Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: Critical Security Update Released for Adobe Reader and Acrobat

Featured Deal: Get 95% off The Ultimate MCSE Certification Training Bundle

Hijacked Laptop Keeps Redirecting

Started by DrFeel , Feb 22 2011 07:54 PM

Please log in to reply

7 replies to this topic

#1 DrFeel

Members
6 posts
OFFLINE

Local time:12:03 AM

Posted 22 February 2011 - 07:54 PM

Got infected a couple of days ago from source unknown, but I've had browser redirects and the PC operating at maximum computing power continuously since then. While multiple SV hosts running at the same time doesn't have to be a bad thing I'm also seeing that when I go into TSKMngr. Tried running gmer but the last two times I attempted to my laptop bluescreened, so I'm not sure how to proceed. Any help is much appreciated!

Best,

Ryan

DDS Logs

DDS (Ver_10-12-12.02) - NTFSx86
Run by Ryan at 0:04:56.65 on Wed 02/23/2011
Internet Explorer: 8.0.6001.18999 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.2045.943 [GMT 0:00]

AV: AVG Anti-Virus Free *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k Akamai
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\CISVC.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\bin\hsswd.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\Windows\system32\STacSV.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\I8kfanGUI\I8kfanGUI.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Users\Ryan\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
Q:\140061.enu\Office14\ONENOTEM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Ryan\Downloads\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll
BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [i8kfangui] c:\program files\i8kfangui\I8kfanGUI.exe /startup
uRun: [Google Update] "c:\users\ryan\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [AdobeBridge]
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [{CD869620-BE88-771E-03A9-9345E09944A5}] c:\users\ryan\appdata\roaming\homoku\poco.exe
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\users\ryan\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\ryan\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\users\ryan\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\common files\microsoft shared\virtualization handler\CVH.EXE
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - /105
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\windows\system32\wpclsp.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {2866E10A-9F23-42B8-ABC0-B5A0A2032BA5} = 10.4.24.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\users\ryan\appdata\roaming\mozilla\firefox\profiles\6zfgstf6.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\google\google gears\firefox\lib\ff36\gears.dll
FF - plugin: c:\progra~1\mi1933~1\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\google\google updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.27\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\ryan\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\users\ryan\appdata\roaming\facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\users\ryan\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\users\ryan\appdata\roaming\mozilla\firefox\profiles\6zfgstf6.default\extensions\reader_plugin@ebrary.com\plugins\NPinfotl.dll
FF - plugin: c:\users\ryan\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\ryan\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Google Gears: {000a9d1c-beef-4f90-9363-039d445309b8} - c:\program files\google\google gears\Firefox
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg9\Firefox
FF - Ext: AVG Security Toolbar em:version=6.010.006.004 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\avg\avg9\toolbar\firefox\avg@igeared
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ScribeFire: {F807FACD-E46A-4793-B345-D58CB177673C} - %profile%\extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
FF - Ext: EBrary Reader Plugin: reader_plugin@ebrary.com - %profile%\extensions\reader_plugin@ebrary.com
FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - %profile%\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-6-27 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-6-27 29584]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-6-27 243024]
R1 fanio;FanIO driver;c:\windows\system32\drivers\fanio.sys [2010-5-27 14464]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2009-6-28 21504]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-7-19 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-19 308136]
R2 cvhsvc;Client Virtualization Handler;c:\program files\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2010-2-28 821664]
R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\hotspot shield\bin\hsswd.exe -product hss --> c:\program files\hotspot shield\bin\hsswd.exe -product HSS [?]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-2-15 1153368]
R2 sftlist;Application Virtualization Client;c:\program files\microsoft application virtualization client\sftlist.exe [2010-4-24 483688]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfslh.sys [2010-4-24 550760]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplaylh.sys [2010-4-24 195944]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirlh.sys [2010-4-24 21864]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvollh.sys [2010-4-24 19304]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\microsoft application virtualization client\sftvsa.exe [2010-4-24 209768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-8-8 133104]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-26 517448]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-6-28 21504]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2010-10-20 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-22 1493352]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2009-9-25 4639136]
S3 qcusbmdm6k;WP-S1 Proprietary USB Driver;c:\windows\system32\drivers\qcusbmdm6k.sys [2009-9-18 65024]
S3 qcusbnmea;WP-S1 NMEA Port;c:\windows\system32\drivers\qcusbnmea.sys [2009-9-18 65024]
S3 qcusbpcsync;WP-S1 PCSYNC Port;c:\windows\system32\drivers\qcusbpcsync.sys [2009-9-18 65024]
S3 qcusbser6k;WP-S1 Diagnostic Port;c:\windows\system32\drivers\qcusbser6k.sys [2009-9-18 65024]
S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]

=============== Created Last 30 ================

2011-02-20 13:39:44 5890896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{a83d50f7-0d82-47bd-869f-03a0168a789b}\mpengine.dll
2011-02-15 00:30:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-02-15 00:30:53 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
2011-02-13 12:30:33 -------- d-----w- c:\program files\Seagate
2011-02-13 12:26:34 -------- d-----w- c:\program files\common files\Wise Installation Wizard
2011-02-13 11:06:58 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2011-02-13 11:06:57 -------- d-----w- c:\program files\SpywareBlaster
2011-02-10 14:06:50 -------- d-----w- c:\program files\BBC iPlayer Desktop(0)
2011-01-28 18:43:13 -------- d-----w- c:\program files\iPod
2011-01-28 18:43:09 -------- d-----w- c:\program files\iTunes

==================== Find3M ====================

2011-02-02 17:11:20 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-12-28 15:55:03 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-14 14:49:23 1169408 ----a-w- c:\windows\system32\sdclt.exe
2010-11-29 17:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 17:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts

=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6002 Disk: ST9160821AS rev.3.CDD -> Harddisk0\DR0 -> \Device\Ide\IdePort1 P1T0L0-1

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x866935DC]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x866997b8]; MOV EAX, [0x86699834]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x8288E962] -> \Device\Harddisk0\DR0[0x85FEDAC8]
3 CLASSPNP[0x8339D8B3] -> ntkrnlpa!IofCallDriver[0x8288E962] -> [0x866F2A80]
\Driver\atapi[0x85A16D30] -> IRP_MJ_CREATE -> 0x866935DC
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x132; MOV BP, 0x62a; ROR BYTE [BP+0x0], CL; INC BP; }
detected disk devices:
\Device\Ide\IdeDeviceP1T0L0-1 -> \??\IDE#DiskST9160821AS_____________________________3.CDD___#5&2b0df596&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user != kernel MBR !!!
copy of MBR has been found in sector 61 !
copy of MBR has been found in sector 62 !
sectors 312581806 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.

============= FINISH: 0:06:32.47 ===============

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 DrFeel

Topic Starter

Members
6 posts
OFFLINE

Local time:12:03 AM

Posted 24 February 2011 - 12:33 PM

Found a way of allowing GMER to work but I had to select IAT/EAT for some reason and doing that meant it wouldn't crash. The report if copied below, any help is much appreciated

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-02-24 17:30:41
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort1 ST9160821AS rev.3.CDD
Running: gmer.exe; Driver: C:\Users\Ryan\AppData\Local\Temp\kxldrpog.sys

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[280] ntdll.dll!LdrLoadDll 77889390 5 Bytes JMP 011F13F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Windows\Explorer.EXE[1632] ntdll.dll!NtProtectVirtualMemory 778C4D34 5 Bytes JMP 00E4000A
.text C:\Windows\Explorer.EXE[1632] ntdll.dll!NtWriteVirtualMemory 778C5674 5 Bytes JMP 00E5000A
.text C:\Windows\Explorer.EXE[1632] ntdll.dll!KiUserExceptionDispatcher 778C5DC8 5 Bytes JMP 00BF000A
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtClose 778C4314 5 Bytes JMP 6C269BF1 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtCreateFile 778C43D4 5 Bytes JMP 6C2688D9 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtCreateKey 778C4414 5 Bytes JMP 6C26552A C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtDeleteFile 778C47B4 5 Bytes JMP 6C2686F6 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtDeleteKey 778C47C4 5 Bytes JMP 6C264D8A C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtDeleteValueKey 778C47F4 5 Bytes JMP 6C26504D C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtDuplicateObject 778C4824 5 Bytes JMP 6C269CC7 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtEnumerateKey 778C4864 5 Bytes JMP 6C264E2E C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtEnumerateValueKey 778C4894 5 Bytes JMP 6C264FA7 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtFlushKey 778C48F4 5 Bytes JMP 6C264DDC C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtNotifyChangeKey 778C4B64 5 Bytes JMP 6C2650FB C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtNotifyChangeMultipleKeys 778C4B74 5 Bytes JMP 6C265189 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtOpenFile 778C4BB4 5 Bytes JMP 6C268A64 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtOpenKey 778C4BE4 5 Bytes JMP 6C26543B C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtQueryAttributesFile 778C4D54 5 Bytes JMP 6C268761 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtQueryDirectoryFile 778C4DB4 5 Bytes JMP 6C2675E6 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtQueryFullAttributesFile 778C4E04 5 Bytes JMP 6C2687D1 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtQueryKey 778C4EB4 5 Bytes JMP 6C264E81 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtQueryMultipleValueKey 778C4EC4 5 Bytes JMP 6C2650A8 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtQueryObject 778C4EE4 5 Bytes JMP 6C269D1D C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtQuerySecurityObject 778C4F44 5 Bytes JMP 6C269C61 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtQueryValueKey 778C4FD4 5 Bytes JMP 6C264F54 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtRenameKey 778C50C4 5 Bytes JMP 6C26559F C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtSetInformationFile 778C52E4 5 Bytes JMP 6C268841 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtSetInformationKey 778C5304 5 Bytes JMP 6C264EE7 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtSetSecurityObject 778C53B4 5 Bytes JMP 6C269D7A C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ntdll.dll!NtSetValueKey 778C5454 5 Bytes JMP 6C264FFA C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] kernel32.dll!CreateProcessW 760B1BF3 5 Bytes JMP 6C242337 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] kernel32.dll!CreateProcessA 760B1C28 5 Bytes JMP 6C242475 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] kernel32.dll!LoadLibraryExW 760D9109 7 Bytes JMP 6C242E8C C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] kernel32.dll!SetDllDirectoryW 76142467 5 Bytes JMP 6C243300 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] kernel32.dll!SetDllDirectoryA 761424FD 5 Bytes JMP 6C243633 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] kernel32.dll!WinExec 76145CF7 5 Bytes JMP 6C242A2E C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] GDI32.dll!AddFontResourceW 7608CC93 5 Bytes JMP 6C250AB4 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] GDI32.dll!AddFontResourceA 7608CFBF 5 Bytes JMP 6C250A98 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!StartServiceA 774CA24D 7 Bytes JMP 6C25379E C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!CreateProcessAsUserA 774CCEB9 5 Bytes JMP 6C2427ED C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!CreateProcessAsUserW 774E1EE9 5 Bytes JMP 6C2426AB C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!OpenSCManagerA 774E2D93 7 Bytes JMP 6C2531B4 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!OpenServiceA 774E2EBD 7 Bytes JMP 6C253323 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!StartServiceW 774E3E0B 7 Bytes JMP 6C253708 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!QueryServiceStatusEx 774E4FFE 7 Bytes JMP 6C2539AC C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!QueryServiceConfigW 774E50A4 7 Bytes JMP 6C254448 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!QueryServiceConfigA 774E51AD 7 Bytes JMP 6C2544E1 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!OpenSCManagerW 774E7137 7 Bytes JMP 6C253128 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!CloseServiceHandle 774E82A5 7 Bytes JMP 6C253BB6 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!OpenServiceW 774E8354 7 Bytes JMP 6C253297 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!QueryServiceStatus 774E842C 7 Bytes JMP 6C253919 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!CreateServiceW 77509EB4 7 Bytes JMP 6C253421 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!ControlService 77509FB8 7 Bytes JMP 6C25388D C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!DeleteService 7750A07E 7 Bytes JMP 6C253C44 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!GetServiceDisplayNameW 7750B0B3 7 Bytes JMP 6C254297 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!GetServiceKeyNameW 7750B164 7 Bytes JMP 6C2540E6 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!EnumServicesStatusExA 7750B31B 7 Bytes JMP 6C254A26 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!ControlServiceExA 7754662E 7 Bytes JMP 6C252BDA C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!ControlServiceExW 77546741 7 Bytes JMP 6C252B61 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!EnumServicesStatusExW 77546909 7 Bytes JMP 6C254960 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!EnumServicesStatusA 77546B47 7 Bytes JMP 6C2548A2 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!QueryServiceObjectSecurity 77546C21 7 Bytes JMP 6C2546B2 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!SetServiceObjectSecurity 77546CD9 7 Bytes JMP 6C25474E C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!ChangeServiceConfigA 77546DD9 7 Bytes JMP 6C253DB7 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!ChangeServiceConfigW 77546F81 7 Bytes JMP 6C253CD2 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!ChangeServiceConfig2A 77547099 7 Bytes JMP 6C254050 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!ChangeServiceConfig2W 775471E1 7 Bytes JMP 6C253FBA C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!CreateServiceA 775472A1 7 Bytes JMP 6C2534F7 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!EnumDependentServicesA 77547505 7 Bytes JMP 6C253AFF C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!EnumDependentServicesW 775475D9 7 Bytes JMP 6C253A48 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!GetServiceDisplayNameA 775476B1 7 Bytes JMP 6C25434F C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!GetServiceKeyNameA 77547759 7 Bytes JMP 6C25419E C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!QueryServiceConfig2A 77547891 7 Bytes JMP 6C254616 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!QueryServiceConfig2W 77547A19 7 Bytes JMP 6C25457A C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ADVAPI32.dll!EnumServicesStatusW 77547F61 5 Bytes JMP 6C2547E4 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoRegisterPSClsid 77372746 5 Bytes JMP 6C25A1FE C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoResumeClassObjects + 7 77382C12 7 Bytes JMP 6C25A7CF C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoRegisterClassObject 77387DBE 5 Bytes JMP 6C25B27B C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!OleInitialize 7738EE4B 5 Bytes JMP 6C25A539 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!OleRun 7738F3F4 5 Bytes JMP 6C25A68A C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoGetPSClsid 77391B2B 5 Bytes JMP 6C25A376 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoGetClassObject 773AFAE8 5 Bytes JMP 6C25B5E2 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoRevokeClassObject 773BB109 5 Bytes JMP 6C259DE0 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoCreateInstance 773C9F3E 5 Bytes JMP 6C25C8B0 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoCreateInstanceEx 773C9F81 5 Bytes JMP 6C25AC12 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoInitializeEx 773CADFB 5 Bytes JMP 6C25A3E9 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoUninitialize 773CD309 5 Bytes JMP 6C25A46B C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoSuspendClassObjects + 7 773D19A9 7 Bytes JMP 6C25A6FA C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!OleUninitialize 773EB90D 6 Bytes JMP 6C25A5A9 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!CoGetInstanceFromFile 7741C595 5 Bytes JMP 6C25BAA2 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text Q:\140061.enu\Office14\ONENOTEM.EXE[4852] ole32.dll!OleRegEnumFormatEtc 77465657 5 Bytes JMP 6C25A614 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Windows\system32\svchost.exe[6860] ntdll.dll!NtProtectVirtualMemory 778C4D34 5 Bytes JMP 0098000A
.text C:\Windows\system32\svchost.exe[6860] ntdll.dll!NtWriteVirtualMemory 778C5674 5 Bytes JMP 0099000A
.text C:\Windows\system32\svchost.exe[6860] ntdll.dll!KiUserExceptionDispatcher 778C5DC8 5 Bytes JMP 0093000A
.text C:\Windows\system32\svchost.exe[6860] ole32.dll!CoCreateInstance 773C9F3E 5 Bytes JMP 00F4000A
.text C:\Windows\system32\svchost.exe[6860] USER32.dll!WindowFromPoint 77A2884F 5 Bytes JMP 009D000A
.text C:\Windows\system32\svchost.exe[6860] USER32.dll!GetForegroundWindow 77A332C4 5 Bytes JMP 009E000A
.text C:\Windows\system32\svchost.exe[6860] USER32.dll!GetCursorPos 77A40B88 5 Bytes JMP 009C000A

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \Device\Ide\IdeDeviceP1T0L0-1 -> \??\IDE#DiskST9160821AS_____________________________3.CDD___#5&2b0df596&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- Processes - GMER 1.0.15 ----

Library Q:\140061.enu\Office14\ONENOTEM.EXE (*** hidden *** ) @ Q:\140061.enu\Office14\ONENOTEM.EXE [4852] 0x2D2E0000
Library Q:\140061.enu\Office14\1033\ONINTL.DLL (*** hidden *** ) @ Q:\140061.enu\Office14\ONENOTEM.EXE [4852] 0x686E0000

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x71 0x1A 0xE2 0x30 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x31 0xD1 0xE7 0xE0 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xF9 0x57 0x74 0xF0 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x71 0x1A 0xE2 0x30 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x31 0xD1 0xE7 0xE0 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xF9 0x57 0x74 0xF0 ...

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior; <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 54: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 55: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 56: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 57: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 58: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 59: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 60: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 61: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 312581552 (+255): rootkit-like behavior;

---- EOF - GMER 1.0.15 ----

#3 SweetTech

Agent ST

Members
13,421 posts
OFFLINE

Gender:Male
Location:Antarctica
Local time:01:03 AM

Posted 25 February 2011 - 12:29 PM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
Because of this, you must reply within three days failure to reply will result in the topic being closed!
Please do not PM me directly for help. If you have any questions, post them in this topic.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Posted Image

One or more of the identified infections is a backdoor trojan and password stealer.

This type of infection allows hackers to access and remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge.
If you do any banking or other financial transactions on the PC or if it contains any other sensitive information, then from a clean computer, change all passwords where applicable.
It would also be wise to contact those same financial institutions to appraise them of your situation.

I highly suggest you take a look at the two links provided below:
1. How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?
2. When should I re-format? How should I reinstall?

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

NEXT:

Running TDSSKiller

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

NEXT:

Running OTM

We need to execute an OTM script

Please download OTM by OldTimer and save it to your desktop.
Double click the icon on your desktop.

Paste the following code under the Posted Image

area. Do not include the word "Code".

:Processes
:Files

:Commands
[resethosts]
[purity]
[emptytemp]
[emptyflash]
[createrestorepoint]

Push the large button.
OTM may ask to reboot the machine. Please do so if asked.
Copy/Paste the contents under the line here in your next reply.
If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

NEXT:

Running OTL

We need to create an OTL Report

Please download OTL from one of the following mirrors:
- This is THE Mirror
Save it to your desktop.
Double click on the icon on your desktop.
Click the "Scan All Users" checkbox.
Push the button.
Two reports will open, copy and paste them in a reply here:
- OTL.txt <-- Will be opened
- Extra.txt <-- Will be minimized

NEXT:

Please be sure to include an update on how things are currently running in your next reply.

Have I helped you? If you'd like to assist in the fight against malware, click here

The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.

#4 DrFeel

Topic Starter

Members
6 posts
OFFLINE

Local time:12:03 AM

Posted 25 February 2011 - 02:42 PM

Hi Sweet Tech,

No worries about the delayed reply. I'm just happy to get some help. I haven't used any financial websites since I got infected. However I'll be changing my email passwords. I'll probably reformat down the line, but I'm at a busy stage of my academic semester so for right now I'll try and solve as is. The first time I tried to run OTM it froze after getting to the last command [createrestorepoint]. Up until that point it had gotten rid of somewhere around 714MB of stuff. However, because it crashed the first report simply stated this:

Files moved on Reboot...

Registry entries deleted on Reboot...

I tried it for a second time, and it worked, but of course nothing was removed or 'moved,' since it had just happened already. Can't get my head around whether the machine is running better now, but my gut feeling is that its running better,but that stuff is probually still lurking around somewhere.

Cheers,

Ryan

TDSS Killer REPORT

2011/02/25 19:04:16.0765 2316 TDSS rootkit removing tool 2.4.18.0 Feb 21 2011 11:08:08
2011/02/25 19:04:18.0395 2316 ================================================================================
2011/02/25 19:04:18.0395 2316 SystemInfo:
2011/02/25 19:04:18.0395 2316
2011/02/25 19:04:18.0395 2316 OS Version: 6.0.6002 ServicePack: 2.0
2011/02/25 19:04:18.0395 2316 Product type: Workstation
2011/02/25 19:04:18.0395 2316 ComputerName: RYAN-PC
2011/02/25 19:04:18.0396 2316 UserName: Ryan
2011/02/25 19:04:18.0396 2316 Windows directory: C:\Windows
2011/02/25 19:04:18.0396 2316 System windows directory: C:\Windows
2011/02/25 19:04:18.0396 2316 Processor architecture: Intel x86
2011/02/25 19:04:18.0396 2316 Number of processors: 2
2011/02/25 19:04:18.0396 2316 Page size: 0x1000
2011/02/25 19:04:18.0396 2316 Boot type: Normal boot
2011/02/25 19:04:18.0396 2316 ================================================================================
2011/02/25 19:04:18.0980 2316 Initialize success
2011/02/25 19:04:37.0619 5812 ================================================================================
2011/02/25 19:04:37.0619 5812 Scan started
2011/02/25 19:04:37.0619 5812 Mode: Manual;
2011/02/25 19:04:37.0619 5812 ================================================================================
2011/02/25 19:04:38.0368 5812 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/02/25 19:04:38.0477 5812 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/02/25 19:04:38.0577 5812 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/02/25 19:04:38.0668 5812 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/02/25 19:04:38.0777 5812 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/02/25 19:04:38.0908 5812 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/02/25 19:04:38.0980 5812 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/02/25 19:04:39.0049 5812 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/02/25 19:04:39.0134 5812 aliide (3a99cb23a2d326fd532618705d6e3048) C:\Windows\system32\drivers\aliide.sys
2011/02/25 19:04:39.0208 5812 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/02/25 19:04:39.0277 5812 amdide (4333c133dbd71c7d7fe4fb1b83f9ee3e) C:\Windows\system32\drivers\amdide.sys
2011/02/25 19:04:39.0370 5812 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/02/25 19:04:39.0436 5812 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2011/02/25 19:04:39.0648 5812 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/02/25 19:04:39.0742 5812 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/02/25 19:04:39.0824 5812 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/02/25 19:04:39.0896 5812 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/02/25 19:04:40.0087 5812 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\Windows\System32\Drivers\avgldx86.sys
2011/02/25 19:04:40.0186 5812 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\Windows\System32\Drivers\avgmfx86.sys
2011/02/25 19:04:40.0470 5812 AvgTdiX (22e3b793c3e61720f03d3a22351af410) C:\Windows\System32\Drivers\avgtdix.sys
2011/02/25 19:04:40.0597 5812 BCM43XV (746f59822a5187510471fc46889b8cc9) C:\Windows\system32\DRIVERS\bcmwl6.sys
2011/02/25 19:04:40.0665 5812 BCM43XX (746f59822a5187510471fc46889b8cc9) C:\Windows\system32\DRIVERS\bcmwl6.sys
2011/02/25 19:04:40.0731 5812 bcm4sbxp (cd4646067cc7dcba1907fa0acf7e3966) C:\Windows\system32\DRIVERS\bcm4sbxp.sys
2011/02/25 19:04:40.0822 5812 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/02/25 19:04:40.0939 5812 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/02/25 19:04:41.0016 5812 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/02/25 19:04:41.0092 5812 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/02/25 19:04:41.0193 5812 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/02/25 19:04:41.0264 5812 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/02/25 19:04:41.0373 5812 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/02/25 19:04:41.0874 5812 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/02/25 19:04:41.0923 5812 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/02/25 19:04:42.0003 5812 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/02/25 19:04:42.0105 5812 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/02/25 19:04:42.0183 5812 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/02/25 19:04:42.0290 5812 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/02/25 19:04:42.0432 5812 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/02/25 19:04:42.0543 5812 cmdide (dfb94a6fc3a26972b0461ab5f1d8272b) C:\Windows\system32\drivers\cmdide.sys
2011/02/25 19:04:42.0606 5812 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/02/25 19:04:42.0722 5812 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/02/25 19:04:42.0876 5812 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/02/25 19:04:43.0043 5812 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
2011/02/25 19:04:43.0275 5812 CVPNDRVA (c23025ac5ae45a105d63bd6e2408edd4) C:\Windows\system32\Drivers\CVPNDRVA.sys
2011/02/25 19:04:43.0415 5812 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/02/25 19:04:43.0498 5812 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/02/25 19:04:43.0592 5812 DNE (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys
2011/02/25 19:04:43.0739 5812 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/02/25 19:04:43.0853 5812 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys
2011/02/25 19:04:43.0999 5812 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/02/25 19:04:44.0108 5812 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/02/25 19:04:44.0202 5812 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/02/25 19:04:44.0351 5812 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/02/25 19:04:44.0449 5812 fanio (0dd24dabb0b8c4ac0d8f2ebf0492276a) C:\Windows\system32\drivers\fanio.sys
2011/02/25 19:04:44.0549 5812 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/02/25 19:04:44.0613 5812 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/02/25 19:04:44.0722 5812 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/02/25 19:04:44.0815 5812 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/02/25 19:04:44.0893 5812 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/02/25 19:04:44.0976 5812 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/02/25 19:04:45.0088 5812 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys
2011/02/25 19:04:45.0155 5812 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/02/25 19:04:45.0254 5812 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/02/25 19:04:45.0316 5812 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/02/25 19:04:45.0539 5812 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/02/25 19:04:45.0643 5812 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/02/25 19:04:45.0756 5812 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/02/25 19:04:45.0817 5812 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/02/25 19:04:45.0955 5812 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/02/25 19:04:46.0103 5812 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/02/25 19:04:46.0167 5812 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/02/25 19:04:46.0246 5812 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
2011/02/25 19:04:46.0451 5812 HssDrv (4f28652ec514fa1ba473bc1a695a5c98) C:\Windows\system32\DRIVERS\HssDrv.sys
2011/02/25 19:04:46.0697 5812 HTTP (0eeeca26c8d4bde2a4664db058a81937) C:\Windows\system32\drivers\HTTP.sys
2011/02/25 19:04:46.0839 5812 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/02/25 19:04:47.0009 5812 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/02/25 19:04:47.0134 5812 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/02/25 19:04:47.0210 5812 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/02/25 19:04:47.0280 5812 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/02/25 19:04:47.0320 5812 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/02/25 19:04:47.0367 5812 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/02/25 19:04:47.0560 5812 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/02/25 19:04:47.0679 5812 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/02/25 19:04:47.0823 5812 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/02/25 19:04:47.0921 5812 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/02/25 19:04:48.0039 5812 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/02/25 19:04:48.0124 5812 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/02/25 19:04:48.0220 5812 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/02/25 19:04:48.0275 5812 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/02/25 19:04:48.0346 5812 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/02/25 19:04:48.0520 5812 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/02/25 19:04:48.0938 5812 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/02/25 19:04:49.0189 5812 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/02/25 19:04:49.0371 5812 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/02/25 19:04:49.0458 5812 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/02/25 19:04:49.0522 5812 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/02/25 19:04:49.0638 5812 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/02/25 19:04:49.0700 5812 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/02/25 19:04:49.0771 5812 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/02/25 19:04:49.0880 5812 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/02/25 19:04:49.0934 5812 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/02/25 19:04:50.0011 5812 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/02/25 19:04:50.0104 5812 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/02/25 19:04:50.0188 5812 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/02/25 19:04:50.0294 5812 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/02/25 19:04:50.0361 5812 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/02/25 19:04:50.0481 5812 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/02/25 19:04:50.0535 5812 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/02/25 19:04:50.0643 5812 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/02/25 19:04:50.0731 5812 msahci (f0ec3a4e0693a34b148723b4da31668c) C:\Windows\system32\drivers\msahci.sys
2011/02/25 19:04:50.0819 5812 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/02/25 19:04:50.0979 5812 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/02/25 19:04:51.0054 5812 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/02/25 19:04:51.0161 5812 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/02/25 19:04:51.0234 5812 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/02/25 19:04:51.0335 5812 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/02/25 19:04:51.0440 5812 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/02/25 19:04:51.0514 5812 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/02/25 19:04:51.0602 5812 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/02/25 19:04:51.0656 5812 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/02/25 19:04:51.0811 5812 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/02/25 19:04:51.0911 5812 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/02/25 19:04:52.0025 5812 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/02/25 19:04:52.0077 5812 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/02/25 19:04:52.0142 5812 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/02/25 19:04:52.0205 5812 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/02/25 19:04:52.0275 5812 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/02/25 19:04:52.0448 5812 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2011/02/25 19:04:52.0549 5812 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/02/25 19:04:52.0635 5812 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/02/25 19:04:52.0726 5812 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/02/25 19:04:52.0833 5812 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/02/25 19:04:52.0943 5812 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/02/25 19:04:53.0010 5812 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/02/25 19:04:53.0448 5812 nvlddmkm (8fe5350fa6a9f0b6633aee811c468954) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/02/25 19:04:53.0990 5812 nvraid (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys
2011/02/25 19:04:54.0089 5812 nvstor (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys
2011/02/25 19:04:54.0208 5812 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/02/25 19:04:54.0414 5812 OEM02Dev (19cac780b858822055f46c58a111723c) C:\Windows\system32\DRIVERS\OEM02Dev.sys
2011/02/25 19:04:54.0480 5812 OEM02Vfx (86326062a90494bdd79ce383511d7d69) C:\Windows\system32\DRIVERS\OEM02Vfx.sys
2011/02/25 19:04:54.0537 5812 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/02/25 19:04:54.0711 5812 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/02/25 19:04:54.0784 5812 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/02/25 19:04:54.0828 5812 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/02/25 19:04:54.0929 5812 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/02/25 19:04:55.0002 5812 pciide (20b869152448f80ac49cf10264e91f5e) C:\Windows\system32\drivers\pciide.sys
2011/02/25 19:04:55.0065 5812 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/02/25 19:04:55.0169 5812 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/02/25 19:04:55.0442 5812 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/02/25 19:04:55.0504 5812 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/02/25 19:04:55.0583 5812 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/02/25 19:04:55.0709 5812 qcusbmdm6k (eea75ef65e3eea3f4a18ac21ef241a0f) C:\Windows\system32\DRIVERS\qcusbmdm6k.sys
2011/02/25 19:04:55.0793 5812 qcusbnmea (eea75ef65e3eea3f4a18ac21ef241a0f) C:\Windows\system32\DRIVERS\qcusbnmea.sys
2011/02/25 19:04:55.0860 5812 qcusbpcsync (eea75ef65e3eea3f4a18ac21ef241a0f) C:\Windows\system32\DRIVERS\qcusbpcsync.sys
2011/02/25 19:04:55.0972 5812 qcusbser6k (eea75ef65e3eea3f4a18ac21ef241a0f) C:\Windows\system32\DRIVERS\qcusbser6k.sys
2011/02/25 19:04:56.0118 5812 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/02/25 19:04:56.0258 5812 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/02/25 19:04:56.0331 5812 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/02/25 19:04:56.0420 5812 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/02/25 19:04:56.0524 5812 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/02/25 19:04:56.0609 5812 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/02/25 19:04:56.0696 5812 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/02/25 19:04:56.0773 5812 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/02/25 19:04:56.0886 5812 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/02/25 19:04:56.0980 5812 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/02/25 19:04:57.0087 5812 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/02/25 19:04:57.0150 5812 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/02/25 19:04:57.0280 5812 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys
2011/02/25 19:04:57.0365 5812 rimsptsk (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\DRIVERS\rimsptsk.sys
2011/02/25 19:04:57.0418 5812 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\DRIVERS\rixdptsk.sys
2011/02/25 19:04:57.0476 5812 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/02/25 19:04:57.0575 5812 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/02/25 19:04:57.0696 5812 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
2011/02/25 19:04:57.0796 5812 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/02/25 19:04:57.0877 5812 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/02/25 19:04:57.0962 5812 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/02/25 19:04:58.0109 5812 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/02/25 19:04:58.0216 5812 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/02/25 19:04:58.0263 5812 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/02/25 19:04:58.0299 5812 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/02/25 19:04:58.0363 5812 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/02/25 19:04:58.0510 5812 Sftfs (cc895997c0995a07b6b2779a3b21918b) C:\Windows\system32\DRIVERS\Sftfslh.sys
2011/02/25 19:04:58.0719 5812 Sftplay (cf5e9798637795db59697f5e40fca993) C:\Windows\system32\DRIVERS\Sftplaylh.sys
2011/02/25 19:04:58.0854 5812 Sftredir (4c8076ff8938b365eeec9123969e0350) C:\Windows\system32\DRIVERS\Sftredirlh.sys
2011/02/25 19:04:58.0955 5812 Sftvol (6095a5f221eca9dada2c9ee80ec0d92d) C:\Windows\system32\DRIVERS\Sftvollh.sys
2011/02/25 19:04:59.0051 5812 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/02/25 19:04:59.0096 5812 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/02/25 19:04:59.0144 5812 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/02/25 19:04:59.0220 5812 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/02/25 19:04:59.0347 5812 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/02/25 19:04:59.0426 5812 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\System32\Drivers\sptd.sys
2011/02/25 19:04:59.0554 5812 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys
2011/02/25 19:04:59.0598 5812 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys
2011/02/25 19:04:59.0641 5812 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys
2011/02/25 19:04:59.0831 5812 STHDA (3cfea727795243364bb6a7f9a091faa3) C:\Windows\system32\drivers\stwrt.sys
2011/02/25 19:04:59.0897 5812 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/02/25 19:05:00.0060 5812 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/02/25 19:05:00.0164 5812 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/02/25 19:05:00.0268 5812 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/02/25 19:05:00.0356 5812 tap0901 (34f1bcb847a924a161422f106a79b9ff) C:\Windows\system32\DRIVERS\tap0901.sys
2011/02/25 19:05:00.0409 5812 taphss (0c3b2a9c4bd2dd9a6c2e4084314dd719) C:\Windows\system32\DRIVERS\taphss.sys
2011/02/25 19:05:00.0472 5812 tapvpn (27a2c318cd28cfb3eb2200fd96af1e58) C:\Windows\system32\DRIVERS\tapvpn.sys
2011/02/25 19:05:00.0569 5812 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys
2011/02/25 19:05:00.0670 5812 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys
2011/02/25 19:05:00.0717 5812 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
2011/02/25 19:05:00.0774 5812 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/02/25 19:05:00.0839 5812 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/02/25 19:05:00.0909 5812 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/02/25 19:05:00.0973 5812 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/02/25 19:05:01.0119 5812 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/02/25 19:05:01.0214 5812 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/02/25 19:05:01.0294 5812 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/02/25 19:05:01.0359 5812 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/02/25 19:05:01.0425 5812 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/02/25 19:05:01.0495 5812 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/02/25 19:05:01.0554 5812 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/02/25 19:05:01.0639 5812 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/02/25 19:05:01.0716 5812 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/02/25 19:05:01.0840 5812 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/02/25 19:05:01.0955 5812 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\Windows\system32\Drivers\usbaapl.sys
2011/02/25 19:05:02.0115 5812 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys
2011/02/25 19:05:02.0192 5812 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/02/25 19:05:02.0271 5812 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/02/25 19:05:02.0352 5812 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/02/25 19:05:02.0388 5812 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/02/25 19:05:02.0453 5812 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/02/25 19:05:02.0514 5812 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/02/25 19:05:02.0583 5812 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/02/25 19:05:02.0632 5812 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/02/25 19:05:02.0684 5812 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/02/25 19:05:02.0751 5812 usbvideo (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys
2011/02/25 19:05:02.0886 5812 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/02/25 19:05:02.0977 5812 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/02/25 19:05:03.0036 5812 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/02/25 19:05:03.0110 5812 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/02/25 19:05:03.0194 5812 viaide (58c8d5ac5c3eef40e7e704a5ced7987d) C:\Windows\system32\drivers\viaide.sys
2011/02/25 19:05:03.0260 5812 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/02/25 19:05:03.0346 5812 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/02/25 19:05:03.0417 5812 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/02/25 19:05:03.0483 5812 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/02/25 19:05:03.0567 5812 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/02/25 19:05:03.0640 5812 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/25 19:05:03.0663 5812 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/25 19:05:03.0720 5812 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/02/25 19:05:03.0806 5812 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/02/25 19:05:03.0931 5812 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
2011/02/25 19:05:04.0052 5812 WinUSB (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\WinUSB.sys
2011/02/25 19:05:04.0209 5812 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/02/25 19:05:04.0347 5812 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/02/25 19:05:04.0444 5812 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/02/25 19:05:04.0566 5812 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/02/25 19:05:04.0726 5812 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/02/25 19:05:04.0732 5812 ================================================================================
2011/02/25 19:05:04.0732 5812 Scan finished
2011/02/25 19:05:04.0732 5812 ================================================================================
2011/02/25 19:05:04.0750 4960 Detected object count: 1
2011/02/25 19:05:38.0186 4960 \HardDisk0 - will be cured after reboot
2011/02/25 19:05:38.0187 4960 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/02/25 19:05:44.0932 4520 Deinitialize success

OTM Report

All processes killed
========== PROCESSES ==========
========== FILES ==========
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Family
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Ryan
->Temp folder emptied: 98620 bytes
->Temporary Internet Files folder emptied: 32969 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 17015431 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: TEMP

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 3031174 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 19.00 mb

Restore point Set: OTM Restore Point

OTM by OldTimer - Version 3.1.17.2 log created on 02252011_192330

Files moved on Reboot...

Registry entries deleted on Reboot...

OTL Report

OTL logfile created on: 2/25/2011 7:32:47 PM - Run 1
OTL by OldTimer - Version 3.2.21.0 Folder = C:\Users\Ryan\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146.00 Gb Total Space | 25.33 Gb Free Space | 17.35% Space Free | Partition Type: NTFS

Computer Name: RYAN-PC | User Name: Ryan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found --
PRC - [2011/02/25 19:17:32 | 000,577,024 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe
PRC - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/12/11 22:07:09 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/11/30 20:19:06 | 000,268,848 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe
PRC - [2010/11/24 13:54:14 | 000,725,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/10/15 18:42:14 | 000,326,704 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\hsswd.exe
PRC - [2010/10/14 09:23:33 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
PRC - [2010/09/23 10:36:19 | 000,621,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/09/22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010/07/20 18:33:17 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010/07/19 13:31:28 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/07/19 13:31:26 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/07/19 13:30:25 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/04/24 01:10:54 | 000,209,768 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2010/04/24 01:10:44 | 000,483,688 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/02/28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE
PRC - [2010/02/26 05:10:20 | 021,979,992 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2009/11/17 04:07:46 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2009/04/11 06:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2007/03/06 17:38:28 | 000,090,112 | ---- | M] (SigmaTel, Inc.) -- C:\Windows\System32\stacsv.exe
PRC - [2007/02/16 16:58:12 | 000,856,064 | ---- | M] (Christian Diefer) -- C:\Program Files\I8kfanGUI\I8kfanGUI.exe

========== Modules (SafeList) ==========

MOD - [2011/02/25 19:17:32 | 000,577,024 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe
MOD - [2010/08/31 15:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/01/06 10:36:11 | 003,129,432 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\netsession_win_dbc0250.dll -- (Akamai)
SRV - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/11/30 20:20:50 | 000,057,640 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2010/11/30 20:19:06 | 000,268,848 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)
SRV - [2010/10/15 18:42:14 | 000,326,704 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2010/10/15 18:35:30 | 000,352,304 | ---- | M] (AnchorFree Inc.) [Disabled | Stopped] -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2010/10/06 10:31:48 | 000,517,448 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
SRV - [2010/09/22 23:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010/09/22 15:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010/09/22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2010/07/20 18:33:17 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/19 13:31:26 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/04/24 01:10:54 | 000,209,768 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2010/04/24 01:10:44 | 000,483,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/03/18 17:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 17:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/11/17 04:07:46 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2009/09/25 01:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/12/12 17:41:18 | 005,117,568 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2008/12/12 17:41:08 | 000,243,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2008/01/19 07:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/03/06 17:38:28 | 000,090,112 | ---- | M] (SigmaTel, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV)

========== Driver Services (SafeList) ==========

DRV - [2010/09/22 23:21:24 | 000,039,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV - [2010/09/22 19:19:02 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hssdrv.sys -- (HssDrv)
DRV - [2010/07/19 13:31:29 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/07/19 13:31:28 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010/07/19 13:30:25 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/05/26 12:08:13 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010/04/24 01:10:54 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV - [2010/04/24 01:10:52 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV - [2010/04/24 01:10:50 | 000,195,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV - [2010/04/24 01:10:44 | 000,550,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV - [2009/11/17 04:07:06 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2009/09/15 20:04:58 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2009/07/22 19:13:20 | 000,028,592 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
DRV - [2009/06/16 18:59:00 | 009,768,640 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/04/11 04:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/04/11 04:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUSB)
DRV - [2008/11/16 10:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008/01/23 21:25:32 | 000,027,136 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tapvpn.sys -- (tapvpn)
DRV - [2007/10/10 22:03:00 | 000,235,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Dev.sys -- (OEM02Dev)
DRV - [2007/10/02 21:30:32 | 000,065,024 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qcusbser6k.sys -- (qcusbser6k)
DRV - [2007/10/02 21:30:32 | 000,065,024 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qcusbpcsync.sys -- (qcusbpcsync)
DRV - [2007/10/02 21:30:32 | 000,065,024 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qcusbnmea.sys -- (qcusbnmea)
DRV - [2007/10/02 21:30:32 | 000,065,024 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qcusbmdm6k.sys -- (qcusbmdm6k)
DRV - [2007/03/21 16:33:46 | 000,534,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2007/03/21 16:33:46 | 000,534,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XV)
DRV - [2007/03/06 17:38:52 | 000,323,584 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/03/05 23:45:00 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
DRV - [2007/02/21 19:48:56 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2007/02/21 19:48:56 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2007/02/21 19:48:56 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007/02/16 09:05:48 | 000,014,464 | ---- | M] (Christian Diefer) [Kernel | System | Running] -- C:\Windows\System32\drivers\fanio.sys -- (fanio)
DRV - [2007/01/18 12:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2007/01/06 05:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2007/01/06 05:59:34 | 000,086,096 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) NVIDIA nForce™
DRV - [2006/11/21 09:25:44 | 000,045,568 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/11/15 05:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/15 00:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/14 22:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/11/02 09:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 09:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 09:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 09:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 09:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 09:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 09:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 09:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 09:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 09:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 09:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 09:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 09:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 09:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 09:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 09:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 09:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 09:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 09:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 09:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 09:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 09:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 09:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 09:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 09:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 09:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 09:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 09:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 09:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 09:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 08:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 08:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 08:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 08:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 08:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 08:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 07:41:50 | 000,987,648 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTDPV3.SYS -- (HSF_DPV)
DRV - [2006/11/02 07:41:49 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2006/11/02 07:41:48 | 000,654,336 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTCNXT3.SYS -- (winachsf)
DRV - [2006/11/02 07:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 07:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel®

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?rd=1
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CC B4 35 02 D8 CB CB 01 [binary data]
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: {F807FACD-E46A-4793-B345-D58CB177673C}:3.5.3.3
FF - prefs.js..extensions.enabledItems: reader_plugin@ebrary.com:3.2.3.0
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: avg@igeared:6.010.006.004
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p="
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/11/24 14:09:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2010/03/06 05:03:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/10/26 09:19:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/20 20:31:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/18 00:07:05 | 000,000,000 | ---D | M]

[2009/09/05 09:46:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Extensions
[2011/02/25 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions
[2010/04/07 06:41:35 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010/04/28 01:25:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/04 08:31:22 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/01/09 23:05:06 | 000,000,000 | ---D | M] (ScribeFire) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
[2009/09/05 10:16:12 | 000,000,000 | ---D | M] (LogMeIn, Inc. Remote Access Plugin) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\LogMeInClient@logmein.com
[2010/03/23 06:48:31 | 000,000,000 | ---D | M] (EBrary Reader Plugin) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\extensions\reader_plugin@ebrary.com
[2009/09/05 08:29:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles(125)\23fscdza.default\extensions
[2009/09/05 07:34:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles(125)\23fscdza.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/25 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/22 20:14:27 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/11/24 14:09:28 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
[2010/10/26 09:19:18 | 000,000,000 | ---D | M] ("urn:mozilla:install-manifest" em:id="avg@igeared" em:name="AVG Security Toolbar" em:version="6.010.006.004" em:displayname="AVG Security Toolbar" em:iconURL="chrome://tavgp/skin/logo.ico" em:creator="AVG Technologies" em:description="AVG Security Toolbar" em:homepageURL="http://www.avg.com" >) -- C:\PROGRAM FILES\AVG\AVG9\TOOLBAR\FIREFOX\AVG@IGEARED
[2010/03/06 05:03:00 | 000,000,000 | ---D | M] (Google Gears) -- C:\PROGRAM FILES\GOOGLE\GOOGLE GEARS\FIREFOX

O1 HOSTS File: ([2011/02/25 19:23:30 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll (AnchorFree Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [{CD869620-BE88-771E-03A9-9345E09944A5}] C:\Users\Ryan\AppData\Roaming\Izipy\duisy.exe (Ueuhtaxhu Owychxl)
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe (Christian Diefer)
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Ryan\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Ryan\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Ryan\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/05/26 12:52:19 | 000,000,000 | ---D | M] - C:\Autorun -- [ NTFS ]
O33 - MountPoints2\{17bd1282-9c7f-11de-ba60-001c238cee27}\Shell\AutoRun\command - "" = wd_windows_tools\setup.exe
O33 - MountPoints2\{2e360a4b-e9ac-11df-90f2-c26bb38aaee3}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bot.vbs
O33 - MountPoints2\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\Shell\AutoRun\command - "" = E:\xedex.exe
O33 - MountPoints2\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\Shell\open\Command - "" = E:\xedex.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/02/25 19:17:26 | 000,577,024 | ---- | C] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe
[2011/02/25 19:11:55 | 000,000,000 | ---D | C] -- C:\_OTM
[2011/02/25 19:10:59 | 000,519,680 | ---- | C] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTM.exe
[2011/02/25 19:03:59 | 001,372,248 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Ryan\Desktop\TDSSKiller.exe
[2011/02/23 12:07:46 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Desktop\www1360.megaupload.com
[2011/02/20 09:24:43 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2011/02/15 09:13:16 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/02/15 00:31:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/02/15 00:30:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011/02/15 00:30:53 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/02/13 12:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate
[2011/02/13 12:30:33 | 000,000,000 | ---D | C] -- C:\Program Files\Seagate
[2011/02/13 12:26:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2011/02/13 11:07:02 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2011/02/13 11:06:58 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSSTDFMT.DLL
[2011/02/13 11:06:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2011/02/13 11:06:57 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
[2011/02/13 10:34:30 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011/02/10 14:06:50 | 000,000,000 | ---D | C] -- C:\Program Files\BBC iPlayer Desktop(0)
[2011/02/07 20:35:13 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\Maritime Terrorism
[2011/02/05 13:31:48 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\28 Days Later Soundtrack
[2011/02/02 13:25:03 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\Flight of the Conchords
[2011/01/28 18:44:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/01/28 18:43:13 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/01/28 18:43:09 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[8 C:\Users\Ryan\Desktop\*.tmp files -> C:\Users\Ryan\Desktop\*.tmp -> ]
[12 C:\Users\Ryan\Documents\*.tmp files -> C:\Users\Ryan\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/02/25 19:32:08 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2011/02/25 19:29:38 | 000,232,698 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/02/25 19:29:38 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/25 19:29:37 | 000,232,698 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/02/25 19:29:15 | 000,003,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/25 19:29:15 | 000,003,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/25 19:29:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/25 19:23:30 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011/02/25 19:17:32 | 000,577,024 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe
[2011/02/25 19:11:01 | 000,519,680 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTM.exe
[2011/02/25 19:03:17 | 001,257,772 | ---- | M] () -- C:\Users\Ryan\Desktop\tdsskiller.zip
[2011/02/25 19:01:50 | 000,002,377 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/02/25 18:45:02 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3993292540-1094406474-1489134255-1000UA.job
[2011/02/25 18:45:02 | 000,000,000 | ---- | M] () -- C:\Users\Ryan\AppData\Local\prvlcl.dat
[2011/02/25 18:44:33 | 071,738,447 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2011/02/25 18:28:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/25 00:42:17 | 000,309,038 | ---- | M] () -- C:\Users\Ryan\Desktop\Institutional_theories._Pre-draft.pdf
[2011/02/25 00:42:12 | 000,303,779 | ---- | M] () -- C:\Users\Ryan\Desktop\amenta-ramsey-institutional-theory-1.pdf
[2011/02/25 00:42:03 | 000,089,996 | ---- | M] () -- C:\Users\Ryan\Desktop\HayWincot1998.pdf
[2011/02/25 00:41:56 | 000,101,935 | ---- | M] () -- C:\Users\Ryan\Desktop\HalyTaylor1996.pdf
[2011/02/25 00:41:51 | 000,113,523 | ---- | M] () -- C:\Users\Ryan\Desktop\givepeaceachancefinal.pdf
[2011/02/24 23:36:26 | 000,204,024 | ---- | M] () -- C:\Users\Ryan\Desktop\download.pdf
[2011/02/24 23:27:51 | 000,229,490 | ---- | M] () -- C:\Users\Ryan\Desktop\annurev.polisci.11.060606.pdf
[2011/02/24 20:45:01 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3993292540-1094406474-1489134255-1000Core.job
[2011/02/24 14:04:42 | 000,169,892 | ---- | M] () -- C:\Users\Ryan\Desktop\gr3.pdf
[2011/02/24 13:57:49 | 000,271,245 | ---- | M] () -- C:\Users\Ryan\Desktop\2001035663.pdf
[2011/02/24 13:43:50 | 015,134,542 | ---- | M] () -- C:\Users\Ryan\Desktop\540710427.pdf
[2011/02/24 13:39:06 | 000,227,714 | ---- | M] () -- C:\Users\Ryan\Desktop\mcginnis.pdf
[2011/02/24 13:38:56 | 000,229,715 | ---- | M] () -- C:\Users\Ryan\Desktop\DTEP 215.pdf
[2011/02/24 13:32:33 | 004,097,296 | ---- | M] () -- C:\Users\Ryan\Desktop\3117505.pdf
[2011/02/24 13:32:16 | 003,598,086 | ---- | M] () -- C:\Users\Ryan\Desktop\4145329.pdf
[2011/02/23 19:46:33 | 000,001,307 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
[2011/02/23 00:41:01 | 265,047,391 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/02/22 23:55:40 | 000,000,020 | ---- | M] () -- C:\Users\Ryan\defogger_reenable
[2011/02/21 11:09:14 | 001,372,248 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Ryan\Desktop\TDSSKiller.exe
[2011/02/20 21:01:06 | 000,090,112 | ---- | M] () -- C:\Users\Ryan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/20 02:28:02 | 000,429,885 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110220-104535.backup
[2011/02/20 00:39:45 | 000,020,596 | ---- | M] () -- C:\Users\Ryan\Documents\In 2009.docx
[2011/02/17 20:26:23 | 000,000,162 | -H-- | M] () -- C:\Users\Ryan\Desktop\~$ssertation Final.doc
[2011/02/15 00:34:20 | 000,429,885 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110220-022802.backup
[2011/02/15 00:31:02 | 000,001,079 | ---- | M] () -- C:\Users\Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/02/15 00:31:02 | 000,001,055 | ---- | M] () -- C:\Users\Ryan\Desktop\Spybot - Search & Destroy.lnk
[2011/02/13 11:12:37 | 000,001,356 | ---- | M] () -- C:\Users\Ryan\AppData\Local\d3d9caps.dat
[2011/02/13 11:06:58 | 000,000,812 | ---- | M] () -- C:\Users\Ryan\Desktop\SpywareBlaster.lnk
[2011/02/13 02:10:33 | 000,052,736 | ---- | M] () -- C:\Users\Ryan\Documents\Writing Sample 3.doc
[2011/02/12 22:17:25 | 001,019,689 | ---- | M] () -- C:\Users\Ryan\Documents\University of Edinburgh Transcript.pdf
[2011/02/12 21:34:29 | 000,033,605 | ---- | M] () -- C:\Users\Ryan\Documents\Writing Sample 3.docx
[2011/02/12 21:33:01 | 000,051,200 | ---- | M] () -- C:\Users\Ryan\Documents\Writing Sample 2 (Excerpt).doc
[2011/02/12 21:30:18 | 000,036,864 | ---- | M] () -- C:\Users\Ryan\Documents\Writing Sample 1.doc
[2011/02/12 21:29:29 | 000,024,425 | ---- | M] () -- C:\Users\Ryan\Documents\Sanctioned Sin.docx
[2011/02/12 17:15:57 | 000,035,644 | ---- | M] () -- C:\Users\Ryan\Documents\New CV.docx
[2011/02/12 17:15:25 | 000,241,353 | ---- | M] () -- C:\Users\Ryan\Documents\Ryan Jacobs CV.pdf
[2011/02/12 16:33:17 | 000,034,200 | ---- | M] () -- C:\Users\Ryan\Documents\Reality or Hype.docx
[2011/02/12 16:33:13 | 000,031,238 | ---- | M] () -- C:\Users\Ryan\Documents\Diss Writing Sample.docx
[2011/02/07 01:35:37 | 000,045,568 | ---- | M] () -- C:\Users\Ryan\Documents\Political Islam Essay.doc
[2011/02/06 20:25:25 | 000,178,568 | -H-- | M] () -- C:\Windows\System32\mlfcache.dat
[2011/02/02 17:11:20 | 000,222,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2011/01/31 10:44:34 | 000,610,360 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/01/31 10:44:34 | 000,106,470 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/01/28 18:44:29 | 000,001,664 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/01/27 20:24:23 | 000,000,006 | R--- | M] () -- C:\Users\Ryan\Desktop\Sovereignty as a Sacred Cow.docx
[8 C:\Users\Ryan\Desktop\*.tmp files -> C:\Users\Ryan\Desktop\*.tmp -> ]
[12 C:\Users\Ryan\Documents\*.tmp files -> C:\Users\Ryan\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/02/25 19:03:13 | 001,257,772 | ---- | C] () -- C:\Users\Ryan\Desktop\tdsskiller.zip
[2011/02/25 00:42:17 | 000,309,038 | ---- | C] () -- C:\Users\Ryan\Desktop\Institutional_theories._Pre-draft.pdf
[2011/02/25 00:42:12 | 000,303,779 | ---- | C] () -- C:\Users\Ryan\Desktop\amenta-ramsey-institutional-theory-1.pdf
[2011/02/25 00:42:03 | 000,089,996 | ---- | C] () -- C:\Users\Ryan\Desktop\HayWincot1998.pdf
[2011/02/25 00:41:56 | 000,101,935 | ---- | C] () -- C:\Users\Ryan\Desktop\HalyTaylor1996.pdf
[2011/02/25 00:41:51 | 000,113,523 | ---- | C] () -- C:\Users\Ryan\Desktop\givepeaceachancefinal.pdf
[2011/02/24 23:36:26 | 000,204,024 | ---- | C] () -- C:\Users\Ryan\Desktop\download.pdf
[2011/02/24 23:27:51 | 000,229,490 | ---- | C] () -- C:\Users\Ryan\Desktop\annurev.polisci.11.060606.pdf
[2011/02/24 14:04:42 | 000,169,892 | ---- | C] () -- C:\Users\Ryan\Desktop\gr3.pdf
[2011/02/24 13:57:49 | 000,271,245 | ---- | C] () -- C:\Users\Ryan\Desktop\2001035663.pdf
[2011/02/24 13:43:50 | 015,134,542 | ---- | C] () -- C:\Users\Ryan\Desktop\540710427.pdf
[2011/02/24 13:39:06 | 000,227,714 | ---- | C] () -- C:\Users\Ryan\Desktop\mcginnis.pdf
[2011/02/24 13:38:56 | 000,229,715 | ---- | C] () -- C:\Users\Ryan\Desktop\DTEP 215.pdf
[2011/02/24 13:32:33 | 004,097,296 | ---- | C] () -- C:\Users\Ryan\Desktop\3117505.pdf
[2011/02/24 13:32:15 | 003,598,086 | ---- | C] () -- C:\Users\Ryan\Desktop\4145329.pdf
[2011/02/24 01:09:12 | 000,039,424 | ---- | C] () -- C:\Users\Ryan\Desktop\Korean War Sophie, Ryan.doc
[2011/02/23 01:52:18 | 000,296,448 | ---- | C] () -- C:\Users\Ryan\Desktop\gmer.exe
[2011/02/23 00:33:10 | 265,047,391 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/02/22 23:55:17 | 000,000,020 | ---- | C] () -- C:\Users\Ryan\defogger_reenable
[2011/02/19 15:54:40 | 000,020,596 | ---- | C] () -- C:\Users\Ryan\Documents\In 2009.docx
[2011/02/17 20:26:23 | 000,000,162 | -H-- | C] () -- C:\Users\Ryan\Desktop\~$ssertation Final.doc
[2011/02/15 00:31:02 | 000,001,079 | ---- | C] () -- C:\Users\Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/02/15 00:31:02 | 000,001,055 | ---- | C] () -- C:\Users\Ryan\Desktop\Spybot - Search & Destroy.lnk
[2011/02/13 11:06:58 | 000,000,812 | ---- | C] () -- C:\Users\Ryan\Desktop\SpywareBlaster.lnk
[2011/02/12 22:17:21 | 001,019,689 | ---- | C] () -- C:\Users\Ryan\Documents\University of Edinburgh Transcript.pdf
[2011/02/12 21:34:46 | 000,052,736 | ---- | C] () -- C:\Users\Ryan\Documents\Writing Sample 3.doc
[2011/02/12 21:34:28 | 000,033,605 | ---- | C] () -- C:\Users\Ryan\Documents\Writing Sample 3.docx
[2011/02/12 21:32:59 | 000,051,200 | ---- | C] () -- C:\Users\Ryan\Documents\Writing Sample 2 (Excerpt).doc
[2011/02/12 21:30:16 | 000,036,864 | ---- | C] () -- C:\Users\Ryan\Documents\Writing Sample 1.doc
[2011/02/07 02:03:19 | 000,031,238 | ---- | C] () -- C:\Users\Ryan\Documents\Diss Writing Sample.docx
[2011/02/07 01:35:36 | 000,045,568 | ---- | C] () -- C:\Users\Ryan\Documents\Political Islam Essay.doc
[2011/02/06 20:25:25 | 000,178,568 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011/01/28 18:44:29 | 000,001,664 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/01/27 20:26:18 | 000,000,006 | R--- | C] () -- C:\Users\Ryan\Desktop\Sovereignty as a Sacred Cow.docx
[2010/05/31 23:02:22 | 000,003,252 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\glide_wrapper.zbag.ini
[2010/02/09 06:22:30 | 000,000,000 | ---- | C] () -- C:\Users\Ryan\AppData\Local\prvlcl.dat
[2009/11/17 04:08:34 | 000,197,424 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2009/08/03 07:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/07/13 14:19:43 | 000,090,112 | ---- | C] () -- C:\Users\Ryan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/09 17:54:55 | 000,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
[2009/07/07 15:07:44 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2009/07/07 15:07:42 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2009/07/07 15:07:42 | 000,755,027 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009/07/07 15:07:42 | 000,159,839 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009/07/07 15:07:40 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009/07/07 15:01:48 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009/06/28 15:26:23 | 000,232,698 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/06/28 15:26:23 | 000,232,698 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/06/28 12:49:35 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/06/28 03:28:34 | 000,065,536 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2009/06/28 03:14:47 | 000,001,356 | ---- | C] () -- C:\Users\Ryan\AppData\Local\d3d9caps.dat
[2009/06/28 02:42:45 | 000,027,240 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\nvModes.001
[2009/06/28 02:42:29 | 000,027,240 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\nvModes.dat
[2009/06/27 15:57:53 | 000,139,152 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\PnkBstrK.sys
[2009/06/27 15:56:58 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini
[2009/06/27 14:50:48 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2009/06/27 14:38:27 | 000,006,656 | ---- | C] () -- C:\Windows\System32\stacutil.dll
[2006/11/02 07:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[1997/03/31 16:00:00 | 001,664,272 | ---- | C] () -- C:\Windows\System32\MSO97V.DLL
[1997/03/31 16:00:00 | 000,022,016 | ---- | C] () -- C:\Windows\System32\DOCOBJ.DLL
[1997/03/31 16:00:00 | 000,016,384 | ---- | C] () -- C:\Windows\System32\MSORFS.DLL
[1997/03/31 16:00:00 | 000,012,288 | ---- | C] () -- C:\Windows\System32\HLINKPRX.DLL

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34

< End of report >
OTL Extras Report
OTL Extras logfile created on: 2/25/2011 7:32:47 PM - Run 1
OTL by OldTimer - Version 3.2.21.0 Folder = C:\Users\Ryan\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146.00 Gb Total Space | 25.33 Gb Free Space | 17.35% Space Free | Partition Type: NTFS

Computer Name: RYAN-PC | User Name: Ryan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3993292540-1094406474-1489134255-1000]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A77B9F8-E04B-499C-8087-719A81EFEE05}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{3942F095-6692-4BCE-B407-51CC2C185F22}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{3FB4E4A7-61CE-44EE-BF56-7D1CDC6DE2BB}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface |
"{4946DB00-F8ED-4C85-B38E-D8AE4F7C3D3A}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{62B2822E-8297-46C1-A7A6-10434E16034C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{92952832-4A18-49EA-9F22-261A5524382B}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00B5350F-95FA-4F72-A7F1-4C0D52701DCB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{00DB21FB-C91B-4E43-BB16-4D5E839F463D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0145B11A-73C0-4C83-8690-CC3959487FB2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{01C50B43-0DDB-4876-80A8-B60924BD1977}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{02571AD0-6C6D-414D-8077-72D41A3DCA48}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{046ACE34-6436-4740-B74D-92AF992B9DBE}" = protocol=58 | dir=in | app=system |
"{051AEC8D-81BB-4579-B9A2-06D6C9D1E7FA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0522C5E7-2EE5-42A7-A277-FC26E3C3F24A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{05C155A1-F691-4BBE-A453-1C8A21F7314D}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{07630A65-18A7-4190-98C0-7B1F7287D7D0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{085B775E-43AE-4DDB-84CE-05F4F9EC3035}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{08C45AA7-53C0-481C-9265-7D47917D5F23}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{09576652-53B5-413B-9BB6-76944AE7174A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0A793835-FF87-48BD-AC98-A7E8C020887C}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe |
"{0B1EE191-0018-4BC1-AD48-981ED23B2944}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{0C0F3220-BC02-4243-9C4E-0A1EA4C34E08}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0C44A97F-4671-4F07-8A99-9DF443B16B4D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0D3A1AC6-DDA8-4EBE-91CA-F9CD49C63B1B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0DF5A90A-15F9-45F5-86E8-54BAD16C54A3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0E19219C-C98E-4FD9-AA01-5098CD526873}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0FB7C812-30B4-48EB-A004-FBF080E6AE93}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{10E351E9-2C68-496C-A8BD-442DA087FBEA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{11C91010-8AFA-4177-BCB1-3D7B17D0FCBB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{13EC2D9E-C310-4677-B443-6981BB2F78A7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{140A5ACE-E76B-49CB-BE7E-7D66065E8376}" = protocol=6 | dir=in | app=c:\program files\codemasters\of dragon rising demo\ofdr demo.exe |
"{14276405-69CD-4729-982F-EEF897BE91A8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{147601C6-B325-4BC8-8CB7-2F1FAC3296E0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{15FD1F2D-3DD3-4749-8526-70E90C3F9091}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{17289404-5D59-4157-A69C-440D66FCF76F}" = protocol=17 | dir=in | app=c:\program files\codemasters\of dragon rising demo\ofdr demo.exe |
"{18B7F42D-7BF0-4A2B-9508-60F96CDC6652}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{18ECF970-634F-408F-AF19-58AB06746F3D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{19616FCA-3082-4532-BFE0-5A3E99047891}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{1A2ACBB9-EFDC-4556-8C28-73D4622975A3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1DCFFE08-2256-4607-A9D6-0B38BFCF565D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1E4DA9AF-FF5B-4749-9A9A-BF24EBED4FB2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1EC0EC3C-C4F4-402E-BC47-3AE02B621950}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{213B5D41-924B-4519-9DF2-812B651DE43C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{21B2EC82-1EB6-4CAA-A6E7-3E2B8136C149}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{227687DE-AE54-4293-AB5D-C3BB5DD0AD7D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{24B27F9A-8E7D-4303-94FB-2F663F24B444}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{257A6779-1CDA-4C76-BB61-F6C1F96070E2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2629C439-C554-4112-A2B6-CD1C882FFE0E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2651245B-88D9-4E0C-BF0E-9621233076D3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{28C66B6C-5B28-469B-9D7C-867D653678EC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{28E8EB08-C910-4C9F-8274-A8DF10108C24}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2D4CFB25-AFB2-4970-B133-C5F8C3E5D8C7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2F905AD0-8494-4EAA-BB85-81664BEAC66C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{316FB50D-CECF-405E-8459-B112C6657434}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{326768EC-3AEC-4A54-B5FA-4D70B8997DB8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3306DDB1-DAEC-4369-84B1-0682EEB756D8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{34E662DE-B967-44BF-8D87-C3026BF4B28A}" = protocol=6 | dir=in | app=c:\program files\times reader\times reader.exe |
"{35B9D56A-18C2-46AA-9B92-C4ECF737CF74}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{389E5005-8B1F-4597-9F73-4F9A1F7E1DA2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{394CDA7A-D272-4501-B2AF-7346062F3C20}" = protocol=6 | dir=in | app=c:\program files\xfire\xfire.exe |
"{39C34977-FCF3-41EF-B402-1AB27A9881DA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{39C8226A-1AB1-4CAF-B7D7-173CF157D72A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3A0AE903-B719-411C-966B-085D6B24B01F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3B30ECEA-EB33-4F28-BE1C-2ECEDE0ADF74}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3B798D3F-864F-4DBC-B4E3-C817C2C27EF2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3D2483D8-258C-4C28-8336-C2E770F8EDAA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3D2F3674-CF76-4208-A7C6-C9634156D07F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3D7488E2-AAC6-496F-BFAD-76AF58EC8B01}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3DCD917E-DB71-42F3-98D1-42F987D17A13}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{402DA075-6D0B-4571-B17A-8885FA8B824C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{428F233B-C0FC-4B22-BD28-7BE7043AEEDF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4489C859-4653-43AC-9B65-8EF9B862F34B}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3sp.exe |
"{4495949E-4E85-4449-B13C-5BA54C07E266}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4955790E-FB11-4594-9199-53328321C29D}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"{4C05D05F-984A-4B14-A104-784F597255B7}" = protocol=17 | dir=in | app=c:\program files\xfire\xfire.exe |
"{4C2B1B47-5886-495B-907D-EBD49C9098EE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4E9B8195-D8BD-40B5-B520-9BF4ABD7F846}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4F3CBDD6-A0EE-4AD6-88B7-015C4E147D9F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4F5C8FEE-3846-400F-854F-07705AC93CD7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{506C7D21-0917-4A6C-9298-8B1BDC3EB730}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{50EAC5B4-9E20-4822-B71B-31393D360127}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{557924B3-322D-4E3F-B119-0865F31BCD8E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{569BD81A-40D0-40C0-B8AA-1C1A1918CC5F}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{57544525-EF0A-422F-8B27-A68817B3DF4D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5889062B-E24A-4BEF-9860-B577B188893C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5CCF3E1C-3B87-4797-81CB-DA709AF8929F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5EE63752-E361-421D-A1D4-D3351ECEB09F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{61E55829-F9BC-4810-9A8C-C07025D9C77D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6256D938-D904-4A58-A477-0155F0C1EA24}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{643BBCEE-1D67-4B99-852C-6EA9A93C347B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{653624F4-5028-4017-888D-722831B5B34D}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe |
"{66CBB1E6-4373-474C-B083-24729AFB1F21}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6902211F-958E-4A05-9756-BFBE2B3E08F9}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{695691A1-3D2F-4AE4-B933-A2682D1A09F0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{69B3316C-A131-4EFD-A95E-60DB0FA5DCE0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6ADF704F-E6BA-43AB-9A1A-6BC4DF09BCA0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6C253639-5B0A-474B-B6F8-B1192BFAEF57}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6D6DB21F-D44D-481A-8EC1-754424D854B5}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{6E003188-D25C-49D5-BA2D-44E29E25BBE1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6E330D85-4C6D-48E7-8AA5-911920650B0B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{712DE252-0A0A-4118-96F3-EC297783E1D2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{71B1D024-226E-455B-8D46-CDEE1F2A086E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{73DCA048-990F-4718-BDD8-E5CD573E4EAF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{74B39E5F-BA4D-45F8-8C9C-D9E05B7CD8B7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{757D34B4-3064-46FB-A1CA-4B77D7488F56}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{75AB0E5D-E42B-470D-BC4A-4811A54E22FE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7675A103-9020-4E53-B5B1-1EE21FA1FEFC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{78F945C6-E8FC-47E1-8DD9-A7E51346D393}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7917E46F-E8A0-4756-9D00-49FDF3A5B60C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{79598718-2957-4CC0-AC59-9E14AC9C9269}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7A2634E4-33F0-4CA8-92FB-F0E5935D4B36}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{7BDE84FE-EF2D-40EE-839C-6D0DABACC5B9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7C3E53B3-B296-46BD-B60C-172E672BA7BA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7D34071F-CAAC-441C-A081-D3BC16D3AA6D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7E41D932-D593-4D9A-958F-7D8159972E6F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{81FB3DF2-044A-4E6B-AE47-64F912350EDE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{82ABDAF1-1B92-4CA7-AE26-3FC4DFBA0550}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{84BCEE33-6D94-4A49-93E9-9E5978958752}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{85EE2D61-C6E8-4706-A406-CF9AF827DC34}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{865F2EA6-3603-444D-B685-5C2922D373DB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{86731CBF-D337-4A96-8C7B-55B8C587C89C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{871E9A8B-D015-41B8-8ACD-35A549DC712F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{87903D1B-87B5-403E-9EA3-DD5CCFB13E7C}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe |
"{883CD6A5-4FA9-4A00-8DEB-25FA9F97528B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8945C712-4E0A-452C-93CC-CFE07417A2BC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{89F06635-EDD2-4E5D-B8F2-EA8EE9EA23A8}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{8BB85181-26DF-4D60-B720-5702290E13F8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8C64FDA3-B16D-4293-AFC9-DD288DA30A5E}" = protocol=17 | dir=in | app=c:\program files\google\google talk\googletalk.exe |
"{8DAC3CCC-81B3-4732-A06B-3F528280B918}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8DBE73FD-D005-414B-815B-F2335095AC1F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8DCEF65D-31FC-4B09-94E1-8A1775763224}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{91759C7D-7C8A-4320-B6E4-64E495B82278}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{92611D40-AF49-4430-B08E-D91F4B4E3468}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9308B61D-9FE6-47EB-B926-092FF9593449}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{94930F0E-9D86-4652-907B-C45B1AC6F897}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{95321B2E-6DDF-4705-807F-81C20A7A99EE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9612D2FB-DC57-4B9F-8582-4680A9D28191}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{974B4029-F091-4836-82C3-00B8BDCEE0B4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{98AABA41-F5B1-47D2-AE70-3F6DC82BD660}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{99679130-A83D-4974-B8E9-3D0992FD4B6A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{996FF0B6-FE02-4DE1-B2FD-9D61987D2593}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9972508A-5A80-489C-81DF-7D91E0AFC15E}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{9BACF5FE-4A50-4519-94AC-1E7C04BD15AE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A0D5AFAD-C532-40D3-AAFE-966BAC2BD289}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A2508804-38E7-4AA7-B92E-8EA8CDC75ECB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A3DDA781-8780-41D3-8260-029A829EE282}" = dir=in | app=c:\program files\avg\avg8\avgnsx.exe |
"{A4935A5E-F01F-466B-9B72-BCFB417DDB42}" = protocol=17 | dir=in | app=c:\program files\hotspot shield\bin\openvpntray.exe |
"{A5C70B3E-87FF-470D-8E01-B450EEC25845}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A625A1C7-F744-4726-A9BA-CA0E90E1EBDF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A7A895B3-AA9F-4C0A-AF83-F6F5CCFA2957}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-203 |
"{A803C427-0C64-48EE-9987-1CF3D99216FD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A98540D0-2487-46DC-A9BC-B00612DC4F75}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{AA067E89-4C2E-47CE-9806-EE05E7FC9205}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AB0F86D6-F060-4612-A384-D53DCDD52885}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AC2F3636-4530-4B66-B4B4-85A826B467F4}" = protocol=6 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{AC72A397-283F-4223-9244-EFF7A2C8BE09}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{ADC23AF5-E665-460F-8082-9714E98A5CFF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AEA845EC-7E5D-4F0E-8EB5-0A7825BFB354}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AF5C16FF-F746-48EA-BCED-70B6F4196B0D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B11DE33B-DCD5-4171-B0C6-0E7332F060F1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B28EF686-871B-4445-99FB-260458F76BB3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B4025046-27CD-44CA-A79D-76BB64D0F9DD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B43CF019-DF84-4206-924B-42C086E00DC1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B4B6B4DC-EF7F-46E2-BE58-BF95AFF554C2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B5DB1306-21FF-4A48-AEBF-65AC4C25FB2E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B81AF0FC-1FEC-4190-BFF4-3ECA9D7A7F5C}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe |
"{BAB3C3EF-8CAA-456E-AB56-650C83A14055}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BB4A1200-A8D9-4F9B-8CD0-7C0002CFBEC2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BB6B508F-4D82-4266-927B-F74C4AF03060}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BB7C7268-B03B-4A70-8621-9F35E7E5566E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BFF0091D-C512-4276-B002-0F736674D4F7}" = protocol=17 | dir=in | app=c:\users\ryan\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{C068F382-6749-40BA-8610-5F6131407C8D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C0CAAC36-98E3-40BD-9737-26204ED69CF1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C1451F8A-5EE0-4FB9-9DFC-0AFBA3B52BDE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C14E4B20-731B-4FAC-9F0E-CB245D0D8456}" = protocol=6 | dir=in | app=c:\program files\hotspot shield\bin\openvpntray.exe |
"{C2BE5B53-22FB-4BF2-A936-EFA718734A9D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C4F67340-03AB-4A27-A191-6405E2ED09A9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C6D41A0E-AD54-4A11-AF26-476634C9BC40}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C6D48F07-CFE6-4C39-AB9F-775A52E3615F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C935D6AC-A742-4F7B-B047-2586C366E2AB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CD02FAF6-BDD9-4D41-97D9-42FFE7B80333}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CD3BBBC0-789B-4FD6-8B37-EE8D9F283FE6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CDDAA643-BE02-48AA-A051-BFC33330A197}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CE2FA8DA-8242-46E4-A85F-B349668E500D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D02DB565-A020-4939-90E0-C9689A358E9F}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3sp.exe |
"{D0C080FB-7DF9-4F71-9F78-ABE903E95031}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{D0D4440E-2CD3-4C16-BC2C-AE508308D38A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D1362C25-E3E3-489C-B26F-F754EFA7AF33}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D1BAE39D-CA88-4F2A-815E-26D8A5A34CB1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D1F581A1-CD29-4DCB-8FAE-F34D882E9DD9}" = protocol=6 | dir=in | app=c:\program files\google\google talk\googletalk.exe |
"{D2E89EA4-70AD-4BEF-81E6-0A4560F3E12F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D68BC2E5-0B22-4D8E-BD25-2A5EC1FF261C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D68E5C4E-6891-42F5-B20A-97A3B6E2013C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D7EBC865-4952-4756-813F-C21E0356AC87}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D910E148-1811-4F29-A99B-F760B399AC78}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DBBFD6C5-48A5-4D74-803E-06D37E06961F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DDA0F214-EFA3-4255-9F85-D89C4D78CA1E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DDEE8A73-F841-41CF-AAAB-60DC91F9C4AE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DFED2570-6364-4F1B-B07F-2CE074E82A2A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E1D93E4E-B96C-4FFE-AB0E-43EE752AB9D0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E2735577-93DB-450E-924A-304483DBF653}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E2D131D7-A161-4D79-9DF3-4D371D38AF12}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{E3400867-687A-4B6E-86ED-421EB3C5D05A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E37B3555-DD4A-4F02-92D7-B706F3E6250C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E383941B-F581-476D-A319-13BCD6AB51E1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E397C84A-EF82-4544-97F2-E6248CEE8372}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E3EEA279-3459-4235-9442-05114052DF29}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E45585D9-60AC-487C-B0DD-9B396BC8E7B3}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{E49D7EC5-920C-489A-8D89-ADDC72087BC3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E612161F-45AE-4B67-9AA9-1A0EFB4BB380}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E8B06FFD-11FE-41AD-9943-1B5041BD9DF0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E8C22D22-8270-479B-B5EB-61B42068F1B6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E942BE05-71DE-49CD-92BE-582C6DE2E5A5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E9856751-6D93-48C7-8BDB-F18D22844DFF}" = protocol=17 | dir=in | app=c:\program files\times reader\times reader.exe |
"{E9E124B4-18DC-42F9-BFFB-A7EFB68781BC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EB002A42-C2D8-4DB8-BD3A-9C4FCBF23AF1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{ECE7721B-A550-489F-9A8A-1946C28A451E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EDC19086-05D4-451F-B570-7F530D8713EA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F17F6ACC-D3C7-4A64-85DB-9E5EFA52B7E0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F1AD0153-5BFD-48FD-BDDF-44DFE976D68F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F581EE16-53AD-43B9-982E-319E697EEDC3}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{F584D96A-FE57-4794-AD36-A642BFC38984}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\america's army 3\binaries\aa3game.exe |
"{F5FC1599-9AA6-4FFB-BC58-8A303F3B3A3F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F78747B9-4991-492B-A7B5-135F1F0C07F6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\america's army 3\binaries\aa3game.exe |
"{FB30ED30-207E-40A8-AA3E-86415F82AC55}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FC369B67-15E6-486E-BEC2-8CA88CD2106D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FE01074D-A6C1-44BF-8604-CA06E0A44DBD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FF70F830-9E15-4D2D-AB1C-B94C09C58153}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{072D7519-8EF3-49EA-A811-CBD7B912E03D}C:\program files\livestation\livestation.exe" = protocol=6 | dir=in | app=c:\program files\livestation\livestation.exe |
"TCP Query User{176F384C-CF72-41C2-946D-331BBE344BA0}C:\wic\world in conflict\wic.exe" = protocol=6 | dir=in | app=c:\wic\world in conflict\wic.exe |
"TCP Query User{1FBF0C8A-AB59-4BD1-A5EB-70391C45776D}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{25D74DC0-C2FF-47A2-9AFA-183CD071E91E}C:\users\ryan\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe" = protocol=6 | dir=in | app=c:\users\ryan\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe |
"TCP Query User{2A38E6C1-438B-4A5A-A0BC-7F43F919DE08}C:\program files\livestation\livestation.exe" = protocol=6 | dir=in | app=c:\program files\livestation\livestation.exe |
"TCP Query User{529C4176-F8EE-41E0-B3E2-DB9D602595AA}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{5C87CE5B-B6EF-4FE1-9E78-CB9C3E8A034F}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{5E27DAF5-ADB5-4D8C-903A-AAD18EC5C2BB}C:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{65339460-617F-4D78-99BC-4F52175028AA}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"TCP Query User{6692207B-56A1-42A2-AD12-CCAA33AF7764}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{7431CC5A-4315-4B07-99E6-875BC6DD462E}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{DB35A70A-822D-42D6-87B4-D11EF0C94A92}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{F59AC357-D8FA-4735-838B-40B64CB1D47F}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{38B11167-40C0-40FB-824B-977CB7F95635}C:\program files\livestation\livestation.exe" = protocol=17 | dir=in | app=c:\program files\livestation\livestation.exe |
"UDP Query User{3D74A165-6AD0-432F-B29A-2257C13324A8}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{4AB0A833-C60B-4130-A950-2335A61A113C}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{71683BB7-F366-43BB-B4AE-99E63EAC69C7}C:\users\ryan\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe" = protocol=17 | dir=in | app=c:\users\ryan\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe |
"UDP Query User{78D5A0D5-3D8B-4B83-99B6-903C20308F40}C:\program files\livestation\livestation.exe" = protocol=17 | dir=in | app=c:\program files\livestation\livestation.exe |
"UDP Query User{791BBF50-29DB-41FE-9795-F024DBB08A75}C:\wic\world in conflict\wic.exe" = protocol=17 | dir=in | app=c:\wic\world in conflict\wic.exe |
"UDP Query User{7E353F6E-C129-4775-9B6C-6AB8CB2B8345}C:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\ryan\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{8F3CDA79-0013-483C-9E9E-3F30B33977EC}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{9A16AB1B-DF7C-4E03-AC6B-40B57ED1A89B}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{A9DD381C-E342-434B-B64F-AFBE91EA393E}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{AC0F8D9B-3ED4-474F-8F38-944711CC9044}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{E683690B-C012-4B73-A36B-42C32EA6D68B}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"UDP Query User{EB2204B1-A964-4B38-89A3-8092D1C94240}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{005F78AF-110D-398A-8430-BE98950A1E22}" = Google Talk Plugin
"{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0AFA293A-5C49-4B3B-A2A3-1E9EF19FBEFD}" = Flow
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{13228AA7-9DD0-7774-9143-DAE4AA73DC12}" = BBC iPlayer Desktop
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}" = Cisco Systems VPN Client 5.0.06.0160
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 17
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{2FB1052B-2F3D-48CE-A65D-006240516ECE}_is1" = Office 2010 Trial Extender version 1.0.0.3
"{331C9768-BAD9-F31B-8DA2-0268D346C702}" = Times Reader
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{612B9183-67A9-4B44-9877-2F059E35B86A}" = Broadcom 440x 10/100 Integrated Controller
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-006D-0409-0000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{90140011-0061-0409-0000-0000000FF1CE}" = Microsoft Office Home and Student 2010 - English
"{90140011-0062-0409-0000-0000000FF1CE}" = Microsoft Office Home and Business 2010 - English
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A1BF9950-8CDB-468E-83FA-EACFB00EA7D5}" = Windows Live Sync
"{A436BE6E-A20F-41B8-ABD7-851AAD42FF8D}" = Livestation
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{AC76BA86-7AD7-2448-0000-900000000003}" = Chinese Traditional Fonts Support For Adobe Reader 9
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B73BEEBE-3D94-2634-B5D1-28B8269489FF}" = twhirl
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF67CB0E-6E9A-49AA-805E-D7ABD15E4FCA}" = WP-S1 PCSync
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F9766AC1-1461-1033-B862-DF8FE1C033BE}" = Adobe InDesign CS5
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF70513F-E3A7-402F-84FB-B7810A064BE2}" = Zune
"8461-7759-5462-8226" = Vuze
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Akamai" = Akamai NetSession Interface
"AVG9Uninstall" = AVG Free 9.0
"Badaboom" = Badaboom 1.2.1.7
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1" = Times Reader
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"CutePDF Writer Installation" = CutePDF Writer 2.8
"de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1" = twhirl
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"Google Updater" = Google Updater
"HotspotShield" = Hotspot Shield 1.56
"I8kfanGUI" = I8kfanGUI V3.1
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty® 4 - Modern Warfare™ 1.4 Patch
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty® 4 - Modern Warfare™ 1.5 Multiplayer Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare™ 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare™ 1.7 Patch
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.0.0 (Full)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"OpenAL" = OpenAL
"Picasa 3" = Picasa 3
"SpywareBlaster_is1" = SpywareBlaster 4.4
"TED Notepad" = TED Notepad
"Viewer97" = Microsoft Word Viewer 97
"VLC media player" = VLC media player 1.1.5
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Zune" = Zune

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3993292540-1094406474-1489134255-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Facebook Plug-In" = Facebook Plug-In
"GoToMeeting" = GoToMeeting 4.1.0.366
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/2/2010 10:33:21 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6224

Error - 7/2/2010 10:33:22 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/2/2010 10:33:22 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7238

Error - 7/2/2010 10:33:22 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7238

Error - 7/2/2010 10:33:23 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/2/2010 10:33:23 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8252

Error - 7/2/2010 10:33:23 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8252

Error - 7/2/2010 10:33:24 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/2/2010 10:33:24 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9266

Error - 7/2/2010 10:33:24 AM | Computer Name = Ryan-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9266

[ Broadcom Wireless LAN Events ]
Error - 2/18/2011 6:29:11 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 10:29:11, Fri, Feb 18, 11 Error - Unable to gain access to user store

Error - 2/19/2011 8:33:17 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 12:33:16, Sat, Feb 19, 11 Error - Unable to gain access to user store

Error - 2/20/2011 5:13:31 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 09:13:31, Sun, Feb 20, 11 Error - Unable to gain access to user store

Error - 2/20/2011 6:15:13 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 10:15:13, Sun, Feb 20, 11 Error - Unable to gain access to user store

Error - 2/22/2011 12:53:30 PM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 16:53:30, Tue, Feb 22, 11 Error - Unable to gain access to user store

Error - 2/22/2011 8:33:36 PM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 00:33:36, Wed, Feb 23, 11 Error - Unable to gain access to user store

Error - 2/22/2011 8:41:25 PM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 00:41:25, Wed, Feb 23, 11 Error - Unable to gain access to user store

Error - 2/22/2011 8:41:57 PM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 00:41:57, Wed, Feb 23, 11 Error - Unable to gain access to user store

Error - 2/25/2011 6:50:40 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 10:50:40, Fri, Feb 25, 11 Error - Unable to gain access to user store

Error - 2/25/2011 7:30:55 AM | Computer Name = Ryan-PC | Source = WLAN-Tray | ID = 0
Description = 11:30:55, Fri, Feb 25, 11 Error - Unable to gain access to user store

[ System Events ]
Error - 2/25/2011 11:40:47 AM | Computer Name = Ryan-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.64 for the Network Card with network
address 001C26264FB3 has been denied by the DHCP server 10.200.2.5 (The DHCP Server
sent a DHCPNACK message).

Error - 2/25/2011 11:59:28 AM | Computer Name = Ryan-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.200.3.21 for the Network Card with network
address 001C26264FB3 has been denied by the DHCP server 10.200.2.5 (The DHCP Server
sent a DHCPNACK message).

Error - 2/25/2011 12:01:47 PM | Computer Name = Ryan-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.200.3.21 for the Network Card with network
address 001C26264FB3 has been denied by the DHCP server 10.200.2.5 (The DHCP Server
sent a DHCPNACK message).

Error - 2/25/2011 12:05:44 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 2/25/2011 2:23:42 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 2/25/2011 2:24:06 PM | Computer Name = Ryan-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.200.3.21 for the Network Card with network
address 001C26264FB3 has been denied by the DHCP server 10.0.0.138 (The DHCP Server
sent a DHCPNACK message).

Error - 2/25/2011 3:07:44 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 2/25/2011 3:11:55 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 2/25/2011 3:23:30 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 2/25/2011 3:29:27 PM | Computer Name = Ryan-PC | Source = Service Control Manager | ID = 7000
Description =

< End of report >

#5 SweetTech

Agent ST

Members
13,421 posts
OFFLINE

Gender:Male
Location:Antarctica
Local time:01:03 AM

Posted 25 February 2011 - 03:25 PM

Ryan,

Things should be running better now since TDSSKiller found and fixed this;

2011/02/25 19:05:04.0750 4960 Detected object count: 1
2011/02/25 19:05:38.0186 4960 \HardDisk0 - will be cured after reboot
2011/02/25 19:05:38.0187 4960 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/02/25 19:05:44.0932 4520 Deinitialize success

Do you recognize these files?

C:\Users\Ryan\Desktop\2001035663.pdf
C:\Users\Ryan\Desktop\540710427.pdf
C:\Users\Ryan\Desktop\3117505.pdf
C:\Users\Ryan\Desktop\4145329.pdf

____________________________________________________

Disable SpyBot TeaTimer
We need to disable Spybot S&D's "TeaTimer"
TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can reenable it when we're done if you like.

Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
If prompted with a legal dialog, accept the warning.
Click and then on "Advanced Mode"
You may be presented with a warning dialog. If so, press
Click on
Click on
Uncheck this checkbox:
Close/Exit Spybot Search and Destroy

NEXT:

OTL Fix

We need to run an OTL Fix

Please reopen on your desktop.

Copy and Paste the following code into the Posted Image

textbox.

:Services
:OTL
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
IE - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
O3 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [{CD869620-BE88-771E-03A9-9345E09944A5}] C:\Users\Ryan\AppData\Roaming\Izipy\duisy.exe (Ueuhtaxhu Owychxl)
O4 - HKU\S-1-5-21-3993292540-1094406474-1489134255-1000..\Run: [AdobeBridge] File not found
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O33 - MountPoints2\{17bd1282-9c7f-11de-ba60-001c238cee27}\Shell\AutoRun\command - "" = wd_windows_tools\setup.exe
O33 - MountPoints2\{2e360a4b-e9ac-11df-90f2-c26bb38aaee3}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bot.vbs
O33 - MountPoints2\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\Shell\AutoRun\command - "" = E:\xedex.exe
O33 - MountPoints2\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\Shell\open\Command - "" = E:\xedex.exe
[2011/02/23 12:07:46 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Desktop\www1360.megaupload.com
[8 C:\Users\Ryan\Desktop\*.tmp files -> C:\Users\Ryan\Desktop\*.tmp -> ]
[12 C:\Users\Ryan\Documents\*.tmp files -> C:\Users\Ryan\Documents\*.tmp -> ]
[2011/02/20 02:28:02 | 000,429,885 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110220-104535.backup
[2011/02/15 00:34:20 | 000,429,885 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110220-022802.backup

:Reg

:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[CreateRestorePoint]
[emptytemp]
[EMPTYFLASH]

Push
OTL may ask to reboot the machine. Please do so if asked.
Click .
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Running ComboFix
Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

#6 SweetTech

Agent ST

Members
13,421 posts
OFFLINE

Gender:Male
Location:Antarctica
Local time:01:03 AM

Posted 28 February 2011 - 01:15 PM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

#7 Andrew

Bleepin' Night Watchman

Moderator
8,260 posts
OFFLINE

Gender:Not Telling
Location:Right behind you
Local time:10:03 PM

Posted 02 March 2011 - 03:48 AM

Reopened by OP request.

Boredom Software

#8 DrFeel

Topic Starter

Members
6 posts
OFFLINE

Local time:12:03 AM

Posted 02 March 2011 - 04:05 AM

Thank you very much for the reopening.

The PDF files are for an essay, so no worries about them. Sorry about not getting back to you. Left my charger at home and didn't have it until I got back last night.

OTL Log
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_USERS\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Run\\{CD869620-BE88-771E-03A9-9345E09944A5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD869620-BE88-771E-03A9-9345E09944A5}\ not found.
C:\Users\Ryan\AppData\Roaming\Izipy\duisy.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-3993292540-1094406474-1489134255-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17bd1282-9c7f-11de-ba60-001c238cee27}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17bd1282-9c7f-11de-ba60-001c238cee27}\ not found.
File wd_windows_tools\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2e360a4b-e9ac-11df-90f2-c26bb38aaee3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2e360a4b-e9ac-11df-90f2-c26bb38aaee3}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bot.vbs not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\ not found.
File E:\xedex.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fa4a13b-21b0-11df-8a9a-f06890971ee6}\ not found.
File E:\xedex.exe not found.
C:\Users\Ryan\Desktop\www1360.megaupload.com folder moved successfully.
C:\Users\Ryan\Desktop\~WRL0002.tmp deleted successfully.
C:\Users\Ryan\Desktop\~WRL0003.tmp deleted successfully.
C:\Users\Ryan\Desktop\~WRL0004.tmp deleted successfully.
C:\Users\Ryan\Desktop\~WRL0005.tmp deleted successfully.
C:\Users\Ryan\Desktop\~WRL0006.tmp deleted successfully.
C:\Users\Ryan\Desktop\~WRL1370.tmp deleted successfully.
C:\Users\Ryan\Desktop\~WRL1598.tmp deleted successfully.
C:\Users\Ryan\Desktop\~WRL2867.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL0001.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL0003.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL0004.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL0005.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL0006.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL0007.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL0042.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL0199.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL0407.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL1601.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL2439.tmp deleted successfully.
C:\Users\Ryan\Documents\~WRL2907.tmp deleted successfully.
C:\Windows\System32\drivers\etc\hosts.20110220-104535.backup moved successfully.
C:\Windows\System32\drivers\etc\hosts.20110220-022802.backup moved successfully.
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Ryan\Desktop\cmd.bat deleted successfully.
C:\Users\Ryan\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Family
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Ryan
->Temp folder emptied: 98632 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 75108248 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 848 bytes

User: TEMP

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 72.00 mb

[EMPTYFLASH]

User: Admin
->Flash cache emptied: 0 bytes

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Family
->Flash cache emptied: 0 bytes

User: Public

User: Ryan
->Flash cache emptied: 0 bytes

User: TEMP

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.21.0 log created on 02252011_215856

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

ComboFix

ComboFix 11-02-24.05 - Ryan 02/25/2011 22:23:19.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.2045.1278 [GMT 0:00]
Running from: c:\users\Ryan\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Ryan\AppData\Roaming\Izipy\duisy.exe
c:\users\Ryan\g2mdlhlpx.exe

.
((((((((((((((((((((((((( Files Created from 2011-01-25 to 2011-02-25 )))))))))))))))))))))))))))))))
.

2011-02-25 21:58 . 2011-02-25 21:58 -------- d-----w- C:\_OTL
2011-02-25 20:21 . 2011-02-25 20:24 -------- d-----w- C:\210bb147ad72d4f042ee
2011-02-25 19:11 . 2011-02-25 19:11 -------- d-----w- C:\_OTM
2011-02-20 13:39 . 2011-02-02 17:10 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A83D50F7-0D82-47BD-869F-03A0168A789B}\mpengine.dll
2011-02-15 00:30 . 2011-02-25 10:11 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-02-15 00:30 . 2011-02-15 00:32 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-02-13 12:30 . 2011-02-13 12:30 -------- d-----w- c:\program files\Seagate
2011-02-13 12:26 . 2011-02-13 12:26 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2011-02-13 11:06 . 2010-01-10 19:40 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2011-02-13 11:06 . 2011-02-15 09:07 -------- d-----w- c:\program files\SpywareBlaster
2011-02-10 14:06 . 2011-02-10 14:06 -------- d-----w- c:\program files\BBC iPlayer Desktop(0)
2011-01-28 18:43 . 2011-01-28 18:43 -------- d-----w- c:\program files\iPod
2011-01-28 18:43 . 2011-01-28 18:44 -------- d-----w- c:\program files\iTunes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-02 17:11 . 2009-10-02 20:47 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-12-28 15:55 . 2011-01-12 09:30 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-14 14:49 . 2011-01-12 09:30 1169408 ----a-w- c:\windows\system32\sdclt.exe
2010-11-29 17:38 . 2010-11-29 17:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 17:38 . 2010-11-29 17:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Ryan\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Ryan\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Ryan\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"i8kfangui"="c:\program files\I8kfanGUI\I8kfanGUI.exe" [2007-02-16 856064]
"Google Update"="c:\users\Ryan\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-08-08 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]

c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Ryan\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE [2010-2-28 3207072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^OfficeSAS.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\OfficeSAS.lnk
backup=c:\windows\pss\OfficeSAS.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Ryan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BBC iPlayer Desktop.lnk]
path=c:\users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk
backup=c:\windows\pss\BBC iPlayer Desktop.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Ryan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Ryan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk]
path=c:\users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Ryan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk]
path=c:\users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
backup=c:\windows\pss\OpenOffice.org 3.1.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Ryan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2007-03-21 16:33 1548288 ----a-w- c:\windows\System32\WLTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
2007-03-01 05:01 180736 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-08-08 14:37 133104 ----atw- c:\users\Ryan\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 ----a-w- c:\program files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 15:08 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Livestation]
2010-06-25 00:08 4657152 ----a-w- c:\program files\Livestation\Livestation.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-09-22 23:47 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-06-16 14:27 13793824 ----a-w- c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
2009-06-16 14:27 92704 ----a-w- c:\windows\System32\nvhotkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-06-16 14:27 92704 ----a-w- c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe]
2007-05-09 22:01 36864 ----a-w- c:\windows\OEM02Mon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 17:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2007-03-06 17:37 303104 ----a-w- c:\windows\sttray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-09-02 14:15 13351304 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-10 20:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WPCUMI]
2006-11-02 12:34 176128 ----a-w- c:\windows\System32\wpcumi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
2008-12-12 17:41 157312 ----a-w- c:\program files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3993292540-1094406474-1489134255-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 133104]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-09-25 4639136]
R3 qcusbmdm6k;WP-S1 Proprietary USB Driver;c:\windows\system32\DRIVERS\qcusbmdm6k.sys [2007-10-02 65024]
R3 qcusbnmea;WP-S1 NMEA Port;c:\windows\system32\DRIVERS\qcusbnmea.sys [2007-10-02 65024]
R3 qcusbpcsync;WP-S1 PCSYNC Port;c:\windows\system32\DRIVERS\qcusbpcsync.sys [2007-10-02 65024]
R3 qcusbser6k;WP-S1 Diagnostic Port;c:\windows\system32\DRIVERS\qcusbser6k.sys [2007-10-02 65024]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-05-26 691696]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 fanio;FanIO driver;c:\windows\system32\drivers\fanio.sys [2007-02-16 14464]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-19 21504]
S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [2010-10-15 326704]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-04-24 483688]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-04-24 550760]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-04-24 195944]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-04-24 21864]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-04-24 19304]
S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-24 209768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2011-02-25 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-08 00:33]

2011-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 14:46]

2011-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 14:46]

2011-02-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3993292540-1094406474-1489134255-1000Core.job
- c:\users\Ryan\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-08 14:37]

2011-02-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3993292540-1094406474-1489134255-1000UA.job
- c:\users\Ryan\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-08 14:37]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - /105
LSP: c:\windows\system32\wpclsp.dll
TCP: {2866E10A-9F23-42B8-ABC0-B5A0A2032BA5} = 10.4.40.1
FF - ProfilePath - c:\users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\6zfgstf6.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Google Gears: {000a9d1c-beef-4f90-9363-039d445309b8} - c:\program files\Google\Google Gears\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ScribeFire: {F807FACD-E46A-4793-B345-D58CB177673C} - %profile%\extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
FF - Ext: EBrary Reader Plugin: reader_plugin@ebrary.com - %profile%\extensions\reader_plugin@ebrary.com
FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - %profile%\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-{CD869620-BE88-771E-03A9-9345E09944A5} - c:\users\Ryan\AppData\Roaming\Izipy\duisy.exe
MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
MSConfigStartUp-AVG9_TRAY - c:\progra~1\AVG\AVG9\avgtray.exe
MSConfigStartUp-BCSSync - c:\program files\Microsoft Office\Office14\BCSSync.exe
MSConfigStartUp-Steam - c:\program files\Steam\Steam.exe
MSConfigStartUp-yaacuxtf - c:\users\Ryan\AppData\Local\xbcxlsvgf\rfyoprktssd.exe
AddRemove-Octoshape add-in for Adobe Flash Player - c:\users\Ryan\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-25 22:31
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-02-25 22:35:39
ComboFix-quarantined-files.txt 2011-02-25 22:35

Pre-Run: 58,937,925,632 bytes free
Post-Run: 58,861,510,656 bytes free

- - End Of File - - F597FB7802AD7B2598BA2D8C6EAF4DD9

Back to Virus, Trojan, Spyware, and Malware Removal Help