Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with ad.yieldmanager & possibly something else


  • This topic is locked This topic is locked
15 replies to this topic

#1 dolphincrazed007

dolphincrazed007

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 11 June 2011 - 10:42 AM

My families home computer (an HP w1858 that runs Windows 7) has been having some problems lately. In the past two days it got really bad, and you could hardly run anything as it was freezing up and not letting me run the anti-virus software. I was finally able to run SUPER Anti-Spyware, which found quite a bit of things and got the computer running again to a manageable state. However, Internet Explorer keeps popping up a site with the URL of ad.yieldmanager. I tried to remove this about a month ago, but apparently it didn't work. I've followed the Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help, running DDS and GMER. With GMER I couldn't select anything other than Services, Registry, Files, and Ads - everything else was greyed out so that I couldn't select it. I think this may have affected my log (as I only got 1 result) so if there is a way I can fix GMER to run properly, that would be appreciated. Thanks for any help in advance!


.
DDS (Ver_2011-06-11.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_20
Run by GIARDINO at 9:01:21 on 2011-06-11
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.2814.1295 [GMT -5:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\LSI SoftModem\agr64svc.exe
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\MediaMall\MediaMallServer.exe
C:\Program Files\Microsoft LifeCam\MSCamS64.exe
C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\Koda\Kodak EasyShare software\bin\EasyShare.exe
C:\Users\GIARDINO\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\QuickTime\QTTask.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files (x86)\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\taskeng.exe
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Users\GIARDINO\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\GIARDINO\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\GIARDINO\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\GIARDINO\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\GIARDINO\AppData\Local\Temp\Temp1_gmer.zip\gmer.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.mystart.com?pr=photopos2_0
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: PageRage Toolbar: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll
uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll
mURLSearchHooks: PageRage Toolbar: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll
mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO: FGCatchUrl: {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - C:\Program Files (x86)\FlashGet\jccatch.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO: PhotoPos Toolbar: {5d0ec45b-d2e4-4dd0-a5b2-69ddefe852a8} - C:\Program Files (x86)\PhotoposComTbr\PhotoposComTbrLib.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: PageRage Toolbar: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll
BHO: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\PROGRA~2\BEARSH~1\MediaBar\ToolBar\bsdtxmltbpi.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - C:\Program Files (x86)\FlashGet\getflash.dll
TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll
TB: PageRage Toolbar: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll
TB: !{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - No File
TB: PhotoPos Toolbar: {5d0ec45b-d2e4-4dd0-a5b2-69ddefe852a8} - C:\Program Files (x86)\PhotoposComTbr\PhotoposComTbrLib.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [ManyCam] "C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe" /silent
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
mRun: [HP Remote Solution] %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
mRun: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
mRun: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
mRun: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
mRun: [Blubster] C:\Program Files (x86)\Blubster\Blubster.exe SILENT
mRun: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
StartupFolder: C:\Users\GIARDINO\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\GIARDINO\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\GIARDINO\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\EVERNO~1.LNK - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\KODAKE~1.LNK - C:\Program Files (x86)\Koda\Kodak EasyShare software\bin\EasyShare.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Download All with FlashGet - C:\Program Files (x86)\FlashGet\jc_all.htm
IE: &Download with FlashGet - C:\Program Files (x86)\FlashGet\jc_link.htm
IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files (x86)\FlashGet\FlashGet.exe
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
Trusted Zone: apnatoronto.com\www
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{67FEBE72-D610-4A8D-B371-F8EE823A48FE} : DhcpNameServer = 192.168.1.1
Handler: intu-tt2010 - {97A0575E-2309-4e75-8509-B1F9390C4DE7} - C:\Program Files (x86)\TurboTax 2010\ic2010pp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO-X64: FGCatchUrl: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files (x86)\FlashGet\jccatch.dll
BHO-X64: flashget urlcatch - No File
BHO-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO-X64: PhotoPos Toolbar: {5D0EC45B-D2E4-4DD0-A5B2-69DDEFE852A8} - C:\Program Files (x86)\PhotoposComTbr\PhotoposComTbrLib.dll
BHO-X64: PhotoPos Toolbar - No File
BHO-X64: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll
BHO-X64: Symantec NCO BHO - No File
BHO-X64: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL
BHO-X64: Symantec Intrusion Prevention - No File
BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
BHO-X64: Search Helper - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: PageRage Toolbar: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll
BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO-X64: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll
BHO-X64: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\PROGRA~2\BEARSH~1\MediaBar\ToolBar\bsdtxmltbpi.dll
BHO-X64: MediaBar - No File
BHO-X64: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: FlashGet GetFlash Class: {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files (x86)\FlashGet\getflash.dll
TB-X64: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll
TB-X64: PageRage Toolbar: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll
TB-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
TB-X64: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll
TB-X64: PhotoPos Toolbar: {5D0EC45B-D2E4-4DD0-A5B2-69DDEFE852A8} - C:\Program Files (x86)\PhotoposComTbr\PhotoposComTbrLib.dll
TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll
TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun-x64: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
mRun-x64: [HP Remote Solution] %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
mRun-x64: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
mRun-x64: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
mRun-x64: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
mRun-x64: [Blubster] C:\Program Files (x86)\Blubster\Blubster.exe SILENT
mRun-x64: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE-X64: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files (x86)\FlashGet\FlashGet.exe
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/home.php?ref=hp
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npkimi.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\GIARDINO\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: C:\Users\GIARDINO\AppData\Roaming\Mozilla\plugins\np-mswmp.dll
.
============= SERVICES / DRIVERS ===============
.
R0 SMR200;Symantec SMR Utility Service 2.0.0;C:\Windows\system32\drivers\SMR200.SYS --> C:\Windows\system32\drivers\SMR200.SYS [?]
R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [?]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [?]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110518.001\BHDrvx64.sys [2011-6-10 1127032]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110604.001\IDSviA64.sys [2011-6-2 488056]
R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
R1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [?]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\drivers\NISx64\1206000.01D\SYMNETS.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\SYMNETS.SYS [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-5-4 128384]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 20992]
R2 MediaMall Server;MediaMall Server;C:\Program Files (x86)\MediaMall\MediaMallServer.exe [2011-1-29 3999600]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe [2011-6-10 130008]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-1-16 1153368]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-6-11 136824]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-29 136176]
S3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;\??\C:\Windows\system32\drivers\BVRPMPR5a64.SYS --> C:\Windows\system32\drivers\BVRPMPR5a64.SYS [?]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-29 136176]
S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;C:\Windows\system32\Drivers\nx6000.sys --> C:\Windows\system32\Drivers\nx6000.sys [?]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]
S3 PCDSRVC{F36B3A4C-F95654BD-06000000}_0;PCDSRVC{F36B3A4C-F95654BD-06000000}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\PC-Doctor for Windows\pcdsrvc_x64.pkms [2009-9-17 23536]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-06-11 12:52:53 96376 ----a-w- C:\Windows\System32\drivers\SMR200.SYS
2011-06-11 12:52:24 -------- d-----w- C:\Users\GIARDINO\AppData\Local\NPE
2011-06-11 10:30:55 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{5B16F97E-7FD5-465F-99A5-188DC4F9A65C}
2011-06-11 03:50:30 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared
2011-06-11 03:47:54 174200 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2011-06-11 03:47:54 -------- d-----w- C:\Program Files\Symantec
2011-06-11 03:47:54 -------- d-----w- C:\Program Files\Common Files\Symantec Shared
2011-06-11 03:47:46 912504 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\symefa64.sys
2011-06-11 03:47:46 744568 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\srtsp64.sys
2011-06-11 03:47:46 450680 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\symds64.sys
2011-06-11 03:47:46 40568 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\srtspx64.sys
2011-06-11 03:47:46 382584 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\symnets.sys
2011-06-11 03:47:46 171128 ----a-r- C:\Windows\System32\drivers\NISx64\1206000.01D\ironx64.sys
2011-06-11 03:47:04 -------- d-----w- C:\Windows\System32\drivers\NISx64\1206000.01D
2011-06-11 03:46:27 -------- d-----w- C:\Windows\System32\drivers\NISx64
2011-06-11 03:46:15 -------- d-----w- C:\Program Files (x86)\Norton Internet Security
2011-06-11 03:32:53 -------- d-----w- C:\Program Files (x86)\NortonInstaller
2011-06-11 03:15:53 -------- d-sh--w- C:\$RECYCLE.BIN
2011-06-11 02:16:48 98816 ----a-w- C:\Windows\sed.exe
2011-06-11 02:16:48 518144 ----a-w- C:\Windows\SWREG.exe
2011-06-11 02:16:48 256512 ----a-w- C:\Windows\PEV.exe
2011-06-11 02:16:48 208896 ----a-w- C:\Windows\MBR.exe
2011-06-11 00:50:46 -------- d-----w- C:\Users\GIARDINO\AppData\Roaming\SUPERAntiSpyware.com
2011-06-11 00:50:46 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2011-06-11 00:50:36 -------- d-----w- C:\ProgramData\!SASCORE
2011-06-11 00:50:33 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2011-06-11 00:19:31 8718160 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DA57DFE3-A97D-49E8-AE74-5D4BDA70E4B0}\mpengine.dll
2011-06-11 00:10:04 302592 ----a-w- C:\Windows\SysWow64\cmd.execf
2011-06-10 21:49:42 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{959EE867-CF12-4A02-8067-ED4C72B2F106}
2011-06-10 05:50:02 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{C0CC7ACB-73E8-4279-AF39-D3B0236D8E27}
2011-06-10 05:49:30 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{5F8C8E2B-DA21-4D71-BA39-170640D7BFA1}
2011-06-09 11:29:31 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{14553ED1-A537-401A-BC12-40E871F3F4E3}
2011-06-08 23:27:24 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{42B80147-D473-47E9-8BA9-E2BFE2DB67ED}
2011-06-08 11:27:00 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{93490FE0-AEE1-4021-9CA1-159C8C837417}
2011-06-07 22:27:24 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{0B481694-22A1-48B7-AA56-4C0BDC0D2AF7}
2011-06-07 10:26:59 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{8827DA79-96CF-4BDD-A14F-B56D4098FC2C}
2011-06-06 21:19:29 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{D8B1CB3A-7DB8-427E-AE77-B4327E7322EA}
2011-06-06 05:05:44 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{46F17E6E-7E1D-4DB5-A6E7-12455795237C}
2011-06-05 17:05:13 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{685CD619-E7CF-483F-8B70-C67D73CED24D}
2011-06-05 05:04:40 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{FD5AAFAC-7B88-42F3-BF9F-F6257CB51E44}
2011-06-04 17:04:16 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{2FDB3C92-035D-4551-A79F-2A71B38DC2C9}
2011-06-03 23:25:45 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{DFB81D9B-8F59-4DAA-9817-4D99E2325FC5}
2011-06-03 10:30:21 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{D82CDC47-F0C3-4353-BEDA-CB6C0DEA35E4}
2011-06-02 22:29:57 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{9F807FDE-7DF6-4B5F-B7F9-6143FC977532}
2011-06-02 10:28:32 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{D5C684AD-CC8D-4B91-BC54-8CB84D17E607}
2011-06-01 18:00:58 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{FF549F17-18A1-4E52-8A69-1370463D8B6E}
2011-06-01 05:21:29 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{65972154-49D5-4D2A-9E53-C990AE9DEA20}
2011-05-31 17:21:03 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{777F5975-C203-4215-9F2C-D8182DC06FC9}
2011-05-31 05:08:12 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{C955D470-F254-4C22-8D17-74C0C039F19C}
2011-05-30 17:07:39 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{64E07228-A232-498E-8481-F92F19430866}
2011-05-30 05:07:03 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{C60F74F6-71F8-4F34-94E9-3C771659B01D}
2011-05-29 17:06:39 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{146EEA15-D324-4B6D-A7D6-21B367328057}
2011-05-29 05:06:02 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{55235726-F00D-4B88-AEC6-54C8A5F5C4CA}
2011-05-28 17:05:36 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{ADB20B77-4D60-4AAC-9287-BE1BD34AC7FB}
2011-05-28 05:05:01 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{7F0BD759-EDCD-4701-9FB9-39E9E33BA15D}
2011-05-28 05:04:50 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{3B259E44-BF45-4187-B89A-DC35138BD981}
2011-05-27 21:22:28 -------- d-----w- C:\Program Files\CCleaner
2011-05-27 17:04:12 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{4B9BC276-BE00-4E58-8B1D-E9D3A01BA088}
2011-05-27 05:03:35 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{BA4EF7F0-CAAA-464E-88D7-1A5E4BCC61D4}
2011-05-26 17:03:06 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{38CD6C29-303C-412E-B6F0-0F68396B90BE}
2011-05-26 04:26:20 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{6CFB127B-251B-422B-B65F-32BF30D43FEE}
2011-05-25 16:25:55 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{FCB7E9BF-8F43-41B0-8E11-2E9F327743CB}
2011-05-25 04:25:31 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{6F3A3186-3185-4FE9-9A52-6237C0E0B552}
2011-05-25 02:16:05 -------- d-----w- C:\Users\GIARDINO\AppData\Roaming\FrmMain
2011-05-25 01:56:22 96 --sh--w- C:\Windows\WSYS049.SYS
2011-05-25 01:53:53 -------- d-----w- C:\Users\GIARDINO\AppData\Roaming\Photopos
2011-05-25 01:53:51 -------- d-----w- C:\Program Files (x86)\PhotoposComTbr
2011-05-25 01:53:39 208490 ----a-w- C:\Windows\Photo Pos Pro Uninstaller.exe
2011-05-25 01:52:59 -------- d-----w- C:\Program Files (x86)\Photo Pos Pro
2011-05-25 01:41:21 -------- d-----w- C:\ProgramData\EmailNotifier
2011-05-25 01:41:04 123373 ----a-w- C:\Windows\Pos Free Photo Editor Uninstaller.exe
2011-05-25 01:40:29 -------- d-----w- C:\Program Files (x86)\Pos Free Photo Editor
2011-05-25 01:40:29 -------- d-----w- C:\Program Files (x86)\Common Files\Thraex Software
2011-05-24 23:57:55 27520 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
2011-05-24 16:24:59 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{BAB437C7-2B37-4DEC-A256-367453A7D937}
2011-05-24 14:53:19 142336 ----a-w- C:\Windows\System32\poqexec.exe
2011-05-24 14:53:19 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe
2011-05-24 04:24:14 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{BADB5DF5-5DD7-422E-8F9D-C53C83B4A116}
2011-05-24 02:06:01 -------- d-----w- C:\Program Files\Paint.NET
2011-05-24 02:04:50 -------- d-----w- C:\Users\GIARDINO\AppData\Local\Paint.NET
2011-05-23 16:23:34 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{FF44D0A2-3C04-45DF-9047-0740102EE6CA}
2011-05-23 04:22:56 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{CEB64DEB-3D3F-43F6-8FBC-DF22B2CFF4A1}
2011-05-22 16:22:14 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{0CD5EF85-E900-4885-8A9E-EA4BEEBD5691}
2011-05-22 04:21:50 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{8FC8C04F-E9FB-4DE6-9C61-00D1C02F108F}
2011-05-21 16:21:23 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{55C66E90-128F-446D-BFCF-CF50AC2762C2}
2011-05-21 02:01:47 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{15E83898-2B64-472C-90A1-7BC5C2763122}
2011-05-20 23:01:09 601424 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0F89E5BB-694C-41CA-9499-3AB49FB43679}\gapaengine.dll
2011-05-20 10:08:38 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{6A78272A-5C16-45A7-AB49-8BEAD6ACDCE1}
2011-05-19 17:16:27 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{C9CF8734-7F9B-4333-8226-0B3ADAC1929C}
2011-05-19 01:11:55 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{6357CDE3-D786-433E-B634-58453ED768E0}
2011-05-18 13:11:31 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{2C2EA9F6-14E6-45E1-9321-D9503994105E}
2011-05-18 01:11:07 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{2711E313-97E5-4CB1-A3CD-F7CDA3E30F65}
2011-05-17 13:10:37 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{BEE22DAA-D740-41C1-BC91-87B07B422520}
2011-05-17 01:10:13 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{F2F6FE59-7040-4F21-8C14-22DEAF24E565}
2011-05-16 13:09:48 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{C64F8C3C-9FDE-4854-8F5A-3E829576A0BB}
2011-05-16 13:06:45 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{571D08DD-3528-4A6C-BE42-E1AAA2831550}
2011-05-16 03:44:44 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{3135DEE4-3373-4A26-AD22-7BC38CC59F68}
2011-05-15 22:55:30 -------- d-----w- C:\Users\GIARDINO\AppData\Roaming\Intuit Canada
2011-05-15 22:54:56 -------- d-----w- C:\Program Files (x86)\Common Files\Intuit
2011-05-15 22:54:32 -------- d-----w- C:\Program Files (x86)\TurboTax 2010
2011-05-15 22:52:47 -------- d-----w- C:\ProgramData\Intuit Canada
2011-05-15 15:43:46 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{F9E28DF5-0095-4AC6-ACDD-7DA37B8E110F}
2011-05-15 03:42:47 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{36487F0D-5E90-4BB0-A1DA-24A81AA0797F}
2011-05-14 15:42:22 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{CEED66E7-0361-495C-BE59-19180CD93C67}
2011-05-14 03:41:50 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{9BE75CC8-3C7B-406B-8314-C348BD867C39}
2011-05-13 15:41:26 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{01D7B4B0-8B8B-4D68-8F2E-B8D865084623}
2011-05-13 03:41:02 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{B95D8334-5849-4916-BB06-4EE02FD91DA6}
2011-05-12 15:40:37 -------- d-----w- C:\Users\GIARDINO\AppData\Local\{288734F8-8BD0-49A0-8744-B35499E44BBA}
.
==================== Find3M ====================
.
2011-04-13 22:40:10 4284416 ----a-w- C:\Windows\SysWow64\GPhotos.scr
2011-04-09 07:02:55 5562240 ----a-w- C:\Windows\System32\ntoskrnl.exe
2011-04-09 06:02:25 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2011-04-09 06:02:25 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2011-04-06 21:26:58 96544 ----a-w- C:\Windows\System32\dnssd.dll
2011-04-06 21:26:58 237856 ----a-w- C:\Windows\System32\dnssdX.dll
2011-04-06 21:26:58 119584 ----a-w- C:\Windows\System32\dns-sd.exe
2011-04-06 21:20:16 91424 ----a-w- C:\Windows\SysWow64\dnssd.dll
2011-04-06 21:20:16 197920 ----a-w- C:\Windows\SysWow64\dnssdX.dll
2011-04-06 21:20:16 107808 ----a-w- C:\Windows\SysWow64\dns-sd.exe
2011-03-25 03:29:26 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys
2011-03-25 03:29:14 98816 ----a-w- C:\Windows\System32\drivers\usbccgp.sys
2011-03-25 03:29:14 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys
2011-03-25 03:29:04 52736 ----a-w- C:\Windows\System32\drivers\usbehci.sys
2011-03-25 03:29:04 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys
2011-03-25 03:28:59 7936 ----a-w- C:\Windows\System32\drivers\usbd.sys
.
============= FINISH: 9:02:50.81 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:06:30 AM

Posted 18 June 2011 - 02:45 PM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. :)

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  • Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within three days
    failure to reply will result in the topic being closed!
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Running OTL

We need to create a FULL OTL Report
  • Please download OTL from here:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Change the "Extra Registry" option to "SafeList"
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extras.txt <-- Will be minimized

NEXT:


Please provide an update on how things are running in your next reply.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#3 dolphincrazed007

dolphincrazed007
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 19 June 2011 - 10:25 AM

Thanks ST for your reply and offer of assistance. I ran OTL and the reports are below. The ad.yieldmanager ads popped up a few times earlier this week, but have been quite since. But I don't think they are really gone - each time I think they've been removed from our regular spyware and anti-virus checks I'm always wrong.

----

OTL logfile created on: 19/06/2011 11:08:42 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\GIARDINO\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 1.04 Gb Available Physical Memory | 37.88% Memory free
5.50 Gb Paging File | 2.61 Gb Available in Paging File | 47.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 286.82 Gb Total Space | 209.07 Gb Free Space | 72.89% Space Free | Partition Type: NTFS
Drive D: | 11.17 Gb Total Space | 0.31 Gb Free Space | 2.81% Space Free | Partition Type: NTFS

Computer Name: GIARDINO | User Name: GIARDINO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/19 11:08:05 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\GIARDINO\Desktop\OTL.exe
PRC - [2011/05/25 15:07:14 | 024,176,560 | ---- | M] (Dropbox, Inc.) -- C:\Users\GIARDINO\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2011/05/11 12:28:35 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2011/04/27 09:55:28 | 000,973,824 | ---- | M] (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) -- C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
PRC - [2011/04/16 19:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe
PRC - [2011/01/29 06:16:38 | 003,999,600 | ---- | M] (MediaMall Technologies, Inc.) -- C:\Program Files (x86)\MediaMall\MediaMallServer.exe
PRC - [2010/12/21 06:16:36 | 001,739,848 | ---- | M] (ManyCam LLC) -- C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe
PRC - [2010/10/27 20:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/11/27 06:23:46 | 002,866,176 | ---- | M] (MP2P Technologies.) -- C:\Program Files (x86)\Blubster\Blubster.exe
PRC - [2009/10/22 21:50:40 | 000,210,216 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2009/08/24 21:11:15 | 000,656,896 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
PRC - [2009/07/10 13:49:24 | 000,323,584 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\Koda\Kodak EasyShare software\bin\EasyShare.exe
PRC - [2009/03/30 15:00:54 | 000,221,184 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
PRC - [2009/03/05 17:07:20 | 002,260,480 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/11/20 13:47:28 | 000,062,768 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
PRC - [2008/09/05 03:28:20 | 000,126,976 | ---- | M] (MP2P) -- C:\Program Files (x86)\Blubster\BGCheck.exe


========== Modules (SafeList) ==========

MOD - [2011/06/19 11:08:05 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\GIARDINO\Desktop\OTL.exe
MOD - [2010/11/20 06:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/05/04 12:55:09 | 000,128,384 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
SRV:64bit: - [2010/12/13 15:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)
SRV:64bit: - [2010/11/11 15:36:38 | 000,282,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2010/11/11 15:36:38 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/03/27 13:10:16 | 000,016,896 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agr64svc.exe -- (AgereModemAudio)
SRV - [2011/06/14 21:39:17 | 003,435,096 | ---- | M] () [Auto | Running] -- c:\Program Files (x86)\Common Files\Akamai\netsession_win_e877e12.dll -- (Akamai)
SRV - [2011/04/16 19:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe -- (NIS)
SRV - [2011/01/29 06:16:38 | 003,999,600 | ---- | M] (MediaMall Technologies, Inc.) [Auto | Running] -- C:\Program Files (x86)\MediaMall\MediaMallServer.exe -- (MediaMall Server)
SRV - [2010/07/28 16:36:52 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/06/11 07:52:53 | 000,096,376 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SMR200.SYS -- (SMR200)
DRV:64bit: - [2011/06/10 22:47:54 | 000,174,200 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2011/03/30 22:00:09 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2011/03/30 22:00:09 | 000,040,568 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV:64bit: - [2011/03/21 19:39:49 | 000,382,584 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnets.sys -- (SymNetS)
DRV:64bit: - [2011/03/14 21:31:23 | 000,912,504 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.sys -- (SymEFA)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/01/27 01:47:10 | 000,450,680 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.sys -- (SymDS)
DRV:64bit: - [2010/12/13 15:37:18 | 000,036,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nx6000.sys -- (MSHUSBVideo)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/15 20:45:33 | 000,171,128 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\ironx64.sys -- (SymIRON)
DRV:64bit: - [2010/10/24 22:25:38 | 000,072,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2010/09/26 21:10:30 | 000,035,840 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS -- (BVRPMPR5a64)
DRV:64bit: - [2010/09/23 00:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010/04/29 13:40:54 | 000,028,528 | ---- | M] (MediaMall Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\povrtdev.sys -- (msvad_simple)
DRV:64bit: - [2010/02/17 13:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV:64bit: - [2010/02/17 13:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV:64bit: - [2009/09/17 00:57:46 | 000,023,536 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- c:\Program Files\PC-Doctor for Windows\pcdsrvc_x64.pkms -- (PCDSRVC{F36B3A4C-F95654BD-06000000}_0)
DRV:64bit: - [2009/08/13 06:20:46 | 001,209,856 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009/07/30 12:12:56 | 000,339,744 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2011/06/11 07:49:09 | 002,011,768 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110618.009\EX64.SYS -- (NAVEX15)
DRV - [2011/06/11 07:49:09 | 000,117,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110618.009\ENG64.SYS -- (NAVENG)
DRV - [2011/06/10 23:10:04 | 000,481,912 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2011/06/10 23:10:04 | 000,136,824 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/06/02 20:08:18 | 000,488,056 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110615.001\IDSviA64.sys -- (IDSVia64)
DRV - [2011/05/19 14:37:05 | 001,143,416 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110616.003\BHDrvx64.sys -- (BHDrvx64)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCON/4
IE - HKLM\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-403862933-658608457-4193072288-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.mystart.com?pr=photopos2_0
IE - HKU\S-1-5-21-403862933-658608457-4193072288-1000\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-403862933-658608457-4193072288-1000\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-403862933-658608457-4193072288-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-403862933-658608457-4193072288-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Bing Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/home.php?ref=hp"
FF - prefs.js..extensions.enabledItems: litmus-ff@f-secure.com:1.10
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8
FF - prefs.js..extensions.enabledItems: {9565115d-c7d6-46d3-bd63-b67b481a4368}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: reader_plugin@ebrary.com:3.2.3.0
FF - prefs.js..extensions.enabledItems: multilinks@plugin:3.0.0.16
FF - prefs.js..extensions.enabledItems: {E0B8C461-F8FB-49b4-8373-FE32E9252800}:4.0.0.138228
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..extensions.enabledItems: {ba14329e-9550-4989-b3f2-9732e92d17cc}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: support@freeraiser.com:1.1
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2011/06/10 22:48:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn\ [2011/06/10 22:47:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/05/11 12:28:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/05/13 23:42:47 | 000,000,000 | ---D | M]

[2011/03/14 09:57:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Extensions
[2010/08/06 16:50:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
[2011/06/02 20:50:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions
[2011/05/24 20:53:58 | 000,000,000 | ---D | M] (PhotoPos Toolbar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{5D0EC45B-D2E4-4DD0-A5B2-69DDEFE852A8}
[2011/05/12 11:18:10 | 000,000,000 | ---D | M] (PageRage Community Toolbar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{9565115d-c7d6-46d3-bd63-b67b481a4368}
[2011/05/05 11:58:24 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2011/03/11 19:58:12 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2011/05/14 13:42:51 | 000,000,000 | ---D | M] (Evernote Web Clipper) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2010/12/02 08:29:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}chrome
[2011/05/12 11:18:07 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\engine@conduit.com
[2011/05/05 11:58:49 | 000,000,000 | ---D | M] (Multi Links) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\multilinks@plugin
[2011/01/18 12:08:29 | 000,000,000 | ---D | M] (EBrary Reader Plugin) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\reader_plugin@ebrary.com
[2011/04/01 20:32:42 | 000,000,000 | ---D | M] (Freeraiser Fundraising Sidebar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\support@freeraiser.com
[2010/09/14 07:48:25 | 000,002,506 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\searchplugins\BearShareWebSearch.xml
[2010/09/03 11:13:05 | 000,001,504 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\searchplugins\imdb.xml
[2011/06/11 05:36:17 | 000,002,470 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\searchplugins\safesearch.xml
[2010/09/03 11:12:50 | 000,004,140 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\searchplugins\youtube.xml
[2011/03/14 09:57:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/01/07 15:25:49 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/03/05 11:49:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
File not found (No name found) --
[2011/06/10 22:47:00 | 000,000,000 | ---D | M] (Norton Toolbar) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\COFFPLGN
[2011/06/10 22:48:15 | 000,000,000 | ---D | M] (Symantec IPS) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPLGN
() (No name found) -- C:\USERS\GIARDINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\70T6TK2T.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\GIARDINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\70T6TK2T.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2011/05/11 12:28:33 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
[2010/04/12 18:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/12/17 12:16:14 | 000,065,536 | ---- | M] ( ) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npkimi.dll
[2010/09/14 07:48:25 | 000,002,506 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\BearShareWebSearch.xml
[2011/05/11 12:28:40 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml
[2010/03/10 10:00:26 | 000,002,035 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrchDpg.xml

