shortybballin
Topic Starter
OTListIt logfile created on: 3/12/2009 3:18:26 PM - Run 3
OTListIt2 by OldTimer - Version 2.0.3.5 Folder = C:\Users\ROG3ERS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XKUAZCNT
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1021.71 Mb Total Physical Memory | 293.83 Mb Available Physical Memory | 28.76% Memory free
2.26 Gb Paging File | 1.15 Gb Available in Paging File | 50.97% Paging File free
Paging file location(s): ?:\pagefile.sys;
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 62.48 Gb Total Space | 17.88 Gb Free Space | 28.62% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.28 Gb Free Space | 62.81% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: ROG3ERS-PC
Current User Name: ROG3ERS
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On
========== Processes (SafeList) ==========
PRC - C:\Windows\System32\WLTRYSVC.EXE ()
PRC - C:\Windows\System32\bcmwltry.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Windows\system32\dlbccoms.exe ( )
PRC - C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
PRC - c:\program files\grasssoft\mouse recorder\MacroService.exe (Grass Software)
PRC - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions)
PRC - C:\Windows\system32\DRIVERS\xaudio.exe (Conexant Systems, Inc.)
PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
PRC - c:\program files\grasssoft\mouse recorder\MacroServiceWnd.exe (Grass Software)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\Windows\System32\WLTRAY.EXE (Dell Inc.)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Program Files\Common Files\aol\1179968950\ee\aolsoftware.exe (America Online, Inc.)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Windows\sttray.exe (SigmaTel, Inc.)
PRC - C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE (MyWebSearch.com)
PRC - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Program Files\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
PRC - C:\Program Files\NETGEAR\WG111T\wlan111t.exe (NETGEAR)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Internet Explorer\ieuser.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe (Adobe Systems, Inc.)
PRC - C:\Users\ROG3ERS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XKUAZCNT\OTListIt2[1].exe (OldTimer Tools)
========== Win32 Services (SafeList) ==========
SRV - (AOL ACS [On_Demand | Stopped]) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Automatic LiveUpdate Scheduler [Auto | Running]) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccSetMgr [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CLTNetCnService [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (dlbc_device [Auto | Running]) – C:\Windows\system32\dlbccoms.exe ( )
SRV - (DSBrokerService [On_Demand | Stopped]) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (GoogleDesktopManager-061008-081103 [On_Demand | Stopped]) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (gupdate1c98a2a782a6e60 [Auto | Stopped]) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (gusvc [Auto | Stopped]) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (IDriverT [On_Demand | Stopped]) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (LiveUpdate [On_Demand | Stopped]) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (LiveUpdate Notice [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (Macro Expert [Auto | Running]) – c:\program files\grasssoft\mouse recorder\MacroService.exe (Grass Software)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (RapiMgr [Auto | Running]) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (RoxMediaDB9 [On_Demand | Stopped]) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (Sonic Solutions)
SRV - (RoxWatch9 [Auto | Running]) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions)
SRV - (Steam Client Service [On_Demand | Running]) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (stllssvr [On_Demand | Stopped]) – C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.)
SRV - (Symantec Core LC [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (Symantec RemoteAssist [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (WcesComm [Auto | Running]) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (WinDefend [Auto | Running]) – C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (wltrysvc [Auto | Running]) – C:\Windows\System32\WLTRYSVC.EXE ()
SRV - (WMPNetworkSvc [On_Demand | Running]) – C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (XAudioService [Auto | Running]) – C:\Windows\system32\DRIVERS\xaudio.exe (Conexant Systems, Inc.)
========== Driver Services (SafeList) ==========
DRV - (adp94xx [Disabled | Stopped]) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (adpahci [Disabled | Stopped]) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (adpu160m [Disabled | Stopped]) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (adpu320 [Disabled | Stopped]) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (AegisP [Auto | Running]) – C:\Windows\system32\DRIVERS\AegisP.sys (Meetinghouse Data Communications)
DRV - (aic78xx [Disabled | Stopped]) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (aliide [Disabled | Stopped]) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (AR5523 [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\WG11TND5.sys (NETGEAR, Inc.)
DRV - (arc [Disabled | Stopped]) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (arcsas [Disabled | Stopped]) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (BCM43XX [On_Demand | Running]) – C:\Windows\system32\DRIVERS\bcmwl6.sys (Broadcom Corporation)
DRV - (bcm4sbxp [On_Demand | Running]) – C:\Windows\system32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (BrFiltLo [On_Demand | Stopped]) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp [On_Demand | Stopped]) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (Brserid [Disabled | Stopped]) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrSerWdm [Disabled | Stopped]) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm [Disabled | Stopped]) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer [On_Demand | Stopped]) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BVRPMPR5 [On_Demand | Stopped]) – C:\Windows\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (cmdide [Disabled | Stopped]) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (COH_Mon [On_Demand | Stopped]) – C:\Windows\system32\Drivers\COH_Mon.sys (Symantec Corporation)
DRV - (DSproct [On_Demand | Stopped]) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (dsunidrv [Auto | Running]) – C:\Program Files\DellSupport\Drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (e1express [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\e1e6032.sys (Intel Corporation)
DRV - (E1G60 [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\E1G60I32.sys (Intel Corporation)
DRV - (eeCtrl [System | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (elxstor [Disabled | Stopped]) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (EraserUtilRebootDrv [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (HpCISSs [Disabled | Stopped]) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (HSF_DPV [On_Demand | Running]) – C:\Windows\system32\DRIVERS\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL [On_Demand | Running]) – C:\Windows\system32\DRIVERS\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (iaStorV [Disabled | Stopped]) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (IDSvix86 [System | Running]) – C:\ProgramData\Symantec\Definitions\SymcData\ipsdefs\20090310.004\IDSvix86.sys (Symantec Corporation)
DRV - (iirsp [Disabled | Stopped]) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (iteatapi [Disabled | Stopped]) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (iteraid [Disabled | Stopped]) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (LSI_FC [Disabled | Stopped]) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (LSI_SAS [Disabled | Stopped]) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (LSI_SCSI [Disabled | Stopped]) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (mdmxsdk [Auto | Running]) – C:\Windows\system32\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (megasas [Disabled | Stopped]) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Mraid35x [Disabled | Stopped]) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (NAVENG [On_Demand | Running]) – C:\ProgramData\Symantec\Definitions\VirusDefs\20090311.049\NAVENG.SYS (Symantec Corporation)
DRV - (NAVEX15 [On_Demand | Running]) – C:\ProgramData\Symantec\Definitions\VirusDefs\20090311.049\NAVEX15.SYS (Symantec Corporation)
DRV - (nfrd960 [Disabled | Stopped]) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (ntrigdigi [Disabled | Stopped]) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (nvlddmkm [On_Demand | Running]) – C:\Windows\system32\DRIVERS\nvlddmkm.sys (NVIDIA Corporation)
DRV - (nvraid [Disabled | Stopped]) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor [Disabled | Stopped]) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (PxHelp20 [Boot | Running]) – C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ql2300 [Disabled | Stopped]) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (ql40xx [Disabled | Stopped]) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (R300 [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\atikmdag.sys (ATI Technologies Inc.)
DRV - (rimmptsk [Auto | Running]) – C:\Windows\system32\DRIVERS\rimmptsk.sys (REDC)
DRV - (rimsptsk [Auto | Running]) – C:\Windows\system32\DRIVERS\rimsptsk.sys (REDC)
DRV - (rismxdp [Auto | Running]) – C:\Windows\system32\DRIVERS\rixdptsk.sys (REDC)
DRV - (secdrv [Auto | Running]) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SiSRaid2 [Disabled | Stopped]) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (SiSRaid4 [Disabled | Stopped]) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (SPBBCDrv [System | Running]) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SRTSP [System | Running]) – C:\Windows\System32\Drivers\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPL [On_Demand | Stopped]) – C:\Windows\System32\Drivers\SRTSPL.SYS (Symantec Corporation)
DRV - (SRTSPX [System | Running]) – C:\Windows\System32\Drivers\SRTSPX.SYS (Symantec Corporation)
DRV - (STHDA [On_Demand | Running]) – C:\Windows\system32\drivers\stwrt.sys (SigmaTel, Inc.)
DRV - (Symc8xx [Disabled | Stopped]) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (SYMDNS [On_Demand | Running]) – C:\Windows\System32\Drivers\SYMDNS.SYS (Symantec Corporation)
DRV - (SymEvent [On_Demand | Running]) – C:\Windows\system32\Drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMFW [On_Demand | Running]) – C:\Windows\System32\Drivers\SYMFW.SYS (Symantec Corporation)
DRV - (SymIM [System | Running]) – C:\Windows\system32\DRIVERS\SymIMv.sys (Symantec Corporation)
DRV - (SYMNDISV [On_Demand | Running]) – C:\Windows\System32\Drivers\SYMNDISV.SYS (Symantec Corporation)
DRV - (SYMREDRV [On_Demand | Running]) – C:\Windows\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMTDI [System | Running]) – C:\Windows\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (Sym_hi [Disabled | Stopped]) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Sym_u3 [Disabled | Stopped]) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (SynTP [On_Demand | Running]) – C:\Windows\system32\DRIVERS\SynTP.sys (Synaptics, Inc.)
DRV - (uliahci [Disabled | Stopped]) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (UlSata [Disabled | Stopped]) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (ulsata2 [Disabled | Stopped]) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (usbaudio [On_Demand | Stopped]) – C:\Windows\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (USB_RNDIS_VISTA [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\usb8023.sys (Microsoft Corporation)
DRV - (viaide [Disabled | Stopped]) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (vsmraid [Disabled | Stopped]) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (wanatw [On_Demand | Running]) – C:\Windows\system32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (winachsf [On_Demand | Running]) – C:\Windows\system32\DRIVERS\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (winusb [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\winusb.sys (Microsoft Corporation)
DRV - (XAudio [Auto | Running]) – C:\Windows\system32\DRIVERS\xaudio.sys (Conexant Systems, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - presf.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758} -> %ProgramFiles%\REAL\REALPLAYER\BROWSERRECORD [C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD] -> [2008/05/27 11:59:18 00,000,000 | —D | M]
FF - C:\Users\ROG3ERS\AppData\Roaming\mozilla\Extensions [2009/03/08 03:00:22 00,000,000 | —D | M]
FF - C:\Users\ROG3ERS\AppData\Roaming\mozilla\Extensions\[removed] [2009/03/08 03:00:22 00,000,000 | —D | M]
FF - C:\Users\ROG3ERS\AppData\Roaming\mozilla\Firefox\Profiles\qxlqo05a.default\extensions [2009/02/07 17:13:43 00,000,000 | —D | M]
FF - C:\Users\ROG3ERS\AppData\Roaming\mozilla\Firefox\Profiles\qxlqo05a.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2008/12/10 13:31:28 00,000,000 | —D | M]
FF - C:\Program Files\mozilla firefox\extensions [2009/03/08 16:39:56 00,000,000 | —D | M]
FF - C:\Program Files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2008/05/27 11:56:39 00,000,000 | —D | M]
FF - C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} [2008/11/05 22:29:56 00,000,000 | —D | M]
O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - Reg Error: Key error. File not found
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! ¤u¨ã¦C) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe (Dell Inc.)
O4 - HKLM..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" (Symantec Corporation)
O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\PhotoDownloader.exe File not found
O4 - HKLM..\Run: [DNS7reminder] "C:\Program Files\Nuance\NaturallySpeaking9\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking9\Ereg.ini (Nuance Communications, Inc.)
O4 - HKLM..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup (Google)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1179968950\ee\AOLSoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start (InstallShield Software Corporation)
O4 - HKLM..\Run: [Macro Manager] C:\Program Files\GrassSoft\Mouse Recorder\MacroManager.exe /q (GrassSoftware)
O4 - HKLM..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w (MyWebSearch.com)
O4 - HKLM..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF (MyWebSearch.com)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart (NVIDIA Corporation)
O4 - HKLM..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe" (CyberLink Corp.)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" ()
O4 - HKLM..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup (InstallShield Software Corporation)
O4 - HKCU..\Run: [MSServer] rundll32.exe C:\Users\ROG3ERS\AppData\Local\Temp\urqPHYOi.dll,#1 File not found
O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (Microsoft Corporation)
O4 - HKCU..\Run: [Steam] "c:\program files\steam\steam.exe" -silent (Valve Corporation)
O4 - HKCU..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [@%SystemRoot%\system32\nlasvc.dll,-1000] - C:\Windows\system32\NLAapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [@%SystemRoot%\system32\napinsp.dll,-1000] - C:\Windows\system32\napinsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [@%SystemRoot%\system32\pnrpnsp.dll,-1000] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [@%SystemRoot%\system32\pnrpnsp.dll,-1001] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([www] * in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.1.cab (Reg Error: Key error.)
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} http://www.acclaim.com/cabs/acclaim_v5.cab (GameLauncher Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\autoexec.bat () - [ NTFS ]
========== Files/Folders - Created Within 30 Days ==========
[2009/03/12 15:02:28 | 00,000,000 | —D | C] – C:\BFU
[2009/03/12 14:58:35 | 00,081,408 | —- | C] (Soeperman Enterprises Ltd.) – C:\Users\ROG3ERS\Desktop\BFU.exe
[2009/03/11 17:36:59 | 00,001,876 | —- | C] () – C:\Users\ROG3ERS\Desktop\HijackThis.lnk
[2009/03/11 17:36:57 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/03/10 21:59:50 | 10,622,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmp.dll
[2009/03/10 21:59:44 | 00,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwmp.dll
[2009/03/10 21:59:44 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdxm.ocx
[2009/03/10 21:59:44 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxmasf.dll
[2009/03/10 21:59:42 | 08,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2009/03/10 21:59:34 | 00,268,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schannel.dll
[2009/03/10 21:58:45 | 02,033,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2009/03/10 17:52:59 | 00,000,000 | -HSD | C] – C:\Config.Msi
[2009/03/08 15:50:06 | 00,000,794 | —- | C] () – C:\Users\ROG3ERS\Desktop\Garry's Mod.lnk
[2009/03/08 14:26:17 | 00,000,553 | —- | C] () – C:\Users\ROG3ERS\Desktop\GoldWave.lnk
[2009/03/08 03:23:06 | 00,000,311 | —- | C] () – C:\Users\ROG3ERS\Desktop\HLSS 3.00.ini
[2009/03/08 03:19:01 | 00,000,993 | —- | C] () – C:\Users\ROG3ERS\Desktop\dBpowerAMP Music Converter.lnk
[2009/03/08 03:18:12 | 00,131,072 | —- | C] () – C:\Windows\System32\SpoonUninstall.exe
[2009/03/08 03:18:12 | 00,036,104 | —- | C] () – C:\Windows\System32\SpoonUninstall-dBpowerAMP Music Converter.dat
[2009/03/08 03:18:12 | 00,033,846 | —- | C] () – C:\Windows\System32\SpoonUninstall-dBpowerAMP Music Converter.bmp
[2009/03/08 03:17:51 | 00,000,000 | —D | C] – C:\Program Files\Illustrate
[2009/03/08 03:17:18 | 02,510,572 | —- | C] () – C:\Users\ROG3ERS\Desktop\gwave520.exe
[2009/03/08 03:16:58 | 00,723,456 | —- | C] (None) – C:\Users\ROG3ERS\Desktop\HLSS 3.00.exe
[2009/03/08 03:01:29 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\Documents\LimeWire
[2009/03/08 02:59:10 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\LimeWire
[2009/03/08 01:40:06 | 00,000,000 | —D | C] – C:\Program Files\GoldWave
[2009/03/08 00:46:11 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\WinRAR
[2009/03/08 00:44:56 | 00,000,816 | —- | C] () – C:\Users\Public\Desktop\WinRAR.lnk
[2009/03/08 00:44:46 | 00,000,000 | —D | C] – C:\Program Files\WinRAR
[2009/03/07 20:00:36 | 00,000,750 | —- | C] () – C:\Users\Public\Desktop\mIRC.lnk
[2009/03/07 20:00:35 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\mIRC
[2009/03/07 20:00:33 | 00,000,000 | —D | C] – C:\Program Files\mIRC
[2009/03/03 19:41:29 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\teamspeak2
[2009/03/03 19:41:12 | 00,034,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lhacm.acm
[2009/03/03 19:41:09 | 00,000,789 | —- | C] () – C:\Users\ROG3ERS\Desktop\Teamspeak 2 RC2.lnk
[2009/03/03 19:41:03 | 00,000,000 | —D | C] – C:\Program Files\Teamspeak2_RC2
[2009/03/01 00:52:25 | 00,045,387 | —- | C] () – C:\Users\ROG3ERS\Documents\Untitled (9).wma
[2009/03/01 00:50:54 | 00,153,147 | —- | C] () – C:\Users\ROG3ERS\Documents\Untitled (8).wma
[2009/03/01 00:47:59 | 00,099,267 | —- | C] () – C:\Users\ROG3ERS\Documents\Untitled (7).wma
[2009/02/28 20:09:47 | 00,000,838 | —- | C] () – C:\Users\ROG3ERS\Desktop\Runescape.url
[2009/02/27 18:23:26 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Blizzard Entertainment
[2009/02/26 21:37:32 | 00,676,656 | —- | C] () – C:\Users\ROG3ERS\Desktop\setup(2).exe
[2009/02/26 21:36:56 | 00,676,656 | —- | C] () – C:\Users\ROG3ERS\Desktop\setup.exe
[2009/02/21 23:41:51 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\Documents\My Spore Creations
[2009/02/21 23:40:53 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\SPORE
[2009/02/21 23:40:12 | 00,000,000 | RH-D | C] – C:\Users\ROG3ERS\AppData\Roaming\SecuROM
[2009/02/21 23:19:55 | 02,319,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_27.dll
[2009/02/21 23:18:19 | 00,000,926 | —- | C] () – C:\Users\Public\Desktop\EA Download Manager.lnk
[2009/02/21 23:18:05 | 00,000,000 | —D | C] – C:\ProgramData\Electronic Arts
[2009/02/21 23:17:46 | 00,016,522 | —- | C] () – C:\Windows\System32\ealregsnapshot1.reg
[2009/02/21 23:00:20 | 00,000,000 | —D | C] – C:\Program Files\Electronic Arts
[2009/02/19 22:30:13 | 00,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
[2009/02/19 12:31:42 | 00,024,112 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\SymIMV.sys
[2009/02/19 12:31:42 | 00,009,844 | —- | C] () – C:\Windows\System32\drivers\SymRedir.cat
[2009/02/19 12:31:42 | 00,001,611 | —- | C] () – C:\Windows\System32\drivers\SymRedir.inf
[2009/02/19 12:31:18 | 00,041,008 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symndisv.sys
[2009/02/19 12:31:16 | 00,184,496 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symtdi.sys
[2009/02/19 12:31:16 | 00,096,560 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symfw.sys
[2009/02/19 12:31:16 | 00,038,576 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symids.sys
[2009/02/19 12:31:16 | 00,022,320 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symredrv.sys
[2009/02/19 12:31:16 | 00,013,616 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symdns.sys
[2009/02/14 18:40:13 | 00,000,512 | —- | C] () – C:\Users\ROG3ERS\Desktop\0062 - Super Street Fighter II X - Revival (J).sav
[2009/02/10 17:48:28 | 03,580,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.dll
[2009/02/10 17:48:25 | 06,069,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieframe.dll
[2009/02/10 17:48:21 | 01,166,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\urlmon.dll
[2009/02/10 17:48:20 | 00,827,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wininet.dll
[2009/02/10 17:48:20 | 00,458,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2009/02/10 17:48:19 | 00,671,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2009/02/10 17:48:17 | 00,270,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iertutil.dll
[2009/02/10 17:48:16 | 00,028,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2009/02/10 17:48:15 | 01,383,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
========== Files - Modified Within 30 Days ==========
[2009/03/12 15:20:00 | 00,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{6347C2A6-EE0E-45B9-8173-E0CBE179A37B}.job
[2009/03/12 14:50:26 | 00,013,119 | —- | M] () – C:\Users\ROG3ERS\AppData\Roaming\nvModes.dat
[2009/03/12 14:50:26 | 00,013,119 | —- | M] () – C:\Users\ROG3ERS\AppData\Roaming\nvModes.001
[2009/03/12 14:48:12 | 00,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2009/03/12 14:13:43 | 00,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/03/12 14:13:43 | 00,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/03/12 09:50:14 | 00,000,422 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{7CF5D42C-A035-4FAD-8B39-FDECD9F6E8A9}.job
[2009/03/12 07:52:46 | 00,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachine.job
[2009/03/11 19:38:45 | 00,000,311 | —- | M] () – C:\Users\ROG3ERS\Desktop\HLSS 3.00.ini
[2009/03/11 17:36:59 | 00,001,876 | —- | M] () – C:\Users\ROG3ERS\Desktop\HijackThis.lnk
[2009/03/11 04:18:31 | 00,690,960 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2009/03/11 04:18:31 | 00,595,684 | —- | M] () – C:\Windows\System32\perfh009.dat
[2009/03/11 04:18:31 | 00,101,350 | —- | M] () – C:\Windows\System32\perfc009.dat
[2009/03/11 04:14:09 | 00,016,384 | —- | M] () – C:\Windows\System32\Ikeext.etl
[2009/03/11 04:13:25 | 00,325,912 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2009/03/11 04:13:25 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/03/11 04:13:00 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/03/11 04:09:09 | 04,269,570 | -H– | M] () – C:\Users\ROG3ERS\AppData\Local\IconCache.db
[2009/03/09 17:08:36 | 00,082,328 | —- | M] () – C:\Users\ROG3ERS\AppData\Local\GDIPFONTCACHEV1.DAT
[2009/03/09 00:00:05 | 00,000,484 | —- | M] () – C:\Windows\tasks\Norton AntiVirus - Run Full System Scan - ROG3ERS.job
[2009/03/08 15:50:06 | 00,000,794 | —- | M] () – C:\Users\ROG3ERS\Desktop\Garry's Mod.lnk
[2009/03/08 14:26:17 | 00,000,553 | —- | M] () – C:\Users\ROG3ERS\Desktop\GoldWave.lnk
[2009/03/08 03:19:01 | 00,000,993 | —- | M] () – C:\Users\ROG3ERS\Desktop\dBpowerAMP Music Converter.lnk
[2009/03/08 03:18:12 | 00,131,072 | —- | M] () – C:\Windows\System32\SpoonUninstall.exe
[2009/03/08 03:18:12 | 00,036,104 | —- | M] () – C:\Windows\System32\SpoonUninstall-dBpowerAMP Music Converter.dat
[2009/03/08 03:17:41 | 00,033,846 | —- | M] () – C:\Windows\System32\SpoonUninstall-dBpowerAMP Music Converter.bmp
[2009/03/08 01:02:22 | 00,000,932 | —- | M] () – C:\Users\ROG3ERS\Desktop\ESEA Client.lnk
[2009/03/08 00:44:56 | 00,000,816 | —- | M] () – C:\Users\Public\Desktop\WinRAR.lnk
[2009/03/07 20:00:36 | 00,000,750 | —- | M] () – C:\Users\Public\Desktop\mIRC.lnk
[2009/03/05 08:10:37 | 00,000,838 | —- | M] () – C:\Users\ROG3ERS\Desktop\Runescape.url
[2009/03/03 19:41:12 | 00,034,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lhacm.acm
[2009/03/03 19:41:09 | 00,000,789 | —- | M] () – C:\Users\ROG3ERS\Desktop\Teamspeak 2 RC2.lnk
[2009/03/01 00:52:52 | 00,045,387 | —- | M] () – C:\Users\ROG3ERS\Documents\Untitled (9).wma
[2009/03/01 00:50:55 | 00,153,147 | —- | M] () – C:\Users\ROG3ERS\Documents\Untitled (8).wma
[2009/03/01 00:48:00 | 00,099,267 | —- | M] () – C:\Users\ROG3ERS\Documents\Untitled (7).wma
[2009/02/26 21:37:41 | 00,676,656 | —- | M] () – C:\Users\ROG3ERS\Desktop\setup(2).exe
[2009/02/26 21:37:09 | 00,676,656 | —- | M] () – C:\Users\ROG3ERS\Desktop\setup.exe
[2009/02/24 21:20:42 | 00,001,730 | -H– | M] () – C:\Users\ROG3ERS\Documents\Default.rdp
[2009/02/21 23:25:16 | 00,000,926 | —- | M] () – C:\Users\Public\Desktop\EA Download Manager.lnk
[2009/02/21 23:17:46 | 00,016,522 | —- | M] () – C:\Windows\System32\ealregsnapshot1.reg
[2009/02/19 22:30:13 | 00,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
[2009/02/19 12:31:42 | 00,024,112 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\SymIMV.sys
[2009/02/19 12:31:42 | 00,009,844 | —- | M] () – C:\Windows\System32\drivers\SymRedir.cat
[2009/02/19 12:31:42 | 00,001,611 | —- | M] () – C:\Windows\System32\drivers\SymRedir.inf
[2009/02/19 12:31:18 | 00,041,008 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symndisv.sys
[2009/02/19 12:31:16 | 00,184,496 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symtdi.sys
[2009/02/19 12:31:16 | 00,096,560 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symfw.sys
[2009/02/19 12:31:16 | 00,038,576 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symids.sys
[2009/02/19 12:31:16 | 00,022,320 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symredrv.sys
[2009/02/19 12:31:16 | 00,013,616 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symdns.sys
[2009/02/14 23:02:27 | 00,002,877 | —- | M] () – C:\Users\ROG3ERS\Desktop\vba.ini
[2009/02/14 18:40:21 | 00,000,512 | —- | M] () – C:\Users\ROG3ERS\Desktop\0062 - Super Street Fighter II X - Revival (J).sav
========== LOP Check ==========
[2009/03/12 14:48:12 | 00,000,868 | —- | M] () – C:\Windows\Tasks\Google Software Updater.job
[2009/03/12 07:52:46 | 00,000,882 | —- | M] () – C:\Windows\Tasks\GoogleUpdateTaskMachine.job
[2009/03/09 00:00:05 | 00,000,484 | —- | M] () – C:\Windows\Tasks\Norton AntiVirus - Run Full System Scan - ROG3ERS.job
[2009/03/11 04:13:25 | 00,000,006 | -H– | M] () – C:\Windows\Tasks\SA.DAT
[2009/03/11 04:10:15 | 00,032,532 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2009/03/12 15:20:00 | 00,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{6347C2A6-EE0E-45B9-8173-E0CBE179A37B}.job
[2009/03/12 09:50:14 | 00,000,422 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{7CF5D42C-A035-4FAD-8B39-FDECD9F6E8A9}.job
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 32 bytes -> C:\Windows\System32\{661379DB-2FD5-499e-BD64-5E82C00459C0}.uid:DAEBC801-806F4C1F
@Alternate Data Stream - 1150 bytes -> C:\Users\ROG3ERS\Desktop\Runescape.url:favicon
@Alternate Data Stream - 0 bytes -> C:\Program Files\GrassSoft\Mouse Recorder\MacroManager.exe:MGAR
< End of report >
OTListIt2 by OldTimer - Version 2.0.3.5 Folder = C:\Users\ROG3ERS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XKUAZCNT
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1021.71 Mb Total Physical Memory | 293.83 Mb Available Physical Memory | 28.76% Memory free
2.26 Gb Paging File | 1.15 Gb Available in Paging File | 50.97% Paging File free
Paging file location(s): ?:\pagefile.sys;
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 62.48 Gb Total Space | 17.88 Gb Free Space | 28.62% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.28 Gb Free Space | 62.81% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: ROG3ERS-PC
Current User Name: ROG3ERS
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On
========== Processes (SafeList) ==========
PRC - C:\Windows\System32\WLTRYSVC.EXE ()
PRC - C:\Windows\System32\bcmwltry.exe (Dell Inc.)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Windows\system32\dlbccoms.exe ( )
PRC - C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
PRC - c:\program files\grasssoft\mouse recorder\MacroService.exe (Grass Software)
PRC - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions)
PRC - C:\Windows\system32\DRIVERS\xaudio.exe (Conexant Systems, Inc.)
PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
PRC - c:\program files\grasssoft\mouse recorder\MacroServiceWnd.exe (Grass Software)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\Windows\System32\WLTRAY.EXE (Dell Inc.)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Program Files\Common Files\aol\1179968950\ee\aolsoftware.exe (America Online, Inc.)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Windows\sttray.exe (SigmaTel, Inc.)
PRC - C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE (MyWebSearch.com)
PRC - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Program Files\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
PRC - C:\Program Files\NETGEAR\WG111T\wlan111t.exe (NETGEAR)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Internet Explorer\ieuser.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe (Adobe Systems, Inc.)
PRC - C:\Users\ROG3ERS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XKUAZCNT\OTListIt2[1].exe (OldTimer Tools)
========== Win32 Services (SafeList) ==========
SRV - (AOL ACS [On_Demand | Stopped]) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Automatic LiveUpdate Scheduler [Auto | Running]) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccSetMgr [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CLTNetCnService [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (dlbc_device [Auto | Running]) – C:\Windows\system32\dlbccoms.exe ( )
SRV - (DSBrokerService [On_Demand | Stopped]) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (GoogleDesktopManager-061008-081103 [On_Demand | Stopped]) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (gupdate1c98a2a782a6e60 [Auto | Stopped]) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (gusvc [Auto | Stopped]) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (IDriverT [On_Demand | Stopped]) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (LiveUpdate [On_Demand | Stopped]) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (LiveUpdate Notice [Auto | Running]) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (Macro Expert [Auto | Running]) – c:\program files\grasssoft\mouse recorder\MacroService.exe (Grass Software)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (RapiMgr [Auto | Running]) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (RoxMediaDB9 [On_Demand | Stopped]) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (Sonic Solutions)
SRV - (RoxWatch9 [Auto | Running]) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions)
SRV - (Steam Client Service [On_Demand | Running]) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (stllssvr [On_Demand | Stopped]) – C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.)
SRV - (Symantec Core LC [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (Symantec RemoteAssist [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (WcesComm [Auto | Running]) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (WinDefend [Auto | Running]) – C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (wltrysvc [Auto | Running]) – C:\Windows\System32\WLTRYSVC.EXE ()
SRV - (WMPNetworkSvc [On_Demand | Running]) – C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (XAudioService [Auto | Running]) – C:\Windows\system32\DRIVERS\xaudio.exe (Conexant Systems, Inc.)
========== Driver Services (SafeList) ==========
DRV - (adp94xx [Disabled | Stopped]) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (adpahci [Disabled | Stopped]) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (adpu160m [Disabled | Stopped]) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (adpu320 [Disabled | Stopped]) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (AegisP [Auto | Running]) – C:\Windows\system32\DRIVERS\AegisP.sys (Meetinghouse Data Communications)
DRV - (aic78xx [Disabled | Stopped]) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (aliide [Disabled | Stopped]) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (AR5523 [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\WG11TND5.sys (NETGEAR, Inc.)
DRV - (arc [Disabled | Stopped]) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (arcsas [Disabled | Stopped]) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (BCM43XX [On_Demand | Running]) – C:\Windows\system32\DRIVERS\bcmwl6.sys (Broadcom Corporation)
DRV - (bcm4sbxp [On_Demand | Running]) – C:\Windows\system32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (BrFiltLo [On_Demand | Stopped]) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp [On_Demand | Stopped]) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (Brserid [Disabled | Stopped]) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrSerWdm [Disabled | Stopped]) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm [Disabled | Stopped]) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer [On_Demand | Stopped]) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BVRPMPR5 [On_Demand | Stopped]) – C:\Windows\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (cmdide [Disabled | Stopped]) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (COH_Mon [On_Demand | Stopped]) – C:\Windows\system32\Drivers\COH_Mon.sys (Symantec Corporation)
DRV - (DSproct [On_Demand | Stopped]) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (dsunidrv [Auto | Running]) – C:\Program Files\DellSupport\Drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (e1express [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\e1e6032.sys (Intel Corporation)
DRV - (E1G60 [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\E1G60I32.sys (Intel Corporation)
DRV - (eeCtrl [System | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (elxstor [Disabled | Stopped]) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (EraserUtilRebootDrv [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (HpCISSs [Disabled | Stopped]) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (HSF_DPV [On_Demand | Running]) – C:\Windows\system32\DRIVERS\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL [On_Demand | Running]) – C:\Windows\system32\DRIVERS\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (iaStorV [Disabled | Stopped]) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (IDSvix86 [System | Running]) – C:\ProgramData\Symantec\Definitions\SymcData\ipsdefs\20090310.004\IDSvix86.sys (Symantec Corporation)
DRV - (iirsp [Disabled | Stopped]) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (iteatapi [Disabled | Stopped]) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (iteraid [Disabled | Stopped]) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (LSI_FC [Disabled | Stopped]) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (LSI_SAS [Disabled | Stopped]) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (LSI_SCSI [Disabled | Stopped]) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (mdmxsdk [Auto | Running]) – C:\Windows\system32\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (megasas [Disabled | Stopped]) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Mraid35x [Disabled | Stopped]) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (NAVENG [On_Demand | Running]) – C:\ProgramData\Symantec\Definitions\VirusDefs\20090311.049\NAVENG.SYS (Symantec Corporation)
DRV - (NAVEX15 [On_Demand | Running]) – C:\ProgramData\Symantec\Definitions\VirusDefs\20090311.049\NAVEX15.SYS (Symantec Corporation)
DRV - (nfrd960 [Disabled | Stopped]) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (ntrigdigi [Disabled | Stopped]) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (nvlddmkm [On_Demand | Running]) – C:\Windows\system32\DRIVERS\nvlddmkm.sys (NVIDIA Corporation)
DRV - (nvraid [Disabled | Stopped]) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor [Disabled | Stopped]) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (PxHelp20 [Boot | Running]) – C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ql2300 [Disabled | Stopped]) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (ql40xx [Disabled | Stopped]) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (R300 [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\atikmdag.sys (ATI Technologies Inc.)
DRV - (rimmptsk [Auto | Running]) – C:\Windows\system32\DRIVERS\rimmptsk.sys (REDC)
DRV - (rimsptsk [Auto | Running]) – C:\Windows\system32\DRIVERS\rimsptsk.sys (REDC)
DRV - (rismxdp [Auto | Running]) – C:\Windows\system32\DRIVERS\rixdptsk.sys (REDC)
DRV - (secdrv [Auto | Running]) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SiSRaid2 [Disabled | Stopped]) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (SiSRaid4 [Disabled | Stopped]) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (SPBBCDrv [System | Running]) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SRTSP [System | Running]) – C:\Windows\System32\Drivers\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPL [On_Demand | Stopped]) – C:\Windows\System32\Drivers\SRTSPL.SYS (Symantec Corporation)
DRV - (SRTSPX [System | Running]) – C:\Windows\System32\Drivers\SRTSPX.SYS (Symantec Corporation)
DRV - (STHDA [On_Demand | Running]) – C:\Windows\system32\drivers\stwrt.sys (SigmaTel, Inc.)
DRV - (Symc8xx [Disabled | Stopped]) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (SYMDNS [On_Demand | Running]) – C:\Windows\System32\Drivers\SYMDNS.SYS (Symantec Corporation)
DRV - (SymEvent [On_Demand | Running]) – C:\Windows\system32\Drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMFW [On_Demand | Running]) – C:\Windows\System32\Drivers\SYMFW.SYS (Symantec Corporation)
DRV - (SymIM [System | Running]) – C:\Windows\system32\DRIVERS\SymIMv.sys (Symantec Corporation)
DRV - (SYMNDISV [On_Demand | Running]) – C:\Windows\System32\Drivers\SYMNDISV.SYS (Symantec Corporation)
DRV - (SYMREDRV [On_Demand | Running]) – C:\Windows\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMTDI [System | Running]) – C:\Windows\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (Sym_hi [Disabled | Stopped]) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Sym_u3 [Disabled | Stopped]) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (SynTP [On_Demand | Running]) – C:\Windows\system32\DRIVERS\SynTP.sys (Synaptics, Inc.)
DRV - (uliahci [Disabled | Stopped]) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (UlSata [Disabled | Stopped]) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (ulsata2 [Disabled | Stopped]) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (usbaudio [On_Demand | Stopped]) – C:\Windows\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (USB_RNDIS_VISTA [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\usb8023.sys (Microsoft Corporation)
DRV - (viaide [Disabled | Stopped]) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (vsmraid [Disabled | Stopped]) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (wanatw [On_Demand | Running]) – C:\Windows\system32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (winachsf [On_Demand | Running]) – C:\Windows\system32\DRIVERS\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (winusb [On_Demand | Stopped]) – C:\Windows\system32\DRIVERS\winusb.sys (Microsoft Corporation)
DRV - (XAudio [Auto | Running]) – C:\Windows\system32\DRIVERS\xaudio.sys (Conexant Systems, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - presf.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758} -> %ProgramFiles%\REAL\REALPLAYER\BROWSERRECORD [C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD] -> [2008/05/27 11:59:18 00,000,000 | —D | M]
FF - C:\Users\ROG3ERS\AppData\Roaming\mozilla\Extensions [2009/03/08 03:00:22 00,000,000 | —D | M]
FF - C:\Users\ROG3ERS\AppData\Roaming\mozilla\Extensions\[removed] [2009/03/08 03:00:22 00,000,000 | —D | M]
FF - C:\Users\ROG3ERS\AppData\Roaming\mozilla\Firefox\Profiles\qxlqo05a.default\extensions [2009/02/07 17:13:43 00,000,000 | —D | M]
FF - C:\Users\ROG3ERS\AppData\Roaming\mozilla\Firefox\Profiles\qxlqo05a.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2008/12/10 13:31:28 00,000,000 | —D | M]
FF - C:\Program Files\mozilla firefox\extensions [2009/03/08 16:39:56 00,000,000 | —D | M]
FF - C:\Program Files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2008/05/27 11:56:39 00,000,000 | —D | M]
FF - C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} [2008/11/05 22:29:56 00,000,000 | —D | M]
O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - Reg Error: Key error. File not found
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! ¤u¨ã¦C) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe (Dell Inc.)
O4 - HKLM..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" (Symantec Corporation)
O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\PhotoDownloader.exe File not found
O4 - HKLM..\Run: [DNS7reminder] "C:\Program Files\Nuance\NaturallySpeaking9\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking9\Ereg.ini (Nuance Communications, Inc.)
O4 - HKLM..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup (Google)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1179968950\ee\AOLSoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start (InstallShield Software Corporation)
O4 - HKLM..\Run: [Macro Manager] C:\Program Files\GrassSoft\Mouse Recorder\MacroManager.exe /q (GrassSoftware)
O4 - HKLM..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w (MyWebSearch.com)
O4 - HKLM..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF (MyWebSearch.com)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart (NVIDIA Corporation)
O4 - HKLM..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe" (CyberLink Corp.)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" ()
O4 - HKLM..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup (InstallShield Software Corporation)
O4 - HKCU..\Run: [MSServer] rundll32.exe C:\Users\ROG3ERS\AppData\Local\Temp\urqPHYOi.dll,#1 File not found
O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (Microsoft Corporation)
O4 - HKCU..\Run: [Steam] "c:\program files\steam\steam.exe" -silent (Valve Corporation)
O4 - HKCU..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [@%SystemRoot%\system32\nlasvc.dll,-1000] - C:\Windows\system32\NLAapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [@%SystemRoot%\system32\napinsp.dll,-1000] - C:\Windows\system32\napinsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [@%SystemRoot%\system32\pnrpnsp.dll,-1000] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [@%SystemRoot%\system32\pnrpnsp.dll,-1001] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([www] * in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.1.cab (Reg Error: Key error.)
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} http://www.acclaim.com/cabs/acclaim_v5.cab (GameLauncher Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\autoexec.bat () - [ NTFS ]
========== Files/Folders - Created Within 30 Days ==========
[2009/03/12 15:02:28 | 00,000,000 | —D | C] – C:\BFU
[2009/03/12 14:58:35 | 00,081,408 | —- | C] (Soeperman Enterprises Ltd.) – C:\Users\ROG3ERS\Desktop\BFU.exe
[2009/03/11 17:36:59 | 00,001,876 | —- | C] () – C:\Users\ROG3ERS\Desktop\HijackThis.lnk
[2009/03/11 17:36:57 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/03/10 21:59:50 | 10,622,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmp.dll
[2009/03/10 21:59:44 | 00,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwmp.dll
[2009/03/10 21:59:44 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdxm.ocx
[2009/03/10 21:59:44 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxmasf.dll
[2009/03/10 21:59:42 | 08,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2009/03/10 21:59:34 | 00,268,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schannel.dll
[2009/03/10 21:58:45 | 02,033,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2009/03/10 17:52:59 | 00,000,000 | -HSD | C] – C:\Config.Msi
[2009/03/08 15:50:06 | 00,000,794 | —- | C] () – C:\Users\ROG3ERS\Desktop\Garry's Mod.lnk
[2009/03/08 14:26:17 | 00,000,553 | —- | C] () – C:\Users\ROG3ERS\Desktop\GoldWave.lnk
[2009/03/08 03:23:06 | 00,000,311 | —- | C] () – C:\Users\ROG3ERS\Desktop\HLSS 3.00.ini
[2009/03/08 03:19:01 | 00,000,993 | —- | C] () – C:\Users\ROG3ERS\Desktop\dBpowerAMP Music Converter.lnk
[2009/03/08 03:18:12 | 00,131,072 | —- | C] () – C:\Windows\System32\SpoonUninstall.exe
[2009/03/08 03:18:12 | 00,036,104 | —- | C] () – C:\Windows\System32\SpoonUninstall-dBpowerAMP Music Converter.dat
[2009/03/08 03:18:12 | 00,033,846 | —- | C] () – C:\Windows\System32\SpoonUninstall-dBpowerAMP Music Converter.bmp
[2009/03/08 03:17:51 | 00,000,000 | —D | C] – C:\Program Files\Illustrate
[2009/03/08 03:17:18 | 02,510,572 | —- | C] () – C:\Users\ROG3ERS\Desktop\gwave520.exe
[2009/03/08 03:16:58 | 00,723,456 | —- | C] (None) – C:\Users\ROG3ERS\Desktop\HLSS 3.00.exe
[2009/03/08 03:01:29 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\Documents\LimeWire
[2009/03/08 02:59:10 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\LimeWire
[2009/03/08 01:40:06 | 00,000,000 | —D | C] – C:\Program Files\GoldWave
[2009/03/08 00:46:11 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\WinRAR
[2009/03/08 00:44:56 | 00,000,816 | —- | C] () – C:\Users\Public\Desktop\WinRAR.lnk
[2009/03/08 00:44:46 | 00,000,000 | —D | C] – C:\Program Files\WinRAR
[2009/03/07 20:00:36 | 00,000,750 | —- | C] () – C:\Users\Public\Desktop\mIRC.lnk
[2009/03/07 20:00:35 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\mIRC
[2009/03/07 20:00:33 | 00,000,000 | —D | C] – C:\Program Files\mIRC
[2009/03/03 19:41:29 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\teamspeak2
[2009/03/03 19:41:12 | 00,034,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lhacm.acm
[2009/03/03 19:41:09 | 00,000,789 | —- | C] () – C:\Users\ROG3ERS\Desktop\Teamspeak 2 RC2.lnk
[2009/03/03 19:41:03 | 00,000,000 | —D | C] – C:\Program Files\Teamspeak2_RC2
[2009/03/01 00:52:25 | 00,045,387 | —- | C] () – C:\Users\ROG3ERS\Documents\Untitled (9).wma
[2009/03/01 00:50:54 | 00,153,147 | —- | C] () – C:\Users\ROG3ERS\Documents\Untitled (8).wma
[2009/03/01 00:47:59 | 00,099,267 | —- | C] () – C:\Users\ROG3ERS\Documents\Untitled (7).wma
[2009/02/28 20:09:47 | 00,000,838 | —- | C] () – C:\Users\ROG3ERS\Desktop\Runescape.url
[2009/02/27 18:23:26 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Blizzard Entertainment
[2009/02/26 21:37:32 | 00,676,656 | —- | C] () – C:\Users\ROG3ERS\Desktop\setup(2).exe
[2009/02/26 21:36:56 | 00,676,656 | —- | C] () – C:\Users\ROG3ERS\Desktop\setup.exe
[2009/02/21 23:41:51 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\Documents\My Spore Creations
[2009/02/21 23:40:53 | 00,000,000 | —D | C] – C:\Users\ROG3ERS\AppData\Roaming\SPORE
[2009/02/21 23:40:12 | 00,000,000 | RH-D | C] – C:\Users\ROG3ERS\AppData\Roaming\SecuROM
[2009/02/21 23:19:55 | 02,319,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_27.dll
[2009/02/21 23:18:19 | 00,000,926 | —- | C] () – C:\Users\Public\Desktop\EA Download Manager.lnk
[2009/02/21 23:18:05 | 00,000,000 | —D | C] – C:\ProgramData\Electronic Arts
[2009/02/21 23:17:46 | 00,016,522 | —- | C] () – C:\Windows\System32\ealregsnapshot1.reg
[2009/02/21 23:00:20 | 00,000,000 | —D | C] – C:\Program Files\Electronic Arts
[2009/02/19 22:30:13 | 00,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
[2009/02/19 12:31:42 | 00,024,112 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\SymIMV.sys
[2009/02/19 12:31:42 | 00,009,844 | —- | C] () – C:\Windows\System32\drivers\SymRedir.cat
[2009/02/19 12:31:42 | 00,001,611 | —- | C] () – C:\Windows\System32\drivers\SymRedir.inf
[2009/02/19 12:31:18 | 00,041,008 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symndisv.sys
[2009/02/19 12:31:16 | 00,184,496 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symtdi.sys
[2009/02/19 12:31:16 | 00,096,560 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symfw.sys
[2009/02/19 12:31:16 | 00,038,576 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symids.sys
[2009/02/19 12:31:16 | 00,022,320 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symredrv.sys
[2009/02/19 12:31:16 | 00,013,616 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\symdns.sys
[2009/02/14 18:40:13 | 00,000,512 | —- | C] () – C:\Users\ROG3ERS\Desktop\0062 - Super Street Fighter II X - Revival (J).sav
[2009/02/10 17:48:28 | 03,580,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.dll
[2009/02/10 17:48:25 | 06,069,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieframe.dll
[2009/02/10 17:48:21 | 01,166,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\urlmon.dll
[2009/02/10 17:48:20 | 00,827,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wininet.dll
[2009/02/10 17:48:20 | 00,458,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2009/02/10 17:48:19 | 00,671,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2009/02/10 17:48:17 | 00,270,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iertutil.dll
[2009/02/10 17:48:16 | 00,028,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2009/02/10 17:48:15 | 01,383,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
========== Files - Modified Within 30 Days ==========
[2009/03/12 15:20:00 | 00,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{6347C2A6-EE0E-45B9-8173-E0CBE179A37B}.job
[2009/03/12 14:50:26 | 00,013,119 | —- | M] () – C:\Users\ROG3ERS\AppData\Roaming\nvModes.dat
[2009/03/12 14:50:26 | 00,013,119 | —- | M] () – C:\Users\ROG3ERS\AppData\Roaming\nvModes.001
[2009/03/12 14:48:12 | 00,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2009/03/12 14:13:43 | 00,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/03/12 14:13:43 | 00,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/03/12 09:50:14 | 00,000,422 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{7CF5D42C-A035-4FAD-8B39-FDECD9F6E8A9}.job
[2009/03/12 07:52:46 | 00,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachine.job
[2009/03/11 19:38:45 | 00,000,311 | —- | M] () – C:\Users\ROG3ERS\Desktop\HLSS 3.00.ini
[2009/03/11 17:36:59 | 00,001,876 | —- | M] () – C:\Users\ROG3ERS\Desktop\HijackThis.lnk
[2009/03/11 04:18:31 | 00,690,960 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2009/03/11 04:18:31 | 00,595,684 | —- | M] () – C:\Windows\System32\perfh009.dat
[2009/03/11 04:18:31 | 00,101,350 | —- | M] () – C:\Windows\System32\perfc009.dat
[2009/03/11 04:14:09 | 00,016,384 | —- | M] () – C:\Windows\System32\Ikeext.etl
[2009/03/11 04:13:25 | 00,325,912 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2009/03/11 04:13:25 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/03/11 04:13:00 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/03/11 04:09:09 | 04,269,570 | -H– | M] () – C:\Users\ROG3ERS\AppData\Local\IconCache.db
[2009/03/09 17:08:36 | 00,082,328 | —- | M] () – C:\Users\ROG3ERS\AppData\Local\GDIPFONTCACHEV1.DAT
[2009/03/09 00:00:05 | 00,000,484 | —- | M] () – C:\Windows\tasks\Norton AntiVirus - Run Full System Scan - ROG3ERS.job
[2009/03/08 15:50:06 | 00,000,794 | —- | M] () – C:\Users\ROG3ERS\Desktop\Garry's Mod.lnk
[2009/03/08 14:26:17 | 00,000,553 | —- | M] () – C:\Users\ROG3ERS\Desktop\GoldWave.lnk
[2009/03/08 03:19:01 | 00,000,993 | —- | M] () – C:\Users\ROG3ERS\Desktop\dBpowerAMP Music Converter.lnk
[2009/03/08 03:18:12 | 00,131,072 | —- | M] () – C:\Windows\System32\SpoonUninstall.exe
[2009/03/08 03:18:12 | 00,036,104 | —- | M] () – C:\Windows\System32\SpoonUninstall-dBpowerAMP Music Converter.dat
[2009/03/08 03:17:41 | 00,033,846 | —- | M] () – C:\Windows\System32\SpoonUninstall-dBpowerAMP Music Converter.bmp
[2009/03/08 01:02:22 | 00,000,932 | —- | M] () – C:\Users\ROG3ERS\Desktop\ESEA Client.lnk
[2009/03/08 00:44:56 | 00,000,816 | —- | M] () – C:\Users\Public\Desktop\WinRAR.lnk
[2009/03/07 20:00:36 | 00,000,750 | —- | M] () – C:\Users\Public\Desktop\mIRC.lnk
[2009/03/05 08:10:37 | 00,000,838 | —- | M] () – C:\Users\ROG3ERS\Desktop\Runescape.url
[2009/03/03 19:41:12 | 00,034,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lhacm.acm
[2009/03/03 19:41:09 | 00,000,789 | —- | M] () – C:\Users\ROG3ERS\Desktop\Teamspeak 2 RC2.lnk
[2009/03/01 00:52:52 | 00,045,387 | —- | M] () – C:\Users\ROG3ERS\Documents\Untitled (9).wma
[2009/03/01 00:50:55 | 00,153,147 | —- | M] () – C:\Users\ROG3ERS\Documents\Untitled (8).wma
[2009/03/01 00:48:00 | 00,099,267 | —- | M] () – C:\Users\ROG3ERS\Documents\Untitled (7).wma
[2009/02/26 21:37:41 | 00,676,656 | —- | M] () – C:\Users\ROG3ERS\Desktop\setup(2).exe
[2009/02/26 21:37:09 | 00,676,656 | —- | M] () – C:\Users\ROG3ERS\Desktop\setup.exe
[2009/02/24 21:20:42 | 00,001,730 | -H– | M] () – C:\Users\ROG3ERS\Documents\Default.rdp
[2009/02/21 23:25:16 | 00,000,926 | —- | M] () – C:\Users\Public\Desktop\EA Download Manager.lnk
[2009/02/21 23:17:46 | 00,016,522 | —- | M] () – C:\Windows\System32\ealregsnapshot1.reg
[2009/02/19 22:30:13 | 00,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
[2009/02/19 12:31:42 | 00,024,112 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\SymIMV.sys
[2009/02/19 12:31:42 | 00,009,844 | —- | M] () – C:\Windows\System32\drivers\SymRedir.cat
[2009/02/19 12:31:42 | 00,001,611 | —- | M] () – C:\Windows\System32\drivers\SymRedir.inf
[2009/02/19 12:31:18 | 00,041,008 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symndisv.sys
[2009/02/19 12:31:16 | 00,184,496 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symtdi.sys
[2009/02/19 12:31:16 | 00,096,560 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symfw.sys
[2009/02/19 12:31:16 | 00,038,576 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symids.sys
[2009/02/19 12:31:16 | 00,022,320 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symredrv.sys
[2009/02/19 12:31:16 | 00,013,616 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\symdns.sys
[2009/02/14 23:02:27 | 00,002,877 | —- | M] () – C:\Users\ROG3ERS\Desktop\vba.ini
[2009/02/14 18:40:21 | 00,000,512 | —- | M] () – C:\Users\ROG3ERS\Desktop\0062 - Super Street Fighter II X - Revival (J).sav
========== LOP Check ==========
[2009/03/12 14:48:12 | 00,000,868 | —- | M] () – C:\Windows\Tasks\Google Software Updater.job
[2009/03/12 07:52:46 | 00,000,882 | —- | M] () – C:\Windows\Tasks\GoogleUpdateTaskMachine.job
[2009/03/09 00:00:05 | 00,000,484 | —- | M] () – C:\Windows\Tasks\Norton AntiVirus - Run Full System Scan - ROG3ERS.job
[2009/03/11 04:13:25 | 00,000,006 | -H– | M] () – C:\Windows\Tasks\SA.DAT
[2009/03/11 04:10:15 | 00,032,532 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2009/03/12 15:20:00 | 00,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{6347C2A6-EE0E-45B9-8173-E0CBE179A37B}.job
[2009/03/12 09:50:14 | 00,000,422 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{7CF5D42C-A035-4FAD-8B39-FDECD9F6E8A9}.job
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 32 bytes -> C:\Windows\System32\{661379DB-2FD5-499e-BD64-5E82C00459C0}.uid:DAEBC801-806F4C1F
@Alternate Data Stream - 1150 bytes -> C:\Users\ROG3ERS\Desktop\Runescape.url:favicon
@Alternate Data Stream - 0 bytes -> C:\Program Files\GrassSoft\Mouse Recorder\MacroManager.exe:MGAR
< End of report >
