What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Lack permissions to run and uninstall antivirus software

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
After figuring out that my computer was infected after several google redirects I have downloaded several anti spy wares all of which are telling me that I lack the permissions to run these files which is odd considering I am the administrator. At some point in wantonly clearing out my downloads folder I deleted the google redirect but I still cannot run nor uninstall the anti viruses. I have also cleared out remnants of old programs from the program files. currently installed anti viruses: avast 4.8 pro, Superantispyware, and parts of kasperky internet security 2010 Anti viruses used: Superantispyware (once before it was blocked), Norman, and Malwarebytes ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/09/14 00:44 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: catchme.sys Image Path: C:\ComboFix\catchme.sys Address: 0xB1FBA000 Size: 31744 File Visible: No Signed: - Status: - Name: Combo-Fix.sys Image Path: Combo-Fix.sys Address: 0xF7647000 Size: 60416 File Visible: No Signed: - Status: - Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xB1C72000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF79D3000 Size: 8192 File Visible: No Signed: - Status: - Name: PCI_PNP9876 Image Path: \Driver\PCI_PNP9876 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: PROCEXP90.SYS Image Path: C:\WINDOWS\system32\Drivers\PROCEXP90.SYS Address: 0xF79E9000 Size: 6464 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xB17A9000 Size: 49152 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: spzm.sys Image Path: spzm.sys Address: 0xF74D5000 Size: 1052672 File Visible: No Signed: - Status: - SSDT ——————- #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbd6b8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbd574 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbda52 #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbd14c #: 071 Function Name: NtEnumerateKey Status: Hooked by "spzm.sys" at address 0xf74f4ca4 #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "spzm.sys" at address 0xf74f5032 #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbd64e #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbd08c #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbd0f0 #: 160 Function Name: NtQueryKey Status: Hooked by "spzm.sys" at address 0xf74f510a #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbd76e #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbd72e #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb1dbd8ae ==EOF== DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 0:35:15.26 on Mon 09/14/2009 Internet Explorer: 6.0.2900.5512 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1271.729 [GMT -4:00] AV: avast! antivirus 4.8.1351 [VPS 090913-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0} FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\LogMeIn\x86\RaMaint.exe C:\Program Files\LogMeIn\x86\LogMeIn.exe C:\Program Files\LogMeIn\x86\LMIGuardian.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\LogMeIn\x86\LogMeInSystray.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\DNA\btdna.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\LogMeIn\x86\LMIGuardian.exe C:\Program Files\MagicDisc\MagicDisc.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Administrator\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/ uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe" uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe mRun: [Smapp] c:\program files\analog devices\soundmax\SMTray.exe mRun: [DrvLsnr] c:\program files\analog devices\soundmax\DrvLsnr.exe mRun: [SetRefresh] c:\program files\compaq\setrefresh\\SetRefresh.exe mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

Attachments:

Post #2
Hi Faolin, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

It looks like you ran or tried to run combofix. This is a very powerful tool and should not be used without supervision.

If combofix produced a log please post in your next reply. It can be found at C:\Combofix.txt

The DDS log is incomplete, is that all that was produced in the DDS.txt?

Download and run Win32kDiag:
  • Download Win32kDiag from any of the following locations and save it to your Desktop.
    • Download Win32kDiag (Win32kDiag.exe) - #1
    • Download Win32kDiag (Win32kDiag.exe) - #2
    • Download Win32kDiag (Win32kDiag.exe) - #3
  • Double-click Win32kDiag.exe to run Win32kDiag and let it finish.
  • When it states "Finished! Press any key to exit…", press any key on your keyboard to close the program.
  • Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log as a reply to this topic.
    • To ensure the entire contents are copied, please right click anywhere on the text and choose Select All
    • Right click the highlighted text and select copy
We'll use a different scan tool

Download OTListIt2 to your desktop.
  • Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • Check the boxes beside LOP Check and Purity Check.
  • In the Extra Registry section, set it to None
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window. OTL.Txt This will saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of this file, and post it with your next reply.
Please post back with
  • combofix log if you can find one
  • Win32kDiag.txt
  • OTL log
You may need two posts to fit them all in.
Post #3 last edited
It looks like not all the dds copied so do you want me to upload it next post?

Starting up…
Running from: C:\Documents and Settings\[removed]\Desktop\Win32kDiag.exe
Log file at : C:\Documents and Settings\Administrator\Desktop\Win32kDiag.txt
WARNING: Could not get backup privileges!
Searching 'C:\WINDOWS'…

Found mount point : C:\WINDOWS\addins\addins
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZA
P115.tmp\ZAP115.tmp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\assembly\temp\temp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\assembly\tmp\tmp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Config\Config
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\ime\chsime\applets\applets
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\ime\imejp\applets\applets
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\ime\imejp98\imejp98
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\ime\shared\res\res
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F2
31838AD88BCDDC8E8F7C\3.2.30729\3.2.30729
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3
D2F398A9A6D1762F70F3\2.2.30729\2.2.30729
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\java\classes\classes
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\java\trustlib\trustlib
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporar
y ASP.NET Files\Temporary ASP.NET Files
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\msapps\msinfo\msinfo
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\pchealth\ERRORREP\ERRORREP
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH
Mount point destination : \Device\__max++>\^
Cannot access: C:\WINDOWS\pchealth\helpctr\binaries\helpsvc.exe
[1] 2004-08-04 08:00:00 743936 C:\WINDOWS\$NtServicePackUninstall$\helpsvc.exe (
Microsoft Corporation)
[1] 2008-04-13 20:12:21 744448 C:\WINDOWS\pchealth\helpctr\binaries\helpsvc.exe
()
[1] 2008-04-13 20:12:21 744448 C:\WINDOWS\ServicePackFiles\i386\helpsvc.exe (Mic
rosoft Corporation)

Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoi
nt
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\pchealth\helpctr\Config\News\News
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKU
s
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\PIF\PIF
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Do
wnloaded
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\SoftwareDistribution\Download\c2605fe2baba0
3346e8868859fbe2ead\backup\backup
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\SoftwareDistribution\EventCache\EventCache
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\1025\1025
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\1028\1028
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\1031\1031
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\1037\1037
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\1041\1041
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\1042\1042
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\1054\1054
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\2052\2052
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\3076\3076
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-1960408961-790525
478-682003330-500\S-1-5-21-1960408961-790525478-682003330-500
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application D
ata\Microsoft\Media Player\Media Player
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application D
ata\Microsoft\SystemCertificates\My\Certificates\Certificates
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application D
ata\Microsoft\SystemCertificates\My\CRLs\CRLs
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\Application D
ata\Microsoft\SystemCertificates\My\CTLs\CTLs
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Deskt
op
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\Favorites\Fav
orites
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\
My Documents
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHo
od
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\Pri
ntHood
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\config\systemprofile\Recent\Recent

Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\dhcp\dhcp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\drivers\disdn\disdn
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\export\export
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\IME\CINTLGNT\CINTLGNT
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\IME\PINTLGNT\PINTLGNT
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\IME\TINTLGNT\TINTLGNT
Mount point destination : \Device\__max++>\^
Cannot access: C:\WINDOWS\system32\MRT.exe
[1] 2009-08-28 17:38:20 24689600 C:\WINDOWS\system32\MRT.exe ()

Found mount point : C:\WINDOWS\system32\mui\dispspec\dispspec
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\sample\sample
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\ShellExt\ShellExt
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wbem\mof\bad\bad
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wbem\snmp\snmp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wins\wins
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\xircom\xircom
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp
Mount point destination : \Device\__max++>\^

OTL logfile created on: 9/16/2009 6:46:56 AM - Run 1
OTL by OldTimer - Version 3.0.14.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.24 Gb Total Physical Memory | 0.86 Gb Available Physical Memory | 69.59% Memory free
1.84 Gb Paging File | 1.63 Gb Available in Paging File | 88.46% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.48 Gb Free Space | 49.59% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 446.03 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NONE-34EDF5A8C1
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
PRC - C:\Program Files\TortoiseSVN\bin\TSVNCache.exe (http://tortoisesvn.net)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardian.exe (LogMeIn, Inc.)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)
PRC - C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe (adi)
PRC - C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
PRC - C:\WINDOWS\System32\hkcmd.exe (Intel Corporation)
PRC - C:\WINDOWS\System32\igfxpers.exe (Intel Corporation)
PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
PRC - C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardian.exe (LogMeIn, Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (aswUpdSv [Auto | Running]) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (avast! Antivirus [Auto | Stopped]) – C:\Program Files\Alwil Software\Avast4\ashServ.exe ()
SRV - (avast! Mail Scanner [On_Demand | Stopped]) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner [On_Demand | Stopped]) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (AVP [Auto | Stopped]) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe ()
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) – C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (LMIMaint [Auto | Running]) – C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
SRV - (LogMeIn [Auto | Running]) – C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (SoundMAX Agent Service (default) [Auto | Running]) – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)

========== Driver Services (SafeList) ==========

DRV - (Aavmker4 [System | Running]) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (aeaudio [On_Demand | Running]) – C:\WINDOWS\System32\drivers\aeaudio.sys (Andrea Electronics Corporation)
DRV - (aswFsBlk [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\aswFsBlk.sys (ALWIL Software)
DRV - (aswMon2 [Auto | Running]) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswRdr [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswSP [System | Running]) – C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswTdi [System | Running]) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (b57w2k [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\b57xp32.sys (Broadcom Corporation)
DRV - (Belkin Belkin 11Mbps Wireless USB Network Adapter® [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\bkusbxp.sys (Belkin Components )
DRV - (ctljystk [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\ctljystk.sys (Creative Technology Ltd.)
DRV - (gameenum [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (klmouflt [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\klmouflt.sys (Kaspersky Lab)
DRV - (LMIInfo [Auto | Running]) – C:\Program Files\LogMeIn\x86\RaInfo.sys (LogMeIn, Inc.)
DRV - (lmimirr [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\lmimirr.sys (LogMeIn, Inc.)
DRV - (LMIRfsClientNP [Disabled | Stopped]) – C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (LMIRfsDriver [Auto | Running]) – C:\WINDOWS\System32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (mcdbus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\mcdbus.sys (MagicISO, Inc.)
DRV - (PCANDIS5 [On_Demand | Stopped]) – C:\WINDOWS\System32\PCANDIS5.SYS (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (PfModNT [Auto | Running]) – C:\WINDOWS\System32\drivers\PfModNT.sys (Creative Technology Ltd.)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (SASKUTIL [System | Running]) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (smwdm [On_Demand | Running]) – C:\WINDOWS\System32\drivers\smwdm.sys (Analog Devices, Inc.)
DRV - (sptd [Boot | Running]) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (usbaudio [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (ZD1211BU(ZyDAS) [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\zd1211Bu.sys (ZyDAS Technology Corporation)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1
FF - prefs.js..extensions.enabledItems: [removed]:9.0.0.463
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.3


FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/05 03:00:41 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/09/12 22:46:12 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/09/12 22:46:12 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/09/14 16:34:22 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt

[2009/09/13 19:00:02 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\mozilla\Extensions
[2009/09/13 19:00:02 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/09/16 06:22:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\mozilla\Firefox\Profiles\1easy9a4.default\extensions
[2009/08/05 11:30:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\mozilla\Firefox\Profiles\1easy9a4.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/09/16 06:22:35 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/09/12 22:46:05 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/09/13 12:53:43 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\[removed]
[2009/09/12 22:46:04 | 00,023,544 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/09/12 22:46:04 | 00,137,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/09/12 22:46:06 | 00,065,016 | —- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2009/02/27 12:13:42 | 00,103,792 | —- | M] (Adobe Systems Inc.) – C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2009/09/10 01:23:58 | 00,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2009/09/10 01:23:58 | 00,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2009/09/10 01:23:59 | 00,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2009/09/10 01:23:59 | 00,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2009/09/10 01:23:59 | 00,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2009/09/10 01:23:59 | 00,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2009/09/10 01:23:59 | 00,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2009/07/15 14:10:00 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/07/15 14:10:00 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/07/15 14:10:00 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/07/15 14:10:00 | 00,002,344 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/07/15 14:10:00 | 00,002,371 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/07/15 14:10:00 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [DNS7reminder] C:\Program Files\Nuance\NaturallySpeaking9\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe (adi)
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SetRefresh] C:\Program Files\COMPAQ\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe ()
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\System32\klogon.dll (Kaspersky Lab)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/03/18 14:10:57 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/08/16 21:23:47 | 00,000,047 | R— | M] () - F:\AUTORUN.INF – [ CDFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/09/15 07:35:56 | 00,514,560 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2009/09/15 07:35:48 | 00,047,616 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Win32kDiag.exe
[2009/09/13 22:48:03 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/09/13 22:46:32 | 00,000,611 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2009/09/13 22:46:32 | 00,000,592 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2009/09/13 22:46:32 | 00,000,000 | —D | C] – C:\Program Files\ERUNT
[2009/09/13 22:34:30 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/09/13 21:25:27 | 00,000,210 | —- | C] () – C:\Boot.bak
[2009/09/13 21:25:24 | 00,260,272 | —- | C] () – C:\cmldr
[2009/09/13 21:25:22 | 00,000,000 | RHSD | C] – C:\cmdcons
[2009/09/13 21:22:39 | 00,229,888 | —- | C] () – C:\WINDOWS\PEV.exe
[2009/09/13 21:22:39 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/09/13 21:22:39 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/09/13 21:22:39 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/09/13 21:22:39 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/09/13 21:22:39 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/09/13 21:22:39 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/09/13 21:22:39 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/09/13 21:22:34 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2009/09/13 21:20:22 | 00,000,000 | —D | C] – C:\Qoobox
[2009/09/13 21:08:51 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2009/09/13 21:08:49 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/13 21:08:47 | 00,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/09/13 21:08:45 | 00,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/09/13 21:08:45 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/13 21:08:45 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/09/13 21:05:25 | 00,000,684 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2009/09/13 21:05:02 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2009/09/13 21:02:03 | 00,000,000 | —D | C] – C:\Config.Msi
[2009/09/13 19:59:45 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2009/09/13 19:59:36 | 00,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2009/09/13 19:59:36 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
[2009/09/13 19:47:23 | 00,001,638 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HijackThis.lnk
[2009/09/13 19:47:22 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/09/13 16:22:16 | 00,023,152 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2009/09/13 16:22:16 | 00,001,709 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Antivirus.lnk
[2009/09/13 16:22:15 | 00,051,376 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2009/09/13 16:22:14 | 00,026,944 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2009/09/13 16:22:12 | 00,114,768 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2009/09/13 16:22:12 | 00,097,480 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\AvastSS.scr
[2009/09/13 16:22:12 | 00,020,560 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009/09/13 16:22:11 | 00,094,160 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2009/09/13 16:22:11 | 00,093,392 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2009/09/13 16:21:51 | 01,279,456 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2009/09/13 16:21:51 | 00,380,928 | —- | C] () – C:\WINDOWS\System32\actskin4.ocx
[2009/09/13 14:35:45 | 00,000,917 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Revo Uninstaller.lnk
[2009/09/13 14:35:45 | 00,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2009/09/13 12:57:06 | 00,604,140 | -HS- | C] () – C:\WINDOWS\System32\drivers\ISwift3.dat
[2009/09/13 12:32:32 | 00,000,000 | —D | C] – C:\Program Files\Kaspersky Lab
[2009/09/13 12:32:05 | 00,296,976 | —- | C] (Kaspersky Lab) – C:\WINDOWS\System32\drivers\klif.sys
[2009/09/12 12:26:41 | 00,000,000 | -H-D | C] – C:\WINDOWS\PIF
[2009/09/12 11:43:50 | 00,107,547 | —- | C] () – C:\WINDOWS\System32\drivers\klin.dat
[2009/09/12 11:43:50 | 00,095,259 | —- | C] () – C:\WINDOWS\System32\drivers\klick.dat
[2009/09/10 01:26:31 | 00,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/09/10 01:25:30 | 00,000,000 | —D | C] – C:\Program Files\iPod
[2009/09/10 01:25:26 | 00,000,000 | —D | C] – C:\Program Files\iTunes
[2009/09/10 01:25:26 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/09/10 01:23:19 | 00,000,000 | —D | C] – C:\Program Files\QuickTime
[2009/09/09 22:35:35 | 00,153,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\triedit.dll
[2009/09/08 02:40:04 | 01,060,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MFC71.dll
[2009/09/08 02:40:04 | 00,499,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSVCP71.dll
[2009/09/08 02:40:04 | 00,348,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSVCR71.dll
[2009/09/08 02:40:02 | 00,000,000 | —D | C] – C:\Program Files\Alwil Software
[2009/09/07 19:45:06 | 00,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2009/09/07 17:18:59 | 00,299,008 | —- | C] (Koyote Soft - http://www.koyotesoft.com) – C:\WINDOWS\System32\TubeFinder.exe
[2009/09/07 17:18:58 | 00,208,500 | —- | C] () – C:\WINDOWS\System32\ReyXpBasics.tlb
[2009/09/07 17:18:58 | 00,119,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\VB6FR.DLL
[2009/09/07 17:18:58 | 00,101,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\VB6STKIT.DLL
[2009/09/07 17:18:57 | 00,364,544 | —- | C] () – C:\WINDOWS\System32\PropertyGrid.ocx
[2009/09/07 17:18:57 | 00,152,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\COMDLG32.OCX
[2009/09/07 17:18:57 | 00,141,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSCMCFR.DLL
[2009/09/07 17:18:57 | 00,084,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\PICCLP32.OCX
[2009/09/07 17:18:57 | 00,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\CMDLGFR.DLL
[2009/09/07 17:18:57 | 00,024,576 | —- | C] () – C:\WINDOWS\System32\ControlSubX.ocx
[2009/09/07 17:18:57 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\PCCLPFR.DLL
[2009/09/05 01:54:48 | 00,094,208 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\QuickTimeVR.qtx
[2009/09/05 01:54:48 | 00,069,632 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\QuickTime.qts
[2009/09/03 11:40:39 | 00,268,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2009/09/03 11:40:39 | 00,208,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\muweb.dll
[2009/09/03 11:40:39 | 00,027,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2009/09/02 18:09:47 | 00,000,000 | —D | C] – C:\Program Files\Microsoft
[2009/09/02 18:09:33 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\microsoft
[2009/09/02 18:09:26 | 00,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2009/09/02 18:09:01 | 00,000,000 | —D | C] – C:\Program Files\Windows Live
[2009/09/02 18:03:26 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2009/09/01 00:55:40 | 00,091,648 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Thermal Limit of the Integrated Circuit and Preventing Thermal Damage.doc
[2009/08/31 23:21:07 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/08/31 23:20:41 | 00,001,725 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2009/08/31 23:20:07 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Designer
[2009/08/31 23:19:42 | 00,000,000 | —D | C] – C:\WINDOWS\ShellNew
[2009/08/31 23:18:42 | 00,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2009/08/31 23:18:42 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Microsoft Web Folders
[2009/08/31 20:27:36 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities
[2009/08/30 15:28:28 | 00,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2009/08/30 14:06:24 | 00,000,643 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Belkin USB WLAN Monitor.lnk
[2009/08/30 13:44:51 | 00,045,056 | —- | C] (Northern Codeworks) – C:\WINDOWS\NCUNINST.EXE
[2009/08/30 13:42:41 | 00,462,848 | —- | C] (Belkin Components) – C:\WINDOWS\System32\monitorbk.exe
[2009/08/30 13:42:41 | 00,101,099 | —- | C] (Belkin Components ) – C:\WINDOWS\System32\drivers\bkusbxp.sys
[2009/08/30 13:42:41 | 00,073,728 | —- | C] () – C:\WINDOWS\System32\install.dll
[2009/08/30 13:42:41 | 00,061,440 | —- | C] (Printing Communications Assoc., Inc. (PCAUSA)) – C:\WINDOWS\System32\w32n50.dll
[2009/08/30 13:42:41 | 00,036,864 | —- | C] () – C:\WINDOWS\System32\WRLSetup.exe
[2009/08/30 13:42:41 | 00,016,068 | —- | C] (Printing Communications Assoc., Inc. (PCAUSA)) – C:\WINDOWS\System32\pcandis5.sys
[2009/08/30 13:42:41 | 00,011,847 | —- | C] () – C:\WINDOWS\System32\monitorbk.hlp
[2009/08/30 13:42:41 | 00,000,141 | —- | C] () – C:\WINDOWS\filespec
[2009/08/30 13:42:41 | 00,000,000 | —- | C] () – C:\WINDOWS\bkusb.cat
[2009/08/30 13:42:10 | 00,000,000 | —D | C] – C:\Program Files\Belkin
[2009/08/30 13:41:27 | 00,000,000 | —D | C] – C:\Program Files\Common Files\SWF Studio
[2009/08/30 13:41:24 | 00,000,000 | —D | C] – C:\Belkin
[2009/08/30 13:39:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\U3
[2009/08/30 11:39:48 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Scansoft
[2009/08/29 19:15:33 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\InstallShield
[2009/08/29 19:15:19 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Nuance
[2009/08/29 19:15:10 | 00,001,967 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Dragon NaturallySpeaking 9.5.lnk
[2009/08/29 19:06:35 | 00,000,000 | —D | C] – C:\Program Files\Common Files\ScanSoft Shared
[2009/08/29 19:06:35 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2009/08/29 19:06:33 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Nuance
[2009/08/29 19:05:58 | 00,000,000 | —D | C] – C:\Program Files\Nuance
[2009/08/29 19:05:58 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nuance
[2009/08/29 19:05:49 | 00,000,000 | —D | C] – C:\WINDOWS\speech
[2009/08/29 19:01:39 | 00,060,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\USBAUDIO.sys
[2009/08/29 19:01:39 | 00,060,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbaudio.sys
[2009/08/29 17:28:08 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\New Folder
[2009/08/28 06:28:31 | 01,081,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mscomctl.ocx
[2009/08/28 06:16:41 | 00,000,000 | —D | C] – C:\Program Files\FLAC
[2009/08/28 06:15:14 | 00,001,525 | —- | C] () – C:\Documents and Settings\All Users\Desktop\FLAC Frontend.lnk
[2009/08/27 15:44:49 | 00,000,076 | —- | C] () – C:\WINDOWS\cc.ini
[2009/08/27 00:15:13 | 00,304,128 | —- | C] (InstallShield Software Corporation) – C:\WINDOWS\IsUninst.exe
[2009/08/23 00:14:58 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\Snes RPG-Adventure Pack01
[2009/08/18 23:45:51 | 00,140,800 | —- | C] (The Duck Corporation) – C:\WINDOWS\System32\tm20dec.ax
[2009/08/18 23:45:51 | 00,038,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\LMRTREND.dll
[2009/08/18 23:45:49 | 00,182,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dxtmsft3.dll
[2009/08/18 23:45:48 | 00,063,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\unam4ie.exe
[2009/08/18 23:45:46 | 00,194,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qcut.dll
[2009/08/18 23:45:46 | 00,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mciqtz.drv
[2009/08/18 23:45:46 | 00,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2009/08/18 23:45:46 | 00,005,672 | —- | C] () – C:\WINDOWS\System32\quartz.vxd
[2009/08/18 23:45:44 | 00,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\w95inf32.dll
[2009/08/18 23:45:44 | 00,002,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\w95inf16.dll
[2009/08/17 23:00:21 | 00,000,000 | —D | C] – C:\KID
[2009/08/17 23:00:01 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro
[2009/08/16 22:01:37 | 00,721,904 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2009/03/19 17:37:16 | 00,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2009/03/19 17:37:15 | 00,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2009/03/19 17:37:15 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2009/03/19 17:37:15 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2009/03/19 17:37:15 | 00,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2009/03/19 17:37:15 | 00,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2009/03/19 17:34:04 | 00,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2004/08/04 08:00:00 | 00,000,594 | —- | C] () – C:\WINDOWS\win.ini
[2004/08/04 08:00:00 | 00,000,435 | —- | C] () – C:\WINDOWS\system.ini
[2003/11/16 05:48:02 | 00,909,312 | —- | C] () – C:\WINDOWS\System32\vorbisenc.dll
[2003/11/16 05:48:00 | 01,060,864 | —- | C] () – C:\WINDOWS\System32\vorbis.dll
[2003/11/15 12:54:18 | 00,036,864 | —- | C] () – C:\WINDOWS\System32\ogg.dll
[2002/10/06 18:42:58 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\OggDS.dll

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/09/16 06:12:32 | 00,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/09/16 06:11:16 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/09/16 06:11:05 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/09/15 07:35:58 | 00,514,560 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2009/09/15 07:35:48 | 00,047,616 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Win32kDiag.exe
[2009/09/14 02:12:36 | 00,229,888 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/09/13 22:46:32 | 00,000,611 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2009/09/13 22:46:32 | 00,000,592 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2009/09/13 22:29:41 | 00,000,435 | —- | M] () – C:\WINDOWS\system.ini
[2009/09/13 22:29:16 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/09/13 21:25:27 | 00,000,281 | RHS- | M] () – C:\boot.ini
[2009/09/13 21:11:54 | 00,014,336 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/13 21:08:49 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/13 21:05:50 | 00,001,638 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HijackThis.lnk
[2009/09/13 21:05:25 | 00,000,684 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2009/09/13 18:50:29 | 00,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2009/09/13 18:43:17 | 00,083,288 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\System32\LMIRfsClientNP.dll
[2009/09/13 18:43:16 | 00,028,984 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\System32\LMIport.dll
[2009/09/13 18:43:16 | 00,025,248 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\System32\lmimirr.dll
[2009/09/13 18:43:16 | 00,011,552 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\System32\lmimirr2.dll
[2009/09/13 18:43:15 | 00,087,352 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\System32\LMIinit.dll
[2009/09/13 18:36:29 | 06,946,230 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2009/09/13 18:36:20 | 00,001,709 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Antivirus.lnk
[2009/09/13 14:35:45 | 00,000,917 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Revo Uninstaller.lnk
[2009/09/13 13:02:25 | 00,107,547 | —- | M] () – C:\WINDOWS\System32\drivers\klin.dat
[2009/09/13 13:02:25 | 00,095,259 | —- | M] () – C:\WINDOWS\System32\drivers\klick.dat
[2009/09/13 12:57:06 | 00,604,140 | -HS- | M] () – C:\WINDOWS\System32\drivers\ISwift3.dat
[2009/09/12 23:19:37 | 00,001,917 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/09/12 14:19:47 | 00,010,854 | —- | M] () – C:\WINDOWS\gloria.dat
[2009/09/10 14:54:06 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/09/10 14:53:50 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/09/10 01:26:31 | 00,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/09/09 19:44:02 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/09/08 05:39:51 | 00,114,176 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/09/05 01:54:48 | 00,094,208 | —- | M] (Apple Inc.) – C:\WINDOWS\System32\QuickTimeVR.qtx
[2009/09/05 01:54:48 | 00,069,632 | —- | M] (Apple Inc.) – C:\WINDOWS\System32\QuickTime.qts
[2009/09/02 18:11:38 | 00,016,880 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/09/01 03:07:45 | 00,091,648 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Thermal Limit of the Integrated Circuit and Preventing Thermal Damage.doc
[2009/08/31 23:21:07 | 00,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2009/08/31 23:20:44 | 00,000,594 | —- | M] () – C:\WINDOWS\win.ini
[2009/08/31 23:20:41 | 00,001,725 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2009/08/30 14:10:24 | 00,045,056 | —- | M] (Northern Codeworks) – C:\WINDOWS\NCUNINST.EXE
[2009/08/30 14:06:24 | 00,000,643 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Belkin USB WLAN Monitor.lnk
[2009/08/29 19:15:10 | 00,001,967 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Dragon NaturallySpeaking 9.5.lnk
[2009/08/28 17:38:20 | 24,689,600 | —- | M] () – C:\WINDOWS\System32\MRT.exe
[2009/08/28 06:16:42 | 00,001,525 | —- | M] () – C:\Documents and Settings\All Users\Desktop\FLAC Frontend.lnk
[2009/08/27 15:44:49 | 00,000,076 | —- | M] () – C:\WINDOWS\cc.ini
[2009/08/22 00:22:22 | 00,488,794 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/08/22 00:22:22 | 00,432,686 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/08/22 00:22:22 | 00,067,516 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/08/19 03:36:20 | 00,299,008 | —- | M] (Koyote Soft - http://www.koyotesoft.com) – C:\WINDOWS\System32\TubeFinder.exe
[2009/08/18 23:45:48 | 00,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2009/08/18 23:45:48 | 00,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2009/08/18 23:45:43 | 00,004,608 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\w95inf32.dll
[2009/08/18 23:45:43 | 00,002,272 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\w95inf16.dll
[2009/08/17 12:10:20 | 01,279,456 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2009/08/17 12:06:54 | 00,093,392 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2009/08/17 12:06:43 | 00,094,160 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2009/08/17 12:05:52 | 00,114,768 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2009/08/17 12:05:37 | 00,020,560 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009/08/17 12:04:40 | 00,051,376 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2009/08/17 12:04:29 | 00,023,152 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2009/08/17 12:03:21 | 00,026,944 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2009/08/17 12:02:50 | 00,097,480 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\AvastSS.scr

========== LOP Check ==========

[2009/09/13 21:08:51 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Administrator\Application Data
[2009/08/05 16:01:41 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\CoreCodec
[2009/08/17 23:02:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Lite
[2009/08/17 23:00:01 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro
[2009/09/16 06:42:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DNA
[2009/08/03 18:17:23 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\InterVideo
[2009/08/29 19:15:19 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Nuance
[2009/08/03 08:23:25 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Administrator\Application Data\SecuROM
[2009/08/04 23:52:43 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Subversion
[2009/08/04 23:23:28 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Thunderbird
[2009/08/04 23:54:24 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\TortoiseSVN
[2009/09/01 03:09:18 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\U3
[2009/09/13 20:31:25 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2009/09/13 21:08:45 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2009/09/10 01:26:20 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/08/16 17:27:14 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/08/16 22:05:21 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2009/08/14 13:37:17 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LogMeIn
[2009/08/29 19:05:58 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nuance
[2009/08/29 19:06:35 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2009/09/09 19:44:02 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2004/08/04 08:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/09/16 06:11:16 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========


< End of report >

Attachments:

Post #4
Hi Faolin,

Don't worry about the DDS log for now. Please do not attach the logs unless requested to.

We'll use win32kdiag again but run it with a command. Please ensure that is on your desktop.

Click your Start button, click Run. Copy and paste the following line into the run box and click OK:

"%userprofile%\desktop\win32kdiag.exe" -f -r

This will start win32kdiag again. Please wait for the program to finish. Copy and paste the contents of the resulting log into your next reply.

Can you now open the programs you previously had lack the permissions for?

Thanks
Post #6 last edited
Hi Faolin,

Please look on your desktop for a file called Win32kDiag.txt. If you find it, please copy and paste the contents in your next reply. If you can't locate it, please re-run the program with the previous instructions and post the log.

Please download this Inherit by sUBs and save it to your Desktop.
  • Open Windows Explorer and locate the primary .exe of each program you are unable to run.
  • If you used the default installation, they should all be in the C:\Program Files folder.
  • Copy and paste Inherit.exe to the same directory where the file(s) are located.
  • Then drag the program .exe onto Inherit.exe and wait for it to say "OK".
  • When finished click OK.
  • You may then remove Inherit.exe from that directory and move it to the next where you can repeat the "drag & drop" instructions.
For example, for Superantispyware,
  • first, right click on inherit.exe and select copy
  • Open Windows Explorer (right click the Start button and choose Explore) and navigate to this folder
    c:\program files\superantispyware
  • Right click on the folder and select paste
  • Open the folder
  • In the right hand panel, locate SUPERAntiSpyware.exe
  • Left click on SUPERAntiSpyware.exe
  • Holding the left mouse button down, drag the file onto inherit.exe and release the button.
  • Follow the remaining instructions
If you have any problems locating the correct .exe, let us know along with a list of programs that will not open.

Let us know how you make out and we will continue.

Please post back with
  • Win32kDiag.txt
Thanks
Post #7
The posted link is broken. I couldn't find the log at first so I ran the program again and remembered where it was right after that. I also remember the first scan being longer. Running from: C:\Documents and Settings\[removed]\desktop\win32kdiag.exe Log file at : C:\Documents and Settings\Administrator\Desktop\Win32kDiag.txt Removing all found mount points. Attempting to reset file permissions. WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'… Finished!
Post #8 last edited
Hi Faolin, Try the link now. :blush: Thanks for the log. Yes the previous scan would have been a bit longer than this time as it was not only scanning for but also removing the mouuntpoints. Let us know if Inherit helps the other problem and we''ll continue. Thanks
Post #9
It worked for superantispyware but not avast. When I tried copying into the Avast4 folder It gave an error message "Can not copy Inherit: Access is denied. Make sure the disk is not full or write-protected and that the file is not currently in use." I have tried to shut down the rest of avast but I can not figure out how
Post #10
Hi Faolin,

This should take care of that warning
  • Right click the avast! "a" icon near the clock and select Program Settings
  • In the left panel click Troubleshooting
  • Place a check mark next to Disable avast! self defence module
  • Click OK
  • A warning will popup, click Yes to continue.
You should be able to copy and paste inherit.exe into the folder now.

This is the file

C:\Program Files\Alwil Software\Avast4\ashServ.exe

Post back when ready.

Thanks
Post #12
Hi Faolin,

Which error message? The one related to pasting inherit.exe into the Avast4 folder?

Let's see if there are any other files that may need to be reset.
  • Right click the attached file junction.zip
  • Select Save target as
  • Set the Save in box to Desktop
📎Junction.zip

  • Extract the files to your desktop
  • Locate peek.bat and double click it to run it
  • Please be patient and let it run
  • When it's finished, a log will be saved at C:\log.txt
  • Please post it's contents in your next reply

Thanks

Thanks
Post #13
Junction v1.05 - Windows junction creator and reparse point viewer
Copyright © 2000-2007 Mark Russinovich
Systems Internals - http://www.sysinternals.com


Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process.


…

…

…

…

…

…

…

…

…

…

…

…

…

.
Failed to open \\?\c:\\Program Files\Alwil Software\Avast4\ashAvast.exe: Access is denied.



Failed to open \\?\c:\\Program Files\Alwil Software\Avast4\ashServ.exe: Access is denied.


..

…

…

…

.
Failed to open \\?\c:\\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe: Access is denied.


..

…

…
Failed to open \\?\c:\\System Volume Information\MountPointManagerRemoteDatabase: Access is denied.




…

…

..\\?\c:\\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a: JUNCTION
Print Name : C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790
Substitute Name: C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790

\\?\c:\\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a: JUNCTION
Print Name : C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e
Substitute Name: C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e

.

…

…

…

…

…

…

..
Post #14 last edited
Hi Faolin,

Was that the entire log?

Do this. Disable avast's self defence first.

Make sure inherit.exe is on your desktop. Click your start button, click run. Copy and paste the following lines, one at a time, into the run box clicking OK after each line. Wait a bit between lines.

"%userprofile%\desktop\Inherit.exe" "c:\Program Files\Alwil Software\Avast4\ashAvast.exe"

"%userprofile%\desktop\Inherit.exe" "c:\Program Files\Alwil Software\Avast4\ashServ.exe"

"%userprofile%\desktop\Inherit.exe" "c:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"

Can you access Avast now? See if you can uninstall Kaspersky now.

Thanks
Post #15
That was all of the log. I was able to uninstall Kasperky and Ican now use all of avast but there is still a red circle on the avast icon in the tray.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI