:29 | 000,001,664 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/01/27 20:26:18 | 000,000,006 | R--- | C] () -- C:\Users\Ryan\Desktop\Sovereignty as a Sacred Cow.docx
[2010/05/31 23:02:22 | 000,003,252 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\glide_wrapper.zbag.ini
[2010/02/09 06:22:30 | 000,000,000 | ---- | C] () -- C:\Users\Ryan\AppData\Local\prvlcl.dat
[2009/11/17 04:08:34 | 000,197,424 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2009/08/03 07:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/07/13 14:19:43 | 000,090,112 | ---- | C] () -- C:\Users\Ryan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/09 17:54:55 | 000,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
[2009/07/07 15:07:44 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2009/07/07 15:07:42 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2009/07/07 15:07:42 | 000,755,027 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009/07/07 15:07:42 | 000,159,839 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009/07/07 15:07:40 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009/07/07 15:01:48 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009/06/28 15:26:23 | 000,232,698 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/06/28 15:26:23 | 000,232,698 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/06/28 12:49:35 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/06/28 03:28:34 | 000,065,536 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2009/06/28 03:14:47 | 000,001,356 | ---- | C] () -- C:\Users\Ryan\AppData\Local\d3d9caps.dat
[2009/06/28 02:42:45 | 000,027,240 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\nvModes.001
[2009/06/28 02:42:29 | 000,027,240 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\nvModes.dat
[2009/06/27 15:57:53 | 000,139,152 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\PnkBstrK.sys
[2009/06/27 15:56:58 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini
[2009/06/27 14:50:48 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2009/06/27 14:38:27 | 000,006,656 | ---- | C] () -- C:\Windows\System32\stacutil.dll
[2006/11/02 07:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[1997/03/31 16:00:00 | 001,664,272 | ---- | C] () -- C:\Windows\System32\MSO97V.DLL
[1997/03/31 16:00:00 | 000,022,016 | ---- | C] () -- C:\Windows\System32\DOCOBJ.DLL
[1997/03/31 16:00:00 | 000,016,384 | ---- | C] () -- C:\Windows\System32\MSORFS.DLL
[1997/03/31 16:00:00 | 000,012,288 | ---- | C] () -- C:\Windows\System32\HLINKPRX.DLL
========== Alternate Data Streams ========== @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34
< End of report >
OTL Extras Report
OTL Extras logfile created on: 2/25/2011 7:32:47 PM - Run 1
OTL by OldTimer - Version 3.2.21.0 Folder = C:\Users\Ryan\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146.00 Gb Total Space | 25.33 Gb Free Space | 17.35% Space Free | Partition Type: NTFS
Computer Name: RYAN-PC | User Name: Ryan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3993292540-1094406474-1489134255-1000]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A77B9F8-E04B-499C-8087-719A81EFEE05}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{3942F095-6692-4BCE-B407-51CC2C185F22}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{3FB4E4A7-61CE-44EE-BF56-7D1CDC6DE2BB}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface |
"{4946DB00-F8ED-4C85-B38E-D8AE4F7C3D3A}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{62B2822E-8297-46C1-A7A6-10434E16034C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{92952832-4A18-49EA-9F22-261A5524382B}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00B5350F-95FA-4F72-A7F1-4C0D52701DCB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{00DB21FB-C91B-4E43-BB16-4D5E839F463D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0145B11A-73C0-4C83-8690-CC3959487FB2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{01C50B43-0DDB-4876-80A8-B60924BD1977}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{02571AD0-6C6D-414D-8077-72D41A3DCA48}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{046ACE34-6436-4740-B74D-92AF992B9DBE}" = protocol=58 | dir=in | app=system |
"{051AEC8D-81BB-4579-B9A2-06D6C9D1E7FA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0522C5E7-2EE5-42A7-A277-FC26E3C3F24A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{05C155A1-F691-4BBE-A453-1C8A21F7314D}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{07630A65-18A7-4190-98C0-7B1F7287D7D0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{085B775E-43AE-4DDB-84CE-05F4F9EC3035}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{08C45AA7-53C0-481C-9265-7D47917D5F23}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{09576652-53B5-413B-9BB6-76944AE7174A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0A793835-FF87-48BD-AC98-A7E8C020887C}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe |
"{0B1EE191-0018-4BC1-AD48-981ED23B2944}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{0C0F3220-BC02-4243-9C4E-0A1EA4C34E08}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0C44A97F-4671-4F07-8A99-9DF443B16B4D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0D3A1AC6-DDA8-4EBE-91CA-F9CD49C63B1B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0DF5A90A-15F9-45F5-86E8-54BAD16C54A3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0E19219C-C98E-4FD9-AA01-5098CD526873}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0FB7C812-30B4-48EB-A004-FBF080E6AE93}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{10E351E9-2C68-496C-A8BD-442DA087FBEA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{11C91010-8AFA-4177-BCB1-3D7B17D0FCBB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{13EC2D9E-C310-4677-B443-6981BB2F78A7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{140A5ACE-E76B-49CB-BE7E-7D66065E8376}" = protocol=6 | dir=in | app=c:\program files\codemasters\of dragon rising demo\ofdr demo.exe |
"{14276405-69CD-4729-982F-EEF897BE91A8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{147601C6-B325-4BC8-8CB7-2F1FAC3296E0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{15FD1F2D-3DD3-4749-8526-70E90C3F9091}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{17289404-5D59-4157-A69C-440D66FCF76F}" = protocol=17 | dir=in | app=c:\program files\codemasters\of dragon rising demo\ofdr demo.exe |
"{18B7F42D-7BF0-4A2B-9508-60F96CDC6652}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{18ECF970-634F-408F-AF19-58AB06746F3D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{19616FCA-3082-4532-BFE0-5A3E99047891}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{1A2ACBB9-EFDC-4556-8C28-73D4622975A3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1DCFFE08-2256-4607-A9D6-0B38BFCF565D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1E4DA9AF-FF5B-4749-9A9A-BF24EBED4FB2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1EC0EC3C-C4F4-402E-BC47-3AE02B621950}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{213B5D41-924B-4519-9DF2-812B651DE43C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{21B2EC82-1EB6-4CAA-A6E7-3E2B8136C149}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{227687DE-AE54-4293-AB5D-C3BB5DD0AD7D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{24B27F9A-8E7D-4303-94FB-2F663F24B444}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{257A6779-1CDA-4C76-BB61-F6C1F96070E2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2629C439-C554-4112-A2B6-CD1C882FFE0E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2651245B-88D9-4E0C-BF0E-9621233076D3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{28C66B6C-5B28-469B-9D7C-867D653678EC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{28E8EB08-C910-4C9F-8274-A8DF10108C24}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2D4CFB25-AFB2-4970-B133-C5F8C3E5D8C7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2F905AD0-8494-4EAA-BB85-81664BEAC66C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{316FB50D-CECF-405E-8459-B112C6657434}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{326768EC-3AEC-4A54-B5FA-4D70B8997DB8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3306DDB1-DAEC-4369-84B1-0682EEB756D8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{34E662DE-B967-44BF-8D87-C3026BF4B28A}" = protocol=6 | dir=in | app=c:\program files\times reader\times reader.exe |
"{35B9D56A-18C2-46AA-9B92-C4ECF737CF74}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{389E5005-8B1F-4597-9F73-4F9A1F7E1DA2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{394CDA7A-D272-4501-B2AF-7346062F3C20}" = protocol=6 | dir=in | app=c:\program files\xfire\xfire.exe |
"{39C34977-FCF3-41EF-B402-1AB27A9881DA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{39C8226A-1AB1-4CAF-B7D7-173CF157D72A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3A0AE903-B719-411C-966B-085D6B24B01F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3B30ECEA-EB33-4F28-BE1C-2ECEDE0ADF74}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3B798D3F-864F-4DBC-B4E3-C817C2C27EF2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3D2483D8-258C-4C28-8336-C2E770F8EDAA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3D2F3674-CF76-4208-A7C6-C9634156D07F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3D7488E2-AAC6-496F-BFAD-76AF58EC8B01}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3DCD917E-DB71-42F3-98D1-42F987D17A13}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{402DA075-6D0B-4571-B17A-8885FA8B824C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{428F233B-C0FC-4B22-BD28-7BE7043AEEDF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4489C859-4653-43AC-9B65-8EF9B862F34B}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3sp.exe |
"{4495949E-4E85-4449-B13C-5BA54C07E266}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4955790E-FB11-4594-9199-53328321C29D}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"{4C05D05F-984A-4B14-A104-784F597255B7}" = protocol=17 | dir=in | app=c:\program files\xfire\xfire.exe |
"{4C2B1B47-5886-495B-907D-EBD49C9098EE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4E9B8195-D8BD-40B5-B520-9BF4ABD7F846}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4F3CBDD6-A0EE-4AD6-88B7-015C4E147D9F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4F5C8FEE-3846-400F-854F-07705AC93CD7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{506C7D21-0917-4A6C-9298-8B1BDC3EB730}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{50EAC5B4-9E20-4822-B71B-31393D360127}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{557924B3-322D-4E3F-B119-0865F31BCD8E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{569BD81A-40D0-40C0-B8AA-1C1A1918CC5F}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{57544525-EF0A-422F-8B27-A68817B3DF4D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5889062B-E24A-4BEF-9860-B577B188893C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5CCF3E1C-3B87-4797-81CB-DA709AF8929F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5EE63752-E361-421D-A1D4-D3351ECEB09F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{61E55829-F9BC-4810-9A8C-C07025D9C77D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6256D938-D904-4A58-A477-0155F0C1EA24}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{643BBCEE-1D67-4B99-852C-6EA9A93C347B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{653624F4-5028-4017-888D-722831B5B34D}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe |
"{66CBB1E6-4373-474C-B083-24729AFB1F21}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6902211F-958E-4A05-9756-BFBE2B3E08F9}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{695691A1-3D2F-4AE4-B933-A2682D1A09F0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{69B3316C-A131-4EFD-A95E-60DB0FA5DCE0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6ADF704F-E6BA-43AB-9A1A-6BC4DF09BCA0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6C253639-5B0A-474B-B6F8-B1192BFAEF57}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6D6DB21F-D44D-481A-8EC1-754424D854B5}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{6E003188-D25C-49D5-BA2D-44E29E25BBE1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6E330D85-4C6D-48E7-8AA5-911920650B0B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{712DE252-0A0A-4118-96F3-EC297783E1D2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{71B1D024-226E-455B-8D46-CDEE1F2A086E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{73DCA048-990F-4718-BDD8-E5CD573E4EAF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{74B39E5F-BA4D-45F8-8C9C-D9E05B7CD8B7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{757D34B4-3064-46FB-A1CA-4B77D7488F56}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{75AB0E5D-E42B-470D-BC4A-4811A54E22FE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7675A103-9020-4E53-B5B1-1EE21FA1FEFC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{78F945C6-E8FC-47E1-8DD9-A7E51346D393}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7917E46F-E8A0-4756-9D00-49FDF3A5B60C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{79598718-2957-4CC0-AC59-9E14AC9C9269}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7A2634E4-33F0-4CA8-92FB-F0E5935D4B36}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{7BDE84FE-EF2D-40EE-839C-6D0DABACC5B9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7C3E53B3-B296-46BD-B60C-172E672BA7BA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7D34071F-CAAC-441C-A081-D3BC16D3AA6D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7E41D932-D593-4D9A-958F-7D8159972E6F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{81FB3DF2-044A-4E6B-AE47-64F912350EDE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{82ABDAF1-1B92-4CA7-AE26-3FC4DFBA0550}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{84BCEE33-6D94-4A49-93E9-9E5978958752}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{85EE2D61-C6E8-4706-A406-CF9AF827DC34}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{865F2EA6-3603-444D-B685-5C2922D373DB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{86731CBF-D337-4A96-8C7B-55B8C587C89C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{871E9A8B-D015-41B8-8ACD-35A549DC712F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{87903D1B-87B5-403E-9EA3-DD5CCFB13E7C}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe |
"{883CD6A5-4FA9-4A00-8DEB-25FA9F97528B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8945C712-4E0A-452C-93CC-CFE07417A2BC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{89F06635-EDD2-4E5D-B8F2-EA8EE9EA23A8}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{8BB85181-26DF-4D60-B720-5702290E13F8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8C64FDA3-B16D-4293-AFC9-DD288DA30A5E}" = protocol=17 | dir=in | app=c:\program files\google\google talk\googletalk.exe |