O1 HOSTS File: ([2011/06/10 21:35:56 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files (x86)\FlashGet\jccatch.dll (www.flashget.com)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (PhotoPos Toolbar) - {5D0EC45B-D2E4-4DD0-A5B2-69DDEFE852A8} - C:\Program Files (x86)\PhotoposComTbr\PhotoposComTbrLib.dll ()
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O2 - BHO: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - File not found
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files (x86)\FlashGet\getflash.dll (www.flashget.com)
O3 - HKLM\..\Toolbar: (no name) - !{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (PhotoPos Toolbar) - {5D0EC45B-D2E4-4DD0-A5B2-69DDEFE852A8} - C:\Program Files (x86)\PhotoposComTbr\PhotoposComTbrLib.dll ()
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-403862933-658608457-4193072288-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-403862933-658608457-4193072288-1000\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-403862933-658608457-4193072288-1000\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-403862933-658608457-4193072288-1000\..\Toolbar\WebBrowser: (PageRage Toolbar) - {9565115D-C7D6-46D3-BD63-B67B481A4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-403862933-658608457-4193072288-1000\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [PC-Doctor for Windows localizer] C:\Program Files\PC-Doctor for Windows\localizer.exe (PC-Doctor, Inc.)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Blubster] C:\Program Files (x86)\Blubster\Blubster.exe (MP2P Technologies.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [HP Remote Solution] C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-403862933-658608457-4193072288-1000..\Run: [ManyCam] C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe (ManyCam LLC)
O4 - HKU\S-1-5-21-403862933-658608457-4193072288-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-403862933-658608457-4193072288-1000..\Run: [Spyware Doctor] C:\Users\GIARDINO\Desktop\sdsetup_aff.exe ()
O4 - HKU\S-1-5-21-403862933-658608457-4193072288-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\GIARDINO\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-403862933-658608457-4193072288-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-403862933-658608457-4193072288-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: &Download All with FlashGet - C:\Program Files (x86)\FlashGet\JC_ALL.HTM ()
O8:64bit: - Extra context menu item: &Download with FlashGet - C:\Program Files (x86)\FlashGet\JC_LINK.HTM ()
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files (x86)\FlashGet\JC_ALL.HTM ()
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files (x86)\FlashGet\JC_LINK.HTM ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files (x86)\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files (x86)\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\.DEFAULT\..Trusted Domains: netflix.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: netflix.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-403862933-658608457-4193072288-1000\..Trusted Domains: apnatoronto.com ([www] https in Trusted sites)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\intu-tt2010 {97A0575E-2309-4e75-8509-B1F9390C4DE7} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\intu-tt2010 {97A0575E-2309-4e75-8509-B1F9390C4DE7} - C:\Program Files (x86)\TurboTax 2010\ic2010pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/19 11:08:09 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\GIARDINO\Desktop\OTL.exe
[2011/06/19 09:25:39 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{0ED6C5FC-4853-497E-94B5-6C9FB92FF1D2}
[2011/06/18 21:25:09 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{CE21AC3E-9271-4948-82DE-82B52FF854E2}
[2011/06/18 19:42:03 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2011/06/18 08:38:32 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{B66B7FAB-CE32-4399-B5AC-5C4E406FFA44}
[2011/06/17 18:39:22 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{252446F8-1079-4DA1-BE10-43B055E149A1}
[2011/06/17 18:39:11 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{C24E2049-D893-439C-BC79-594B5F4F5FBE}
[2011/06/17 06:38:34 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{825A0D5E-C96B-43B2-B228-4551239545B6}
[2011/06/16 18:38:08 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{B7FB6B4F-04FD-4DC2-A9F1-0D91D1A91932}
[2011/06/16 06:37:24 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{4BC638A3-57E4-4186-A607-371222F9DF54}
[2011/06/15 18:30:28 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FFD1B81E-1174-4711-B703-66D289645805}
[2011/06/15 06:29:41 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{901A8600-7207-481E-84C5-FC1078FA8E5D}
[2011/06/15 03:29:35 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2011/06/14 18:21:42 | 000,702,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011/06/14 18:21:41 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2011/06/14 18:21:40 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011/06/14 18:21:40 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011/06/14 18:21:32 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2011/06/14 18:21:32 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10_1.dll
[2011/06/14 18:21:14 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2011/06/14 16:40:19 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FF1E7813-40BC-4E20-8ACB-5340C0270B02}
[2011/06/13 22:00:17 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{DFE01AEE-71A9-486B-A993-16D02B237D82}
[2011/06/13 09:59:42 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{850FEBA1-6198-4C12-A3EC-5048682BAAA0}
[2011/06/12 21:59:01 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{AA8757A1-5AFE-486C-972C-282548960D38}
[2011/06/12 17:16:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo!
[2011/06/12 17:15:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Photo!
[2011/06/12 17:15:04 | 008,161,357 | ---- | C] ( ) -- C:\Users\GIARDINO\Desktop\peditor11inst.exe
[2011/06/12 16:07:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2011/06/12 16:07:25 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2011/06/12 15:55:36 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\Desktop\Adobe
[2011/06/12 09:58:32 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{6B2F8020-40B0-45F4-BF51-84EA94101799}
[2011/06/11 17:31:34 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{991F8FBD-0525-4EBA-BA74-D8DF55118BB6}
[2011/06/11 13:53:52 | 000,000,000 | ---D | C] -- C:\NBRT
[2011/06/11 07:52:53 | 000,096,376 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SMR200.SYS
[2011/06/11 07:52:24 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\NPE
[2011/06/11 05:30:55 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{5B16F97E-7FD5-465F-99A5-188DC4F9A65C}
[2011/06/10 22:50:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Symantec Shared
[2011/06/10 22:48:44 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\Documents\Symantec
[2011/06/10 22:47:54 | 000,174,200 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2011/06/10 22:47:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2011/06/10 22:47:54 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2011/06/10 22:47:46 | 000,912,504 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.sys
[2011/06/10 22:47:46 | 000,744,568 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.sys
[2011/06/10 22:47:46 | 000,450,680 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.sys
[2011/06/10 22:47:46 | 000,382,584 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnets.sys
[2011/06/10 22:47:46 | 000,171,128 | R--- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\ironx64.sys
[2011/06/10 22:47:46 | 000,040,568 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.sys
[2011/06/10 22:47:04 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D
[2011/06/10 22:46:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NISx64
[2011/06/10 22:46:15 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
[2011/06/10 22:46:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton Internet Security
[2011/06/10 22:32:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NortonInstaller
[2011/06/10 22:15:53 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/06/10 22:13:35 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/06/10 21:16:48 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/06/10 21:16:48 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/06/10 21:16:48 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/06/10 21:07:08 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/06/10 21:02:36 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/06/10 21:02:05 | 004,113,977 | ---- | C] (Swearware) -- C:\Users\GIARDINO\Desktop\iexplorer.exe
[2011/06/10 19:50:46 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\SUPERAntiSpyware.com
[2011/06/10 19:50:46 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011/06/10 19:50:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011/06/10 19:50:36 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
[2011/06/10 19:50:33 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/06/10 19:10:04 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cmd.execf
[2011/06/10 16:49:42 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{959EE867-CF12-4A02-8067-ED4C72B2F106}
[2011/06/10 00:50:02 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{C0CC7ACB-73E8-4279-AF39-D3B0236D8E27}
[2011/06/10 00:49:30 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{5F8C8E2B-DA21-4D71-BA39-170640D7BFA1}
[2011/06/09 19:08:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/06/09 06:29:31 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{14553ED1-A537-401A-BC12-40E871F3F4E3}
[2011/06/08 18:27:24 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{42B80147-D473-47E9-8BA9-E2BFE2DB67ED}
[2011/06/08 06:27:00 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{93490FE0-AEE1-4021-9CA1-159C8C837417}
[2011/06/07 17:27:24 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{0B481694-22A1-48B7-AA56-4C0BDC0D2AF7}
[2011/06/07 09:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage
[2011/06/07 05:26:59 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{8827DA79-96CF-4BDD-A14F-B56D4098FC2C}
[2011/06/06 16:26:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
[2011/06/06 16:19:29 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{D8B1CB3A-7DB8-427E-AE77-B4327E7322EA}
[2011/06/06 00:05:44 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{46F17E6E-7E1D-4DB5-A6E7-12455795237C}
[2011/06/05 12:05:13 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{685CD619-E7CF-483F-8B70-C67D73CED24D}
[2011/06/05 00:04:40 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FD5AAFAC-7B88-42F3-BF9F-F6257CB51E44}
[2011/06/04 12:04:16 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{2FDB3C92-035D-4551-A79F-2A71B38DC2C9}
[2011/06/03 18:25:45 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{DFB81D9B-8F59-4DAA-9817-4D99E2325FC5}
[2011/06/03 05:30:21 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{D82CDC47-F0C3-4353-BEDA-CB6C0DEA35E4}
[2011/06/02 17:29:57 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{9F807FDE-7DF6-4B5F-B7F9-6143FC977532}
[2011/06/02 05:28:32 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{D5C684AD-CC8D-4B91-BC54-8CB84D17E607}
[2011/06/01 13:00:58 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FF549F17-18A1-4E52-8A69-1370463D8B6E}
[2011/06/01 00:21:29 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{65972154-49D5-4D2A-9E53-C990AE9DEA20}
[2011/05/31 12:21:03 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{777F5975-C203-4215-9F2C-D8182DC06FC9}
[2011/05/31 00:08:12 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{C955D470-F254-4C22-8D17-74C0C039F19C}
[2011/05/30 12:07:39 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{64E07228-A232-498E-8481-F92F19430866}
[2011/05/30 00:07:03 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{C60F74F6-71F8-4F34-94E9-3C771659B01D}
[2011/05/29 12:06:39 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{146EEA15-D324-4B6D-A7D6-21B367328057}
[2011/05/29 00:06:02 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{55235726-F00D-4B88-AEC6-54C8A5F5C4CA}
[2011/05/28 12:05:36 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{ADB20B77-4D60-4AAC-9287-BE1BD34AC7FB}
[2011/05/28 00:05:01 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{7F0BD759-EDCD-4701-9FB9-39E9E33BA15D}
[2011/05/28 00:04:50 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{3B259E44-BF45-4187-B89A-DC35138BD981}
[2011/05/27 16:22:28 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/05/27 14:10:49 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\Desktop\Spring Youth Forum
[2011/05/27 12:04:12 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{4B9BC276-BE00-4E58-8B1D-E9D3A01BA088}
[2011/05/27 00:03:35 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{BA4EF7F0-CAAA-464E-88D7-1A5E4BCC61D4}
[2011/05/26 12:03:06 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{38CD6C29-303C-412E-B6F0-0F68396B90BE}
[2011/05/25 23:26:20 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{6CFB127B-251B-422B-B65F-32BF30D43FEE}
[2011/05/25 11:25:55 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FCB7E9BF-8F43-41B0-8E11-2E9F327743CB}
[2011/05/24 23:25:31 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{6F3A3186-3185-4FE9-9A52-6237C0E0B552}
[2011/05/24 21:16:05 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\FrmMain
[2011/05/24 20:53:53 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\Photopos
[2011/05/24 20:53:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotoposComTbr
[2011/05/24 20:53:39 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Photo Pos Pro
[2011/05/24 20:52:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Photo Pos Pro
[2011/05/24 20:41:21 | 000,000,000 | ---D | C] -- C:\ProgramData\EmailNotifier
[2011/05/24 20:40:40 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pos Free Photo Editor
[2011/05/24 20:40:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Thraex Software
[2011/05/24 20:40:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pos Free Photo Editor
[2011/05/24 18:57:55 | 000,027,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\Diskdump.sys
[2011/05/24 11:24:59 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{BAB437C7-2B37-4DEC-A256-367453A7D937}
[2011/05/24 09:53:19 | 000,142,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\poqexec.exe
[2011/05/24 09:53:19 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\poqexec.exe
[2011/05/23 23:24:14 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{BADB5DF5-5DD7-422E-8F9D-C53C83B4A116}
[2011/05/23 21:06:01 | 000,000,000 | ---D | C] -- C:\Program Files\Paint.NET
[2011/05/23 21:04:50 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\Paint.NET
[2011/05/23 11:23:34 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FF44D0A2-3C04-45DF-9047-0740102EE6CA}
[2011/05/23 11:11:53 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\Desktop\partyy j shore
[2011/05/22 23:22:56 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{CEB64DEB-3D3F-43F6-8FBC-DF22B2CFF4A1}
[2011/05/22 11:22:14 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{0CD5EF85-E900-4885-8A9E-EA4BEEBD5691}
[2011/05/21 23:21:50 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{8FC8C04F-E9FB-4DE6-9C61-00D1C02F108F}
[2011/05/21 11:21:23 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{55C66E90-128F-446D-BFCF-CF50AC2762C2}
[2011/05/20 21:01:47 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{15E83898-2B64-472C-90A1-7BC5C2763122}
[3 C:\Users\GIARDINO\Documents\*.tmp files -> C:\Users\GIARDINO\Documents\*.tmp -> ]
[2 C:\Users\GIARDINO\Desktop\*.tmp files -> C:\Users\GIARDINO\Desktop\*.tmp -> ]
[1 C:\Users\GIARDINO\AppData\Local\*.tmp files -> C:\Users\GIARDINO\AppData\Local\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/19 11:08:05 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\GIARDINO\Desktop\OTL.exe
[2011/06/19 10:59:01 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/19 07:43:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/06/18 22:59:05 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/18 19:40:59 | 000,512,992 | ---- | M] () -- C:\Users\GIARDINO\Desktop\sdsetup_aff.exe
[2011/06/18 18:45:52 | 000,820,060 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Standen_The debate on the social and economic consequences of the conquest..pdf
[2011/06/18 09:55:31 | 000,000,841 | ---- | M] () -- C:\Windows\Brpfx04a.ini
[2011/06/18 09:21:40 | 002,324,203 | ---- | M] () -- C:\Users\GIARDINO\Desktop\fulltext.pdf
[2011/06/17 16:45:52 | 000,002,453 | ---- | M] () -- C:\Users\Public\Documents\Global.sw2
[2011/06/17 11:27:57 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/17 11:27:57 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/17 11:19:33 | 000,262,144 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2011/06/17 11:19:17 | 2213,404,672 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/15 03:59:24 | 000,000,406 | ---- | M] () -- C:\Windows\tasks\EasyShare Registration Task.job
[2011/06/15 03:59:21 | 000,428,480 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/06/14 18:21:06 | 001,665,698 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\Cat.DB
[2011/06/12 17:16:04 | 000,001,179 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Photo! Editor.lnk
[2011/06/12 17:15:13 | 008,161,357 | ---- | M] ( ) -- C:\Users\GIARDINO\Desktop\peditor11inst.exe
[2011/06/12 16:08:10 | 000,002,069 | ---- | M] () -- C:\Users\Public\Desktop\Lightroom 3.4.1 64-bit.lnk
[2011/06/12 10:12:07 | 000,000,953 | ---- | M] () -- C:\Users\Public\Desktop\Kobo.lnk
[2011/06/11 11:28:52 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\defogger_reenable
[2011/06/11 09:32:36 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\Desktop\gmer.reg
[2011/06/11 09:04:23 | 000,302,592 | ---- | M] () -- C:\Users\GIARDINO\Desktop\gmer.exe
[2011/06/11 07:54:09 | 000,000,746 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\SMRBackup200.dat
[2011/06/11 07:52:53 | 000,096,376 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SMR200.SYS
[2011/06/10 22:47:54 | 000,174,200 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2011/06/10 22:47:54 | 000,007,488 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2011/06/10 22:47:54 | 000,000,855 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2011/06/10 22:47:48 | 000,002,563 | ---- | M] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2011/06/10 21:35:56 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2011/06/10 21:00:32 | 004,113,977 | ---- | M] (Swearware) -- C:\Users\GIARDINO\Desktop\iexplorer.exe
[2011/06/10 19:50:36 | 000,001,810 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/06/10 19:10:04 | 000,302,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\cmd.execf
[2011/06/09 22:19:52 | 000,000,542 | ---- | M] () -- C:\Windows\wininit.ini
[2011/06/09 19:08:05 | 000,001,284 | ---- | M] () -- C:\Users\GIARDINO\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/06/09 19:08:05 | 000,001,260 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Spybot - Search & Destroy.lnk
[2011/06/08 07:11:25 | 000,002,416 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Google Chrome.lnk
[2011/06/06 16:27:13 | 000,001,129 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
[2011/06/06 16:26:24 | 000,000,932 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Evernote.lnk
[2011/06/02 17:55:54 | 000,071,573 | ---- | M] () -- C:\Users\GIARDINO\Desktop\relig.jpg
[2011/06/01 06:42:02 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-403862933-658608457-4193072288-1000Core1cc2050ec638780.job
[2011/05/30 09:08:33 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\{B09E859D-7D17-46C8-BC9A-33927F6A5B5A}
[2011/05/27 23:08:46 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\{ABF7A1DE-F167-4EF1-AA09-10644CB85ECF}
[2011/05/27 13:34:59 | 000,001,010 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/05/26 23:57:41 | 000,001,009 | ---- | M] () -- C:\Users\GIARDINO\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2011/05/26 23:57:41 | 000,000,985 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/05/24 20:54:00 | 000,208,490 | ---- | M] () -- C:\Windows\Photo Pos Pro Uninstaller.exe
[2011/05/24 20:53:39 | 000,001,973 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Photo Pos Pro.lnk
[2011/05/24 20:41:28 | 000,123,373 | ---- | M] () -- C:\Windows\Pos Free Photo Editor Uninstaller.exe
[2011/05/24 20:40:40 | 000,001,150 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Pos Free Photo Editor.lnk
[2011/05/23 21:07:10 | 000,001,178 | ---- | M] () -- C:\Users\Public\Desktop\Paint.NET.lnk
[3 C:\Users\GIARDINO\Documents\*.tmp files -> C:\Users\GIARDINO\Documents\*.tmp -> ]
[2 C:\Users\GIARDINO\Desktop\*.tmp files -> C:\Users\GIARDINO\Desktop\*.tmp -> ]
[1 C:\Users\GIARDINO\AppData\Local\*.tmp files -> C:\Users\GIARDINO\AppData\Local\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/18 19:42:04 | 000,512,992 | ---- | C] () -- C:\Users\GIARDINO\Desktop\sdsetup_aff.exe
[2011/06/18 18:45:56 | 000,820,060 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Standen_The debate on the social and economic consequences of the conquest..pdf
[2011/06/18 09:21:49 | 002,324,203 | ---- | C] () -- C:\Users\GIARDINO\Desktop\fulltext.pdf
[2011/06/12 17:16:04 | 000,001,179 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Photo! Editor.lnk
[2011/06/12 16:08:11 | 000,002,077 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 3.4.1 64-bit.lnk
[2011/06/12 16:08:09 | 000,002,069 | ---- | C] () -- C:\Users\Public\Desktop\Lightroom 3.4.1 64-bit.lnk
[2011/06/12 10:12:07 | 000,000,953 | ---- | C] () -- C:\Users\Public\Desktop\Kobo.lnk
[2011/06/11 11:28:52 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\defogger_reenable
[2011/06/11 09:32:27 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\Desktop\gmer.reg
[2011/06/11 07:54:09 | 000,000,746 | ---- | C] () -- C:\Users\GIARDINO\AppData\Roaming\SMRBackup200.dat
[2011/06/10 22:47:59 | 001,665,698 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\Cat.DB
[2011/06/10 22:47:54 | 000,007,488 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2011/06/10 22:47:54 | 000,000,855 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2011/06/10 22:47:48 | 000,002,563 | ---- | C] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2011/06/10 22:47:46 | 000,007,492 | R--- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\iron.cat
[2011/06/10 22:47:46 | 000,007,462 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.cat
[2011/06/10 22:47:46 | 000,007,460 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.cat
[2011/06/10 22:47:46 | 000,007,458 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnet64.cat
[2011/06/10 22:47:46 | 000,007,458 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.cat
[2011/06/10 22:47:46 | 000,003,373 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa.inf
[2011/06/10 22:47:46 | 000,002,792 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds.inf
[2011/06/10 22:47:46 | 000,001,446 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnet.inf
[2011/06/10 22:47:46 | 000,001,438 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.inf
[2011/06/10 22:47:46 | 000,001,422 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.inf
[2011/06/10 22:47:46 | 000,000,772 | R--- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\iron.inf
[2011/06/10 22:47:46 | 000,000,172 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\isolate.ini
[2011/06/10 22:47:14 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.cat
[2011/06/10 21:16:48 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/06/10 21:16:48 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/06/10 21:16:48 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/06/10 21:16:48 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/06/10 21:16:48 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/06/10 19:50:36 | 000,001,810 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/06/09 22:19:46 | 000,000,542 | ---- | C] () -- C:\Windows\wininit.ini
[2011/06/09 19:08:05 | 000,001,284 | ---- | C] () -- C:\Users\GIARDINO\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/06/09 19:08:05 | 000,001,260 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Spybot - Search & Destroy.lnk
[2011/06/06 16:27:12 | 000,001,129 | ---- | C] () -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
[2011/06/06 16:26:24 | 000,000,932 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Evernote.lnk
[2011/06/02 17:56:08 | 000,071,573 | ---- | C] () -- C:\Users\GIARDINO\Desktop\relig.jpg
[2011/06/01 06:42:02 | 000,000,868 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-403862933-658608457-4193072288-1000Core1cc2050ec638780.job
[2011/05/30 09:08:33 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{B09E859D-7D17-46C8-BC9A-33927F6A5B5A}
[2011/05/29 12:32:00 | 000,302,592 | ---- | C] () -- C:\Users\GIARDINO\Desktop\gmer.exe
[2011/05/27 23:08:46 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{ABF7A1DE-F167-4EF1-AA09-10644CB85ECF}
[2011/05/26 23:57:41 | 000,001,009 | ---- | C] () -- C:\Users\GIARDINO\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2011/05/24 20:56:22 | 000,000,096 | -HS- | C] () -- C:\Windows\WSYS049.SYS
[2011/05/24 20:53:39 | 000,208,490 | ---- | C] () -- C:\Windows\Photo Pos Pro Uninstaller.exe
[2011/05/24 20:53:39 | 000,001,973 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Photo Pos Pro.lnk
[2011/05/24 20:41:04 | 000,123,373 | ---- | C] () -- C:\Windows\Pos Free Photo Editor Uninstaller.exe
[2011/05/24 20:40:40 | 000,001,150 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Pos Free Photo Editor.lnk
[2011/05/23 21:07:10 | 000,001,190 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.NET.lnk
[2011/05/23 21:07:10 | 000,001,178 | ---- | C] () -- C:\Users\Public\Desktop\Paint.NET.lnk
[2011/05/16 08:07:02 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{C5AE3C0D-AE5F-4764-A731-1F6E36D0D18E}
[2011/05/15 02:29:01 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{ADEFFDEF-2C74-4004-9589-7B3019A2CD45}
[2011/04/27 17:23:30 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{E5218568-B48E-434B-A66F-80F87C925D1C}
[2010/12/30 17:16:59 | 000,000,000 | ---- | C] () -- C:\Windows\Secrets.INI
[2010/12/24 13:22:11 | 000,009,216 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/31 00:15:43 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2010/10/04 23:33:42 | 000,003,986 | ---- | C] () -- C:\Users\GIARDINO\AppData\Roaming\wklnhst.dat
[2010/09/25 16:36:19 | 000,007,597 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\Resmon.ResmonCfg
[2010/08/23 00:26:10 | 000,867,793 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_1274.JPG
[2010/08/23 00:26:08 | 003,582,646 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_1274.0
[2010/08/21 20:20:05 | 000,000,164 | ---- | C] () -- C:\Windows\brpcfx.ini
[2010/08/21 20:20:04 | 000,000,841 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2010/08/21 20:19:25 | 000,000,419 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010/08/21 20:19:25 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2010/08/21 20:18:35 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat
[2010/08/05 23:53:10 | 000,042,664 | ---- | C] () -- C:\Windows\SysWow64\drivers\fsbts.sys
[2010/08/05 23:52:38 | 000,733,550 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/08/05 18:31:20 | 000,541,568 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_0292.1
[2010/08/05 18:31:16 | 000,013,060 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_0292_navi.JPG
[2010/08/05 18:30:02 | 000,534,083 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_0292.JPG
[2010/08/05 18:30:01 | 002,177,155 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_0292.0
[2010/08/04 15:33:22 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/04/06 05:10:15 | 000,225,411 | ---- | C] () -- C:\Windows\SysWow64\PosPrKpLib.dll
[2010/04/06 05:10:07 | 000,020,480 | ---- | C] () -- C:\Windows\SysWow64\PosTickerLib.dll
[2009/12/30 19:21:59 | 000,021,505 | ---- | C] () -- C:\Windows\SysWow64\cporpub.dll
[2009/09/29 18:25:16 | 000,013,312 | ---- | C] () -- C:\Windows\LPRES.DLL
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2005/09/23 06:52:14 | 000,078,848 | ---- | C] () -- C:\Windows\SysWow64\OneWay.dll
[2002/06/02 09:05:40 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\1Way.dll
[1999/01/22 13:46:58 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\MSRTEDIT.DLL

< End of report >



OTL Extras logfile created on: 19/06/2011 11:08:42 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\GIARDINO\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 1.04 Gb Available Physical Memory | 37.88% Memory free
5.50 Gb Paging File | 2.61 Gb Available in Paging File | 47.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 286.82 Gb Total Space | 209.07 Gb Free Space | 72.89% Space Free | Partition Type: NTFS
Drive D: | 11.17 Gb Total Space | 0.31 Gb Free Space | 2.81% Space Free | Partition Type: NTFS

Computer Name: GIARDINO | User Name: GIARDINO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-21-403862933-658608457-4193072288-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E543634-7E25-4B8F-8D5B-97880E5E5088}" = Bonjour
"{16DDB3D1-5C27-4599-9C63-E583287191CC}" = iTunes
"{1AAF3A3B-7B32-4DDF-8ABB-438DAEB46EEC}" = Windows Live Family Safety
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{46A5FBE9-ADB3-4493-A1CC-B4CFFD24D26A}" = Windows Live Family Safety
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5CE7E3F5-9803-4F32-AA89-2D8848A80109}" = Microsoft LifeCam
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{88E60521-1E4E-4785-B9F1-1798A4BD0C30}" = HP MediaSmart SmartMenu
"{8BBA6F77-4A79-4E90-BD82-E24669ACF221}" = Adobe Photoshop Lightroom 3.4.1 64-bit
"{8F473675-D702-45F9-8EBC-342B40C17BF5}" = Apple Mobile Device Support
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C5A08BF-BB99-4998-81BD-F6CC32483B34}" = Microsoft Corporation
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB3}" = Paint.NET v3.5.8
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E77543EE-6FB5-4FF6-AB70-635392C8C756}" = Microsoft Security Client
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 7.1.0.1218
"CCleaner" = CCleaner
"LSI Soft Modem" = LSI PCI-SV92EX Soft Modem
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"novaPDF Professional Desktop 7 printer_is1" = novaPDF Professional Desktop 7.3 printer
"NVIDIA Drivers" = NVIDIA Drivers
"PC-Doctor for Windows" = Hardware Diagnostic Tools

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{00040409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Disc 2
"{007B37D9-0C45-4202-834B-DD5FAAE99D63}" = ArcSoft Print Creations - Slimline Card
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{09234F0D-5971-4701-94EE-89CB6926E273}" = Serif PhotoPlus SE
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{17B4760F-334B-475D-829F-1A3E94A6A4E6}" = HP Setup
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{24AE6B5B-3D5A-488C-9224-1BEE11F75DD9}" = TurboTax 2010
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 20
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor
"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{48F20CAC-845F-4AFD-9AFE-E600A98480B7}_is1" = Photo Makeup Editor 1.45
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
"{56589DFE-0C29-4DFE-8E42-887B771ECD23}" = ArcSoft Print Creations - Photo Book
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{608D2A3C-6889-4C11-9B54-A42F45ACBFDB}" = fflink
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66FCA9AD-FBF2-428C-83EB-39F6491362D5}" = calibre
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6BFDC0CD-ADF5-49F6-8A47-3177EF2AE6D2}" = Google Book Downloader
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7D0F001D-6EA6-4545-9CCB-B11BBF9562F3}" = PlayOn
"{7E48AFD3-F28A-4E54-99A8-9F3A4A27DBC4}" = Brother MFL-Pro Suite MFC-240C
"{7FC8C210-A319-4835-A87D-B935EFB4C148}" = Microsoft Live Search Toolbar
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9591C049-5CAE-4E89-A8D9-191F1899628B}" = ArcSoft Print Creations - Funhouse
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.6
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AF36CE1D-FD2C-4BA0-93FA-1196785DD610}" = Adobe Flash Player 10 Plugin
"{B0D83FCD-9D42-43ED-8315-250326AADA02}" = ArcSoft Print Creations - Scrapbook
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B7F98125-4955-41E3-8A71-4CE11CE9C198}" = KODAK Gallery Upload Software
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}" = HP Support Information
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C611CF88-969D-43E6-A877-D6D6439DD081}" = HP Remote Solution
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CA9ED5E4-1548-485B-A293-417840060158}" = ArcSoft Print Creations - Photo Calendar
"{CAE8A0F1-B498-4C23-95FA-55047E730C8F}" = ArcSoft Print Creations
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CC8E94A2-55C7-4460-953C-2A790180578C}" = LightScribe System Software
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D46D081B-F60E-467E-A7C4-117B70D76731}" = HP Update
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DB99AB7F-725B-4F71-BE55-0332EA53C15C}" = Nancy Drew: Secrets Can Kill REMASTERED
"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DF802C05-4660-418c-970C-B988ADB1D316}" = Microsoft Live Search Toolbar
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3D04529-6EDB-11D8-A372-0050BAE317E1}" = CyberLink PowerDVD Copy
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E6B4117F-AC59-4B13-9274-EB136E8897EE}" = ArcSoft Print Creations - Album Page
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F04F9557-81A9-4293-BC49-2C216FA325A7}" = ArcSoft Print Creations - Greeting Card
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote v. 4.3.1
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"8461-7759-5462-8226" = Vuze
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Akamai" = Akamai NetSession Interface
"Blubster" = Blubster 3.1.1
"conduitEngine" = Conduit Engine
"EuroTalk Talk Now Plus!" = EuroTalk Talk Now Plus!
"FlashGet" = FlashGet 1.9.6.1073
"GPL Ghostscript Lite_is1" = GPL Ghostscript Lite 8.70
"HP Remote Solution" = HP Remote Solution
"Imikimi Plugin" = Imikimi Plugin
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video
"Kobo" = Kobo
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"ManyCam" = ManyCam 2.6.30 (remove only)
"Monster Quest" = Monster Quest
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"Nancy Drew Shadow at the Water’s Edge" = Nancy Drew Shadow at the Water’s Edge
"NIS" = Norton Internet Security
"Opera 11.10.2092" = Opera 11.10
"PageRage Toolbar" = PageRage Toolbar
"Photo Pos Pro" = Photo Pos Pro
"PhotoposComTbr" = Photopos Toolbar (Remove Toolbar Only)
"PhotoToolkit_is1" = Photo! Editor 1.1
"Picasa 3" = Picasa 3
"Pos Free Photo Editor" = Pos Free Photo Editor
"PriceGong" = PriceGong 2.1.0
"Viper" = Viper 1.5.00
"Vuze_Remote Toolbar" = Vuze Remote Toolbar
"WildTangent hp Master Uninstall" = HP Games
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite" = Windows Live Essentials

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-403862933-658608457-4193072288-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

#4 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:06:30 AM

Posted 19 June 2011 - 10:36 AM

Hi!

No problem!

Disable SpyBot TeaTimer
We need to disable Spybot S&D's "TeaTimer"
TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can reenable it when we're done if you like.
  • Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
  • If prompted with a legal dialog, accept the warning.
  • Click Posted Image and then on "Advanced Mode"
    Posted Image
  • You may be presented with a warning dialog. If so, press Posted Image
  • Click on Posted Image
  • Click on Posted Image
  • Uncheck this checkbox:
    Posted Image
  • Close/Exit Spybot Search and Destroy


NEXT:



OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Services
    :OTL
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
    [2011/03/05 11:49:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    O2 - BHO: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - File not found
    O3 - HKLM\..\Toolbar: (no name) - !{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
    O3 - HKU\S-1-5-21-403862933-658608457-4193072288-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    [2011/06/19 09:25:39 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{0ED6C5FC-4853-497E-94B5-6C9FB92FF1D2}
    [2011/06/18 21:25:09 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{CE21AC3E-9271-4948-82DE-82B52FF854E2}
    [2011/06/18 08:38:32 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{B66B7FAB-CE32-4399-B5AC-5C4E406FFA44}
    [2011/06/17 18:39:22 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{252446F8-1079-4DA1-BE10-43B055E149A1}
    [2011/06/17 18:39:11 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{C24E2049-D893-439C-BC79-594B5F4F5FBE}
    [2011/06/17 06:38:34 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{825A0D5E-C96B-43B2-B228-4551239545B6}
    [2011/06/16 18:38:08 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{B7FB6B4F-04FD-4DC2-A9F1-0D91D1A91932}
    [2011/06/16 06:37:24 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{4BC638A3-57E4-4186-A607-371222F9DF54}
    [2011/06/15 18:30:28 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FFD1B81E-1174-4711-B703-66D289645805}
    [2011/06/15 06:29:41 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{901A8600-7207-481E-84C5-FC1078FA8E5D}
    [2011/06/14 16:40:19 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FF1E7813-40BC-4E20-8ACB-5340C0270B02}
    [2011/06/13 22:00:17 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{DFE01AEE-71A9-486B-A993-16D02B237D82}
    [2011/06/13 09:59:42 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{850FEBA1-6198-4C12-A3EC-5048682BAAA0}
    [2011/06/12 21:59:01 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{AA8757A1-5AFE-486C-972C-282548960D38}
    [2011/06/12 09:58:32 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{6B2F8020-40B0-45F4-BF51-84EA94101799}
    [2011/06/11 17:31:34 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{991F8FBD-0525-4EBA-BA74-D8DF55118BB6}
    [2011/06/11 05:30:55 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{5B16F97E-7FD5-465F-99A5-188DC4F9A65C}
    [2011/06/10 16:49:42 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{959EE867-CF12-4A02-8067-ED4C72B2F106}
    [2011/06/10 00:50:02 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{C0CC7ACB-73E8-4279-AF39-D3B0236D8E27}
    [2011/06/10 00:49:30 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{5F8C8E2B-DA21-4D71-BA39-170640D7BFA1}
    [2011/06/09 06:29:31 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{14553ED1-A537-401A-BC12-40E871F3F4E3}
    [2011/06/08 18:27:24 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{42B80147-D473-47E9-8BA9-E2BFE2DB67ED}
    [2011/06/08 06:27:00 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{93490FE0-AEE1-4021-9CA1-159C8C837417}
    [2011/06/07 17:27:24 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{0B481694-22A1-48B7-AA56-4C0BDC0D2AF7}
    [2011/06/07 05:26:59 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{8827DA79-96CF-4BDD-A14F-B56D4098FC2C}
    [2011/06/06 16:19:29 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{D8B1CB3A-7DB8-427E-AE77-B4327E7322EA}
    [2011/06/06 00:05:44 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{46F17E6E-7E1D-4DB5-A6E7-12455795237C}
    [2011/06/05 12:05:13 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{685CD619-E7CF-483F-8B70-C67D73CED24D}
    [2011/06/05 00:04:40 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FD5AAFAC-7B88-42F3-BF9F-F6257CB51E44}
    [2011/06/04 12:04:16 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{2FDB3C92-035D-4551-A79F-2A71B38DC2C9}
    [2011/06/03 18:25:45 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{DFB81D9B-8F59-4DAA-9817-4D99E2325FC5}
    [2011/06/03 05:30:21 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{D82CDC47-F0C3-4353-BEDA-CB6C0DEA35E4}
    [2011/06/02 17:29:57 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{9F807FDE-7DF6-4B5F-B7F9-6143FC977532}
    [2011/06/02 05:28:32 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{D5C684AD-CC8D-4B91-BC54-8CB84D17E607}
    [2011/06/01 13:00:58 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FF549F17-18A1-4E52-8A69-1370463D8B6E}
    [2011/06/01 00:21:29 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{65972154-49D5-4D2A-9E53-C990AE9DEA20}
    [2011/05/31 12:21:03 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{777F5975-C203-4215-9F2C-D8182DC06FC9}
    [2011/05/31 00:08:12 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{C955D470-F254-4C22-8D17-74C0C039F19C}
    [2011/05/30 12:07:39 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{64E07228-A232-498E-8481-F92F19430866}
    [2011/05/30 00:07:03 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{C60F74F6-71F8-4F34-94E9-3C771659B01D}
    [2011/05/29 12:06:39 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{146EEA15-D324-4B6D-A7D6-21B367328057}
    [2011/05/29 00:06:02 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{55235726-F00D-4B88-AEC6-54C8A5F5C4CA}
    [2011/05/28 12:05:36 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{ADB20B77-4D60-4AAC-9287-BE1BD34AC7FB}
    [2011/05/28 00:05:01 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{7F0BD759-EDCD-4701-9FB9-39E9E33BA15D}
    [2011/05/28 00:04:50 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{3B259E44-BF45-4187-B89A-DC35138BD981}
    [2011/05/27 12:04:12 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{4B9BC276-BE00-4E58-8B1D-E9D3A01BA088}
    [2011/05/27 00:03:35 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{BA4EF7F0-CAAA-464E-88D7-1A5E4BCC61D4}
    [2011/05/26 12:03:06 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{38CD6C29-303C-412E-B6F0-0F68396B90BE}
    [2011/05/25 23:26:20 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{6CFB127B-251B-422B-B65F-32BF30D43FEE}
    [2011/05/25 11:25:55 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FCB7E9BF-8F43-41B0-8E11-2E9F327743CB}
    [2011/05/24 23:25:31 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{6F3A3186-3185-4FE9-9A52-6237C0E0B552}
    [2011/05/24 11:24:59 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{BAB437C7-2B37-4DEC-A256-367453A7D937}
    [2011/05/23 23:24:14 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{BADB5DF5-5DD7-422E-8F9D-C53C83B4A116}
    [2011/05/23 11:23:34 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{FF44D0A2-3C04-45DF-9047-0740102EE6CA}
    [2011/05/22 23:22:56 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{CEB64DEB-3D3F-43F6-8FBC-DF22B2CFF4A1}
    [2011/05/22 11:22:14 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{0CD5EF85-E900-4885-8A9E-EA4BEEBD5691}
    [2011/05/21 23:21:50 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{8FC8C04F-E9FB-4DE6-9C61-00D1C02F108F}
    [2011/05/21 11:21:23 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{55C66E90-128F-446D-BFCF-CF50AC2762C2}
    [2011/05/20 21:01:47 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\{15E83898-2B64-472C-90A1-7BC5C2763122}
    [2011/05/30 09:08:33 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\{B09E859D-7D17-46C8-BC9A-33927F6A5B5A}
    [2011/05/27 23:08:46 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\{ABF7A1DE-F167-4EF1-AA09-10644CB85ECF}
    [2011/05/30 09:08:33 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{B09E859D-7D17-46C8-BC9A-33927F6A5B5A}
    [2011/05/27 23:08:46 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{ABF7A1DE-F167-4EF1-AA09-10644CB85ECF}
    [2011/05/16 08:07:02 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{C5AE3C0D-AE5F-4764-A731-1F6E36D0D18E}
    [2011/05/15 02:29:01 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{ADEFFDEF-2C74-4004-9589-7B3019A2CD45}
    [2011/04/27 17:23:30 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\{E5218568-B48E-434B-A66F-80F87C925D1C}
    
    :Reg
    
    :Files
    type "C:\ComboFix.txt" /c
    ipconfig /flushdns /c
    :Commands
    [purity]
    [resethosts]
    [CreateRestorePoint]
    [emptytemp]
    [EMPTYFLASH]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#5 dolphincrazed007

dolphincrazed007
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 19 June 2011 - 01:47 PM

I disabled "TeaTimer" and ran OTL Fix with the code you provided.


All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_USERS\S-1-5-21-403862933-658608457-4193072288-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
C:\Users\GIARDINO\AppData\Local\{0ED6C5FC-4853-497E-94B5-6C9FB92FF1D2} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{CE21AC3E-9271-4948-82DE-82B52FF854E2} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{B66B7FAB-CE32-4399-B5AC-5C4E406FFA44} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{252446F8-1079-4DA1-BE10-43B055E149A1} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{C24E2049-D893-439C-BC79-594B5F4F5FBE} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{825A0D5E-C96B-43B2-B228-4551239545B6} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{B7FB6B4F-04FD-4DC2-A9F1-0D91D1A91932} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{4BC638A3-57E4-4186-A607-371222F9DF54} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{FFD1B81E-1174-4711-B703-66D289645805} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{901A8600-7207-481E-84C5-FC1078FA8E5D} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{FF1E7813-40BC-4E20-8ACB-5340C0270B02} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{DFE01AEE-71A9-486B-A993-16D02B237D82} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{850FEBA1-6198-4C12-A3EC-5048682BAAA0} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{AA8757A1-5AFE-486C-972C-282548960D38} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{6B2F8020-40B0-45F4-BF51-84EA94101799} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{991F8FBD-0525-4EBA-BA74-D8DF55118BB6} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{5B16F97E-7FD5-465F-99A5-188DC4F9A65C} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{959EE867-CF12-4A02-8067-ED4C72B2F106} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{C0CC7ACB-73E8-4279-AF39-D3B0236D8E27} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{5F8C8E2B-DA21-4D71-BA39-170640D7BFA1} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{14553ED1-A537-401A-BC12-40E871F3F4E3} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{42B80147-D473-47E9-8BA9-E2BFE2DB67ED} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{93490FE0-AEE1-4021-9CA1-159C8C837417} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{0B481694-22A1-48B7-AA56-4C0BDC0D2AF7} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{8827DA79-96CF-4BDD-A14F-B56D4098FC2C} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{D8B1CB3A-7DB8-427E-AE77-B4327E7322EA} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{46F17E6E-7E1D-4DB5-A6E7-12455795237C} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{685CD619-E7CF-483F-8B70-C67D73CED24D} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{FD5AAFAC-7B88-42F3-BF9F-F6257CB51E44} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{2FDB3C92-035D-4551-A79F-2A71B38DC2C9} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{DFB81D9B-8F59-4DAA-9817-4D99E2325FC5} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{D82CDC47-F0C3-4353-BEDA-CB6C0DEA35E4} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{9F807FDE-7DF6-4B5F-B7F9-6143FC977532} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{D5C684AD-CC8D-4B91-BC54-8CB84D17E607} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{FF549F17-18A1-4E52-8A69-1370463D8B6E} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{65972154-49D5-4D2A-9E53-C990AE9DEA20} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{777F5975-C203-4215-9F2C-D8182DC06FC9} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{C955D470-F254-4C22-8D17-74C0C039F19C} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{64E07228-A232-498E-8481-F92F19430866} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{C60F74F6-71F8-4F34-94E9-3C771659B01D} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{146EEA15-D324-4B6D-A7D6-21B367328057} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{55235726-F00D-4B88-AEC6-54C8A5F5C4CA} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{ADB20B77-4D60-4AAC-9287-BE1BD34AC7FB} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{7F0BD759-EDCD-4701-9FB9-39E9E33BA15D} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{3B259E44-BF45-4187-B89A-DC35138BD981} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{4B9BC276-BE00-4E58-8B1D-E9D3A01BA088} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{BA4EF7F0-CAAA-464E-88D7-1A5E4BCC61D4} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{38CD6C29-303C-412E-B6F0-0F68396B90BE} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{6CFB127B-251B-422B-B65F-32BF30D43FEE} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{FCB7E9BF-8F43-41B0-8E11-2E9F327743CB} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{6F3A3186-3185-4FE9-9A52-6237C0E0B552} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{BAB437C7-2B37-4DEC-A256-367453A7D937} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{BADB5DF5-5DD7-422E-8F9D-C53C83B4A116} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{FF44D0A2-3C04-45DF-9047-0740102EE6CA} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{CEB64DEB-3D3F-43F6-8FBC-DF22B2CFF4A1} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{0CD5EF85-E900-4885-8A9E-EA4BEEBD5691} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{8FC8C04F-E9FB-4DE6-9C61-00D1C02F108F} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{55C66E90-128F-446D-BFCF-CF50AC2762C2} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{15E83898-2B64-472C-90A1-7BC5C2763122} folder moved successfully.
C:\Users\GIARDINO\AppData\Local\{B09E859D-7D17-46C8-BC9A-33927F6A5B5A} moved successfully.
C:\Users\GIARDINO\AppData\Local\{ABF7A1DE-F167-4EF1-AA09-10644CB85ECF} moved successfully.
File C:\Users\GIARDINO\AppData\Local\{B09E859D-7D17-46C8-BC9A-33927F6A5B5A} not found.
File C:\Users\GIARDINO\AppData\Local\{ABF7A1DE-F167-4EF1-AA09-10644CB85ECF} not found.
C:\Users\GIARDINO\AppData\Local\{C5AE3C0D-AE5F-4764-A731-1F6E36D0D18E} moved successfully.
C:\Users\GIARDINO\AppData\Local\{ADEFFDEF-2C74-4004-9589-7B3019A2CD45} moved successfully.
C:\Users\GIARDINO\AppData\Local\{E5218568-B48E-434B-A66F-80F87C925D1C} moved successfully.
========== REGISTRY ==========
========== FILES ==========
< type "C:\ComboFix.txt" /c >
ComboFix 11-06-10.09 - GIARDINO 10/06/2011 21:19:59.1.1 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.2814.1638 [GMT -5:00]
Running from: H:\ComboFix.exe
AV: COGECO Security Services 9.01 *Disabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
FW: COGECO Security Services 9.01 *Disabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
SP: COGECO Security Services 9.01 *Disabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\Tarma Installer
c:\users\GIARDINO\AppData\Roaming\.#
c:\windows\SysWow64\regobj.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-05-11 to 2011-06-11 )))))))))))))))))))))))))))))))
.
.
2011-06-11 02:34 . 2011-06-11 02:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-11 02:34 . 2011-06-11 02:34 -------- d-----w- c:\users\CHANTELLE\AppData\Local\temp
2011-06-11 00:50 . 2011-06-11 00:50 -------- d-----w- c:\users\GIARDINO\AppData\Roaming\SUPERAntiSpyware.com
2011-06-11 00:50 . 2011-06-11 00:50 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-06-11 00:50 . 2011-06-11 00:50 -------- d-----w- c:\programdata\!SASCORE
2011-06-11 00:50 . 2011-06-11 00:50 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-06-11 00:19 . 2011-05-09 22:00 8718160 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DA57DFE3-A97D-49E8-AE74-5D4BDA70E4B0}\mpengine.dll
2011-06-11 00:10 . 2011-06-11 00:10 302592 ----a-w- c:\windows\SysWow64\cmd.execf
2011-06-10 21:49 . 2011-06-10 21:49 -------- d-----w- c:\users\GIARDINO\AppData\Local\{959EE867-CF12-4A02-8067-ED4C72B2F106}
2011-06-10 05:50 . 2011-06-10 05:50 -------- d-----w- c:\users\GIARDINO\AppData\Local\{C0CC7ACB-73E8-4279-AF39-D3B0236D8E27}
2011-06-10 05:49 . 2011-06-10 05:49 -------- d-----w- c:\users\GIARDINO\AppData\Local\{5F8C8E2B-DA21-4D71-BA39-170640D7BFA1}
2011-06-09 16:36 . 2011-06-09 16:36 -------- d-----w- c:\users\CHANTELLE\AppData\Local\Paint.NET
2011-06-09 16:35 . 2011-06-09 16:35 -------- d-----w- c:\users\CHANTELLE\AppData\Local\Google
2011-06-09 16:20 . 2011-06-09 16:20 1156569 ----a-w- c:\users\CHANTELLE\AppData\Local\tmp130.tmp
2011-06-09 16:19 . 2011-06-09 16:19 -------- d-----w- c:\users\CHANTELLE\AppData\Local\CyberLink
2011-06-09 16:19 . 2011-06-09 16:19 -------- d-----w- c:\users\CHANTELLE\AppData\Local\PowerCinema
2011-06-09 11:29 . 2011-06-09 11:29 -------- d-----w- c:\users\GIARDINO\AppData\Local\{14553ED1-A537-401A-BC12-40E871F3F4E3}
2011-06-08 23:27 . 2011-06-08 23:27 -------- d-----w- c:\users\GIARDINO\AppData\Local\{42B80147-D473-47E9-8BA9-E2BFE2DB67ED}
2011-06-08 11:27 . 2011-06-08 11:27 -------- d-----w- c:\users\GIARDINO\AppData\Local\{93490FE0-AEE1-4021-9CA1-159C8C837417}
2011-06-07 22:27 . 2011-06-07 22:27 -------- d-----w- c:\users\GIARDINO\AppData\Local\{0B481694-22A1-48B7-AA56-4C0BDC0D2AF7}
2011-06-07 10:26 . 2011-06-07 10:27 -------- d-----w- c:\users\GIARDINO\AppData\Local\{8827DA79-96CF-4BDD-A14F-B56D4098FC2C}
2011-06-06 21:19 . 2011-06-06 21:19 -------- d-----w- c:\users\GIARDINO\AppData\Local\{D8B1CB3A-7DB8-427E-AE77-B4327E7322EA}
2011-06-06 05:05 . 2011-06-06 05:05 -------- d-----w- c:\users\GIARDINO\AppData\Local\{46F17E6E-7E1D-4DB5-A6E7-12455795237C}
2011-06-05 17:05 . 2011-06-05 17:05 -------- d-----w- c:\users\GIARDINO\AppData\Local\{685CD619-E7CF-483F-8B70-C67D73CED24D}
2011-06-05 05:04 . 2011-06-05 05:04 -------- d-----w- c:\users\GIARDINO\AppData\Local\{FD5AAFAC-7B88-42F3-BF9F-F6257CB51E44}
2011-06-04 17:04 . 2011-06-04 17:04 -------- d-----w- c:\users\GIARDINO\AppData\Local\{2FDB3C92-035D-4551-A79F-2A71B38DC2C9}
2011-06-03 23:25 . 2011-06-03 23:25 -------- d-----w- c:\users\GIARDINO\AppData\Local\{DFB81D9B-8F59-4DAA-9817-4D99E2325FC5}
2011-06-03 10:30 . 2011-06-03 10:30 -------- d-----w- c:\users\GIARDINO\AppData\Local\{D82CDC47-F0C3-4353-BEDA-CB6C0DEA35E4}
2011-06-02 22:29 . 2011-06-02 22:30 -------- d-----w- c:\users\GIARDINO\AppData\Local\{9F807FDE-7DF6-4B5F-B7F9-6143FC977532}
2011-06-02 10:28 . 2011-06-02 10:29 -------- d-----w- c:\users\GIARDINO\AppData\Local\{D5C684AD-CC8D-4B91-BC54-8CB84D17E607}
2011-06-01 18:00 . 2011-06-01 18:01 -------- d-----w- c:\users\GIARDINO\AppData\Local\{FF549F17-18A1-4E52-8A69-1370463D8B6E}
2011-06-01 05:21 . 2011-06-01 05:21 -------- d-----w- c:\users\GIARDINO\AppData\Local\{65972154-49D5-4D2A-9E53-C990AE9DEA20}
2011-05-31 17:21 . 2011-05-31 17:21 -------- d-----w- c:\users\GIARDINO\AppData\Local\{777F5975-C203-4215-9F2C-D8182DC06FC9}
2011-05-31 05:08 . 2011-05-31 05:08 -------- d-----w- c:\users\GIARDINO\AppData\Local\{C955D470-F254-4C22-8D17-74C0C039F19C}
2011-05-30 17:07 . 2011-05-30 17:07 -------- d-----w- c:\users\GIARDINO\AppData\Local\{64E07228-A232-498E-8481-F92F19430866}
2011-05-30 05:07 . 2011-05-30 05:07 -------- d-----w- c:\users\GIARDINO\AppData\Local\{C60F74F6-71F8-4F34-94E9-3C771659B01D}
2011-05-29 17:06 . 2011-05-29 17:06 -------- d-----w- c:\users\GIARDINO\AppData\Local\{146EEA15-D324-4B6D-A7D6-21B367328057}
2011-05-29 05:06 . 2011-05-29 05:06 -------- d-----w- c:\users\GIARDINO\AppData\Local\{55235726-F00D-4B88-AEC6-54C8A5F5C4CA}
2011-05-28 17:05 . 2011-05-28 17:05 -------- d-----w- c:\users\GIARDINO\AppData\Local\{ADB20B77-4D60-4AAC-9287-BE1BD34AC7FB}
2011-05-28 05:05 . 2011-05-28 05:05 -------- d-----w- c:\users\GIARDINO\AppData\Local\{7F0BD759-EDCD-4701-9FB9-39E9E33BA15D}
2011-05-28 05:04 . 2011-05-28 05:05 -------- d-----w- c:\users\GIARDINO\AppData\Local\{3B259E44-BF45-4187-B89A-DC35138BD981}
2011-05-27 21:22 . 2011-05-27 21:22 -------- d-----w- c:\program files\CCleaner
2011-05-27 17:04 . 2011-05-27 17:04 -------- d-----w- c:\users\GIARDINO\AppData\Local\{4B9BC276-BE00-4E58-8B1D-E9D3A01BA088}
2011-05-27 05:03 . 2011-05-27 05:03 -------- d-----w- c:\users\GIARDINO\AppData\Local\{BA4EF7F0-CAAA-464E-88D7-1A5E4BCC61D4}
2011-05-26 17:03 . 2011-05-26 17:03 -------- d-----w- c:\users\GIARDINO\AppData\Local\{38CD6C29-303C-412E-B6F0-0F68396B90BE}
2011-05-26 04:26 . 2011-05-26 04:26 -------- d-----w- c:\users\GIARDINO\AppData\Local\{6CFB127B-251B-422B-B65F-32BF30D43FEE}
2011-05-25 16:25 . 2011-05-25 16:26 -------- d-----w- c:\users\GIARDINO\AppData\Local\{FCB7E9BF-8F43-41B0-8E11-2E9F327743CB}
2011-05-25 04:25 . 2011-05-25 04:25 -------- d-----w- c:\users\GIARDINO\AppData\Local\{6F3A3186-3185-4FE9-9A52-6237C0E0B552}
2011-05-25 02:16 . 2011-05-25 02:16 -------- d-----w- c:\users\GIARDINO\AppData\Roaming\FrmMain
2011-05-25 01:56 . 2002-08-01 00:55 96 --sh--w- c:\windows\WSYS049.SYS
2011-05-25 01:53 . 2011-05-25 01:53 -------- d-----w- c:\users\GIARDINO\AppData\Roaming\Photopos
2011-05-25 01:53 . 2011-05-25 01:53 -------- d-----w- c:\program files (x86)\PhotoposComTbr
2011-05-25 01:53 . 2011-05-25 01:54 208490 ----a-w- c:\windows\Photo Pos Pro Uninstaller.exe
2011-05-25 01:52 . 2011-05-25 01:54 -------- d-----w- c:\program files (x86)\Photo Pos Pro
2011-05-25 01:41 . 2011-05-25 01:41 -------- d-----w- c:\programdata\EmailNotifier
2011-05-25 01:41 . 2011-05-25 01:41 123373 ----a-w- c:\windows\Pos Free Photo Editor Uninstaller.exe
2011-05-25 01:40 . 2011-05-25 01:40 -------- d-----w- c:\program files (x86)\Pos Free Photo Editor
2011-05-25 01:40 . 2011-05-25 01:40 -------- d-----w- c:\program files (x86)\Common Files\Thraex Software
2011-05-24 23:57 . 2011-04-22 22:15 27520 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2011-05-24 16:24 . 2011-05-24 16:25 -------- d-----w- c:\users\GIARDINO\AppData\Local\{BAB437C7-2B37-4DEC-A256-367453A7D937}
2011-05-24 14:53 . 2011-04-09 06:58 142336 ----a-w- c:\windows\system32\poqexec.exe
2011-05-24 14:53 . 2011-04-09 05:56 123904 ----a-w- c:\windows\SysWow64\poqexec.exe
2011-05-24 04:24 . 2011-05-24 04:24 -------- d-----w- c:\users\GIARDINO\AppData\Local\{BADB5DF5-5DD7-422E-8F9D-C53C83B4A116}
2011-05-24 02:06 . 2011-05-24 02:06 -------- d-----w- c:\program files\Paint.NET
2011-05-24 02:04 . 2011-05-24 02:12 -------- d-----w- c:\users\GIARDINO\AppData\Local\Paint.NET
2011-05-23 16:23 . 2011-05-23 16:23 -------- d-----w- c:\users\GIARDINO\AppData\Local\{FF44D0A2-3C04-45DF-9047-0740102EE6CA}
2011-05-23 04:22 . 2011-05-23 04:23 -------- d-----w- c:\users\GIARDINO\AppData\Local\{CEB64DEB-3D3F-43F6-8FBC-DF22B2CFF4A1}
2011-05-22 16:22 . 2011-05-22 16:22 -------- d-----w- c:\users\GIARDINO\AppData\Local\{0CD5EF85-E900-4885-8A9E-EA4BEEBD5691}
2011-05-22 04:21 . 2011-05-22 04:22 -------- d-----w- c:\users\GIARDINO\AppData\Local\{8FC8C04F-E9FB-4DE6-9C61-00D1C02F108F}
2011-05-21 16:21 . 2011-05-21 16:21 -------- d-----w- c:\users\GIARDINO\AppData\Local\{55C66E90-128F-446D-BFCF-CF50AC2762C2}
2011-05-21 02:01 . 2011-05-21 02:02 -------- d-----w- c:\users\GIARDINO\AppData\Local\{15E83898-2B64-472C-90A1-7BC5C2763122}
2011-05-20 23:01 . 2011-02-01 14:22 601424 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0F89E5BB-694C-41CA-9499-3AB49FB43679}\gapaengine.dll
2011-05-20 10:08 . 2011-05-20 10:08 -------- d-----w- c:\users\GIARDINO\AppData\Local\{6A78272A-5C16-45A7-AB49-8BEAD6ACDCE1}
2011-05-19 17:16 . 2011-05-19 17:16 -------- d-----w- c:\users\GIARDINO\AppData\Local\{C9CF8734-7F9B-4333-8226-0B3ADAC1929C}
2011-05-19 01:11 . 2011-05-19 01:12 -------- d-----w- c:\users\GIARDINO\AppData\Local\{6357CDE3-D786-433E-B634-58453ED768E0}
2011-05-18 13:11 . 2011-05-18 13:11 -------- d-----w- c:\users\GIARDINO\AppData\Local\{2C2EA9F6-14E6-45E1-9321-D9503994105E}
2011-05-18 01:11 . 2011-05-18 01:11 -------- d-----w- c:\users\GIARDINO\AppData\Local\{2711E313-97E5-4CB1-A3CD-F7CDA3E30F65}
2011-05-17 13:10 . 2011-05-17 13:10 -------- d-----w- c:\users\GIARDINO\AppData\Local\{BEE22DAA-D740-41C1-BC91-87B07B422520}
2011-05-17 01:10 . 2011-05-17 01:10 -------- d-----w- c:\users\GIARDINO\AppData\Local\{F2F6FE59-7040-4F21-8C14-22DEAF24E565}
2011-05-16 13:09 . 2011-05-16 13:09 -------- d-----w- c:\users\GIARDINO\AppData\Local\{C64F8C3C-9FDE-4854-8F5A-3E829576A0BB}
2011-05-16 13:06 . 2011-05-16 13:06 -------- d-----w- c:\users\GIARDINO\AppData\Local\{571D08DD-3528-4A6C-BE42-E1AAA2831550}
2011-05-16 03:44 . 2011-05-16 03:44 -------- d-----w- c:\users\GIARDINO\AppData\Local\{3135DEE4-3373-4A26-AD22-7BC38CC59F68}
2011-05-15 22:55 . 2011-05-15 22:55 -------- d-----w- c:\users\GIARDINO\AppData\Roaming\Intuit Canada
2011-05-15 22:54 . 2011-05-15 22:54 -------- d-----w- c:\program files (x86)\Common Files\Intuit
2011-05-15 22:54 . 2011-05-15 23:01 -------- d-----w- c:\program files (x86)\TurboTax 2010
2011-05-15 22:52 . 2011-05-15 22:52 -------- d-----w- c:\programdata\Intuit Canada
2011-05-15 15:43 . 2011-05-15 15:43 -------- d-----w- c:\users\GIARDINO\AppData\Local\{F9E28DF5-0095-4AC6-ACDD-7DA37B8E110F}
2011-05-15 03:42 . 2011-05-15 03:42 -------- d-----w- c:\users\GIARDINO\AppData\Local\{36487F0D-5E90-4BB0-A1DA-24A81AA0797F}
2011-05-14 15:42 . 2011-05-14 15:42 -------- d-----w- c:\users\GIARDINO\AppData\Local\{CEED66E7-0361-495C-BE59-19180CD93C67}
2011-05-14 03:41 . 2011-05-14 03:42 -------- d-----w- c:\users\GIARDINO\AppData\Local\{9BE75CC8-3C7B-406B-8314-C348BD867C39}
2011-05-13 15:41 . 2011-05-13 15:41 -------- d-----w- c:\users\GIARDINO\AppData\Local\{01D7B4B0-8B8B-4D68-8F2E-B8D865084623}
2011-05-13 03:41 . 2011-05-13 03:41 -------- d-----w- c:\users\GIARDINO\AppData\Local\{B95D8334-5849-4916-BB06-4EE02FD91DA6}
2011-05-12 15:40 . 2011-05-12 15:40 -------- d-----w- c:\users\GIARDINO\AppData\Local\{288734F8-8BD0-49A0-8744-B35499E44BBA}
2011-05-12 03:40 . 2011-05-12 03:40 -------- d-----w- c:\users\GIARDINO\AppData\Local\{91F830A8-D66E-4861-BE81-3E4644D4466F}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-09 22:00 . 2010-10-18 17:03 8718160 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-04-27 22:23 . 2011-04-27 22:23 0 ---ha-w- c:\users\GIARDINO\AppData\Local\BITFE1C.tmp
2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\SysWow64\GPhotos.scr
2011-04-09 07:02 . 2011-05-11 01:34 5562240 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-04-09 06:02 . 2011-05-11 01:34 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-11 01:34 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-04-07 12:30 . 2010-06-24 16:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-04-06 21:26 . 2011-04-06 21:26 96544 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 21:26 . 2011-04-06 21:26 237856 ----a-w- c:\windows\system32\dnssdX.dll
2011-04-06 21:26 . 2011-04-06 21:26 119584 ----a-w- c:\windows\system32\dns-sd.exe
2011-04-06 21:20 . 2011-04-06 21:20 91424 ----a-w- c:\windows\SysWow64\dnssd.dll
2011-04-06 21:20 . 2011-04-06 21:20 197920 ----a-w- c:\windows\SysWow64\dnssdX.dll
2011-04-06 21:20 . 2011-04-06 21:20 107808 ----a-w- c:\windows\SysWow64\dns-sd.exe
2011-03-25 03:29 . 2011-05-11 01:34 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2011-03-25 03:29 . 2011-05-11 01:34 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2011-03-25 03:29 . 2011-05-11 01:34 98816 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-03-25 03:29 . 2011-05-11 01:34 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
2011-03-25 03:29 . 2011-05-11 01:34 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2011-03-25 03:28 . 2011-05-11 01:34 7936 ----a-w- c:\windows\system32\drivers\usbd.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files (x86)\PageRage\tbPage.dll" [2010-10-10 3906656]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\tbVuze.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-10 20:51 3906656 ----a-w- c:\program files (x86)\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
2010-10-10 20:51 3906656 ----a-w- c:\program files (x86)\PageRage\tbPage.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
2010-12-09 18:51 3911776 ----a-w- c:\program files (x86)\Vuze_Remote\tbVuze.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files (x86)\PageRage\tbPage.dll" [2010-10-10 3906656]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\ConduitEngine.dll" [2010-10-10 3906656]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\tbVuze.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\GIARDINO\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\GIARDINO\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\GIARDINO\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]
"ManyCam"="c:\program files (x86)\ManyCam\Bin\ManyCam.exe" [2010-12-21 1739848]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-06-10 2988928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"HP Remote Solution"="c:\program files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe" [2009-08-25 656896]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"F-Secure Manager"="c:\program files (x86)\COGECO Security Services\Common\FSM32.EXE" [2009-08-05 199264]
"F-Secure TNB"="c:\program files (x86)\COGECO Security Services\FSGUI\TNBUtil.exe" [2009-08-05 2349664]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"Blubster"="c:\program files (x86)\Blubster\Blubster.exe" [2009-11-27 2866176]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-01-22 40368]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-04-14 421160]
.
c:\users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\GIARDINO\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
EvernoteClipper.lnk - c:\program files (x86)\Evernote\Evernote\EvernoteClipper.exe [2011-4-27 973824]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files (x86)\Koda\Kodak EasyShare software\bin\EasyShare.exe [2009-7-10 323584]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-30 136176]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-30 136176]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]
R3 PCDSRVC{F36B3A4C-F95654BD-06000000}_0;PCDSRVC{F36B3A4C-F95654BD-06000000}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms [2009-09-17 23536]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 F-Secure Filter;F-Secure File System Filter;c:\program files (x86)\COGECO Security Services\Anti-Virus\Win2K\FSfilter.sys [2009-08-05 39776]
R4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files (x86)\COGECO Security Services\Anti-Virus\Win2K\FSrec.sys [2009-08-05 25184]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files (x86)\COGECO Security Services\HIPS\drivers\fshs.sys [2009-08-05 57920]
S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [x]
S1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [x]
S1 fsvista;F-Secure Vista Support Driver;c:\program files (x86)\COGECO Security Services\Anti-Virus\minifilter\fsvista.sys [2009-08-05 14904]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-05-04 128384]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 MediaMall Server;MediaMall Server;c:\program files (x86)\MediaMall\MediaMallServer.exe [2011-01-29 3999600]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files (x86)\COGECO Security Services\Anti-Virus\minifilter\fsgk.sys [2011-06-09 198824]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files (x86)\COGECO Security Services\ORSP Client\fsorsp.exe [2011-05-23 61088]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-29 c:\windows\Tasks\EasyShare Registration Task.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2011-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-30 02:18]
.
2011-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-30 02:18]
.
2011-06-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-403862933-658608457-4193072288-1000Core1cc2050ec638780.job
- c:\users\GIARDINO\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-09 07:23]
.
2010-11-21 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18 07:11]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\GIARDINO\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\GIARDINO\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\GIARDINO\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-29 16333856]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-09-15 610360]
"PC-Doctor for Windows localizer"="c:\program files\PC-Doctor for Windows\localizer.exe" [2009-09-17 95728]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.mystart.com?pr=photopos2_0
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: &Download All with FlashGet - c:\program files (x86)\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files (x86)\FlashGet\jc_link.htm
IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204
LSP: c:\program files (x86)\COGECO Security Services\FSPS\program\FSLSP.DLL
Trusted Zone: apnatoronto.com\www
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{67FEBE72-D610-4A8D-B371-F8EE823A48FE}: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/home.php?ref=hp
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~2\BEARSH~1\MediaBar\ToolBar\bsdtxmltbpi.dll
Toolbar-10 - (no file)
Toolbar-!{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - (no file)
Wow6432Node-HKLM-Run-DivXUpdate - c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe
Toolbar-10 - (no file)
Toolbar-!{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{9565115D-C7D6-46D3-BD63-B67B481A4368} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
AddRemove-PDF Scissors - c:\windows\system32\javaws.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{F36B3A4C-F95654BD-06000000}_0]
"ImagePath"="\??\c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-403862933-658608457-4193072288-1000\Software\SecuROM\License information*]
"datasecu"=hex:60,38,a7,f9,6d,79,2c,6a,bf,7b,d9,52,bc,03,7b,a3,29,d3,9f,37,2f,
19,65,bf,66,16,f7,73,20,c8,fe,f8,11,b4,6d,cc,31,24,2d,e3,56,03,16,4f,31,39,\
"rkeysecu"=hex:05,b6,da,f6,78,25,71,c3,9c,57,43,5d,e1,8c,d9,36
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-06-10 22:10:11
ComboFix-quarantined-files.txt 2011-06-11 03:10
.
Pre-Run: 229,864,411,136 bytes free
Post-Run: 229,300,342,784 bytes free
.
- - End Of File - - CBFFA7CC3C068CDD27E61B10E19A1007
C:\Users\GIARDINO\Desktop\cmd.bat deleted successfully.
C:\Users\GIARDINO\Desktop\cmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\GIARDINO\Desktop\cmd.bat deleted successfully.
C:\Users\GIARDINO\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: CHANTELLE
->Temp folder emptied: 814069 bytes
->Temporary Internet Files folder emptied: 15922519 bytes
->FireFox cache emptied: 314030788 bytes
->Opera cache emptied: 27873915 bytes
->Flash cache emptied: 59377 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: GIARDINO
->Temp folder emptied: 3054653 bytes
->Temporary Internet Files folder emptied: 56480487 bytes
->Java cache emptied: 11642514 bytes
->FireFox cache emptied: 522617083 bytes
->Google Chrome cache emptied: 432970938 bytes
->Opera cache emptied: 18457530 bytes
->Flash cache emptied: 3091706 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 120110749 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 2242436 bytes

Total Files Cleaned = 1,459.00 mb


[EMPTYFLASH]

User: All Users

User: CHANTELLE
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: GIARDINO
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.24.1 log created on 06192011_142353

Files\Folders moved on Reboot...
C:\Users\GIARDINO\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF13FE3C9E5E643574.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF1E002DEB194ABB22.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF2785215C2B44DAEA.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF28BD9F4F4822236D.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DFBA5887100CB2F3DE.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DFEC86D07EAF39CBE5.TMP not found!

Registry entries deleted on Reboot...

#6 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:06:30 AM

Posted 19 June 2011 - 02:06 PM

Hi!

Lets see what these scans find, and see where we stand then.

Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

  • Open Malwarebytes' Anti-Malware
  • Select the Update tab
  • Click Check for Updates
  • After the update have been completed, Select the Scanner tab.
  • Select Perform quick scan, then click on Scan
  • Leave the default options as it is and click on Start Scan
  • When done, you will be prompted. Click OK, then click on Show Results
  • Checked (ticked) all items and click on Remove Selected
  • After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT:



ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.



  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Make sure that the option "Remove found threats" is Unchecked
  • When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
    • Enable Anti-Stealth technology
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image


NEXT:



Security Check
Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#7 dolphincrazed007

dolphincrazed007
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 19 June 2011 - 07:32 PM

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6897

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

19/06/2011 5:16:29 PM
mbam-log-2011-06-19 (17-16-29).txt

Scan type: Quick scan
Objects scanned: 182257
Time elapsed: 4 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


ESET OnlineScan
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage105.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage140.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage175.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage210.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage245.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage33.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage70.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage105.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage140.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage175.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage210.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage245.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage33.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage70.zip Win32/Bagle.gen.zip worm
C:\Users\GIARDINO\Downloads\MCSetup.exe Win32/Toolbar.Zugo application
C:\Users\GIARDINO\Downloads\PhotoPosPro_SetUp.exe Win32/Toolbar.Zugo application
C:\Users\GIARDINO\Downloads\posfreephotoeditor_setup.exe Win32/Toolbar.Zugo application


Results of screen317's Security Check version 0.99.14
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
ESET Online Scanner v3
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware
Java™ 6 Update 20
Out of date Java installed!
Flash Player Out of Date!
Adobe Flash Player 10.0.45.2
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent

Norton ccSvcHst.exe
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
system32 MediaMallServer.exe -?-
MediaMall MediaMallServer.exe
``````````End of Log````````````

#8 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:06:30 AM

Posted 19 June 2011 - 07:35 PM

Hi!

These threat(s) below will be removed very shortly:

C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage105.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage140.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage175.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage210.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage245.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage33.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage70.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage105.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage140.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage175.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage210.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage245.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage33.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage70.zip Win32/Bagle.gen.zip worm


____________________________________________________

From the looks of your SecurityCheck log, I can see that we have some outdated programs that need to be updated.

Lets address those programs that need updating now!

Your SecurityCheck log indicates that your version of Flash Player is outdated. This is a vulnerability that needs to be addressed. Please remove the outdated version of Flash Player and then install the latest version.

Java Outdated
Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Platform, Standard Edition".
  • Click the "Download JRE" button to the right.
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • From the list, select your OS and Platform.
    • 32-bit Select: Windows x86 Offline.
    • 64-bit Select: Windows x64.
  • If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Posted Image > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u25-windows-i586.exe to install the newest version.
  • If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  • The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.
-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:
  • Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
  • Click Ok and reboot your computer.


NEXT



OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Services
    :OTL
    
    :Reg
    
    :Files
    C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage105.zip
    C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage140.zip
    C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage175.zip
    C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage210.zip
    C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage245.zip
    C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage33.zip
    C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage70.zip
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage105.zip
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage140.zip
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage175.zip
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage210.zip
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage245.zip
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage33.zip
    C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage70.zip
    ipconfig /flushdns /c
    :Commands
    [purity]
    [resethosts]
    [CreateRestorePoint]
    [emptytemp]
    [EMPTYFLASH]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



OTL Custom Scan

We need to run an OTL Custom Scan
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.


    netsvcs
    drivers32
    hklm\software\clients\startmenuinternet|command /rs
    %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Push the Posted Image button.
  • A report will open. Copy and Paste that report in your next reply.


NEXT:



What outstanding issues (if any) are you still experiencing with your computer?

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#9 dolphincrazed007

dolphincrazed007
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 19 June 2011 - 08:09 PM

The two logs are below. As far as I know, there are no outstanding issues... yet. The ad.yieldmanager (my initial reason for posting asking for help) comes and goes, so I won't know for a few days/a week or so if it is really gone. If that's all we need to do, I assume that I can just reopen this thread after it is closed? Also, thank you so much for your help! I appreciate your effort, and how fast you responded, and I can't believe you (and all the others) are volunteers! Again, thank you for all your help. Is there a way I can make a small donation to the website through PayPal to continue supporting all the work done here?



All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
========== REGISTRY ==========
========== FILES ==========
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage105.zip moved successfully.
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage140.zip moved successfully.
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage175.zip moved successfully.
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage210.zip moved successfully.
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage245.zip moved successfully.
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage33.zip moved successfully.
C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage70.zip moved successfully.
File\Folder C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage105.zip not found.
File\Folder C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage140.zip not found.
File\Folder C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage175.zip not found.
File\Folder C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage210.zip not found.
File\Folder C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage245.zip not found.
File\Folder C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage33.zip not found.
File\Folder C:\Users\All Users\Spybot - Search & Destroy\Recovery\YontooPagerage70.zip not found.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\GIARDINO\Desktop\cmd.bat deleted successfully.
C:\Users\GIARDINO\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: CHANTELLE
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: GIARDINO
->Temp folder emptied: 2467410 bytes
->Temporary Internet Files folder emptied: 381599 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 67157817 bytes
->Google Chrome cache emptied: 65319665 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 5076 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 86384 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 96892919 bytes

Total Files Cleaned = 222.00 mb


[EMPTYFLASH]

User: All Users

User: CHANTELLE
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: GIARDINO
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.24.1 log created on 06192011_205439

Files\Folders moved on Reboot...
C:\Users\GIARDINO\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...



OTL logfile created on: 19/06/2011 9:00:17 PM - Run 2
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\GIARDINO\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 1.20 Gb Available Physical Memory | 43.82% Memory free
5.50 Gb Paging File | 3.61 Gb Available in Paging File | 65.69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 286.82 Gb Total Space | 213.28 Gb Free Space | 74.36% Space Free | Partition Type: NTFS
Drive D: | 11.17 Gb Total Space | 0.41 Gb Free Space | 3.69% Space Free | Partition Type: NTFS
Drive G: | 480.73 Mb Total Space | 480.62 Mb Free Space | 99.98% Space Free | Partition Type: FAT

Computer Name: GIARDINO | User Name: GIARDINO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/19 11:08:05 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\GIARDINO\Desktop\OTL.exe
PRC - [2011/05/25 15:07:14 | 024,176,560 | ---- | M] (Dropbox, Inc.) -- C:\Users\GIARDINO\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2011/04/27 09:55:28 | 000,973,824 | ---- | M] (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) -- C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
PRC - [2011/04/16 19:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe
PRC - [2011/01/29 06:16:38 | 003,999,600 | ---- | M] (MediaMall Technologies, Inc.) -- C:\Program Files (x86)\MediaMall\MediaMallServer.exe
PRC - [2010/12/21 06:16:36 | 001,739,848 | ---- | M] (ManyCam LLC) -- C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe
PRC - [2010/11/20 07:17:55 | 000,257,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
PRC - [2010/10/27 20:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/10/22 21:50:40 | 000,210,216 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2009/08/24 21:11:15 | 000,656,896 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
PRC - [2009/07/10 13:49:24 | 000,323,584 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\Koda\Kodak EasyShare software\bin\EasyShare.exe
PRC - [2009/03/30 15:00:54 | 000,221,184 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
PRC - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/11/20 13:47:28 | 000,062,768 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe


========== Modules (SafeList) ==========

MOD - [2011/06/19 11:08:05 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\GIARDINO\Desktop\OTL.exe
MOD - [2010/11/20 06:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/05/04 12:55:09 | 000,128,384 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
SRV:64bit: - [2010/12/13 15:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)
SRV:64bit: - [2010/11/11 15:36:38 | 000,282,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2010/11/11 15:36:38 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/03/27 13:10:16 | 000,016,896 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agr64svc.exe -- (AgereModemAudio)
SRV - [2011/06/14 21:39:17 | 003,435,096 | ---- | M] () [Auto | Running] -- c:\Program Files (x86)\Common Files\Akamai\netsession_win_e877e12.dll -- (Akamai)
SRV - [2011/04/16 19:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe -- (NIS)
SRV - [2011/01/29 06:16:38 | 003,999,600 | ---- | M] (MediaMall Technologies, Inc.) [Auto | Running] -- C:\Program Files (x86)\MediaMall\MediaMallServer.exe -- (MediaMall Server)
SRV - [2010/07/28 16:36:52 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/06/11 07:52:53 | 000,096,376 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SMR200.SYS -- (SMR200)
DRV:64bit: - [2011/06/10 22:47:54 | 000,174,200 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2011/03/30 22:00:09 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2011/03/30 22:00:09 | 000,040,568 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV:64bit: - [2011/03/21 19:39:49 | 000,382,584 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnets.sys -- (SymNetS)
DRV:64bit: - [2011/03/14 21:31:23 | 000,912,504 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.sys -- (SymEFA)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/01/27 01:47:10 | 000,450,680 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.sys -- (SymDS)
DRV:64bit: - [2010/12/13 15:37:18 | 000,036,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nx6000.sys -- (MSHUSBVideo)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/15 20:45:33 | 000,171,128 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\ironx64.sys -- (SymIRON)
DRV:64bit: - [2010/10/24 22:25:38 | 000,072,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2010/09/26 21:10:30 | 000,035,840 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS -- (BVRPMPR5a64)
DRV:64bit: - [2010/09/23 00:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010/04/29 13:40:54 | 000,028,528 | ---- | M] (MediaMall Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\povrtdev.sys -- (msvad_simple)
DRV:64bit: - [2010/02/17 13:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV:64bit: - [2010/02/17 13:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV:64bit: - [2009/09/17 00:57:46 | 000,023,536 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- c:\Program Files\PC-Doctor for Windows\pcdsrvc_x64.pkms -- (PCDSRVC{F36B3A4C-F95654BD-06000000}_0)
DRV:64bit: - [2009/08/13 06:20:46 | 001,209,856 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009/07/30 12:12:56 | 000,339,744 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2011/06/11 07:49:09 | 002,011,768 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110619.002\EX64.SYS -- (NAVEX15)
DRV - [2011/06/11 07:49:09 | 000,117,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110619.002\ENG64.SYS -- (NAVENG)
DRV - [2011/06/10 23:10:04 | 000,481,912 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2011/06/10 23:10:04 | 000,136,824 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/06/02 20:08:18 | 000,488,056 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110615.001\IDSviA64.sys -- (IDSVia64)
DRV - [2011/05/19 14:37:05 | 001,143,416 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110616.003\BHDrvx64.sys -- (BHDrvx64)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCON/4
IE - HKLM\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.mystart.com?pr=photopos2_0
IE - HKCU\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Bing Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/home.php?ref=hp"

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2011/06/10 22:48:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn\ [2011/06/10 22:47:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/05/11 12:28:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/05/13 23:42:47 | 000,000,000 | ---D | M]

[2011/03/14 09:57:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Extensions
[2010/08/06 16:50:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
[2011/06/02 20:50:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions
[2011/05/24 20:53:58 | 000,000,000 | ---D | M] (PhotoPos Toolbar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{5D0EC45B-D2E4-4DD0-A5B2-69DDEFE852A8}
[2011/05/12 11:18:10 | 000,000,000 | ---D | M] (PageRage Community Toolbar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{9565115d-c7d6-46d3-bd63-b67b481a4368}
[2011/05/05 11:58:24 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2011/03/11 19:58:12 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2011/05/14 13:42:51 | 000,000,000 | ---D | M] (Evernote Web Clipper) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2010/12/02 08:29:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}chrome
[2011/05/12 11:18:07 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\engine@conduit.com
[2011/05/05 11:58:49 | 000,000,000 | ---D | M] (Multi Links) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\multilinks@plugin
[2011/01/18 12:08:29 | 000,000,000 | ---D | M] (EBrary Reader Plugin) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\reader_plugin@ebrary.com
[2011/04/01 20:32:42 | 000,000,000 | ---D | M] (Freeraiser Fundraising Sidebar) -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\extensions\support@freeraiser.com
[2010/09/14 07:48:25 | 000,002,506 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\searchplugins\BearShareWebSearch.xml
[2010/09/03 11:13:05 | 000,001,504 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\searchplugins\imdb.xml
[2011/06/11 05:36:17 | 000,002,470 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\searchplugins\safesearch.xml
[2010/09/03 11:12:50 | 000,004,140 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Mozilla\Firefox\Profiles\70t6tk2t.default\searchplugins\youtube.xml
[2011/06/19 14:24:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/01/07 15:25:49 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
File not found (No name found) --
[2011/06/10 22:47:00 | 000,000,000 | ---D | M] (Norton Toolbar) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\COFFPLGN
[2011/06/10 22:48:15 | 000,000,000 | ---D | M] (Symantec IPS) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPLGN
() (No name found) -- C:\USERS\GIARDINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\70T6TK2T.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\GIARDINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\70T6TK2T.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2011/05/11 12:28:33 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
[2010/04/12 18:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/12/17 12:16:14 | 000,065,536 | ---- | M] ( ) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npkimi.dll
[2010/09/14 07:48:25 | 000,002,506 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\BearShareWebSearch.xml
[2011/05/11 12:28:40 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml
[2010/03/10 10:00:26 | 000,002,035 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrchDpg.xml

O1 HOSTS File: ([2011/06/19 20:54:42 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files (x86)\FlashGet\jccatch.dll (www.flashget.com)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (PhotoPos Toolbar) - {5D0EC45B-D2E4-4DD0-A5B2-69DDEFE852A8} - C:\Program Files (x86)\PhotoposComTbr\PhotoposComTbrLib.dll ()
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found
O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files (x86)\FlashGet\getflash.dll (www.flashget.com)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (PhotoPos Toolbar) - {5D0EC45B-D2E4-4DD0-A5B2-69DDEFE852A8} - C:\Program Files (x86)\PhotoposComTbr\PhotoposComTbrLib.dll ()
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (PageRage Toolbar) - {9565115D-C7D6-46D3-BD63-B67B481A4368} - C:\Program Files (x86)\PageRage\tbPage.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files (x86)\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [PC-Doctor for Windows localizer] C:\Program Files\PC-Doctor for Windows\localizer.exe (PC-Doctor, Inc.)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Blubster] C:\Program Files (x86)\Blubster\Blubster.exe (MP2P Technologies.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [HP Remote Solution] C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ManyCam] C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe (ManyCam LLC)
O4 - HKCU..\Run: [Spyware Doctor] File not found
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\GIARDINO\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: &Download All with FlashGet - C:\Program Files (x86)\FlashGet\JC_ALL.HTM ()
O8:64bit: - Extra context menu item: &Download with FlashGet - C:\Program Files (x86)\FlashGet\JC_LINK.HTM ()
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files (x86)\FlashGet\JC_ALL.HTM ()
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files (x86)\FlashGet\JC_LINK.HTM ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files (x86)\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files (x86)\FlashGet\flashget.exe (FlashGet.com)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: apnatoronto.com ([www] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\intu-tt2010 {97A0575E-2309-4e75-8509-B1F9390C4DE7} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\intu-tt2010 {97A0575E-2309-4e75-8509-B1F9390C4DE7} - C:\Program Files (x86)\TurboTax 2010\ic2010pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/01/10 13:48:36 | 000,000,123 | ---- | M] () - G:\autorun.inf -- [ FAT ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv50 - C:\Windows\SysWow64\ir50_32.dll (Intel Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/19 20:52:31 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2011/06/19 17:20:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011/06/19 14:23:53 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/06/19 11:08:09 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\GIARDINO\Desktop\OTL.exe
[2011/06/18 19:42:03 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2011/06/15 03:29:35 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2011/06/12 17:16:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo!
[2011/06/12 17:15:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Photo!
[2011/06/12 16:07:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2011/06/12 16:07:25 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2011/06/12 15:55:36 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\Desktop\Adobe
[2011/06/11 13:53:52 | 000,000,000 | ---D | C] -- C:\NBRT
[2011/06/11 07:52:53 | 000,096,376 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SMR200.SYS
[2011/06/11 07:52:24 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\NPE
[2011/06/10 22:50:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Symantec Shared
[2011/06/10 22:48:44 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\Documents\Symantec
[2011/06/10 22:47:54 | 000,174,200 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2011/06/10 22:47:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2011/06/10 22:47:54 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2011/06/10 22:47:46 | 000,912,504 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.sys
[2011/06/10 22:47:46 | 000,744,568 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.sys
[2011/06/10 22:47:46 | 000,450,680 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.sys
[2011/06/10 22:47:46 | 000,382,584 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnets.sys
[2011/06/10 22:47:46 | 000,171,128 | R--- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\ironx64.sys
[2011/06/10 22:47:46 | 000,040,568 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.sys
[2011/06/10 22:47:04 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NISx64\1206000.01D
[2011/06/10 22:46:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NISx64
[2011/06/10 22:46:15 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
[2011/06/10 22:46:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton Internet Security
[2011/06/10 22:32:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NortonInstaller
[2011/06/10 22:15:53 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/06/10 22:13:35 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/06/10 21:16:48 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/06/10 21:16:48 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/06/10 21:16:48 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/06/10 21:07:08 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/06/10 21:02:36 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/06/10 21:02:05 | 004,113,977 | ---- | C] (Swearware) -- C:\Users\GIARDINO\Desktop\iexplorer.exe
[2011/06/10 19:50:46 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\SUPERAntiSpyware.com
[2011/06/10 19:50:46 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011/06/10 19:50:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011/06/10 19:50:36 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
[2011/06/10 19:50:33 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/06/09 19:08:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/06/07 09:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage
[2011/06/06 16:26:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
[2011/05/27 16:22:28 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/05/24 21:16:05 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\FrmMain
[2011/05/24 20:53:53 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\Photopos
[2011/05/24 20:53:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotoposComTbr
[2011/05/24 20:53:39 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Photo Pos Pro
[2011/05/24 20:52:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Photo Pos Pro
[2011/05/24 20:41:21 | 000,000,000 | ---D | C] -- C:\ProgramData\EmailNotifier
[2011/05/24 20:40:40 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pos Free Photo Editor
[2011/05/24 20:40:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Thraex Software
[2011/05/24 20:40:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pos Free Photo Editor
[2011/05/23 21:06:01 | 000,000,000 | ---D | C] -- C:\Program Files\Paint.NET
[2011/05/23 21:04:50 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\AppData\Local\Paint.NET
[2011/05/23 11:11:53 | 000,000,000 | ---D | C] -- C:\Users\GIARDINO\Desktop\partyy j shore
[3 C:\Users\GIARDINO\Documents\*.tmp files -> C:\Users\GIARDINO\Documents\*.tmp -> ]
[2 C:\Users\GIARDINO\Desktop\*.tmp files -> C:\Users\GIARDINO\Desktop\*.tmp -> ]
[1 C:\Users\GIARDINO\AppData\Local\*.tmp files -> C:\Users\GIARDINO\AppData\Local\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/19 21:05:15 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/19 21:05:15 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/19 20:59:01 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/19 20:58:36 | 000,002,453 | ---- | M] () -- C:\Users\Public\Documents\Global.sw2
[2011/06/19 20:57:22 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/19 20:57:02 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2011/06/19 20:56:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/06/19 20:56:48 | 2213,404,672 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/19 20:54:42 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2011/06/19 17:05:34 | 000,879,123 | ---- | M] () -- C:\Users\GIARDINO\Desktop\SecurityCheck.exe
[2011/06/19 11:08:05 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\GIARDINO\Desktop\OTL.exe
[2011/06/18 18:45:52 | 000,820,060 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Standen_The debate on the social and economic consequences of the conquest..pdf
[2011/06/18 09:55:31 | 000,000,841 | ---- | M] () -- C:\Windows\Brpfx04a.ini
[2011/06/18 09:21:40 | 002,324,203 | ---- | M] () -- C:\Users\GIARDINO\Desktop\fulltext.pdf
[2011/06/15 03:59:24 | 000,000,406 | ---- | M] () -- C:\Windows\tasks\EasyShare Registration Task.job
[2011/06/15 03:59:21 | 000,428,480 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/06/14 18:21:06 | 001,665,698 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\Cat.DB
[2011/06/12 17:16:04 | 000,001,179 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Photo! Editor.lnk
[2011/06/12 16:08:10 | 000,002,069 | ---- | M] () -- C:\Users\Public\Desktop\Lightroom 3.4.1 64-bit.lnk
[2011/06/11 11:28:52 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\defogger_reenable
[2011/06/11 09:32:36 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\Desktop\gmer.reg
[2011/06/11 09:04:23 | 000,302,592 | ---- | M] () -- C:\Users\GIARDINO\Desktop\gmer.exe
[2011/06/11 07:54:09 | 000,000,746 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\SMRBackup200.dat
[2011/06/11 07:52:53 | 000,096,376 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SMR200.SYS
[2011/06/10 22:47:54 | 000,174,200 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2011/06/10 22:47:54 | 000,007,488 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2011/06/10 22:47:54 | 000,000,855 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2011/06/10 22:47:48 | 000,002,563 | ---- | M] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2011/06/10 21:00:32 | 004,113,977 | ---- | M] (Swearware) -- C:\Users\GIARDINO\Desktop\iexplorer.exe
[2011/06/10 19:50:36 | 000,001,810 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/06/09 22:19:52 | 000,000,542 | ---- | M] () -- C:\Windows\wininit.ini
[2011/06/09 19:08:05 | 000,001,284 | ---- | M] () -- C:\Users\GIARDINO\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/06/09 19:08:05 | 000,001,260 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Spybot - Search & Destroy.lnk
[2011/06/08 07:11:25 | 000,002,416 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Google Chrome.lnk
[2011/06/06 16:27:13 | 000,001,129 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
[2011/06/06 16:26:24 | 000,000,932 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Evernote.lnk
[2011/06/02 17:55:54 | 000,071,573 | ---- | M] () -- C:\Users\GIARDINO\Desktop\relig.jpg
[2011/06/01 06:42:02 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-403862933-658608457-4193072288-1000Core1cc2050ec638780.job
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,025,912 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011/05/27 13:34:59 | 000,001,010 | ---- | M] () -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/05/26 23:57:41 | 000,001,009 | ---- | M] () -- C:\Users\GIARDINO\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2011/05/26 23:57:41 | 000,000,985 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/05/24 20:54:00 | 000,208,490 | ---- | M] () -- C:\Windows\Photo Pos Pro Uninstaller.exe
[2011/05/24 20:53:39 | 000,001,973 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Photo Pos Pro.lnk
[2011/05/24 20:41:28 | 000,123,373 | ---- | M] () -- C:\Windows\Pos Free Photo Editor Uninstaller.exe
[2011/05/24 20:40:40 | 000,001,150 | ---- | M] () -- C:\Users\GIARDINO\Desktop\Pos Free Photo Editor.lnk
[2011/05/23 21:07:10 | 000,001,178 | ---- | M] () -- C:\Users\Public\Desktop\Paint.NET.lnk
[3 C:\Users\GIARDINO\Documents\*.tmp files -> C:\Users\GIARDINO\Documents\*.tmp -> ]
[2 C:\Users\GIARDINO\Desktop\*.tmp files -> C:\Users\GIARDINO\Desktop\*.tmp -> ]
[1 C:\Users\GIARDINO\AppData\Local\*.tmp files -> C:\Users\GIARDINO\AppData\Local\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/19 17:06:12 | 000,879,123 | ---- | C] () -- C:\Users\GIARDINO\Desktop\SecurityCheck.exe
[2011/06/18 18:45:56 | 000,820,060 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Standen_The debate on the social and economic consequences of the conquest..pdf
[2011/06/18 09:21:49 | 002,324,203 | ---- | C] () -- C:\Users\GIARDINO\Desktop\fulltext.pdf
[2011/06/12 17:16:04 | 000,001,179 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Photo! Editor.lnk
[2011/06/12 16:08:11 | 000,002,077 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 3.4.1 64-bit.lnk
[2011/06/12 16:08:09 | 000,002,069 | ---- | C] () -- C:\Users\Public\Desktop\Lightroom 3.4.1 64-bit.lnk
[2011/06/11 11:28:52 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\defogger_reenable
[2011/06/11 09:32:27 | 000,000,000 | ---- | C] () -- C:\Users\GIARDINO\Desktop\gmer.reg
[2011/06/11 07:54:09 | 000,000,746 | ---- | C] () -- C:\Users\GIARDINO\AppData\Roaming\SMRBackup200.dat
[2011/06/10 22:47:59 | 001,665,698 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\Cat.DB
[2011/06/10 22:47:54 | 000,007,488 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2011/06/10 22:47:54 | 000,000,855 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2011/06/10 22:47:48 | 000,002,563 | ---- | C] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2011/06/10 22:47:46 | 000,007,492 | R--- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\iron.cat
[2011/06/10 22:47:46 | 000,007,462 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.cat
[2011/06/10 22:47:46 | 000,007,460 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa64.cat
[2011/06/10 22:47:46 | 000,007,458 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnet64.cat
[2011/06/10 22:47:46 | 000,007,458 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.cat
[2011/06/10 22:47:46 | 000,003,373 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symefa.inf
[2011/06/10 22:47:46 | 000,002,792 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds.inf
[2011/06/10 22:47:46 | 000,001,446 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symnet.inf
[2011/06/10 22:47:46 | 000,001,438 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtsp64.inf
[2011/06/10 22:47:46 | 000,001,422 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\srtspx64.inf
[2011/06/10 22:47:46 | 000,000,772 | R--- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\iron.inf
[2011/06/10 22:47:46 | 000,000,172 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\isolate.ini
[2011/06/10 22:47:14 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\NISx64\1206000.01D\symds64.cat
[2011/06/10 21:16:48 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/06/10 21:16:48 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/06/10 21:16:48 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/06/10 21:16:48 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/06/10 21:16:48 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/06/10 19:50:36 | 000,001,810 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/06/09 22:19:46 | 000,000,542 | ---- | C] () -- C:\Windows\wininit.ini
[2011/06/09 19:08:05 | 000,001,284 | ---- | C] () -- C:\Users\GIARDINO\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/06/09 19:08:05 | 000,001,260 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Spybot - Search & Destroy.lnk
[2011/06/06 16:27:12 | 000,001,129 | ---- | C] () -- C:\Users\GIARDINO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
[2011/06/06 16:26:24 | 000,000,932 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Evernote.lnk
[2011/06/02 17:56:08 | 000,071,573 | ---- | C] () -- C:\Users\GIARDINO\Desktop\relig.jpg
[2011/06/01 06:42:02 | 000,000,868 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-403862933-658608457-4193072288-1000Core1cc2050ec638780.job
[2011/05/29 12:32:00 | 000,302,592 | ---- | C] () -- C:\Users\GIARDINO\Desktop\gmer.exe
[2011/05/26 23:57:41 | 000,001,009 | ---- | C] () -- C:\Users\GIARDINO\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2011/05/24 20:56:22 | 000,000,096 | -HS- | C] () -- C:\Windows\WSYS049.SYS
[2011/05/24 20:53:39 | 000,208,490 | ---- | C] () -- C:\Windows\Photo Pos Pro Uninstaller.exe
[2011/05/24 20:53:39 | 000,001,973 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Photo Pos Pro.lnk
[2011/05/24 20:41:04 | 000,123,373 | ---- | C] () -- C:\Windows\Pos Free Photo Editor Uninstaller.exe
[2011/05/24 20:40:40 | 000,001,150 | ---- | C] () -- C:\Users\GIARDINO\Desktop\Pos Free Photo Editor.lnk
[2011/05/23 21:07:10 | 000,001,190 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.NET.lnk
[2011/05/23 21:07:10 | 000,001,178 | ---- | C] () -- C:\Users\Public\Desktop\Paint.NET.lnk
[2010/12/30 17:16:59 | 000,000,000 | ---- | C] () -- C:\Windows\Secrets.INI
[2010/12/24 13:22:11 | 000,009,216 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/31 00:15:43 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2010/10/04 23:33:42 | 000,003,986 | ---- | C] () -- C:\Users\GIARDINO\AppData\Roaming\wklnhst.dat
[2010/09/25 16:36:19 | 000,007,597 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\Resmon.ResmonCfg
[2010/08/23 00:26:10 | 000,867,793 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_1274.JPG
[2010/08/23 00:26:08 | 003,582,646 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_1274.0
[2010/08/21 20:20:05 | 000,000,164 | ---- | C] () -- C:\Windows\brpcfx.ini
[2010/08/21 20:20:04 | 000,000,841 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2010/08/21 20:19:25 | 000,000,419 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010/08/21 20:19:25 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2010/08/21 20:18:35 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat
[2010/08/05 23:53:10 | 000,042,664 | ---- | C] () -- C:\Windows\SysWow64\drivers\fsbts.sys
[2010/08/05 23:52:38 | 000,733,550 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/08/05 18:31:20 | 000,541,568 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_0292.1
[2010/08/05 18:31:16 | 000,013,060 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_0292_navi.JPG
[2010/08/05 18:30:02 | 000,534,083 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_0292.JPG
[2010/08/05 18:30:01 | 002,177,155 | ---- | C] () -- C:\Users\GIARDINO\AppData\Local\tmpIMG_0292.0
[2010/08/04 15:33:22 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/04/06 05:10:15 | 000,225,411 | ---- | C] () -- C:\Windows\SysWow64\PosPrKpLib.dll
[2010/04/06 05:10:07 | 000,020,480 | ---- | C] () -- C:\Windows\SysWow64\PosTickerLib.dll
[2009/12/30 19:21:59 | 000,021,505 | ---- | C] () -- C:\Windows\SysWow64\cporpub.dll
[2009/09/29 18:25:16 | 000,013,312 | ---- | C] () -- C:\Windows\LPRES.DLL
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2005/09/23 06:52:14 | 000,078,848 | ---- | C] () -- C:\Windows\SysWow64\OneWay.dll
[2002/06/02 09:05:40 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\1Way.dll
[1999/01/22 13:46:58 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\MSRTEDIT.DLL

========== LOP Check ==========

[2011/01/10 13:12:42 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\adma
[2011/06/11 07:54:14 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Azureus
[2011/01/17 02:58:16 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\calibre
[2011/06/19 20:59:26 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Dropbox
[2011/01/12 14:48:14 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\EuroTalk
[2010/08/11 09:45:58 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\F-Secure
[2011/01/10 13:48:53 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\FlashGet
[2011/05/24 21:16:05 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\FrmMain
[2010/12/13 21:34:57 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\gtk-2.0
[2010/12/08 01:06:38 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Main
[2011/01/07 15:47:42 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\ManyCam
[2010/12/02 01:10:46 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\MusicNet
[2011/05/09 16:03:07 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Opera
[2011/06/15 23:12:36 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\PC-FAX TX
[2011/01/24 14:27:49 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\PDF Writer
[2011/05/24 20:53:58 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Photopos
[2010/09/25 11:10:28 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\PhotoScape
[2010/07/20 08:12:53 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\PlayFirst
[2010/09/30 09:39:02 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Serif
[2010/07/25 03:09:42 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Skinux
[2010/11/15 12:59:28 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\SoftGrid Client
[2011/01/10 14:05:25 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Softland
[2010/10/04 23:33:47 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Template
[2010/08/27 20:35:42 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\TP
[2010/07/20 07:15:13 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\WildTangent
[2010/08/06 13:56:33 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\WinBatch
[2010/11/02 18:48:42 | 000,000,000 | ---D | M] -- C:\Users\GIARDINO\AppData\Roaming\Windows Live Writer
[2011/06/15 03:59:24 | 000,000,406 | ---- | M] () -- C:\Windows\Tasks\EasyShare Registration Task.job
[2010/11/21 08:18:15 | 000,000,448 | ---- | M] () -- C:\Windows\Tasks\PCDRScheduledMaintenance.job
[2011/05/29 10:37:25 | 000,032,550 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/05/11 12:28:42 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/05/11 12:28:42 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/05/11 12:28:42 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files (x86)\Mozilla Firefox\firefox.exe [2011/05/11 12:28:35 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -preferences [2011/05/11 12:28:35 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode [2011/05/11 12:28:35 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2010/11/20 07:17:13 | 000,176,128 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2010/11/20 07:17:13 | 000,176,128 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2010/11/20 07:17:13 | 000,176,128 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -extoff [2010/11/20 07:22:51 | 000,673,040 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" [2010/11/20 07:22:51 | 000,673,040 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Opera.exe\InstallInfo\\ShowIconsCommand: "C:\Program Files (x86)\Opera\Opera.exe" /ShowIconsCommand [2011/05/09 16:02:59 | 000,941,936 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Opera.exe\InstallInfo\\HideIconsCommand: "C:\Program Files (x86)\Opera\Opera.exe" /HideIconsCommand [2011/05/09 16:02:59 | 000,941,936 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Opera.exe\InstallInfo\\ReinstallCommand: "C:\Program Files (x86)\Opera\Opera.exe" /ReInstallBrowser [2011/05/09 16:02:59 | 000,941,936 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Opera.exe\shell\open\command\\: "C:\Program Files (x86)\Opera\Opera.exe" [2011/05/09 16:02:59 | 000,941,936 | ---- | M] (Opera Software)

< %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s >
[2011/05/28 08:26:50 | 000,001,758 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\.ChromotingConfig.json
[2011/05/27 13:28:14 | 000,000,012 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Custom Dictionary.txt
[2010/09/23 14:16:20 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\First Run
[2011/06/19 21:03:51 | 000,006,795 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Local State
[2011/06/19 21:02:37 | 005,528,992 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom
[2011/06/19 21:02:39 | 001,936,815 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Filter 2
[2011/06/19 21:02:37 | 000,136,104 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Safe Browsing Download
[2011/06/01 18:31:40 | 000,000,055 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Service State
[2011/05/09 07:58:47 | 000,053,248 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Archived History
[2011/06/18 12:46:18 | 000,016,469 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
[2011/06/18 12:46:18 | 000,016,469 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Bookmarks.bak
[2011/06/19 21:07:58 | 000,701,440 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cookies
[2011/06/19 21:08:31 | 000,680,562 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Current Session
[2011/06/19 21:06:58 | 000,005,181 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
[2010/09/23 15:21:20 | 000,006,144 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
[2011/06/19 21:07:46 | 003,074,048 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Favicons
[2011/06/19 21:07:46 | 000,014,904 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal
[2011/06/19 21:08:25 | 040,919,040 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\History
[2011/06/19 20:35:50 | 048,627,712 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\History Index 2011-05
[2011/06/19 21:08:25 | 040,210,432 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\History Index 2011-06
[2011/06/19 21:08:25 | 000,488,888 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\History Index 2011-06-journal
[2011/06/19 21:08:25 | 000,131,840 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\History-journal
[2011/06/19 20:54:35 | 000,056,128 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Last Session
[2011/06/19 20:52:25 | 000,018,017 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Last Tabs
[2011/06/18 18:43:07 | 000,018,432 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Login Data
[2011/06/19 20:59:52 | 000,137,341 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Preferences
[2011/06/19 21:04:16 | 000,245,760 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Top Sites
[2011/06/05 11:18:30 | 000,000,381 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity
[2011/06/19 20:54:40 | 000,524,192 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Visited Links
[2011/06/19 21:07:53 | 000,133,120 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Web Data
[2011/06/19 21:07:53 | 000,006,680 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
[8 C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\*.tmp files -> C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\*.tmp -> ]
[2011/06/19 20:59:08 | 000,045,056 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0
[2011/06/19 21:04:08 | 000,532,480 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1
[2011/06/19 20:59:10 | 001,056,768 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2
[2011/06/19 20:59:09 | 004,202,496 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3
[2011/06/19 20:59:09 | 000,045,233 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000001
[2011/06/19 20:59:09 | 000,036,316 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000002
[2011/06/19 20:59:09 | 000,077,237 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000003
[2011/06/19 20:59:21 | 000,020,153 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000004
[2011/06/19 21:00:31 | 000,068,618 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000005
[2011/06/19 21:00:31 | 000,039,794 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000006
[2011/06/19 21:03:21 | 000,021,041 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000008
[2011/06/19 21:03:28 | 000,023,527 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000009
[2011/06/19 21:03:29 | 000,024,293 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000a
[2011/06/19 21:03:29 | 000,051,309 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000b
[2011/06/19 21:03:40 | 000,023,031 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000c
[2011/06/19 21:03:54 | 000,035,562 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000d
[2011/06/19 21:03:54 | 000,061,296 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000e
[2011/06/19 21:03:54 | 000,067,352 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000f
[2011/06/19 21:04:25 | 000,020,289 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000010
[2011/06/19 21:07:35 | 000,021,277 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000011
[2011/06/19 21:07:35 | 000,046,484 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000012
[2011/06/19 21:07:35 | 000,058,784 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000013
[2011/06/19 21:07:44 | 000,286,840 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000014
[2011/06/19 21:07:54 | 000,052,186 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000015
[2011/06/19 21:07:55 | 000,072,328 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000016
[2011/06/19 21:07:56 | 000,032,532 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000017
[2011/06/19 21:08:02 | 000,057,582 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000018
[2011/06/19 21:08:02 | 000,085,110 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000019
[2011/06/19 21:08:02 | 000,131,570 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001a
[2011/06/19 21:08:03 | 000,109,924 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001b
[2011/06/19 21:08:03 | 000,047,261 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001c
[2011/06/19 21:08:03 | 000,062,909 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001d
[2011/06/19 21:08:03 | 000,285,629 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001e
[2011/06/19 21:08:04 | 000,018,799 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001f
[2011/06/19 21:08:04 | 000,047,265 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000020
[2011/06/19 21:08:04 | 000,046,095 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000021
[2011/06/19 21:08:04 | 000,030,293 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000022
[2011/06/19 21:08:21 | 000,047,270 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000023
[2011/06/19 21:08:22 | 000,081,377 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000024
[2011/06/19 21:08:22 | 000,046,095 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000025
[2011/06/19 21:08:29 | 000,034,835 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000026
[2011/06/19 20:59:07 | 000,524,656 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Cache\index
[2011/05/30 09:43:54 | 000,009,216 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db
[2011/05/27 22:41:28 | 000,004,096 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\databases\http_twitter.com_0\3
[2011/05/30 09:43:55 | 000,004,096 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\databases\https_twitter.com_0\4
[12 C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\*.tmp files -> C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\*.tmp -> ]
[12 C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\*.tmp files -> C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\*.tmp -> ]
[2011/05/29 20:17:47 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eemcgdkfndhakfknompkggombfjjjeno_0.localstorage
[2010/09/23 14:16:30 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ihflimipbcaljfnojhhknppphnnciiif_0.localstorage
[2011/06/08 23:18:17 | 000,034,816 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pioclpoplcdbaefihamjohnefbikjilc_0.localstorage
[2011/06/02 15:38:08 | 000,051,200 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_secure.shared.live.com_0.localstorage
[2011/05/30 11:28:17 | 000,012,288 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage
[2011/06/19 20:34:13 | 000,040,960 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_twitter.com_0.localstorage
[2011/05/30 09:52:08 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.amazon.ca_0.localstorage
[2011/05/27 23:24:33 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.amazon.com_0.localstorage
[2011/06/12 10:01:09 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.dropbox.com_0.localstorage
[2011/05/13 11:35:55 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.meebo.com_0.localstorage
[2011/06/09 07:52:55 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_ask.com_0.localstorage
[2011/06/02 19:13:00 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_awesomepeoplehangingouttogether.tumblr.com_0.localstorage
[2011/06/02 17:06:08 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_beta.klout.com_0.localstorage
[2011/06/13 08:02:23 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_blog.hercatwalk.com_0.localstorage
[2011/06/02 12:35:00 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_blog.zap2it.com_0.localstorage
[2011/06/05 14:03:34 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_blogs.wsj.com_0.localstorage
[2011/06/12 13:25:48 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_boldnbeautifulmakeup.blogspot.com_0.localstorage
[2011/06/06 23:31:07 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_bookshop.livejournal.com_0.localstorage
[2011/06/18 12:36:03 | 000,528,384 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_cdn.apture.com_0.localstorage
[2011/06/11 15:19:58 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_designyoutrust.com_0.localstorage
[2011/06/11 10:14:50 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_edition.cnn.com_0.localstorage
[2011/06/02 10:24:25 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_entertainment.ca.msn.com_0.localstorage
[2011/05/28 11:39:54 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_fb-tc-2.farmville.com_0.localstorage
[2011/06/12 13:21:39 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_find-a-driving-school.ca_0.localstorage
[2011/05/27 12:29:40 | 000,031,744 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_grooveshark.com_0.localstorage
[2011/06/02 17:39:09 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_howcool.com_0.localstorage
[2011/06/11 15:02:00 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_ilovecharts.tumblr.com_0.localstorage
[2011/06/11 10:45:57 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_majorgeeks.com_0.localstorage
[2011/06/18 12:46:20 | 000,006,144 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_mediacdn.disqus.com_0.localstorage
[2011/06/06 08:43:18 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_mythriftedcloset.blogspot.com_0.localstorage
[2011/06/13 09:11:03 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_news.ninemsn.com.au_0.localstorage
[2011/06/06 23:07:36 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_online.wsj.com_0.localstorage
[2011/06/02 15:27:32 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_partners.livingsocial.com_0.localstorage
[2011/06/11 14:04:26 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pinterest.com_0.localstorage
[2011/06/02 15:26:44 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_signup.womenfreebies.ca_0.localstorage
[2011/06/05 13:11:40 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_swagbucks.com_0.localstorage
[2011/06/06 17:02:30 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_thekawarthas.ca_0.localstorage
[2011/06/02 12:35:39 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_tvlistings.zap2it.com_0.localstorage
[2011/05/29 19:35:37 | 000,030,720 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_twitter.com_0.localstorage
[2011/06/02 11:45:25 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_wiki.answers.com_0.localstorage
[2011/06/11 10:38:01 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.ameandlulu.com_0.localstorage
[2011/06/02 13:43:59 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.applebottoms.com_0.localstorage
[2011/06/13 08:02:16 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.arashmazinani.com_0.localstorage
[2011/06/11 10:12:27 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.beautylish.com_0.localstorage
[2011/06/02 19:04:04 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.bellasugar.com_0.localstorage
[2011/06/02 10:54:41 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.businessinsider.com_0.localstorage
[2011/05/30 12:08:02 | 000,006,144 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.buzzfeed.com_0.localstorage
[2011/06/14 17:28:55 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.cbc.ca_0.localstorage
[2011/06/13 08:06:22 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.dell.com_0.localstorage
[2011/06/18 09:46:28 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.etsy.com_0.localstorage
[2011/06/02 19:04:14 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.fitsugar.com_0.localstorage
[2011/06/02 11:35:43 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.goodreads.com_0.localstorage
[2011/06/06 20:25:58 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.hollywoodreporter.com_0.localstorage
[2011/06/02 17:39:02 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.howcool.com_0.localstorage
[2011/06/05 11:12:04 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.internships.com_0.localstorage
[2011/06/12 10:06:31 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.kobobooks.com_0.localstorage
[2011/06/06 16:21:07 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mediafire.com_0.localstorage
[2011/06/19 20:29:31 | 001,804,288 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.meebo.com_0.localstorage
[2011/06/13 07:56:19 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mischiefmydear.com_0.localstorage
[2011/06/04 18:59:57 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.neatorama.com_0.localstorage
[2011/06/06 17:10:32 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.nytimes.com_0.localstorage
[2011/06/12 12:56:43 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.positivelypresent.com_0.localstorage
[2011/06/11 15:20:00 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.punchtab.com_0.localstorage
[2011/06/04 12:31:38 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.raisehopeforcongo.org_0.localstorage
[2011/06/11 10:12:22 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.refinery29.com_0.localstorage
[2011/06/12 10:18:09 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.rtwblog.com_0.localstorage
[2011/06/13 09:20:58 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.seventeen.com_0.localstorage
[2011/06/02 19:04:14 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.stylelist.com_0.localstorage
[2011/06/05 13:14:08 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.swagbucks.com_0.localstorage
[2011/06/13 10:56:54 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.thecollegeprepster.com_0.localstorage
[2011/06/02 19:04:39 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.thefrisky.com_0.localstorage
[2011/06/13 09:28:28 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.thetwentylife.com_0.localstorage
[2011/06/08 07:08:03 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.ticketmaster.ca_0.localstorage
[2011/06/04 12:46:08 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.tigerdirect.ca_0.localstorage
[2011/06/05 11:12:01 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.urbaninterns.com_0.localstorage
[2011/06/13 09:10:42 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.vancouversun.com_0.localstorage
[2011/06/05 14:03:47 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.washingtonpost.com_0.localstorage
[2011/06/12 13:44:49 | 000,003,072 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.youtube.com_0.localstorage
[2011/06/15 20:30:36 | 000,045,056 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_0
[2011/06/15 20:30:36 | 000,270,336 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_1
[2011/05/19 13:55:31 | 000,008,192 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_2
[2011/05/19 13:55:31 | 000,008,192 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_3
[2011/05/19 13:55:33 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000001
[2011/05/19 13:55:34 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000002
[2011/05/19 13:55:34 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000003
[2011/05/19 13:55:35 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000004
[2011/05/19 13:55:35 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000005
[2011/05/19 13:55:37 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000006
[2011/05/19 13:55:39 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000007
[2011/05/19 13:55:40 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000008
[2011/05/19 13:55:41 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000009
[2011/05/19 13:55:41 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00000a
[2011/05/19 13:56:58 | 000,146,076 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00000b
[2011/05/27 15:44:28 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00000c
[2011/05/27 15:44:30 | 000,635,776 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00000d
[2011/05/30 13:41:10 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00000e
[2011/05/30 13:41:10 | 000,336,957 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00000f
[2011/06/14 17:31:25 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000010
[2011/06/14 17:31:24 | 000,507,355 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000011
[2011/06/14 17:31:26 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000012
[2011/06/14 17:53:00 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000013
[2011/06/14 17:52:58 | 000,509,613 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000014
[2011/06/14 17:53:01 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000015
[2011/06/14 17:56:14 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000016
[2011/06/14 17:56:15 | 000,386,780 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000017
[2011/06/14 17:56:15 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000018
[2011/06/15 20:18:10 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000019
[2011/06/15 20:18:35 | 000,251,206 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00001a
[2011/06/15 20:18:13 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00001b
[2011/06/15 20:18:14 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00001c
[2011/06/15 20:18:16 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00001d
[2011/06/15 20:18:20 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00001e
[2011/06/15 20:18:22 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_00001f
[2011/06/15 20:18:23 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000020
[2011/06/15 20:18:25 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000021
[2011/06/15 20:18:27 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000022
[2011/06/15 20:18:29 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000023
[2011/06/15 20:18:31 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000024
[2011/06/15 20:18:32 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000025
[2011/06/15 20:18:34 | 001,048,576 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_000026
[2011/05/19 13:55:31 | 000,524,656 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Media Cache\index
[2010/09/23 14:33:51 | 000,017,408 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Plugin Data\Google Gears\localserver.db
[2010/09/23 14:33:51 | 000,019,456 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\Plugin Data\Google Gears\permissions.db
[2010/09/23 14:16:22 | 000,000,000 | ---- | M] () -- C:\Users\GIARDINO\AppData\Local\Google\Chrome\User Data\Default\User StyleSheets\Custom.css

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

#10 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:06:30 AM

Posted 19 June 2011 - 09:01 PM

Hi!

The two logs are below. As far as I know, there are no outstanding issues... yet. The ad.yieldmanager (my initial reason for posting asking for help) comes and goes, so I won't know for a few days/a week or so if it is really gone.

What you're describing with the ad.yieldmanager sounds like you're seeing cookies being set.

A colleague of mine (quietman7) has the following to say about cookies.

Cookies are text string messages given to a Web browser by a Web server. Whenever you visit a web page or navigate different pages with your browser, the web site generates a unique ID number which your browser stores in a text (cookie) file that is sent back to the server each time the browser requests a page from that server. Cookies allow third-party providers such as ad serving networks, spyware or adware providers to track personal information. The main purpose of cookies is to identify users and prepare customized Web pages for them.

  • Persistent cookies have expiration dates set by the Web server when it passes the cookie and are stored on a user's hard drive until they expire or are deleted. These types of cookies are used to store information between visits to a site and collect identifying information about the user such as surfing behavior or preferences for a specific web site.
  • Session (transient) cookies are not saved to the hard drive, do not collect any information and have no set expiration date. They are used to temporarily hold information in the form of a session identification stored in memory as you browse web pages. These types of cookies are cached only while a user is visiting the Web server issuing the session cookie and are deleted from the cache when the user closes the session.
Cookies can be categorized as:
  • Trusted cookies are from sites you trust, use often, and want to be able to identify and personalize content for you.
  • Nuisance cookies are from those sites you do not recognize or often use but somehow it's put a cookie on your machine.
  • Bad cookies (i.e. persistent cookies, long term and third party tracking cookies) are those that can be linked to an ad company or something that tracks your movements across the web.
The type of persistent cookie that is a cause for some concern are "tracking cookies" because they can be considered a privacy risk. These types of cookies are used to track your Web browsing habits (your movement from site to site). Ad companies use them to record your activity on all sites where they have placed ads. They can keep count of how many times you visited a web page, store your username and password so you don't have to log in and retain your custom settings. When you visit one of these sites, a cookie is placed on your computer. Each time you visit another site that hosts one of their ads, that same cookie is read, and soon they have assembled a list of which of their sites you have visited and which of their ads that you have clicked on. Cookies are used all over the Internet and advertisement companies often plant them whenever your browser loads one of their banners.

Cookies are NOT a "threat". As text files they cannot be executed to cause any damage. Cookies do not cause any pop ups or install malware and they cannot erase or read information from a computer.

Cookies cannot be used to run code (run programs) or to deliver viruses to your computer.

MS Article ID: 60971 - Description of Cookies

To learn more about Cookies, please refer to:Flash cookies (or Local Shared Objects) and Evercookies are a newer way of tracking user behavior and surfing habits but they too are not a threat, nor can they harm your computer.

An Evercookie is a Javascript API created and managed persistent cookie which can be used to identify a user even after they have removed standard and Flash cookies. This is accomplished by creating a new cookie and storing the data in as many storage locations (currently eight) as it can find on the local browser. Storage mechanisms range from Standard HTTP and Flash cookies to HTML5's new storage methods. When evercookie finds that other types of cookies have been removed, it recreates them so they can be reused over and over.Flash cookies are cookie-like data stored on a computer and used by all versions of Adobe Flash Player and similar applications. They can store much more information than traditional browser cookies and they are typically stored within each user’s Application Data directory with a ".SOL" extension, under the Macromedia\FlashPlayer\#SharedObjects folder. Unlike traditional cookies, Flash cookies cannot be managed through browser controls so they are more difficult to find and remove. However, they can be viewed, managed and deleted using the Website Storage Settings panel at Macromedia's Support Site. From this panel, you can change storage settings for a website, delete a specific website or delete all sites which erases any information that may have been stored on the computer. To prevent any Flash Cookies from being stored on your computer, go to the Global Storage Settings panel and uncheck the option “Allow third-party Flash content to store data on your computer”. For more information, please refer to:As long as you surf the Internet, you are going to get cookies and some of your security programs will flag them for removal. However, you can minimize the number of them which are stored on your computer by referring to:Third party utilities to Manage (view & delete) Cookies:




If that's all we need to do, I assume that I can just reopen this thread after it is closed?

Yes, just need to send me a private message to have it re-opened.

Also, thank you so much for your help! I appreciate your effort, and how fast you responded, and I can't believe you (and all the others) are volunteers! Again, thank you for all your help. Is there a way I can make a small donation to the website through PayPal to continue supporting all the work done here?

You're welcome! The site does not accept donations, as it's able to support itself through ads on the site, but I do have a link in my signature if you'd like to personally donate to me.


OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Services
    :OTL
    O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found
    O4 - HKCU..\Run: [Spyware Doctor] File not found
    [3 C:\Users\GIARDINO\Documents\*.tmp files -> C:\Users\GIARDINO\Documents\*.tmp -> ]
    [2 C:\Users\GIARDINO\Desktop\*.tmp files -> C:\Users\GIARDINO\Desktop\*.tmp -> ]
    [1 C:\Users\GIARDINO\AppData\Local\*.tmp files -> C:\Users\GIARDINO\AppData\Local\*.tmp -> ]
    :Reg
    
    :Files
    ipconfig /flushdns /c
    :Commands
    [purity]
    [resethosts]
    [CreateRestorePoint]
    [emptytemp]
    [EMPTYFLASH]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



Clear Browsing Data for Chrome

Open Google Chrome

  • Click the wrench icon Posted Image on the browser toolbar.
  • Select Tools.
  • Select Clear browsing data.
  • Where it says Obliterate the following items from: select The begining of time
  • In the dialog that appears, select the following checkboxes:
    • Empty the cache
  • Click Clear browsing data.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#11 dolphincrazed007

dolphincrazed007
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 20 June 2011 - 09:05 AM

In reading your colleagues info about cookies, I noticed he said:

Cookies do not cause any pop ups...


ad.yieldmanager is a popup - it usually says something along the lines of "you won" or is slots/casino related. I call it ad.yieldmanager, because when it pops up in Internet Explorer, the address it gives begins with ad.yieldmanager. Because it pops up, does this mean it isn't a cookie-related problem? Again, I haven't experienced it so far/yet, but just so I understand more.



All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Spyware Doctor deleted successfully.
C:\Users\GIARDINO\Documents\~WRL0370.tmp deleted successfully.
C:\Users\GIARDINO\Documents\~WRL0881.tmp deleted successfully.
C:\Users\GIARDINO\Documents\~WRL1924.tmp deleted successfully.
C:\Users\GIARDINO\Desktop\~WRL0954.tmp deleted successfully.
C:\Users\GIARDINO\Desktop\~WRL3039.tmp deleted successfully.
C:\Users\GIARDINO\AppData\Local\BITFE1C.tmp deleted successfully.
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\GIARDINO\Desktop\cmd.bat deleted successfully.
C:\Users\GIARDINO\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: CHANTELLE
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: GIARDINO
->Temp folder emptied: 2333853 bytes
->Temporary Internet Files folder emptied: 872122 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 116025866 bytes
->Google Chrome cache emptied: 148105912 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 4308 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 95664 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 255.00 mb


[EMPTYFLASH]

User: All Users

User: CHANTELLE
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: GIARDINO
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.24.1 log created on 06202011_095318

Files\Folders moved on Reboot...
C:\Users\GIARDINO\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF4AD2B6DBA72C4A48.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF6843FA48969C3D1A.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF7B719838F0D7C68D.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF8098C3C452622247.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF8FF1D52306806BBB.TMP not found!
File\Folder C:\Users\GIARDINO\AppData\Local\Temp\~DF9ED8C69EB22C11D1.TMP not found!

Registry entries deleted on Reboot...

#12 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:06:30 AM

Posted 20 June 2011 - 09:58 AM

ad.yieldmanager is a popup - it usually says something along the lines of "you won" or is slots/casino related. I call it ad.yieldmanager, because when it pops up in Internet Explorer, the address it gives begins with ad.yieldmanager. Because it pops up, does this mean it isn't a cookie-related problem? Again, I haven't experienced it so far/yet, but just so I understand more.

hmm.. You may want to try using Google Chrome as your default browser, as it's more secure than Internet Explorer, and shouldn't cause issues with experiencing pop-ups.

Are you experiencing any other issues with your computer, or do you think you're ready for the clean-up procedure?

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#13 dolphincrazed007

dolphincrazed007
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 20 June 2011 - 01:40 PM

I am not aware of any other problems with the computer, no. I think I'm ready for the clean up procedure.

#14 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:06:30 AM

Posted 20 June 2011 - 01:43 PM

Hello,

Your logs appear to be clean, so if you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.



Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall



NEXT:



OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Commands
    [ClearAllRestorePoints]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.


NEXT:



OTL Clean-Up

We Need to Clean Up our Mess
Our work on your machine has left considerable leftovers on your box. Let's clean those up real quick:
  • Reopen Posted Image on your desktop.
  • Click on Posted Image
  • You will be prompted to reboot your system. Please do so.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.


NEXT:



All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===



Below I have included a number of recommendations for how to protect your computer against malware infections.


Updated Anti-Virus Program
It's essential that you have an updated anti-virus program running on your computer. You don't want to run more than one as it can cause program conflicts, as well as false positives

You can view an excellent list of Free Security Software programs that has been compiled by GeekstoGo.


Avoid P2P Programs

Remember that no matter how clean the program you're using for peer-to-peer filesharing may be, it offers no guarantees regarding the cleanliness of files you may choose to download. All files available via p2p filesharing carry a high risk, particularly those that offer you illegitimate methods of using legitimate software programs without paying for them. Some further readings on this subject, along the included links, are as follows: File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology.

If you have any of these programs installed then I highly suggest you uninstall them.

NOTE: Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.


Internet Browsers

Many of the users that I assist here on the forums, ask me which programs they can use to prevent themselves from getting infected again in the future. The best answer I can give you is too practice safe browsing.

Please consider using an alternative browser such as Google Chrome or Opera. They are both much more secure than Internet Explorer, immune to almost all known browser hijackers, and also have great built-in pop-up blockers.

I also suggest you make your Internet Explore more secure.


Make Internet Explorer more secure

  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.



Extra Goodies

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • You should run an updated scan with MalwareBytes' Anti-Malware weekly. Instructions are included below:

    • Open Malwarebytes' Anti-Malware
    • Select the Update tab
    • Click Check for Updates

  • Be weary of e-mails from unknown senders. Keep the following in mind as well: If it's to good to be true, then it more than likely is.

  • FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for Chrome and Opera.
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security--What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#15 dolphincrazed007

dolphincrazed007
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 21 June 2011 - 03:59 PM

Thank you so much!


========== COMMANDS ==========
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.24.1 log created on 06212011_165207




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users