"{8DAC3CCC-81B3-4732-A06B-3F528280B918}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8DBE73FD-D005-414B-815B-F2335095AC1F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8DCEF65D-31FC-4B09-94E1-8A1775763224}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{91759C7D-7C8A-4320-B6E4-64E495B82278}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{92611D40-AF49-4430-B08E-D91F4B4E3468}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9308B61D-9FE6-47EB-B926-092FF9593449}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{94930F0E-9D86-4652-907B-C45B1AC6F897}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{95321B2E-6DDF-4705-807F-81C20A7A99EE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9612D2FB-DC57-4B9F-8582-4680A9D28191}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{974B4029-F091-4836-82C3-00B8BDCEE0B4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{98AABA41-F5B1-47D2-AE70-3F6DC82BD660}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{99679130-A83D-4974-B8E9-3D0992FD4B6A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{996FF0B6-FE02-4DE1-B2FD-9D61987D2593}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9972508A-5A80-489C-81DF-7D91E0AFC15E}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{9BACF5FE-4A50-4519-94AC-1E7C04BD15AE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A0D5AFAD-C532-40D3-AAFE-966BAC2BD289}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A2508804-38E7-4AA7-B92E-8EA8CDC75ECB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A3DDA781-8780-41D3-8260-029A829EE282}" = dir=in | app=c:\program files\avg\avg8\avgnsx.exe |
"{A4935A5E-F01F-466B-9B72-BCFB417DDB42}" = protocol=17 | dir=in | app=c:\program files\hotspot shield\bin\openvpntray.exe |
"{A5C70B3E-87FF-470D-8E01-B450EEC25845}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A625A1C7-F744-4726-A9BA-CA0E90E1EBDF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A7A895B3-AA9F-4C0A-AF83-F6F5CCFA2957}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-203 |
"{A803C427-0C64-48EE-9987-1CF3D99216FD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A98540D0-2487-46DC-A9BC-B00612DC4F75}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{AA067E89-4C2E-47CE-9806-EE05E7FC9205}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AB0F86D6-F060-4612-A384-D53DCDD52885}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AC2F3636-4530-4B66-B4B4-85A826B467F4}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{AC72A397-283F-4223-9244-EFF7A2C8BE09}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{ADC23AF5-E665-460F-8082-9714E98A5CFF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AEA845EC-7E5D-4F0E-8EB5-0A7825BFB354}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AF5C16FF-F746-48EA-BCED-70B6F4196B0D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B11DE33B-DCD5-4171-B0C6-0E7332F060F1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B28EF686-871B-4445-99FB-260458F76BB3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B4025046-27CD-44CA-A79D-76BB64D0F9DD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B43CF019-DF84-4206-924B-42C086E00DC1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B4B6B4DC-EF7F-46E2-BE58-BF95AFF554C2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B5DB1306-21FF-4A48-AEBF-65AC4C25FB2E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B81AF0FC-1FEC-4190-BFF4-3ECA9D7A7F5C}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe |
"{BAB3C3EF-8CAA-456E-AB56-650C83A14055}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BB4A1200-A8D9-4F9B-8CD0-7C0002CFBEC2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BB6B508F-4D82-4266-927B-F74C4AF03060}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BB7C7268-B03B-4A70-8621-9F35E7E5566E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BFF0091D-C512-4276-B002-0F736674D4F7}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{C068F382-6749-40BA-8610-5F6131407C8D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C0CAAC36-98E3-40BD-9737-26204ED69CF1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C1451F8A-5EE0-4FB9-9DFC-0AFBA3B52BDE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C14E4B20-731B-4FAC-9F0E-CB245D0D8456}" = protocol=6 | dir=in | app=c:\program files\hotspot shield\bin\openvpntray.exe |
"{C2BE5B53-22FB-4BF2-A936-EFA718734A9D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C4F67340-03AB-4A27-A191-6405E2ED09A9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C6D41A0E-AD54-4A11-AF26-476634C9BC40}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C6D48F07-CFE6-4C39-AB9F-775A52E3615F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C935D6AC-A742-4F7B-B047-2586C366E2AB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CD02FAF6-BDD9-4D41-97D9-42FFE7B80333}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CD3BBBC0-789B-4FD6-8B37-EE8D9F283FE6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CDDAA643-BE02-48AA-A051-BFC33330A197}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CE2FA8DA-8242-46E4-A85F-B349668E500D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D02DB565-A020-4939-90E0-C9689A358E9F}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3sp.exe |
"{D0C080FB-7DF9-4F71-9F78-ABE903E95031}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{D0D4440E-2CD3-4C16-BC2C-AE508308D38A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D1362C25-E3E3-489C-B26F-F754EFA7AF33}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D1BAE39D-CA88-4F2A-815E-26D8A5A34CB1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D1F581A1-CD29-4DCB-8FAE-F34D882E9DD9}" = protocol=6 | dir=in | app=c:\program files\google\google talk\googletalk.exe |
"{D2E89EA4-70AD-4BEF-81E6-0A4560F3E12F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D68BC2E5-0B22-4D8E-BD25-2A5EC1FF261C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D68E5C4E-6891-42F5-B20A-97A3B6E2013C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D7EBC865-4952-4756-813F-C21E0356AC87}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D910E148-1811-4F29-A99B-F760B399AC78}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DBBFD6C5-48A5-4D74-803E-06D37E06961F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DDA0F214-EFA3-4255-9F85-D89C4D78CA1E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DDEE8A73-F841-41CF-AAAB-60DC91F9C4AE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DFED2570-6364-4F1B-B07F-2CE074E82A2A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E1D93E4E-B96C-4FFE-AB0E-43EE752AB9D0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E2735577-93DB-450E-924A-304483DBF653}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E2D131D7-A161-4D79-9DF3-4D371D38AF12}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{E3400867-687A-4B6E-86ED-421EB3C5D05A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E37B3555-DD4A-4F02-92D7-B706F3E6250C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E383941B-F581-476D-A319-13BCD6AB51E1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E397C84A-EF82-4544-97F2-E6248CEE8372}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E3EEA279-3459-4235-9442-05114052DF29}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E45585D9-60AC-487C-B0DD-9B396BC8E7B3}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{E49D7EC5-920C-489A-8D89-ADDC72087BC3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E612161F-45AE-4B67-9AA9-1A0EFB4BB380}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E8B06FFD-11FE-41AD-9943-1B5041BD9DF0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E8C22D22-8270-479B-B5EB-61B42068F1B6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E942BE05-71DE-49CD-92BE-582C6DE2E5A5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E9856751-6D93-48C7-8BDB-F18D22844DFF}" = protocol=17 | dir=in | app=c:\program files\times reader\times reader.exe |
"{E9E124B4-18DC-42F9-BFFB-A7EFB68781BC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EB002A42-C2D8-4DB8-BD3A-9C4FCBF23AF1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{ECE7721B-A550-489F-9A8A-1946C28A451E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EDC19086-05D4-451F-B570-7F530D8713EA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F17F6ACC-D3C7-4A64-85DB-9E5EFA52B7E0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F1AD0153-5BFD-48FD-BDDF-44DFE976D68F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F581EE16-53AD-43B9-982E-319E697EEDC3}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{F584D96A-FE57-4794-AD36-A642BFC38984}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\america's army 3\binaries\aa3game.exe |
"{F5FC1599-9AA6-4FFB-BC58-8A303F3B3A3F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F78747B9-4991-492B-A7B5-135F1F0C07F6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\america's army 3\binaries\aa3game.exe |
"{FB30ED30-207E-40A8-AA3E-86415F82AC55}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FC369B67-15E6-486E-BEC2-8CA88CD2106D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FE01074D-A6C1-44BF-8604-CA06E0A44DBD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FF70F830-9E15-4D2D-AB1C-B94C09C58153}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{072D7519-8EF3-49EA-A811-CBD7B912E03D}C:\program files\livestation\livestation.exe" = protocol=6 | dir=in | app=c:\program files\livestation\livestation.exe |
"TCP Query User{176F384C-CF72-41C2-946D-331BBE344BA0}C:\wic\world in conflict\wic.exe" = protocol=6 | dir=in | app=c:\wic\world in conflict\wic.exe |
"TCP Query User{1FBF0C8A-AB59-4BD1-A5EB-70391C45776D}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{25D74DC0-C2FF-47A2-9AFA-183CD071E91E}C:\users\ryan\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe" = protocol=6 | dir=in | app=c:\users\ryan\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe |
"TCP Query User{2A38E6C1-438B-4A5A-A0BC-7F43F919DE08}C:\program files\livestation\livestation.exe" = protocol=6 | dir=in | app=c:\program files\livestation\livestation.exe |
"TCP Query User{529C4176-F8EE-41E0-B3E2-DB9D602595AA}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{5C87CE5B-B6EF-4FE1-9E78-CB9C3E8A034F}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{5E27DAF5-ADB5-4D8C-903A-AAD18EC5C2BB}C:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{65339460-617F-4D78-99BC-4F52175028AA}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"TCP Query User{6692207B-56A1-42A2-AD12-CCAA33AF7764}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{7431CC5A-4315-4B07-99E6-875BC6DD462E}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{DB35A70A-822D-42D6-87B4-D11EF0C94A92}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{F59AC357-D8FA-4735-838B-40B64CB1D47F}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{38B11167-40C0-40FB-824B-977CB7F95635}C:\program files\livestation\livestation.exe" = protocol=17 | dir=in | app=c:\program files\livestation\livestation.exe |
"UDP Query User{3D74A165-6AD0-432F-B29A-2257C13324A8}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{4AB0A833-C60B-4130-A950-2335A61A113C}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{71683BB7-F366-43BB-B4AE-99E63EAC69C7}C:\users\ryan\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe" = protocol=17 | dir=in | app=c:\users\ryan\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe |
"UDP Query User{78D5A0D5-3D8B-4B83-99B6-903C20308F40}C:\program files\livestation\livestation.exe" = protocol=17 | dir=in | app=c:\program files\livestation\livestation.exe |
"UDP Query User{791BBF50-29DB-41FE-9795-F024DBB08A75}C:\wic\world in conflict\wic.exe" = protocol=17 | dir=in | app=c:\wic\world in conflict\wic.exe |
"UDP Query User{7E353F6E-C129-4775-9B6C-6AB8CB2B8345}C:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{8F3CDA79-0013-483C-9E9E-3F30B33977EC}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{9A16AB1B-DF7C-4E03-AC6B-40B57ED1A89B}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{A9DD381C-E342-434B-B64F-AFBE91EA393E}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{AC0F8D9B-3ED4-474F-8F38-944711CC9044}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{E683690B-C012-4B73-A36B-42C32EA6D68B}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"UDP Query User{EB2204B1-A964-4B38-89A3-8092D1C94240}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{005F78AF-110D-398A-8430-BE98950A1E22}" = Google Talk Plugin
"{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0AFA293A-5C49-4B3B-A2A3-1E9EF19FBEFD}" = Flow
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{13228AA7-9DD0-7774-9143-DAE4AA73DC12}" = BBC iPlayer Desktop
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}" = Cisco Systems VPN Client 5.0.06.0160
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java 6 Update 17
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{2FB1052B-2F3D-48CE-A65D-006240516ECE}_is1" = Office 2010 Trial Extender version 1.0.0.3
"{331C9768-BAD9-F31B-8DA2-0268D346C702}" = Times Reader
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{612B9183-67A9-4B44-9877-2F059E35B86A}" = Broadcom 440x 10/100 Integrated Controller
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-006D-0409-0000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{90140011-0061-0409-0000-0000000FF1CE}" = Microsoft Office Home and Student 2010 - English
"{90140011-0062-0409-0000-0000000FF1CE}" = Microsoft Office Home and Business 2010 - English
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A1BF9950-8CDB-468E-83FA-EACFB00EA7D5}" = Windows Live Sync
"{A436BE6E-A20F-41B8-ABD7-851AAD42FF8D}" = Livestation
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{AC76BA86-7AD7-2448-0000-900000000003}" = Chinese Traditional Fonts Support For Adobe Reader 9
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B73BEEBE-3D94-2634-B5D1-28B8269489FF}" = twhirl
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF67CB0E-6E9A-49AA-805E-D7ABD15E4FCA}" = WP-S1 PCSync
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F9766AC1-1461-1033-B862-DF8FE1C033BE}" = Adobe InDesign CS5
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF70513F-E3A7-402F-84FB-B7810A064BE2}" = Zune
"8461-7759-5462-8226" = Vuze
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Akamai" = Akamai NetSession Interface
"AVG9Uninstall" = AVG Free 9.0
"Badaboom" = Badaboom 1.2.1.7
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1" = Times Reader
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"CutePDF Writer Installation" = CutePDF Writer 2.8
"de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1" = twhirl
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"Google Updater" = Google Updater
"HotspotShield" = Hotspot Shield 1.56
"I8kfanGUI" = I8kfanGUI V3.1
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty® 4 - Modern Warfare 1.4 Patch
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty® 4 - Modern Warfare 1.5 Multiplayer Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare 1.7 Patch
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.0.0 (Full)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"OpenAL" = OpenAL
"Picasa 3" = Picasa 3
"SpywareBlaster_is1" = SpywareBlaster 4.4
"TED Notepad" = TED Notepad
"Viewer97" = Microsoft Word Viewer 97
"VLC media player" = VLC media player 1.1.5
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Zune" = Zune
========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Facebook Plug-In" = Facebook Plug-In
"GoToMeeting" = GoToMeeting 4.1.0.366
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
========== Last 10 Event Log Errors ========== [ Application Events ]
Error - 7/2/2010 10:33:21 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6224
Error - 7/2/2010 10:33:22 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 7/2/2010 10:33:22 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7238
Error - 7/2/2010 10:33:22 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7238
Error - 7/2/2010 10:33:23 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 7/2/2010 10:33:23 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8252
Error - 7/2/2010 10:33:23 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8252
Error - 7/2/2010 10:33:24 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 7/2/2010 10:33:24 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9266
Error - 7/2/2010 10:33:24 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9266
[ Broadcom Wireless LAN Events ]
Error - 2/18/2011 6:29:11 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 10:29:11, Fri, Feb 18, 11 Error - Unable to gain access to user store
Error - 2/19/2011 8:33:17 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 12:33:16, Sat, Feb 19, 11 Error - Unable to gain access to user store
Error - 2/20/2011 5:13:31 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 09:13:31, Sun, Feb 20, 11 Error - Unable to gain access to user store
Error - 2/20/2011 6:15:13 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 10:15:13, Sun, Feb 20, 11 Error - Unable to gain access to user store
Error - 2/22/2011 12:53:30 PM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 16:53:30, Tue, Feb 22, 11 Error - Unable to gain access to user store
Error - 2/22/2011 8:33:36 PM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 00:33:36, Wed, Feb 23, 11 Error - Unable to gain access to user store
Error - 2/22/2011 8:41:25 PM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 00:41:25, Wed, Feb 23, 11 Error - Unable to gain access to user store
Error - 2/22/2011 8:41:57 PM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 00:41:57, Wed, Feb 23, 11 Error - Unable to gain access to user store
Error - 2/25/2011 6:50:40 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 10:50:40, Fri, Feb 25, 11 Error - Unable to gain access to user store
Error - 2/25/2011 7:30:55 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 11:30:55, Fri, Feb 25, 11 Error - Unable to gain access to user store
[ System Events ]
Error - 2/25/2011 11:40:47 AM | Computer Name = Ryan-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.64 for the Network Card with network
address 001C26264FB3 has been denied by the DHCP server 10.200.2.5 (The DHCP Server
sent a DHCPNACK message).
Error - 2/25/2011 11:59:28 AM | Computer Name = Ryan-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.200.3.21 for the Network Card with network
address 001C26264FB3 has been denied by the DHCP server 10.200.2.5 (The DHCP Server
sent a DHCPNACK message).
Error - 2/25/2011 12:01:47 PM | Computer Name = Ryan-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.200.3.21 for the Network Card with network
address 001C26264FB3 has been denied by the DHCP server 10.200.2.5 (The DHCP Server
sent a DHCPNACK message).
Error - 2/25/2011 12:05:44 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 2/25/2011 2:23:42 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7011
Description =
Error - 2/25/2011 2:24:06 PM | Computer Name = Ryan-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.200.3.21 for the Network Card with network
address 001C26264FB3 has been denied by the DHCP server 10.0.0.138 (The DHCP Server
sent a DHCPNACK message).
Error - 2/25/2011 3:07:44 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 2/25/2011 3:11:55 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7034
Description =
Error - 2/25/2011 3:23:30 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7034
Description =
Error - 2/25/2011 3:29:27 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >