[Resolved] http://error404.com/index.php

I noticed that others have had the same issue with http://error404.com/index.php pop-up and that this forum has helped them fix the issue. I tried to follow the steps for new members in setting up this post. However, I was unable to utilize Root Repeal because it is not compatible with my Windows Vista Home Premium 64-bit. I have attached the DDS log that I got. Please help me. Thank you.

DDS (Ver_09-12-01.01) - NTFSX64
Run by [removed] at 17:09:47.97 on Fri 12/11/2009
Internet Explorer: 8.0.6001.18865 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3998.1528 [GMT -6:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
C:\Windows\system32\lsm.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_5730ce9f\STacSV64.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_5730ce9f\AESTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Users\Kat\AppData\Roaming\Document Systems, Inc\DocMagic Online\bin\dmlsvc.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\SMINST\BLService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\SysWOW64\WebUpdateSvc4.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files (x86)\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Megaupload\Mega Manager\MegaManager.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\PROGRA~2\MICROS~2\Office12\OUTLOOK.EXE
C:\Windows\splwow64.exe
C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Kat\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mLocal Page = c:\windows\syswow64\blank.htm
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files (x86)\avg\avg9\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files (x86)\avg\avg9\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files (x86)\avg\avg9\toolbar\IEToolbar.dll
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\program files (x86)\megaupload\mega manager\MegaIEMn.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files (x86)\msn\toolbar\3.0.0541.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files (x86)\msn\toolbar\3.0.0541.0\msneshellx.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files (x86)\avg\avg9\toolbar\IEToolbar.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [LightScribe Control Panel] c:\program files (x86)\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files (x86)\common files\ahead\lib\NMBgMonitor.exe"
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Defence] "c:\programdata\defence\smss.exe" -SystemDefence
mRun: [DVDAgent] "c:\program files (x86)\hewlett-packard\media\dvd\DVDAgent.exe"
mRun: [TSMAgent] "c:\program files (x86)\hewlett-packard\touchsmart\media\TSMAgent.exe"
mRun: [CLMLServer for HP TouchSmart] "c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\CLMLSvc.exe"
mRun: [UCam_Menu] "c:\program files (x86)\hewlett-packard\media\webcam\muitransfer\muistartmenu.exe" "c:\program files (x86)\hewlett-packard\media\webcam" update "software\hewlett-packard\media\Webcam"
mRun: [QlbCtrl.exe] "c:\program files (x86)\hewlett-packard\hp quick launch buttons\QlbCtrl.exe" /Start
mRun: [SunJavaUpdateSched] "c:\program files (x86)\java\jre6\bin\jusched.exe"
mRun: [HP Health Check Scheduler] c:\program files (x86)\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [HP Software Update] c:\program files (x86)\hp\hp software update\HPWuSchd2.exe
mRun: [WirelessAssistant] c:\program files (x86)\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [QuickTime Task] "c:\program files (x86)\quicktime\QTTask.exe" -atboottime
mRun: []
mRun: [RoxWatchTray] "c:\program files (x86)\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files (x86)\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [AppleSyncNotifier] c:\program files (x86)\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [iTunesHelper] "c:\program files (x86)\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files (x86)\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [AVG9_TRAY] c:\progra~2\avg\avg9\avgtray.exe
StartupFolder: c:\users\kat\appdata\roaming\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files (x86)\microsoft office\office11\ONENOTEM.EXE
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files (x86)\microsoft office\office11\ONENOTEM.EXE
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: HideFastUserSwitching = 1 (0x1)
IE: Download Link Using Mega Manager… - c:\program files (x86)\megaupload\mega manager\mm_file.htm
IE: E&xport to Microsoft Excel - c:\progra~2\micros~2\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files (x86)\avg\avg9\avgpp.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files (x86)\common files\lightscribe\LSRunOnce.exe"
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files (x86)\avg\avg9\avgssiea.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
mRun-x64: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun-x64: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun-x64: [Persistence] c:\windows\system32\igfxpers.exe
mRun-x64: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun-x64: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray64.exe
mRun-x64: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
AppInit_DLLs-X64: avgrssta.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\kat\appdata\roaming\mozilla\firefox\profiles\yisqu8qt.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files (x86)\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files (x86)\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files (x86)\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files (x86)\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files (x86)\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\users\kat\appdata\roaming\move networks\plugins\npqmp071505000010.dll
FF - plugin: c:\users\kat\appdata\roaming\move networks\plugins\npqmp071505000011.dll
FF - plugin: c:\users\kat\appdata\roaming\move networks\plugins\npqmp071701000002.dll
FF - plugin: c:\users\kat\appdata\roaming\mozilla\plugins\npatgpc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 PxHlpa64;PxHlpa64;c:\windows\system32\drivers\PxHlpa64.sys [2009-9-26 52856]
R1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\drivers\avgldx64.sys [2009-9-18 422920]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\drivers\avgmfx64.sys [2009-9-18 34248]
R1 AvgTdiA;AVG Free8 Network Redirector x64;c:\windows\system32\drivers\avgtdia.sys [2009-9-18 470024]
R2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/09/13 03:28:11];c:\program files (x86)\hewlett-packard\media\dvd\000.fcl [2008-11-28 146928]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt64.inf_5730ce9f\AESTSr64.exe [2009-9-13 89088]
R2 avg9wd;AVG Free WatchDog;c:\program files (x86)\avg\avg9\avgwdsvc.exe [2009-11-26 285392]
R2 DML Service;DML Service;c:\users\kat\appdata\roaming\document systems, inc\docmagic online\bin\dmlsvc.exe [2009-10-15 297120]
R2 hpsrv;HP Service;c:\windows\system32\hpservice.exe [2008-3-18 23040]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files (x86)\sminst\BLService.exe [2009-6-1 365952]
R2 WebUpdate4;Web Update Wizard Service V4;c:\windows\syswow64\WebUpdateSvc4.exe [2007-10-10 237784]
R3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-6-1 222512]
R3 enecir;ENE CIR Receiver;c:\windows\system32\drivers\enecir.sys [2008-9-4 64000]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-7-15 126464]
R3 NETw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\drivers\NETw5v64.sys [2009-9-13 4745216]
S2 Norton Internet Security;Norton Internet Security;"c:\program files (x86)\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files (x86)\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 –> c:\program files (x86)\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe [2009-9-18 93184]
S3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2008-7-21 145496]
S3 NETw3v64;Intel® PRO/Wireless 3945ABG Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\drivers\NETw3v64.sys [2008-1-20 3154432]
S3 PerfHost;Performance Counter DLL Host;c:\windows\syswow64\perfhost.exe [2008-1-20 19968]
S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk60x64.sys [2006-11-2 273408]

============== File Associations ===============

JSEFile=c:\windows\syswow64\WScript.exe "%1" %*

=============== Created Last 30 ================

2009-12-09 04:43:49 32768 —-a-w- c:\windows\system32\nshhttp.dll
2009-12-09 04:43:49 24064 —-a-w- c:\windows\syswow64\nshhttp.dll
2009-12-09 04:43:44 610304 —-a-w- c:\windows\system32\drivers\http.sys
2009-12-09 04:43:44 33792 —-a-w- c:\windows\system32\httpapi.dll
2009-12-09 04:43:44 31232 —-a-w- c:\windows\syswow64\httpapi.dll
2009-12-09 04:42:40 442368 —-a-w- c:\windows\system32\winhttp.dll
2009-12-09 04:42:40 378368 —-a-w- c:\windows\syswow64\winhttp.dll
2009-12-09 04:42:00 295936 —-a-w- c:\windows\system32\raschap.dll
2009-12-09 04:42:00 281600 —-a-w- c:\windows\syswow64\raschap.dll
2009-12-09 04:42:00 280576 —-a-w- c:\windows\system32\rastls.dll
2009-12-09 04:42:00 244224 —-a-w- c:\windows\syswow64\rastls.dll
2009-12-01 16:45:04 31 —-a-w- c:\windows\WebUpdateSvc4.INI
2009-12-01 16:44:32 47624 —-a-w- c:\windows\syswow64\wuwuninst.exe
2009-12-01 16:42:23 0 d—–w- c:\program files (x86)\Electronic Bluebook
2009-12-01 16:42:20 301 —-a-w- c:\windows\{F03C81CA-4445-4D53-B4B3-6B85CA0C5EB4}_WiseFW.ini
2009-12-01 16:41:43 0 d—–w- c:\program files (x86)\common files\Wise Installation Wizard
2009-11-26 06:42:24 411368 —-a-w- c:\windows\syswow64\deploytk.dll
2009-11-26 06:42:24 149280 —-a-w- c:\windows\syswow64\javaws.exe
2009-11-26 06:42:24 145184 —-a-w- c:\windows\syswow64\javaw.exe
2009-11-26 06:42:24 145184 —-a-w- c:\windows\syswow64\java.exe
2009-11-26 06:29:13 0 d–h–w- C:\$AVG
2009-11-26 06:27:35 0 d—–w- c:\programdata\avg9
2009-11-25 12:47:54 2048 —-a-w- c:\windows\syswow64\tzres.dll
2009-11-25 12:47:54 2048 —-a-w- c:\windows\system32\tzres.dll
2009-11-24 20:13:30 1875456 —-a-w- c:\windows\system32\msxml3.dll
2009-11-24 20:13:29 1794560 —-a-w- c:\windows\system32\msxml6.dll
2009-11-24 20:13:28 1399296 —-a-w- c:\windows\syswow64\msxml6.dll
2009-11-24 20:13:28 1257472 —-a-w- c:\windows\syswow64\msxml3.dll
2009-11-24 20:13:25 880640 —-a-w- c:\windows\system32\timedate.cpl
2009-11-24 20:13:25 714240 —-a-w- c:\windows\syswow64\timedate.cpl

==================== Find3M ====================

2009-11-26 06:28:30 470024 —-a-w- c:\windows\system32\drivers\avgtdia.sys
2009-11-26 06:28:30 422920 —-a-w- c:\windows\system32\drivers\avgldx64.sys
2009-11-26 06:28:30 34248 —-a-w- c:\windows\system32\drivers\avgmfx64.sys
2009-11-26 06:28:30 12464 —-a-w- c:\windows\system32\avgrssta.dll
2009-11-21 06:52:02 1147904 —-a-w- c:\windows\system32\wininet.dll
2009-11-21 06:46:36 77312 —-a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:46:36 132096 —-a-w- c:\windows\system32\iesysprep.dll
2009-11-21 06:40:20 916480 —-a-w- c:\windows\syswow64\wininet.dll
2009-11-21 06:40:03 1208832 —-a-w- c:\windows\syswow64\urlmon.dll
2009-11-21 06:38:17 206848 —-a-w- c:\windows\syswow64\occache.dll
2009-11-21 06:35:43 5940736 —-a-w- c:\windows\syswow64\mshtml.dll
2009-11-21 06:35:38 594432 —-a-w- c:\windows\syswow64\msfeeds.dll
2009-11-21 06:35:38 55296 —-a-w- c:\windows\syswow64\msfeedsbs.dll
2009-11-21 06:34:58 25600 —-a-w- c:\windows\syswow64\jsproxy.dll
2009-11-21 06:34:39 71680 —-a-w- c:\windows\syswow64\iesetup.dll
2009-11-21 06:34:39 1985536 —-a-w- c:\windows\syswow64\iertutil.dll
2009-11-21 06:34:39 164352 —-a-w- c:\windows\syswow64\ieui.dll
2009-11-21 06:34:39 109056 —-a-w- c:\windows\syswow64\iesysprep.dll
2009-11-21 06:34:38 55808 —-a-w- c:\windows\syswow64\iernonce.dll
2009-11-21 06:34:38 184320 —-a-w- c:\windows\syswow64\iepeers.dll
2009-11-21 06:34:38 11069952 —-a-w- c:\windows\syswow64\ieframe.dll
2009-11-21 06:34:33 387584 —-a-w- c:\windows\syswow64\iedkcs32.dll
2009-11-21 05:07:24 162816 —-a-w- c:\windows\system32\ieUnatt.exe
2009-11-21 04:59:58 133632 —-a-w- c:\windows\syswow64\ieUnatt.exe
2009-11-21 04:59:52 173056 —-a-w- c:\windows\syswow64\ie4uinit.exe
2009-11-21 04:59:14 13312 —-a-w- c:\windows\syswow64\msfeedssync.exe
2009-11-03 02:42:06 226688 ——w- c:\windows\system32\MpSigStub.exe
2009-09-26 14:21:11 51200 —-a-w- c:\windows\inf\infpub.dat
2009-09-26 14:21:10 86016 —-a-w- c:\windows\inf\infstrng.dat
2009-09-26 14:21:09 86016 —-a-w- c:\windows\inf\infstor.dat
2009-09-13 10:29:31 855552 —-a-w- c:\windows\syswow64\kernel32.dll
2009-09-13 10:29:31 24064 —-a-w- c:\windows\syswow64\amxread.dll
2009-09-13 10:29:30 25600 —-a-w- c:\windows\system32\amxread.dll
2009-09-13 10:29:30 15872 —-a-w- c:\windows\system32\apilogen.dll
2009-09-13 10:29:30 13824 —-a-w- c:\windows\syswow64\apilogen.dll
2009-09-13 10:27:12 730112 —-a-w- c:\windows\system32\msdtcprx.dll
2009-09-13 10:27:12 562176 —-a-w- c:\windows\syswow64\msdtcprx.dll
2009-09-13 10:27:12 48640 —-a-w- c:\windows\system32\xolehlp.dll
2009-09-13 10:27:12 38912 —-a-w- c:\windows\syswow64\xolehlp.dll
2009-06-01 13:37:56 665600 —-a-w- c:\windows\inf\drvindex.dat
2008-01-21 03:21:59 174 –sha-w- c:\program files\desktop.ini
2008-01-21 03:21:59 174 –sha-w- c:\program files (x86)\desktop.ini
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-01 13:29:09 8192 –sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 17:10:00.39 ===============

Thank you so much for your help. I have followed all of the steps, however, I am unable to run rooter. Every time I run it the program stops working and it closes. Please advise. I have posted the other logs.

Antivirus Version Last Update Result
a-squared 4.5.0.43 2009.12.16 -
AhnLab-V3 5.0.0.2 2009.12.16 -
AntiVir 7.9.1.114 2009.12.16 -
Antiy-AVL 2.0.3.7 2009.12.16 -
Authentium 5.2.0.5 2009.12.02 W32/SecRisk-ProcessPatcher-based!Maximus
Avast 4.8.1351.0 2009.12.17 -
AVG 8.5.0.427 2009.12.16 -
BitDefender 7.2 2009.12.17 -
CAT-QuickHeal 10.00 2009.12.16 -
ClamAV 0.94.1 2009.12.16 -
Comodo 3267 2009.12.16 -
DrWeb 5.0.0.12182 2009.12.17 -
eSafe 7.0.17.0 2009.12.16 -
eTrust-Vet 35.1.7179 2009.12.16 -
F-Prot 4.5.1.85 2009.12.16 W32/SecRisk-ProcessPatcher-based!Maximus
F-Secure 9.0.15370.0 2009.12.16 -
Fortinet 4.0.14.0 2009.12.16 -
GData 19 2009.12.17 -
Ikarus T3.1.1.78.0 2009.12.16 -
Jiangmin 13.0.900 2009.12.16 -
K7AntiVirus 7.10.922 2009.12.16 -
Kaspersky 7.0.0.125 2009.12.17 -
McAfee 5834 2009.12.16 -
McAfee+Artemis 5834 2009.12.16 -
McAfee-GW-Edition 6.8.5 2009.12.17 -
Microsoft 1.5302 2009.12.16 -
NOD32 4694 2009.12.16 -
Norman 6.04.03 2009.12.16 -
nProtect 2009.1.8.0 2009.12.16 -
Panda 10.0.2.2 2009.12.15 -
PCTools 7.0.3.5 2009.12.17 -
Rising 22.26.02.04 2009.12.16 -
Sophos 4.49.0 2009.12.16 -
Sunbelt 3.2.1858.2 2009.12.17 -
Symantec 1.4.4.12 2009.12.17 -
TheHacker 6.5.0.2.094 2009.12.15 -
TrendMicro 9.100.0.1001 2009.12.16 -
VBA32 3.12.12.0 2009.12.16 -
ViRobot 2009.12.16.2092 2009.12.16 -
VirusBuster 5.0.21.0 2009.12.16 -
Additional information
File size: 297120 bytes
MD5…: 8e3acc95968d2e696f5914a3f00f9b67
SHA1..: 98dab06cc8401b35e2e59f565d4b9e213492bb40
SHA256: 91894849e5660fa8f1ee384dfad623c21623cdbfaf70a68f14df7a90bcf3b22c
ssdeep: 6144:rDMU2khiWguFAxlDLqFSy3ky+2R9kfaG+39bOwUW:rDn2khiWguFAxlDeF/
3F+ikSxN1UW
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x6a31
timedatestamp…..: 0x4ac298a9 (Tue Sep 29 23:30:49 2009)
machinetype…….: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x17319 0x17400 6.66 e2ff7ea3a5df23cbf83f663c2b7674d2
.rdata 0x19000 0x5142 0x5200 4.88 ff3dc9401220cff8ebbb60e3dd9ab503
.data 0x1f000 0x22b24 0x4000 1.31 640c71e3d48455081c57f03ac6aac0a8
.rsrc 0x42000 0x24d40 0x24e00 6.15 8a46810ac308d34e09423cafe9a56e0c
.reloc 0x67000 0x2250 0x2400 4.29 880d5abb4ebbe5abb065be21cf8bdd59

( 5 imports )
> SHLWAPI.dll: StrStrIW, PathIsRelativeW, PathAppendW, PathRemoveFileSpecW, PathFindFileNameW
> KERNEL32.dll: SuspendThread, GetThreadContext, VirtualProtect, SetThreadContext, CreateToolhelp32Snapshot, Module32FirstW, Module32NextW, Thread32First, Thread32Next, GetModuleFileNameW, CreateFileW, OpenMutexW, CreateMutexW, GetFileSize, SetEndOfFile, ReleaseMutex, WideCharToMultiByte, GetCurrentProcessId, Process32FirstW, Process32NextW, CreateEventW, SetEvent, WriteConsoleA, OpenThread, GetProcessHeap, SetFilePointer, SetStdHandle, FlushFileBuffers, GetConsoleMode, GetConsoleCP, GetModuleHandleA, HeapSize, GetLocaleInfoA, GetStringTypeW, GetStringTypeA, LCMapStringW, MultiByteToWideChar, LCMapStringA, HeapReAlloc, VirtualAlloc, GetTickCount, QueryPerformanceCounter, VirtualFree, VirtualFreeEx, CloseHandle, WaitForSingleObject, CreateRemoteThread, WriteProcessMemory, VirtualAllocEx, OpenProcess, ResumeThread, GetLastError, GetModuleHandleW, GetProcAddress, GetVersion, Sleep, GetConsoleOutputCP, CreateFileA, WriteConsoleW, CompareStringA, CompareStringW, SetEnvironmentVariableA, ReadFile, HeapCreate, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetSystemTimeAsFileTime, EnterCriticalSection, LeaveCriticalSection, ExitProcess, RaiseException, RtlUnwind, HeapFree, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapAlloc, GetTimeZoneInformation, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, WriteFile, GetModuleFileNameA, LoadLibraryA, InitializeCriticalSectionAndSpinCount, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW
> USER32.dll: MessageBoxW, WaitForInputIdle, EnumWindowStationsW, CloseWindowStation, EnumDesktopsW, OpenWindowStationW, CloseDesktop, EnumDesktopWindows, OpenDesktopW, GetClassNameW, GetWindowThreadProcessId, IsWindowVisible, SendMessageW
> ADVAPI32.dll: StartServiceW, SetServiceStatus, RegisterServiceCtrlHandlerW, StartServiceCtrlDispatcherW, ControlService, DeleteService, QueryServiceStatus, OpenServiceW, CloseServiceHandle, CreateServiceW, OpenSCManagerW, RegCloseKey, RegSetValueExW, RegOpenKeyExW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor
> SHELL32.dll: SHGetFolderPathW

( 0 exports )
RDS…: NSRL Reference Data Set
-
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
pdfid.: -
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: Document Systems, Inc.
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
signing date.: 2:23 AM 12/17/2009
verified…..: -



Antivirus Version Last Update Result
a-squared 4.5.0.43 2009.12.16 -
AhnLab-V3 5.0.0.2 2009.12.16 -
AntiVir 7.9.1.114 2009.12.16 -
Antiy-AVL 2.0.3.7 2009.12.16 -
Authentium 5.2.0.5 2009.12.02 -
Avast 4.8.1351.0 2009.12.17 -
AVG 8.5.0.427 2009.12.16 -
BitDefender 7.2 2009.12.17 -
CAT-QuickHeal 10.00 2009.12.16 -
ClamAV 0.94.1 2009.12.16 -
Comodo 3267 2009.12.16 -
DrWeb 5.0.0.12182 2009.12.17 -
eSafe 7.0.17.0 2009.12.16 -
eTrust-Vet 35.1.7179 2009.12.16 -
F-Prot 4.5.1.85 2009.12.16 -
F-Secure 9.0.15370.0 2009.12.16 -
Fortinet 4.0.14.0 2009.12.16 -
GData 19 2009.12.17 -
Ikarus T3.1.1.78.0 2009.12.16 -
Jiangmin 13.0.900 2009.12.16 -
K7AntiVirus 7.10.922 2009.12.16 -
Kaspersky 7.0.0.125 2009.12.17 -
McAfee 5834 2009.12.16 -
McAfee+Artemis 5834 2009.12.16 -
McAfee-GW-Edition 6.8.5 2009.12.17 -
Microsoft 1.5302 2009.12.16 -
NOD32 4694 2009.12.16 -
Norman 6.04.03 2009.12.16 -
nProtect 2009.1.8.0 2009.12.16 -
Panda 10.0.2.2 2009.12.15 -
PCTools 7.0.3.5 2009.12.17 -
Prevx 3.0 2009.12.17 -
Rising 22.26.02.04 2009.12.16 -
Sophos 4.49.0 2009.12.16 -
Sunbelt 3.2.1858.2 2009.12.17 -
Symantec 1.4.4.12 2009.12.17 -
TheHacker 6.5.0.2.094 2009.12.15 -
TrendMicro 9.100.0.1001 2009.12.16 -
VBA32 3.12.12.0 2009.12.16 -
ViRobot 2009.12.16.2092 2009.12.16 -
VirusBuster 5.0.21.0 2009.12.16 -
Additional information
File size: 365952 bytes
MD5…: bc0a4d47472b042537f4e57b950415fa
SHA1..: 10a16be20e72671fd83e289becf95b0e7924920c
SHA256: 77776364308e0cbc683033eee8a5c865c852bf9cf8892a1771b4e180f48ac884
ssdeep: 6144:F8VsE7d5iR37JSw3YHOUVqovtLMbnzth4SjZplE1sfWaxJ:ciRZ3YHrVFv2
zztSSlY1uWaxJ
PEiD..: -
PEInfo: -
RDS…: NSRL Reference Data Set
-
pdfid.: -
trid..: InstallShield setup (37.7%)
Win32 Executable MS Visual C++ (generic) (33.0%)
Windows Screen Saver (11.4%)
Win32 Executable Generic (7.4%)
Win32 Dynamic Link Library (generic) (6.6%)
sigcheck:
publisher….: n/a
copyright….: Copyright © SoftThinks 2008
product……: Application STServices
description..: STServices
original name: STServices.EXE
internal name: STServices
file version.: 1, 0, 0, 12
comments…..: n/a
signers……: SoftThinks
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
signing date.: 4:11 PM 12/17/2008
verified…..: -


OTL Logs

OTL logfile created on: 12/16/2009 7:42:06 PM - Run 1
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Users\Kat\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18865)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.90 Gb Total Physical Memory | 2.24 Gb Available Physical Memory | 57.41% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.65 Gb Total Space | 9.52 Gb Free Space | 3.35% Space Free | Partition Type: NTFS
Drive D: | 14.44 Gb Total Space | 2.16 Gb Free Space | 14.98% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KAT-PC
Current User Name: Kat
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Kat\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Users\Kat\AppData\Roaming\Document Systems, Inc\DocMagic Online\bin\dmlsvc.exe ()
PRC - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\SMINST\BLService.exe ()
PRC - C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe ()
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe ( Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
PRC - C:\Windows\SysWOW64\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
PRC - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG)
PRC - C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Program Files (x86)\Microsoft Office\OFFICE11\ONENOTEM.EXE (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Kat\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV:64bit: - (BthServ) – C:\Windows\SysNative\bthserv.dll ()
SRV:64bit: - (STacSV) – C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_5730ce9f\STacSV64.exe ()
SRV:64bit: - (AESTFilters) – C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_5730ce9f\AESTSr64.exe ()
SRV:64bit: - (hpsrv) – C:\Windows\SysNative\Hpservice.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (avg9wd) – C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (DML Service) – C:\Users\Kat\AppData\Roaming\Document Systems, Inc\DocMagic Online\bin\dmlsvc.exe ()
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Recovery Service for Windows) – C:\Program Files (x86)\SMINST\BLService.exe ()
SRV - (Bonjour Service) – C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (Com4QLBEx) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Hewlett-Packard Development Company, L.P.)
SRV - (hpqwmiex) – C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
SRV - (HP Health Check Service) – c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe (Hewlett-Packard)
SRV - (clr_optimization_v2.0.50727_64) – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (LightScribeService) – C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (WebUpdate4) – C:\Windows\SysWOW64\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
SRV - (NBService) – C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe (Nero AG)
SRV - (NMIndexingService) – C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG)
SRV - (RoxLiveShare9) – C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (Sonic Solutions)
SRV - (RoxWatch9) – C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions)
SRV - (RoxMediaDB9) – C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (Sonic Solutions)
SRV - (Roxio UPnP Renderer 9) – C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe (Sonic Solutions)
SRV - (Roxio Upnp Server 9) – C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe (Sonic Solutions)
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2006/11/02 07:34:14 | 00,000,000 | —D | M]
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (VSS) – C:\Windows\SysWOW64\wbem\vss.mof ()
SRV - (IDriverT) – C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (AvgTdiA) – C:\Windows\SysNative\Drivers\avgtdia.sys ()
DRV:64bit: - (AvgLdx64) – C:\Windows\SysNative\Drivers\avgldx64.sys ()
DRV:64bit: - (AvgMfx64) – C:\Windows\SysNative\Drivers\avgmfx64.sys ()
DRV:64bit: - (BTHPORT) – C:\Windows\SysNative\Drivers\BTHport.sys ()
DRV:64bit: - (RFCOMM) Bluetooth Device (RFCOMM Protocol TDI) – C:\Windows\SysNative\DRIVERS\rfcomm.sys ()
DRV:64bit: - (BTHUSB) – C:\Windows\SysNative\Drivers\BTHUSB.sys ()
DRV:64bit: - (BthEnum) – C:\Windows\SysNative\DRIVERS\BthEnum.sys ()
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys ()
DRV:64bit: - (RimVSerPort) – C:\Windows\SysNative\DRIVERS\RimSerial_AMD64.sys ()
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys ()
DRV:64bit: - (STHDA) – C:\Windows\SysNative\DRIVERS\stwrt64.sys ()
DRV:64bit: - (enecir) – C:\Windows\SysNative\DRIVERS\enecir.sys ()
DRV:64bit: - (igfx) – C:\Windows\SysNative\DRIVERS\igdkmd64.sys ()
DRV:64bit: - (NETw5v64) Intel® – C:\Windows\SysNative\DRIVERS\NETw5v64.sys ()
DRV:64bit: - (JMCR) – C:\Windows\SysNative\DRIVERS\jmcr.sys ()
DRV:64bit: - (IntcHdmiAddService) Intel® – C:\Windows\SysNative\drivers\IntcHdmi.sys ()
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys ()
DRV:64bit: - (hpdskflt) – C:\Windows\SysNative\DRIVERS\hpdskflt.sys ()
DRV:64bit: - (Accelerometer) – C:\Windows\SysNative\DRIVERS\Accelerometer.sys ()
DRV:64bit: - (ApfiltrService) – C:\Windows\SysNative\DRIVERS\Apfiltr.sys ()
DRV:64bit: - (ROOTMODEM) – C:\Windows\SysNative\Drivers\RootMdm.sys ()
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys ()
DRV:64bit: - (usbvideo) USB Video Device (WDM) – C:\Windows\SysNative\Drivers\usbvideo.sys ()
DRV:64bit: - (BthPan) Bluetooth Device (Personal Area Network) – C:\Windows\SysNative\DRIVERS\bthpan.sys ()
DRV:64bit: - (NETw3v64) Intel® – C:\Windows\SysNative\DRIVERS\NETw3v64.sys ()
DRV:64bit: - (sdbus) – C:\Windows\SysNative\DRIVERS\sdbus.sys ()
DRV:64bit: - (CmBatt) – C:\Windows\SysNative\DRIVERS\CmBatt.sys ()
DRV:64bit: - (HpqKbFiltr) – C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys ()
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\Drivers\PxHlpa64.sys ()
DRV:64bit: - (HdAudAddService) – C:\Windows\SysNative\drivers\HdAudio.sys ()
DRV:64bit: - (yukonx64) – C:\Windows\SysNative\DRIVERS\yk60x64.sys ()
DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) – C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl (CyberLink Corp.)
DRV - (Tcpip) – C:\Windows\SysWOW64\wbem\tcpip.mof ()
DRV - (mpsdrv) – C:\Windows\SysWOW64\wbem\mpsdrv.mof ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716
FF - prefs.js..extensions.enabledItems: avg@igeared:3.011.025.005
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type;=yahoo_avg_hs2-tb-web_us&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2009/12/11 14:49:48 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files (x86)\AVG\AVG9\Toolbar\Firefox\avg@igeared [2009/12/16 10:53:40 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2009/11/06 08:37:44 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2009/11/26 00:42:24 | 00,000,000 | —D | M]

[2009/09/18 20:29:34 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Mozilla\Extensions
[2009/12/15 10:47:56 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Mozilla\Firefox\Profiles\yisqu8qt.default\extensions
[2009/11/26 00:42:28 | 00,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions

O1 HOSTS File: (761 bytes) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files (x86)\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe ()
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe ()
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DVDAgent] C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe ( Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TSMAgent] C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - Startup: C:\Users\Kat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files (x86)\Microsoft Office\OFFICE11\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O8:64bit: - Extra context menu item: Download Link Using Mega Manager… - C:\Program Files (x86)\Megaupload\Mega Manager\mm_file.htm ()
O8 - Extra context menu item: Download Link Using Mega Manager… - C:\Program Files (x86)\Megaupload\Mega Manager\mm_file.htm ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysNative\wshbth.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysWOW64\wshbth.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files (x86)\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll ()
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{00809676-b145-11de-b7b8-0026229b7131}\Shell - "" = AutoRun
O33 - MountPoints2\{00809676-b145-11de-b7b8-0026229b7131}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\AutoRun\command - "" = F:\Autorun.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\Shell00\Command - "" = F:\Autorun.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\Shell01\Command - "" = F:\Autorun.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\Shell02\Command - "" = F:\Autorun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - comfile [open] – "%1" %* File not found
64bit: O35 - exefile [open] – "%1" %* File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs:64bit: Ias - C:\Windows\SysNative\ias [2008/01/20 21:06:38 | 00,000,000 | —D | M]
NetSvcs:64bit: Irmon - C:\Windows\SysNative\irmon.dll ()
NetSvcs:64bit: Wmi - C:\Windows\SysNative\wmi.dll ()
NetSvcs: Ias - C:\Windows\SysWOW64\ias [2008/01/20 21:08:35 | 00,000,000 | —D | M]
NetSvcs: Wmi - C:\Windows\SysWOW64\wmi.dll (Microsoft Corporation)


SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PEVSystemStart - Service
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: procexp90.Sys - Driver
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: VDS - C:\Windows\SysWOW64\wbem\vds.mof ()
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PEVSystemStart - Service
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: procexp90.Sys - Driver
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MPSDrv - C:\Windows\SysWOW64\wbem\mpsdrv.mof ()
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: Tcpip - C:\Windows\SysWOW64\wbem\tcpip.mof ()
SafeBootNet: TDI - Driver Group
SafeBootNet: VDS - C:\Windows\SysWOW64\wbem\vds.mof ()
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker 2.6
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

========== Files/Folders - Created Within 30 Days ==========

[2009/12/16 19:30:12 | 00,000,000 | —D | C] – C:\_OTL
[2009/12/16 19:28:47 | 00,538,112 | —- | C] (OldTimer Tools) – C:\Users\Kat\Desktop\OTL.exe
[2009/12/11 16:36:58 | 00,472,064 | —- | C] ( ) – C:\Users\Kat\Desktop\RootRepeal.exe
[2009/12/11 16:04:17 | 00,000,000 | —D | C] – C:\Windows\ERDNT
[2009/12/11 16:02:22 | 00,000,000 | —D | C] – C:\Program Files (x86)\ERUNT
[2009/12/09 21:28:25 | 00,916,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wininet.dll
[2009/12/09 21:28:24 | 00,594,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2009/12/09 21:28:24 | 00,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iedkcs32.dll
[2009/12/09 21:28:24 | 00,206,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2009/12/09 21:28:22 | 01,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2009/12/09 21:28:22 | 00,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2009/12/09 21:28:22 | 00,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2009/12/09 21:28:22 | 00,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2009/12/09 21:28:22 | 00,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2009/12/09 21:28:22 | 00,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedsbs.dll
[2009/12/09 21:28:21 | 00,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2009/12/09 21:28:21 | 00,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2009/12/09 21:28:21 | 00,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2009/12/09 21:28:21 | 00,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jsproxy.dll
[2009/12/09 21:28:21 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2009/12/08 22:43:49 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshhttp.dll
[2009/12/08 22:43:44 | 00,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\httpapi.dll
[2009/12/08 22:42:00 | 00,281,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\raschap.dll
[2009/12/08 22:42:00 | 00,244,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rastls.dll
[2009/12/01 13:22:02 | 00,000,000 | —D | C] – C:\Users\Kat\Documents\My Exams
[2009/12/01 10:42:23 | 00,000,000 | —D | C] – C:\Program Files (x86)\Electronic Bluebook
[2009/12/01 10:41:43 | 00,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2009/11/30 20:46:07 | 00,000,000 | —D | C] – C:\32788R22FWJFW
[2009/11/26 00:42:24 | 00,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deploytk.dll
[2009/11/26 00:42:24 | 00,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2009/11/26 00:42:24 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2009/11/26 00:42:24 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2009/11/26 00:29:13 | 00,000,000 | -H-D | C] – C:\$AVG
[2009/11/26 00:27:35 | 00,000,000 | —D | C] – C:\ProgramData\avg9
[2009/11/24 14:13:25 | 00,714,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\timedate.cpl

========== Files - Modified Within 30 Days ==========

[2009/12/16 19:40:48 | 02,359,296 | -HS- | M] () – C:\Users\Kat\NTUSER.DAT
[2009/12/16 19:38:19 | 00,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/12/16 19:38:18 | 00,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/12/16 19:38:15 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/12/16 19:38:11 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/12/16 19:37:56 | 41,932,10368 | -HS- | M] () – C:\hiberfil.sys
[2009/12/16 19:37:11 | 00,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2009/12/16 19:37:05 | 00,524,288 | -HS- | M] () – C:\Users\Kat\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms
[2009/12/16 19:37:05 | 00,065,536 | -HS- | M] () – C:\Users\Kat\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf
[2009/12/16 19:36:59 | 02,619,723 | -H– | M] () – C:\Users\Kat\AppData\Local\IconCache.db
[2009/12/16 19:28:47 | 00,538,112 | —- | M] (OldTimer Tools) – C:\Users\Kat\Desktop\OTL.exe
[2009/12/16 18:36:10 | 46,707,805 | —- | M] () – C:\Windows\SysNative\drivers\Avg\incavi.avm
[2009/12/16 18:35:40 | 00,126,461 | —- | M] () – C:\Windows\SysNative\drivers\Avg\microavi.avg
[2009/12/16 18:34:35 | 00,194,560 | —- | M] () – C:\Users\Kat\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/15 09:12:20 | 00,690,960 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2009/12/15 09:12:20 | 00,595,684 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2009/12/15 09:12:20 | 00,101,350 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2009/12/12 15:19:20 | 00,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2009/12/11 16:50:19 | 00,472,064 | —- | M] ( ) – C:\Users\Kat\Desktop\RootRepeal.exe
[2009/12/11 16:33:23 | 00,524,288 | —- | M] () – C:\Users\Kat\Desktop\dds.scr
[2009/12/11 16:02:26 | 00,000,723 | —- | M] () – C:\Users\Kat\Desktop\NTREGOPT.lnk
[2009/12/11 16:02:25 | 00,000,704 | —- | M] () – C:\Users\Kat\Desktop\ERUNT.lnk
[2009/12/08 09:25:10 | 00,000,368 | —- | M] () – C:\Users\Kat\Documents\Pictures - Shortcut.lnk
[2009/12/05 11:30:11 | 00,001,866 | —- | M] () – C:\Users\Public\Desktop\Safari.lnk
[2009/12/02 23:00:27 | 00,006,080 | —- | M] () – C:\Users\Kat\AppData\Local\d3d9caps.dat
[2009/12/01 13:20:19 | 00,000,031 | —- | M] () – C:\Windows\WebUpdateSvc4.INI
[2009/12/01 13:20:14 | 00,002,385 | —- | M] () – C:\Users\Kat\Desktop\Electronic Bluebook.lnk
[2009/12/01 10:44:32 | 00,047,624 | —- | M] () – C:\Windows\SysWow64\wuwuninst.exe
[2009/12/01 10:42:59 | 00,000,301 | —- | M] () – C:\Windows\{F03C81CA-4445-4D53-B4B3-6B85CA0C5EB4}_WiseFW.ini
[2009/11/26 23:44:03 | 00,707,184 | —- | M] () – C:\Users\Kat\AppData\Local\rx_image.Cache
[2009/11/26 23:44:03 | 00,033,728 | —- | M] () – C:\Users\Kat\AppData\Local\rx_audio.Cache
[2009/11/26 00:41:28 | 00,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2009/11/26 00:41:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2009/11/26 00:41:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2009/11/26 00:41:27 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deploytk.dll
[2009/11/26 00:28:36 | 00,001,649 | —- | M] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2009/11/26 00:28:30 | 00,470,024 | —- | M] () – C:\Windows\SysNative\drivers\avgtdia.sys
[2009/11/26 00:28:30 | 00,422,920 | —- | M] () – C:\Windows\SysNative\drivers\avgldx64.sys
[2009/11/26 00:28:30 | 00,113,461 | —- | M] () – C:\Windows\SysNative\drivers\Avg\iavichjw.avm
[2009/11/26 00:28:30 | 00,034,248 | —- | M] () – C:\Windows\SysNative\drivers\avgmfx64.sys
[2009/11/26 00:28:30 | 00,012,464 | —- | M] () – C:\Windows\SysNative\avgrssta.dll
[2009/11/21 00:52:02 | 01,147,904 | —- | M] () – C:\Windows\SysNative\wininet.dll
[2009/11/21 00:50:26 | 00,243,712 | —- | M] () – C:\Windows\SysNative\occache.dll
[2009/11/21 00:47:45 | 00,700,928 | —- | M] () – C:\Windows\SysNative\msfeeds.dll
[2009/11/21 00:47:45 | 00,071,680 | —- | M] () – C:\Windows\SysNative\msfeedsbs.dll
[2009/11/21 00:47:02 | 00,031,744 | —- | M] () – C:\Windows\SysNative\jsproxy.dll
[2009/11/21 00:46:55 | 01,538,560 | —- | M] () – C:\Windows\SysNative\inetcpl.cpl
[2009/11/21 00:46:36 | 02,334,208 | —- | M] () – C:\Windows\SysNative\iertutil.dll
[2009/11/21 00:46:36 | 00,219,136 | —- | M] () – C:\Windows\SysNative\ieui.dll
[2009/11/21 00:46:36 | 00,132,096 | —- | M] () – C:\Windows\SysNative\iesysprep.dll
[2009/11/21 00:46:36 | 00,077,312 | —- | M] () – C:\Windows\SysNative\iesetup.dll
[2009/11/21 00:46:35 | 00,072,192 | —- | M] () – C:\Windows\SysNative\iernonce.dll
[2009/11/21 00:46:34 | 00,252,416 | —- | M] () – C:\Windows\SysNative\iepeers.dll
[2009/11/21 00:46:28 | 00,459,776 | —- | M] () – C:\Windows\SysNative\iedkcs32.dll
[2009/11/21 00:40:20 | 00,916,480 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\wininet.dll
[2009/11/21 00:38:17 | 00,206,848 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2009/11/21 00:35:38 | 00,594,432 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2009/11/21 00:35:38 | 00,055,296 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedsbs.dll
[2009/11/21 00:34:58 | 00,025,600 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jsproxy.dll
[2009/11/21 00:34:52 | 01,469,440 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2009/11/21 00:34:39 | 00,164,352 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2009/11/21 00:34:39 | 00,109,056 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2009/11/21 00:34:39 | 00,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2009/11/21 00:34:38 | 00,184,320 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2009/11/21 00:34:38 | 00,055,808 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2009/11/21 00:34:33 | 00,387,584 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iedkcs32.dll
[2009/11/20 23:07:24 | 00,162,816 | —- | M] () – C:\Windows\SysNative\ieUnatt.exe
[2009/11/20 23:07:08 | 00,070,656 | —- | M] () – C:\Windows\SysNative\ie4uinit.exe
[2009/11/20 23:06:35 | 00,012,288 | —- | M] () – C:\Windows\SysNative\msfeedssync.exe
[2009/11/20 22:59:58 | 00,133,632 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2009/11/20 22:59:52 | 00,173,056 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2009/11/20 22:59:14 | 00,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2009/11/18 09:37:38 | 00,000,299 | —- | M] () – C:\Users\Kat\Desktop\DocMagic Online.url

========== Files Created - No Company Name ==========

[2009/12/12 15:19:20 | 00,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2009/12/11 16:04:59 | 00,524,288 | —- | C] () – C:\Users\Kat\Desktop\dds.scr
[2009/12/11 16:02:26 | 00,000,723 | —- | C] () – C:\Users\Kat\Desktop\NTREGOPT.lnk
[2009/12/11 16:02:25 | 00,000,704 | —- | C] () – C:\Users\Kat\Desktop\ERUNT.lnk
[2009/12/09 21:28:29 | 09,237,504 | —- | C] () – C:\Windows\SysNative\mshtml.dll
[2009/12/09 21:28:28 | 12,462,080 | —- | C] () – C:\Windows\SysNative\ieframe.dll
[2009/12/09 21:28:26 | 02,334,208 | —- | C] () – C:\Windows\SysNative\iertutil.dll
[2009/12/09 21:28:25 | 01,484,288 | —- | C] () – C:\Windows\SysNative\urlmon.dll
[2009/12/09 21:28:24 | 01,147,904 | —- | C] () – C:\Windows\SysNative\wininet.dll
[2009/12/09 21:28:24 | 00,459,776 | —- | C] () – C:\Windows\SysNative\iedkcs32.dll
[2009/12/09 21:28:24 | 00,243,712 | —- | C] () – C:\Windows\SysNative\occache.dll
[2009/12/09 21:28:22 | 01,538,560 | —- | C] () – C:\Windows\SysNative\inetcpl.cpl
[2009/12/09 21:28:22 | 00,700,928 | —- | C] () – C:\Windows\SysNative\msfeeds.dll
[2009/12/09 21:28:22 | 00,162,816 | —- | C] () – C:\Windows\SysNative\ieUnatt.exe
[2009/12/09 21:28:22 | 00,070,656 | —- | C] () – C:\Windows\SysNative\ie4uinit.exe
[2009/12/09 21:28:21 | 01,638,912 | —- | C] () – C:\Windows\SysNative\mshtml.tlb
[2009/12/09 21:28:21 | 00,252,416 | —- | C] () – C:\Windows\SysNative\iepeers.dll
[2009/12/09 21:28:21 | 00,219,136 | —- | C] () – C:\Windows\SysNative\ieui.dll
[2009/12/09 21:28:21 | 00,132,096 | —- | C] () – C:\Windows\SysNative\iesysprep.dll
[2009/12/09 21:28:21 | 00,077,312 | —- | C] () – C:\Windows\SysNative\iesetup.dll
[2009/12/09 21:28:21 | 00,072,192 | —- | C] () – C:\Windows\SysNative\iernonce.dll
[2009/12/09 21:28:21 | 00,071,680 | —- | C] () – C:\Windows\SysNative\msfeedsbs.dll
[2009/12/09 21:28:21 | 00,031,744 | —- | C] () – C:\Windows\SysNative\jsproxy.dll
[2009/12/09 21:28:21 | 00,012,288 | —- | C] () – C:\Windows\SysNative\msfeedssync.exe
[2009/12/08 22:43:49 | 00,032,768 | —- | C] () – C:\Windows\SysNative\nshhttp.dll
[2009/12/08 22:43:44 | 00,610,304 | —- | C] () – C:\Windows\SysNative\drivers\http.sys
[2009/12/08 22:43:44 | 00,033,792 | —- | C] () – C:\Windows\SysNative\httpapi.dll
[2009/12/08 22:42:40 | 00,442,368 | —- | C] () – C:\Windows\SysNative\winhttp.dll
[2009/12/08 22:42:00 | 00,295,936 | —- | C] () – C:\Windows\SysNative\raschap.dll
[2009/12/08 22:42:00 | 00,280,576 | —- | C] () – C:\Windows\SysNative\rastls.dll
[2009/12/08 09:25:10 | 00,000,368 | —- | C] () – C:\Users\Kat\Documents\Pictures - Shortcut.lnk
[2009/12/01 10:45:04 | 00,000,031 | —- | C] () – C:\Windows\WebUpdateSvc4.INI
[2009/12/01 10:44:32 | 00,047,624 | —- | C] () – C:\Windows\SysWow64\wuwuninst.exe
[2009/12/01 10:42:25 | 00,002,385 | —- | C] () – C:\Users\Kat\Desktop\Electronic Bluebook.lnk
[2009/12/01 10:42:20 | 00,000,301 | —- | C] () – C:\Windows\{F03C81CA-4445-4D53-B4B3-6B85CA0C5EB4}_WiseFW.ini
[2009/11/26 00:28:36 | 00,001,649 | —- | C] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2009/11/25 06:47:54 | 00,002,048 | —- | C] () – C:\Windows\SysNative\tzres.dll
[2009/11/24 14:13:30 | 01,875,456 | —- | C] () – C:\Windows\SysNative\msxml3.dll
[2009/11/24 14:13:29 | 01,794,560 | —- | C] () – C:\Windows\SysNative\msxml6.dll
[2009/11/24 14:13:25 | 00,880,640 | —- | C] () – C:\Windows\SysNative\timedate.cpl
[2009/10/29 15:23:47 | 00,006,080 | —- | C] () – C:\Users\Kat\AppData\Local\d3d9caps.dat
[2009/10/05 18:11:42 | 00,707,184 | —- | C] () – C:\Users\Kat\AppData\Local\rx_image.Cache
[2009/10/05 18:11:42 | 00,033,728 | —- | C] () – C:\Users\Kat\AppData\Local\rx_audio.Cache
[2009/09/25 17:28:00 | 00,194,560 | —- | C] () – C:\Users\Kat\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/25 14:11:02 | 00,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/09/18 17:53:36 | 00,000,000 | —- | C] () – C:\Users\Kat\AppData\Local\QSwitch.txt
[2009/09/18 17:53:36 | 00,000,000 | —- | C] () – C:\Users\Kat\AppData\Local\DSwitch.txt
[2009/09/18 17:53:36 | 00,000,000 | —- | C] () – C:\Users\Kat\AppData\Local\AtStart.txt
[2008/01/20 20:50:05 | 00,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2008/01/20 20:49:49 | 00,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2009/09/26 08:20:52 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Blackberry Desktop
[2009/10/15 09:32:48 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Document Systems, Inc
[2009/09/25 15:54:28 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Megaupload
[2009/09/26 08:35:07 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Research In Motion
[2009/11/24 09:21:38 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\uTorrent
[2009/11/30 14:46:18 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\WebEx
[2009/12/16 19:37:11 | 00,029,102 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %systemroot%\System32\antiwpa.dll >

< %systemroot%\SYSTEM32\wpa.dll >

< %systemroot%\setup\scripts\biestart.exe >

< %systemroot%\system32\drivers\royal.sys >

< %systemroot%\system32\serauth1.dll >

< %systemroot%\system32\serauth2.dll >

< %systemroot%\system32\sysaudio.sys >

< %systemroot%\system32\wdmaud.sys >

< %systemroot%\system32\aeaudio.sys >

< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/01/20 20:46:51 | 00,064,568 | —- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
[2008/01/20 20:46:51 | 00,064,568 | —- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_181d01cb743015fc\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/20 20:46:50 | 00,022,584 | —- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
[2009/06/01 07:29:07 | 00,022,584 | —- | M] (Microsoft Corporation) MD5=35137384FFB6FB4B4C3063CEB5DB34BE – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6000.20847_none_37d5e5fef5f86cf7\atapi.sys
[2009/06/01 07:29:07 | 00,022,584 | —- | M] (Microsoft Corporation) MD5=B388797CAAB36D523840347CC6A39B96 – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.22193_none_398211faf34b271a\atapi.sys
[2009/04/11 01:15:00 | 00,020,952 | —- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 – C:\Windows\SoftwareDistribution\Download\61da130e21aad3387c2fa3ca1d469de3\amd64_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_3b423ca9d7090b1e\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 05:16:48 | 00,014,848 | —- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 – C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006/11/02 03:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\SysWOW64\cngaudit.dll
[2006/11/02 03:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\SysWOW64\cngaudit.dll
[2006/11/02 03:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2008/01/20 20:46:59 | 00,290,872 | —- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2008/01/20 20:51:03 | 00,716,800 | —- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2009/04/11 00:28:23 | 00,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\SoftwareDistribution\Download\61da130e21aad3387c2fa3ca1d469de3\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_6616762521d9e6d4\netlogon.dll
[2009/04/11 01:11:16 | 00,717,312 | —- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB – C:\Windows\SoftwareDistribution\Download\61da130e21aad3387c2fa3ca1d469de3\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_5bc1cbd2ed7924d9\netlogon.dll
[2008/01/20 20:48:28 | 00,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\SysWOW64\netlogon.dll
[2008/01/20 20:48:28 | 00,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\SysWOW64\netlogon.dll
[2008/01/20 20:48:28 | 00,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2008/01/20 20:46:54 | 00,054,328 | —- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/20 20:50:28 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\SysWOW64\scecli.dll
[2008/01/20 20:50:28 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\SysWOW64\scecli.dll
[2008/01/20 20:50:28 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2008/01/20 20:49:49 | 00,235,520 | —- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
[2009/04/11 00:28:24 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\SoftwareDistribution\Download\61da130e21aad3387c2fa3ca1d469de3\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_a06ca13dc2fb6d8f\scecli.dll
[2009/04/11 01:11:23 | 00,235,520 | —- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B – C:\Windows\SoftwareDistribution\Download\61da130e21aad3387c2fa3ca1d469de3\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_9617f6eb8e9aab94\scecli.dll

< %systemroot%\*. /mp /s >

========== Files - Unicode (All) ==========
[2009/10/04 13:27:10 | 00,000,000 | —D | M](C:\Users\Kat\AppData\Roaming\???????sAppData) – C:\Users\Kat\AppData\Roaming\敎潲䍄敔灭慬整sAppData
[2009/10/04 13:27:10 | 00,000,000 | —D | M](C:\Users\Kat\AppData\Roaming\???????sAppData) – C:\Users\Kat\AppData\Roaming\敎潲䍄敔灭慬整sAppData
(C:\Users\Kat\AppData\Roaming\???????sAppData) – C:\Users\Kat\AppData\Roaming\敎潲䍄敔灭慬整sAppData
< End of report >


OTL Extras logfile created on: 12/16/2009 7:42:06 PM - Run 1
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Users\Kat\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18865)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.90 Gb Total Physical Memory | 2.24 Gb Available Physical Memory | 57.41% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.65 Gb Total Space | 9.52 Gb Free Space | 3.35% Space Free | Partition Type: NTFS
Drive D: | 14.44 Gb Total Space | 2.16 Gb Free Space | 14.98% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KAT-PC
Current User Name: Kat
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – "%SystemRoot%\hh.exe" %1

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – "%SystemRoot%\hh.exe" %1
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
chm.file [open] – "%SystemRoot%\hh.exe" %1 File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" ()
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l ()
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
chm.file [open] – "%SystemRoot%\hh.exe" %1
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3752E043-99AD-4DCF-8836-1784A951E3CA}" = lport=138 | protocol=17 | dir=in | app=system |
"{39492433-0045-4C16-83D4-1106FAF6FBBC}" = rport=137 | protocol=17 | dir=out | app=system |
"{45BA7DCD-B921-4F4C-9D5B-A3597CBCEC95}" = lport=137 | protocol=17 | dir=in | app=system |
"{7CDEF423-5C06-4B7F-BA3C-927CAF8A26C8}" = lport=445 | protocol=6 | dir=in | app=system |
"{92D6E77B-184D-441F-99CD-4B1204B2564A}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{A19524B9-AF4D-483C-AA60-A0764997BA2A}" = rport=445 | protocol=6 | dir=out | app=system |
"{B4743FF3-7CC7-4539-9AA1-75D9669E43C2}" = rport=138 | protocol=17 | dir=out | app=system |
"{CF62BEC8-C853-41DD-A518-413B1E42F2E1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{E2F8E89B-003F-4EFE-9E29-8E1E06FDA71A}" = lport=139 | protocol=6 | dir=in | app=system |
"{E3114D00-433C-4F1F-9E3A-37846535D9BF}" = rport=139 | protocol=6 | dir=out | app=system |
"{E3F14893-FC5D-46BC-891A-A239D0D6B8E3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0033B0D0-CCBA-4D24-B49D-856084ADE531}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{1DEAD94E-F565-42DE-B260-D2ECA493373D}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{1F3605A3-C0DA-4EA9-8294-0A110BF2ECC0}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartphoto.exe |
"{287BBCD4-B26F-4A3E-BF5B-873325F354B1}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\tsmagent.exe |
"{4457BCCE-778F-40DC-99B5-9837D4AD37D6}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartvideo.exe |
"{44E10E29-7F97-43F0-B9B0-8357F999FD54}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic bluebook\electronic bluebook.exe |
"{47FFAEAA-A67D-4B87-A7D8-1D067FDDDC5D}" = dir=in | app=c:\program files (x86)\avg\avg8\avgnsa.exe |
"{5B2DE9B9-B1D2-4368-A4B5-D30F33EDCEFB}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{6568FD3C-B8ED-480B-8D2B-076FC9E3EA89}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{6646F544-3B66-4016-A6D0-D926D030D95F}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe |
"{6910B9EE-F0A3-4784-82D0-5BC6B11FCC81}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe |
"{761A3A82-201A-465C-8032-F7E41D4BC248}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{7783AF57-CF00-452A-BFA3-16F7B2F067AB}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic bluebook\electronic bluebook.exe |
"{80F2C9A1-96B8-46F2-9C75-7424D4393F10}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe |
"{86950AAC-24A4-440A-9158-7AFE9759DACF}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\tv\qp.exe |
"{945C46B1-AC6E-43EB-9B59-22BDEA681F06}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\tsmagent.exe |
"{9785A8B0-C126-4699-98D1-A72D144B8786}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{9CC68E59-2651-4D60-989E-DF0EDB6DB62A}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{A1DDA506-E26E-42EA-9BAE-08BB5763FFA9}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hpdvdsmart.exe |
"{A4B74415-4E15-4322-B829-F20FAF3A068D}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{B0E26C6B-FFDF-4E31-9161-2C728686852A}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe |
"{C4A3874E-02BC-457D-81F0-D89D7015473A}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\tv\qpservice.exe |
"{CBA0E5B2-B615-4722-BD89-7619EB4B0C43}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{D146739F-FAFE-4A56-9387-58BAFBB171E3}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{D74800C8-F256-4122-92C6-9FD56D150BC7}" = dir=in | app=c:\program files (x86)\avg\avg8\avgupd.exe |
"{E5DB60EE-16DA-4C75-8BF6-86295D3C84BA}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartmusic.exe |
"{E9479481-2C3C-47CD-9F46-D83B203C60E3}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{EEC7FA8C-2A01-413A-8F19-6DF194682B68}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe |
"{F83D1B2D-7B60-47B8-AF57-7705BF80C98C}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{FA9187DB-3D98-4965-9EEF-83660DE469AB}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe |
"TCP Query User{31DD9869-5B55-4D62-95E1-23FB7ECF2EFA}C:\program files (x86)\roxio\media manager 9\mediamanager9.exe" = protocol=6 | dir=in | app=c:\program files (x86)\roxio\media manager 9\mediamanager9.exe |
"TCP Query User{5724B511-9301-4AEA-A5CA-06B739B0FD1A}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{74EB9ECC-1097-4686-A16F-78B07F9241FF}C:\program files (x86)\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"UDP Query User{56CB8ABF-4357-46B8-AF7D-350C7A8157FA}C:\program files (x86)\roxio\media manager 9\mediamanager9.exe" = protocol=17 | dir=in | app=c:\program files (x86)\roxio\media manager 9\mediamanager9.exe |
"UDP Query User{666F4888-C4DA-444E-87D6-C838B795654B}C:\program files (x86)\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"UDP Query User{8ECC0FC7-9B0B-47D1-A5AC-CA8D73263B1B}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{22ABA92B-6C1B-46D8-AC2B-C48EEAE172A9}" = VD64Inst
"{2F97CE84-9C33-4631-821B-85EA371EA254}" = ProtectSmart Hard Drive Protection
"{39107B20-EA1C-4974-881C-607300BB3C99}" = MobileMe Control Panel
"{4FFA2088-8317-3B14-93CD-4C699DB37843}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{9EFC40E3-5F31-4F75-8445-286273F74D8E}" = Apple Mobile Device Support
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Touch Pad Driver
"{A5F59952-475D-4DCC-BEAD-C216FC68E05C}" = iTunes
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}" = Bonjour
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F1568AA6-5982-4AFB-A871-C68E4328BC3B}" = HP MediaSmart SmartMenu
"07B260955637F1FF7587ED2AA87459040DD09BF7" = Windows Driver Package - ENE (enecir) HIDClass (09/04/2008 2.6.0.0)
"HDMI" = Intel® Graphics Media Accelerator Driver
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0054A0F6-00C9-4498-B821-B5C9578F433E}" = HP Help and Support
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{08333C2F-8219-48E8-8569-E53D4C761882}" = Network Recording Player
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{154A4184-1A3D-4BF9-A5AE-4FA1660445F3}" = HP Total Care Advisor
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java™ 6 Update 15
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 L1
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Vista
"{3B6E3FC6-274C-4B6C-BC85-5C3B15DE18E2}" = Mega Manager
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{47F36D92-E58E-456D-B73C-3382737E4C42}" = HP Update
"{4916DFBD-403B-4707-AA64-294DC082B99F}" = HP Total Care Setup
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57A5AEC1-97FC-474D-92C4-908FCC2253D4}" = HP Customer Experience Enhancements
"{5DC0DF76-3B2F-4C38-BE34-58627949BC1A}" = Mega Manager
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{66D171AA-670F-4309-9C74-5BA7F7DBA0B3}" = Roxio Media Manager
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A370610-3778-44AF-9AAC-69B2FD1A3356}" = Microsoft Live Search Toolbar
"{732A3F80-008B-4350-BD58-EC5AE98707B8}" = HP Common Access Service Library
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8101E/8168/8169 PCI/PCIe Adapters
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_STANDARDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_STANDARDR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
"{91120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9B449C1A-4F64-4ED4-8C96-31B222E8377F}" = BlackBerry Desktop Software 4.2.2
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{C4CF43CE-94AE-498E-9EB1-C804E05CB3CA}" = HP User Guides 0125
"{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}" = HP Active Support Library
"{CF097717-F174-4144-954A-FBC4BF301033}" = Nero 7 Ultra Edition
"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari
"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E5E29403-3D25-40C6-892B-F9FEE2A95585}" = HP Wireless Assistant
"{F03C81CA-4445-4D53-B4B3-6B85CA0C5EB4}" = Electronic Bluebook
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AVG9Uninstall" = AVG Free 9.0
"BlackBerry_{9B449C1A-4F64-4ED4-8C96-31B222E8377F}" = BlackBerry Desktop Software 4.2.2
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ERUNT_is1" = ERUNT 1.1j
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"STANDARDR" = Microsoft Office Standard 2007
"The KMPlayer" = The KMPlayer (remove only)
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.2
"Web Update Wizard (Redistributable)" = Web Update Wizard (Redistributable) 4.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ActiveTouchMeetingClient" = WebEx
"Move Media Player" = Move Media Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/29/2009 8:01:12 PM | Computer Name = Kat-PC | Source = WinMgmt | ID = 10
Description =

Error - 11/30/2009 1:53:51 AM | Computer Name = Kat-PC | Source = Application Hang | ID = 1002
Description = The program WinRAR.exe version 3.90.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 1884 Start Time: 01ca718045b90670 Termination Time: 7

Error - 11/30/2009 1:54:03 AM | Computer Name = Kat-PC | Source = Application Hang | ID = 1002
Description = The program iTunes.exe version 9.0.2.25 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 104c Start Time: 01ca715f99af5480 Termination Time: 50

Error - 11/30/2009 8:23:37 PM | Computer Name = Kat-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/1/2009 12:44:49 PM | Computer Name = Kat-PC | Source = WebUpdate4 | ID = 2
Description =

Error - 12/2/2009 6:50:40 PM | Computer Name = Kat-PC | Source = Application Error | ID = 1000
Description = Faulting application STacSV64.exe, version 1.0.6087.0, time stamp
0x48c944a9, faulting module msvcrt.dll, version 7.0.6001.18000, time stamp 0x4791ad6b,
exception code 0xc0000005, fault offset 0x0000000000003237, process id 0x2c8, application
start time 0x01ca721c6c8c105e.

Error - 12/3/2009 1:00:32 AM | Computer Name = Kat-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/5/2009 11:43:25 AM | Computer Name = Kat-PC | Source = Application Error | ID = 1000
Description = Faulting application STacSV64.exe, version 1.0.6087.0, time stamp
0x48c944a9, faulting module msvcrt.dll, version 7.0.6001.18000, time stamp 0x4791ad6b,
exception code 0xc0000005, fault offset 0x0000000000003237, process id 0x1fc, application
start time 0x01ca73d5757e9062.

Error - 12/6/2009 5:16:01 PM | Computer Name = Kat-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/6/2009 6:08:45 PM | Computer Name = Kat-PC | Source = Application Error | ID = 1000
Description = Faulting application Safari.exe, version 5.31.21.10, time stamp 0x4af39964,
faulting module objc.dll, version 1.435.2.3, time stamp 0x4ae6569b, exception code
0xc0000005, fault offset 0x00008373, process id 0xddc, application start time 0x01ca76bc08697dda.

[ System Events ]
Error - 12/9/2009 11:16:05 PM | Computer Name = Kat-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.100.37.109 for the Network Card with network
address 001E6599C32C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 12/10/2009 12:42:47 PM | Computer Name = Kat-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.119 for the Network Card with network
address 001E6599C32C has been denied by the DHCP server 10.100.3.66 (The DHCP Server
sent a DHCPNACK message).

Error - 12/10/2009 9:07:03 PM | Computer Name = Kat-PC | Source = HTTP | ID = 15016
Description =

Error - 12/10/2009 9:07:25 PM | Computer Name = Kat-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 12/10/2009 9:07:25 PM | Computer Name = Kat-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 12/10/2009 9:07:44 PM | Computer Name = Kat-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.100.37.34 for the Network Card with network
address 001E6599C32C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 12/10/2009 9:11:25 PM | Computer Name = Kat-PC | Source = PlugPlayManager | ID = 12
Description = The device 'JMB38X SD/MMC Host Controller' (PCI\VEN_197B&DEV;_2382&SUBSYS;_30F7103C&REV;_00\4&37ba8cc&0&00E4)
disappeared from the system without first being prepared for removal.

Error - 12/10/2009 9:11:25 PM | Computer Name = Kat-PC | Source = PlugPlayManager | ID = 12
Description = The device 'JMB38X SD Host Controller' (PCI\VEN_197B&DEV;_2381&SUBSYS;_30F7103C&REV;_00\4&37ba8cc&0&02E4)
disappeared from the system without first being prepared for removal.

Error - 12/10/2009 9:11:26 PM | Computer Name = Kat-PC | Source = PlugPlayManager | ID = 12
Description = The device 'JMB38X MS Host Controller' (PCI\VEN_197B&DEV;_2383&SUBSYS;_30F7103C&REV;_00\4&37ba8cc&0&03E4)
disappeared from the system without first being prepared for removal.

Error - 12/10/2009 9:11:26 PM | Computer Name = Kat-PC | Source = PlugPlayManager | ID = 12
Description = The device 'JMB38X xD Host Controller' (PCI\VEN_197B&DEV;_2384&SUBSYS;_30F7103C&REV;_00\4&37ba8cc&0&04E4)
disappeared from the system without first being prepared for removal.


< End of report >

1.

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\*{CFBFAE00-17A6-11D0-99CB-00C04FD64497} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\*{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Kat
->Temp folder emptied: 63855619 bytes
->Temporary Internet Files folder emptied: 8126535 bytes
->Java cache emptied: 48222917 bytes
->FireFox cache emptied: 88341247 bytes
->Apple Safari cache emptied: 799302130 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
Windows Temp folder emptied: 1283041 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 962.41 mb


OTL by OldTimer - Version 3.1.17.0 log created on 12172009_223804

Files\Folders moved on Reboot…
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.

Registry entries deleted on Reboot…


2.

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 22:42 on 17/12/2009 by Kat (Administrator - Elevation successful)

========== dir ==========

C:\32788R22FWJFW - Parameters: "/s"

—Files—
023.dat –a— 39605 bytes [02:46 01/12/2009] [09:53 22/11/2009]
023v.dat –a— 2128 bytes [02:46 01/12/2009] [06:36 21/10/2009]
023w7.dat –a— 661 bytes [02:46 01/12/2009] [06:36 21/10/2009]
appinit.bad –a— 6760 bytes [02:46 01/12/2009] [14:00 31/08/2000]
asp.str –a— 602 bytes [02:46 01/12/2009] [05:09 14/07/2009]
AspackDie.cfxxe -ra— 13312 bytes [02:46 01/12/2009] [17:09 04/12/2006]
Assoc.cmd –a— 3927 bytes [02:46 01/12/2009] [20:51 26/10/2009]
Auto-RC.cmd –a— 3034 bytes [02:46 01/12/2009] [08:46 29/07/2009]
av.cmd –a— 1764 bytes [02:46 01/12/2009] [10:21 25/11/2009]
av.vbs –a— 1464 bytes [02:46 01/12/2009] [00:09 14/05/2009]
AWF.cmd –a— 659 bytes [02:46 01/12/2009] [07:03 16/11/2009]
badclsid.c –a— 801567 bytes [02:46 01/12/2009] [20:53 26/11/2009]
Boot-Rk.cmd –a— 2360 bytes [02:46 01/12/2009] [05:13 11/11/2009]
Boot.bat –a— 7308 bytes [02:46 01/12/2009] [06:54 23/11/2009]
BootSect.dll –a— 7680 bytes [02:46 01/12/2009] [14:00 31/08/2000]
c.bat –a— 52557 bytes [02:46 01/12/2009] [09:19 23/11/2009]
Catch-sub.cmd –a— 977 bytes [02:46 01/12/2009] [10:30 15/11/2009]
catchme.cfxxe –a— 147456 bytes [02:46 01/12/2009] [23:37 17/04/2009]
CF-Script.cmd –a— 27877 bytes [02:46 01/12/2009] [20:41 18/11/2009]
clsid.c –a— 240954 bytes [02:46 01/12/2009] [20:53 26/11/2009]
cmd.cfxxe –a— 318976 bytes [02:46 01/12/2009] [02:46 01/12/2009]
Combo-Fix.sys –a— 1024 bytes [02:46 01/12/2009] [14:00 31/08/2000]
Combobatch.bat –a— 7065 bytes [02:46 01/12/2009] [06:18 16/11/2009]
ComboFix-Download.cfxxe –a— 141312 bytes [02:46 01/12/2009] [14:00 31/08/2000]
Create.cmd –a— 7246 bytes [02:46 01/12/2009] [07:03 16/11/2009]
Creg.dat –a— 653801 bytes [02:46 01/12/2009] [11:32 26/11/2009]
CregC.cmd –a— 2894 bytes [02:46 01/12/2009] [20:53 26/10/2009]
CregC.dat –a— 406 bytes [02:46 01/12/2009] [12:58 15/08/2009]
CSet.cmd –a— 1678 bytes [02:46 01/12/2009] [09:12 15/11/2009]
dd.cfxxe –a— 101376 bytes [02:46 01/12/2009] [14:00 31/08/2000]
ddsDo.sed –a— 7983 bytes [02:46 01/12/2009] [15:59 25/05/2009]
DelClsid.bat –a— 1680 bytes [02:46 01/12/2009] [09:13 15/11/2009]
DelClsid64.bat –a— 1734 bytes [02:46 01/12/2009] [09:13 15/11/2009]
Dnl.dat –a— 26 bytes [02:46 01/12/2009] [01:47 09/11/2009]
DPF.str –a— 746 bytes [02:46 01/12/2009] [14:00 31/08/2000]
dumphive.cfxxe –a— 51200 bytes [02:46 01/12/2009] [14:00 31/08/2000]
embedded.sed –a— 303 bytes [02:46 01/12/2009] [14:00 31/08/2000]
ERDNT.e_e –a— 163328 bytes [02:46 01/12/2009] [02:02 21/10/2005]
ERDNTDOS.LOC –a— 2815 bytes [02:46 01/12/2009] [14:00 31/08/2000]
ERDNTWIN.LOC –a— 3275 bytes [02:46 01/12/2009] [14:00 31/08/2000]
ERUNT.cfxxe –a— 157696 bytes [02:46 01/12/2009] [02:00 21/10/2005]
ERUNT.LOC –a— 4090 bytes [02:46 01/12/2009] [14:00 31/08/2000]
Exe.reg –a— 13778 bytes [02:46 01/12/2009] [12:34 28/10/2009]
extract.cfxxe –a— 52736 bytes [02:46 01/12/2009] [14:00 31/08/2000]
FD-SV.cmd –a— 3733 bytes [02:46 01/12/2009] [11:52 23/11/2009]
ffdefstr.dll –a— 36903 bytes [02:46 01/12/2009] [08:54 01/09/2009]
FileKill.cfxxe –a— 145920 bytes [02:46 01/12/2009] [14:00 31/08/2000]
files.pif –a— 2415 bytes [02:46 01/12/2009] [20:53 26/11/2009]
Fin.dat –a— 683 bytes [02:46 01/12/2009] [12:44 22/11/2009]
FIND3M.bat –a— 29753 bytes [02:46 01/12/2009] [06:04 24/11/2009]
FIXLSP.bat –a— 4759 bytes [02:46 01/12/2009] [05:16 11/11/2009]
FKMGen.cmd –a— 1084 bytes [02:46 01/12/2009] [07:02 16/11/2009]
ForceLibrary.dll –a— 10240 bytes [02:46 01/12/2009] [21:03 15/02/2001]
GetHive.cmd –a— 5969 bytes [02:46 01/12/2009] [20:54 26/10/2009]
grep.cfxxe –a— 80412 bytes [02:46 01/12/2009] [14:00 31/08/2000]
gsar.cfxxe –a— 15360 bytes [02:46 01/12/2009] [14:00 31/08/2000]
handle.cfxxe –a— 173936 bytes [02:46 01/12/2009] [19:15 18/11/2008]
hidec.exe –a— 1536 bytes [02:46 01/12/2009] [07:54 16/08/2005]
history.bat –a— 954 bytes [02:46 01/12/2009] [23:25 20/10/2009]
iexplore.exe –a— 31232 bytes [02:46 01/12/2009] [18:56 20/04/2009]
image001.gif –a— 1057 bytes [02:46 01/12/2009] [14:00 31/08/2000]
Install-RC.cmd –a— 5658 bytes [02:46 01/12/2009] [06:54 23/11/2009]
katch.cmd –a— 1192 bytes [02:46 01/12/2009] [06:03 24/11/2009]
Kill-All.cmd –a— 1729 bytes [02:46 01/12/2009] [23:31 04/11/2009]
Lang.bat –a— 194226 bytes [02:46 01/12/2009] [06:06 15/11/2009]
List-B.bat –a— 44120 bytes [02:46 01/12/2009] [09:08 26/11/2009]
List-C.bat –a— 241802 bytes [02:46 01/12/2009] [20:53 26/11/2009]
List-D.bat –a— 93094 bytes [02:46 01/12/2009] [06:08 26/11/2009]
List.bat –a— 719672 bytes [02:46 01/12/2009] [11:22 26/11/2009]
lnkread.vbs –a— 2428 bytes [02:46 01/12/2009] [14:00 31/08/2000]
LocalService.dat –a— 225 bytes [02:46 01/12/2009] [14:00 31/08/2000]
LocalServiceNetworkRestricted.dat –a— 91 bytes [02:46 01/12/2009] [14:00 31/08/2000]
LocalSystemNetworkRestricted.dat –a— 198 bytes [02:46 01/12/2009] [14:00 31/08/2000]
mbr.cfxxe –a— 77312 bytes [02:46 01/12/2009] [12:11 25/10/2009]
md5sum.pif –a— 5202 bytes [02:46 01/12/2009] [20:53 26/11/2009]
md5sum00.pif –a— 34 bytes [02:46 01/12/2009] [20:53 26/11/2009]
MoveIt.bat –a— 2370 bytes [02:46 01/12/2009] [23:25 20/10/2009]
mtee.cfxxe –a— 11264 bytes [02:46 01/12/2009] [14:00 31/08/2000]
mynul.dat –a— 0 bytes [02:46 01/12/2009] [14:00 31/08/2000]
n.pif –a— 31232 bytes [02:46 01/12/2009] [18:56 20/04/2009]
ncmd.cfxxe –a— 2054 bytes [02:46 01/12/2009] [09:55 14/11/2009]
ndis_combofix.dat –a— 287 bytes [02:46 01/12/2009] [14:00 31/08/2000]
ND_.bat –a— 27476 bytes [02:46 01/12/2009] [19:17 17/11/2009]
netsvc.bad.dat –a— 489 bytes [02:46 01/12/2009] [05:27 21/11/2009]
netsvc.dat –a— 159 bytes [02:46 01/12/2009] [14:00 31/08/2000]
netsvc.vista.dat –a— 481 bytes [02:46 01/12/2009] [14:00 31/08/2000]
netsvc.xp.dat –a— 525 bytes [02:46 01/12/2009] [14:00 31/08/2000]
NetworkService.dat –a— 88 bytes [02:46 01/12/2009] [14:00 31/08/2000]
NirCmd.cfxxe –a— 31232 bytes [02:46 01/12/2009] [18:56 20/04/2009]
NirCmd.chm –a— 32317 bytes [02:46 01/12/2009] [14:00 31/08/2000]
NirCmdC.cfxxe –a— 30720 bytes [02:46 01/12/2009] [18:56 20/04/2009]
NT-OS.cmd –a— 19212 bytes [02:46 01/12/2009] [07:06 26/11/2009]
OSid.vbs –a— 977 bytes [02:46 01/12/2009] [14:00 31/08/2000]
OsVer –a— 40 bytes [02:46 01/12/2009] [02:46 01/12/2009]
P.cmd –a— 17671 bytes [02:46 01/12/2009] [20:53 26/11/2009]
pev.exe –a— 260608 bytes [02:46 01/12/2009] [07:47 14/11/2009]
Policies.dat –a— 2992 bytes [02:46 01/12/2009] [09:51 06/07/2009]
prep.done –a— 3 bytes [02:46 01/12/2009] [02:46 01/12/2009]
Prep.inf –a— 2374 bytes [02:46 01/12/2009] [10:54 14/08/2009]
Purity.dat –a— 404 bytes [02:46 01/12/2009] [14:00 31/08/2000]
pv.com –a— 73728 bytes [02:46 01/12/2009] [05:42 03/03/2006]
RCLink.dat –a— 7478 bytes [02:46 01/12/2009] [14:00 31/08/2000]
REGDACL.sed –a— 3558 bytes [02:46 01/12/2009] [14:00 31/08/2000]
RegDo.sed –a— 9203 bytes [02:46 01/12/2009] [14:00 31/08/2000]
region.dat –a— 1149 bytes [02:46 01/12/2009] [08:29 23/05/2009]
RegScan.cmd –a— 65177 bytes [02:46 01/12/2009] [07:18 20/11/2009]
RegScan64.cmd –a— 17486 bytes [02:46 01/12/2009] [10:30 15/11/2009]
restore_pt.vbs –a— 587 bytes [02:46 01/12/2009] [04:26 02/05/2009]
Rkey.cmd –a— 442 bytes [02:46 01/12/2009] [11:35 15/11/2009]
rogues.dat –a— 820 bytes [02:46 01/12/2009] [14:00 31/08/2000]
run2.sed –a— 287 bytes [02:46 01/12/2009] [14:00 31/08/2000]
Rust.str –a— 30 bytes [02:46 01/12/2009] [17:38 10/06/2009]
safeboot.dat –a— 329 bytes [02:46 01/12/2009] [14:00 31/08/2000]
safeboot.def.dat –a— 1464 bytes [02:46 01/12/2009] [08:25 10/06/2009]
safeboot.def.vista.dat –a— 463 bytes [02:46 01/12/2009] [14:00 31/08/2000]
Safeboot.def.w7.dat –a— 585 bytes [02:46 01/12/2009] [18:00 18/10/2009]
sed.cfxxe –a— 98816 bytes [02:46 01/12/2009] [14:00 31/08/2000]
Set.txt –a— 1905 bytes [02:46 01/12/2009] [02:46 01/12/2009]
SetEnvmt.bat –a— 14382 bytes [02:46 01/12/2009] [07:05 16/11/2009]
setpath.cfxxe –a— 30274 bytes [02:46 01/12/2009] [14:00 31/08/2000]
SnapShot.cmd –a— 3392 bytes [02:46 01/12/2009] [07:00 16/11/2009]
SRestore.cmd –a— 2146 bytes [02:46 01/12/2009] [07:00 16/11/2009]
srizbi.md5 –a— 72080 bytes [02:46 01/12/2009] [11:24 26/11/2009]
SuppScan.cmd –a— 19991 bytes [02:46 01/12/2009] [06:59 16/11/2009]
SvcDrv.vbs –a— 2176 bytes [02:46 01/12/2009] [14:00 31/08/2000]
svchost.dat –a— 555 bytes [02:46 01/12/2009] [14:00 31/08/2000]
svchost.vista.dat –a— 668 bytes [02:46 01/12/2009] [14:00 31/08/2000]
svchost.w7.dat –a— 956 bytes [02:46 01/12/2009] [18:14 18/10/2009]
svchost.w7.x64.dat –a— 290 bytes [02:46 01/12/2009] [06:08 22/10/2009]
svc_wht.dat –a— 12067 bytes [02:46 01/12/2009] [21:17 19/11/2009]
SWREG.cfxxe –a— 161792 bytes [02:46 01/12/2009] [14:00 31/08/2000]
swreg.exe –a— 161792 bytes [02:46 01/12/2009] [14:00 31/08/2000]
swsc.cfxxe –a— 136704 bytes [02:46 01/12/2009] [14:00 31/08/2000]
swxcacls.cfxxe –a— 212480 bytes [02:46 01/12/2009] [14:00 31/08/2000]
system_ini.dat –a— 276 bytes [02:46 01/12/2009] [14:00 31/08/2000]
tail.cfxxe –a— 35328 bytes [02:46 01/12/2009] [14:00 10/11/1999]
toolbar.sed –a— 633 bytes [02:46 01/12/2009] [19:26 30/10/2009]
Update-CF.cmd –a— 2919 bytes [02:46 01/12/2009] [04:53 23/10/2009]
VerCF.bat –a— 27 bytes [02:46 01/12/2009] [02:46 01/12/2009]
VInfo -ra— 7944 bytes [02:46 01/12/2009] [00:46 17/11/2009]
Vista.mac –a— 37 bytes [02:46 01/12/2009] [02:46 01/12/2009]
vistareg.dat –a— 14256 bytes [02:46 01/12/2009] [00:37 06/11/2009]
vun.dat –a— 2834 bytes [02:46 01/12/2009] [20:51 26/11/2009]
w2kreg.dat –a— 38734 bytes [02:46 01/12/2009] [21:49 23/10/2009]
w2k_sock.dll –a— 90202 bytes [02:46 01/12/2009] [21:34 21/06/2009]
W6432.dat –a— 0 bytes [02:46 01/12/2009] [02:46 01/12/2009]
w7reg.dat –a— 14257 bytes [02:46 01/12/2009] [00:52 06/11/2009]
Wmi_rem.vbs –a— 592 bytes [02:46 01/12/2009] [07:08 14/05/2009]
w_sock.dll –a— 98948 bytes [02:46 01/12/2009] [20:45 21/06/2009]
xpreg.dat –a— 54068 bytes [02:46 01/12/2009] [00:39 06/11/2009]
zDomain.dat –a— 23773 bytes [02:46 01/12/2009] [14:00 31/08/2000]
zhsvc.dat –a— 35444 bytes [02:46 01/12/2009] [11:14 26/11/2009]
zip.cfxxe –a— 68096 bytes [02:46 01/12/2009] [14:00 31/08/2000]

C:\32788R22FWJFW\EN-US d—– [02:46 01/12/2009]
cmd.cfxxe.mui –a— 135168 bytes [02:46 01/12/2009] [15:13 02/11/2006]

C:\32788R22FWJFW\License d—– [02:46 01/12/2009]
Curl - license.txt –a— 1070 bytes [02:46 01/12/2009] [14:19 01/04/2009]
dumphive-license.txt –a— 383 bytes [02:46 01/12/2009] [17:38 01/04/2009]
EXTRACT.TXT –a— 7385 bytes [02:46 01/12/2009] [08:10 19/08/1996]
FI - license.txt –a— 212 bytes [02:46 01/12/2009] [09:36 15/11/2007]
iexplore.exe –a— 260608 bytes [02:46 01/12/2009] [07:47 14/11/2009]
mtee.txt.txt –a— 850 bytes [02:46 01/12/2009] [17:06 31/10/2006]
ncmd.cfxxe –a— 2054 bytes [02:46 01/12/2009] [09:55 14/11/2009]
pv_5_2_2.zip –a— 39183 bytes [02:46 01/12/2009] [20:06 13/04/2006]
streamtools.zip –a— 75425 bytes [02:46 01/12/2009] [16:34 01/04/2009]
UnxUtilsDist.html –a— 26383 bytes [02:46 01/12/2009] [08:38 02/04/2009]
Zip - license.txt –a— 3412 bytes [02:46 01/12/2009] [14:40 01/04/2009]

C:\32788R22FWJFW\N_ d—– [02:46 01/12/2009]
1871 –a— 27 bytes [02:46 01/12/2009] [02:46 01/12/2009]
7271 –a— 201 bytes [02:46 01/12/2009] [02:46 01/12/2009]

-=End Of File=-

3. While I'm browsing the internet a new tab w/ the url: http://error404.com/index.php will pop up. It has popped up a new tab with both firefox and ie.

Kaspersky Log

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, December 21, 2009
Operating system: Microsoft Windows Vista Home Premium Edition, 64-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, December 21, 2009 00:36:02
Records in database: 3393868
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 167296
Threats found: 3
Infected objects found: 2
Suspicious objects found: 1
Scan duration: 05:22:40


File name / Threat / Threats count
C:\Users\Kat\AppData\Local\VirtualStore\Windows\SysWOW64\net.net Suspicious: Packed.Win32.PECompact 1
C:\Users\Kat\Music\T.I. - Paper Trail (Explicit) (2008)\11-t.i.-what_up_whats_haapnin.mp3 Infected: Trojan-Downloader.WMA.GetCodec.j 1
C:\_OTL\MovedFiles\12162009_193012\c_programdata\Defence\smss.exe Infected: P2P-Worm.Win32.Agent.xg 1

Selected area has been scanned.


OTL log

OTL logfile created on: 12/21/2009 6:39:25 AM - Run 2
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Users\Kat\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18865)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.90 Gb Total Physical Memory | 1.71 Gb Available Physical Memory | 43.78% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.65 Gb Total Space | 3.10 Gb Free Space | 1.09% Space Free | Partition Type: NTFS
Drive D: | 14.44 Gb Total Space | 2.16 Gb Free Space | 14.98% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KAT-PC
Current User Name: Kat
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Kat\AppData\Local\Temp\jkos-Kat\binaries\ScanningProcess.exe (Kaspersky Lab.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Kat\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\Java\jre6\bin\java.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\Java\jre6\bin\jp2launcher.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Safari\Safari.exe (Apple Inc.)
PRC - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Users\Kat\AppData\Roaming\Document Systems, Inc\DocMagic Online\bin\dmlsvc.exe ()
PRC - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe ()
PRC - C:\Program Files (x86)\The KMPlayer\KMPlayer.exe (Pandora.TV)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\SMINST\BLService.exe ()
PRC - C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe ()
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe ( Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
PRC - C:\Windows\SysWOW64\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
PRC - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG)
PRC - C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Program Files (x86)\Microsoft Office\OFFICE11\ONENOTEM.EXE (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Kat\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18175_none_9e7bbe54
c9c04bca\GdiPlus.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wpdshext.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\fontext.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\comdlg32.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\linkinfo.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV:64bit: - (BthServ) – C:\Windows\SysNative\bthserv.dll ()
SRV:64bit: - (STacSV) – C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_5730ce9f\STacSV64.exe ()
SRV:64bit: - (AESTFilters) – C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_5730ce9f\AESTSr64.exe ()
SRV:64bit: - (hpsrv) – C:\Windows\SysNative\Hpservice.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (avg9wd) – C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (DML Service) – C:\Users\Kat\AppData\Roaming\Document Systems, Inc\DocMagic Online\bin\dmlsvc.exe ()
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Recovery Service for Windows) – C:\Program Files (x86)\SMINST\BLService.exe ()
SRV - (Bonjour Service) – C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (Com4QLBEx) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Hewlett-Packard Development Company, L.P.)
SRV - (hpqwmiex) – C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
SRV - (HP Health Check Service) – c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe (Hewlett-Packard)
SRV - (clr_optimization_v2.0.50727_64) – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (LightScribeService) – C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (WebUpdate4) – C:\Windows\SysWOW64\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
SRV - (NBService) – C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe (Nero AG)
SRV - (NMIndexingService) – C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG)
SRV - (RoxLiveShare9) – C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (Sonic Solutions)
SRV - (RoxWatch9) – C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions)
SRV - (RoxMediaDB9) – C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (Sonic Solutions)
SRV - (Roxio UPnP Renderer 9) – C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe (Sonic Solutions)
SRV - (Roxio Upnp Server 9) – C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe (Sonic Solutions)
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2006/11/02 07:34:14 | 00,000,000 | —D | M]
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (VSS) – C:\Windows\SysWOW64\wbem\vss.mof ()
SRV - (IDriverT) – C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (AvgTdiA) – C:\Windows\SysNative\Drivers\avgtdia.sys ()
DRV:64bit: - (AvgLdx64) – C:\Windows\SysNative\Drivers\avgldx64.sys ()
DRV:64bit: - (AvgMfx64) – C:\Windows\SysNative\Drivers\avgmfx64.sys ()
DRV:64bit: - (BTHPORT) – C:\Windows\SysNative\Drivers\BTHport.sys ()
DRV:64bit: - (RFCOMM) Bluetooth Device (RFCOMM Protocol TDI) – C:\Windows\SysNative\DRIVERS\rfcomm.sys ()
DRV:64bit: - (BTHUSB) – C:\Windows\SysNative\Drivers\BTHUSB.sys ()
DRV:64bit: - (BthEnum) – C:\Windows\SysNative\DRIVERS\BthEnum.sys ()
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys ()
DRV:64bit: - (RimVSerPort) – C:\Windows\SysNative\DRIVERS\RimSerial_AMD64.sys ()
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys ()
DRV:64bit: - (STHDA) – C:\Windows\SysNative\DRIVERS\stwrt64.sys ()
DRV:64bit: - (enecir) – C:\Windows\SysNative\DRIVERS\enecir.sys ()
DRV:64bit: - (igfx) – C:\Windows\SysNative\DRIVERS\igdkmd64.sys ()
DRV:64bit: - (NETw5v64) Intel® – C:\Windows\SysNative\DRIVERS\NETw5v64.sys ()
DRV:64bit: - (JMCR) – C:\Windows\SysNative\DRIVERS\jmcr.sys ()
DRV:64bit: - (IntcHdmiAddService) Intel® – C:\Windows\SysNative\drivers\IntcHdmi.sys ()
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys ()
DRV:64bit: - (hpdskflt) – C:\Windows\SysNative\DRIVERS\hpdskflt.sys ()
DRV:64bit: - (Accelerometer) – C:\Windows\SysNative\DRIVERS\Accelerometer.sys ()
DRV:64bit: - (ApfiltrService) – C:\Windows\SysNative\DRIVERS\Apfiltr.sys ()
DRV:64bit: - (ROOTMODEM) – C:\Windows\SysNative\Drivers\RootMdm.sys ()
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys ()
DRV:64bit: - (usbvideo) USB Video Device (WDM) – C:\Windows\SysNative\Drivers\usbvideo.sys ()
DRV:64bit: - (BthPan) Bluetooth Device (Personal Area Network) – C:\Windows\SysNative\DRIVERS\bthpan.sys ()
DRV:64bit: - (NETw3v64) Intel® – C:\Windows\SysNative\DRIVERS\NETw3v64.sys ()
DRV:64bit: - (sdbus) – C:\Windows\SysNative\DRIVERS\sdbus.sys ()
DRV:64bit: - (CmBatt) – C:\Windows\SysNative\DRIVERS\CmBatt.sys ()
DRV:64bit: - (HpqKbFiltr) – C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys ()
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\Drivers\PxHlpa64.sys ()
DRV:64bit: - (HdAudAddService) – C:\Windows\SysNative\drivers\HdAudio.sys ()
DRV:64bit: - (yukonx64) – C:\Windows\SysNative\DRIVERS\yk60x64.sys ()
DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) – C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl (CyberLink Corp.)
DRV - (Tcpip) – C:\Windows\SysWOW64\wbem\tcpip.mof ()
DRV - (mpsdrv) – C:\Windows\SysWOW64\wbem\mpsdrv.mof ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716
FF - prefs.js..extensions.enabledItems: avg@igeared:3.011.025.005
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type;=yahoo_avg_hs2-tb-web_us&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2009/12/11 14:49:48 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files (x86)\AVG\AVG9\Toolbar\Firefox\avg@igeared [2009/12/16 10:53:40 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2009/12/17 23:12:43 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2009/12/17 23:12:43 | 00,000,000 | —D | M]

[2009/09/18 20:29:34 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Mozilla\Extensions
[2009/12/20 23:40:18 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Mozilla\Firefox\Profiles\yisqu8qt.default\extensions
[2009/12/20 23:40:18 | 00,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions

O1 HOSTS File: (98 bytes) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files (x86)\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe ()
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe ()
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DVDAgent] C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe ( Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TSMAgent] C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - Startup: C:\Users\Kat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files (x86)\Microsoft Office\OFFICE11\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O8:64bit: - Extra context menu item: Download Link Using Mega Manager… - C:\Program Files (x86)\Megaupload\Mega Manager\mm_file.htm ()
O8 - Extra context menu item: Download Link Using Mega Manager… - C:\Program Files (x86)\Megaupload\Mega Manager\mm_file.htm ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysNative\wshbth.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysWOW64\wshbth.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {2149D9FD-6788-49FF-981A-CB147D3CE521} http://go.autorealty.net/cgi-bin/ACWinAX.CAB (ACWinAX.AutoContract)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E1AC9563-A1E3-45B8-A5CE-5C19E34EC6AC} http://www.arirang.co.kr/AlwaysTop.cab (ComTop Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files (x86)\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll ()
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{00809676-b145-11de-b7b8-0026229b7131}\Shell - "" = AutoRun
O33 - MountPoints2\{00809676-b145-11de-b7b8-0026229b7131}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\AutoRun\command - "" = F:\Autorun.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\Shell00\Command - "" = F:\Autorun.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\Shell01\Command - "" = F:\Autorun.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\Shell02\Command - "" = F:\Autorun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - comfile [open] – "%1" %* File not found
64bit: O35 - exefile [open] – "%1" %* File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009/12/20 18:41:10 | 00,000,000 | —D | C] – C:\Windows\Sun
[2009/12/20 15:43:04 | 00,000,000 | —D | C] – C:\Users\Kat\AppData\Roaming\vlc
[2009/12/20 15:41:19 | 00,000,000 | —D | C] – C:\Program Files\VLC
[2009/12/18 09:44:32 | 00,000,000 | —D | C] – C:\Users\Kat\AppData\Local\ICS
[2009/12/17 18:02:00 | 00,000,000 | —D | C] – C:\Visual Studio
[2009/12/17 17:55:47 | 00,000,000 | —D | C] – C:\Users\Kat\AppData\Local\Apps
[2009/12/16 19:53:50 | 00,000,000 | —D | C] – C:\Rooter$
[2009/12/16 19:49:53 | 00,173,119 | —- | C] (Eric_71) – C:\Users\Kat\Desktop\Rooter.exe
[2009/12/16 19:30:12 | 00,000,000 | —D | C] – C:\_OTL
[2009/12/16 19:28:47 | 00,538,112 | —- | C] (OldTimer Tools) – C:\Users\Kat\Desktop\OTL.exe
[2009/12/11 16:36:58 | 00,472,064 | —- | C] ( ) – C:\Users\Kat\Desktop\RootRepeal.exe
[2009/12/11 16:04:17 | 00,000,000 | —D | C] – C:\Windows\ERDNT
[2009/12/11 16:02:22 | 00,000,000 | —D | C] – C:\Program Files (x86)\ERUNT
[2009/12/09 21:28:25 | 00,916,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wininet.dll
[2009/12/09 21:28:24 | 00,594,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2009/12/09 21:28:24 | 00,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iedkcs32.dll
[2009/12/09 21:28:24 | 00,206,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2009/12/09 21:28:22 | 01,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2009/12/09 21:28:22 | 00,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2009/12/09 21:28:22 | 00,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2009/12/09 21:28:22 | 00,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2009/12/09 21:28:22 | 00,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2009/12/09 21:28:22 | 00,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedsbs.dll
[2009/12/09 21:28:21 | 00,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2009/12/09 21:28:21 | 00,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2009/12/09 21:28:21 | 00,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2009/12/09 21:28:21 | 00,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jsproxy.dll
[2009/12/09 21:28:21 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2009/12/08 22:43:49 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshhttp.dll
[2009/12/08 22:43:44 | 00,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\httpapi.dll
[2009/12/08 22:42:00 | 00,281,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\raschap.dll
[2009/12/08 22:42:00 | 00,244,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rastls.dll
[2009/12/01 13:22:02 | 00,000,000 | —D | C] – C:\Users\Kat\Documents\My Exams
[2009/12/01 10:42:23 | 00,000,000 | —D | C] – C:\Program Files (x86)\Electronic Bluebook
[2009/12/01 10:41:43 | 00,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2009/11/26 00:42:24 | 00,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deploytk.dll
[2009/11/26 00:42:24 | 00,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2009/11/26 00:42:24 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2009/11/26 00:42:24 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2009/11/26 00:29:13 | 00,000,000 | -H-D | C] – C:\$AVG
[2009/11/26 00:27:35 | 00,000,000 | —D | C] – C:\ProgramData\avg9
[2009/11/24 14:13:25 | 00,714,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\timedate.cpl

========== Files - Modified Within 30 Days ==========

[2009/12/21 06:38:35 | 02,359,296 | -HS- | M] () – C:\Users\Kat\NTUSER.DAT
[2009/12/21 05:39:45 | 00,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/12/21 05:39:45 | 00,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/12/21 00:08:12 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/12/20 23:48:03 | 00,208,896 | —- | M] () – C:\Users\Kat\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/20 21:05:18 | 00,709,336 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2009/12/20 21:05:18 | 00,598,588 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2009/12/20 21:05:18 | 00,102,194 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2009/12/20 17:57:52 | 46,855,652 | —- | M] () – C:\Windows\SysNative\drivers\Avg\incavi.avm
[2009/12/20 17:57:21 | 00,127,520 | —- | M] () – C:\Windows\SysNative\drivers\Avg\microavi.avg
[2009/12/19 23:18:35 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/12/19 23:18:26 | 41,932,10368 | -HS- | M] () – C:\hiberfil.sys
[2009/12/19 23:17:42 | 00,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2009/12/19 23:17:36 | 00,524,288 | -HS- | M] () – C:\Users\Kat\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms
[2009/12/19 23:17:36 | 00,065,536 | -HS- | M] () – C:\Users\Kat\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf
[2009/12/19 23:17:33 | 03,464,637 | -H– | M] () – C:\Users\Kat\AppData\Local\IconCache.db
[2009/12/17 22:42:07 | 00,102,660 | —- | M] () – C:\Users\Kat\Desktop\SystemLook.exe
[2009/12/16 19:58:41 | 00,006,080 | —- | M] () – C:\Users\Kat\AppData\Local\d3d9caps.dat
[2009/12/16 19:55:16 | 00,173,119 | —- | M] (Eric_71) – C:\Users\Kat\Desktop\Rooter.exe
[2009/12/16 19:28:47 | 00,538,112 | —- | M] (OldTimer Tools) – C:\Users\Kat\Desktop\OTL.exe
[2009/12/15 09:12:20 | 00,690,960 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2009/12/12 15:19:20 | 00,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2009/12/11 16:50:19 | 00,472,064 | —- | M] ( ) – C:\Users\Kat\Desktop\RootRepeal.exe
[2009/12/11 16:33:23 | 00,524,288 | —- | M] () – C:\Users\Kat\Desktop\dds.scr
[2009/12/11 16:02:26 | 00,000,723 | —- | M] () – C:\Users\Kat\Desktop\NTREGOPT.lnk
[2009/12/11 16:02:25 | 00,000,704 | —- | M] () – C:\Users\Kat\Desktop\ERUNT.lnk
[2009/12/08 09:25:10 | 00,000,368 | —- | M] () – C:\Users\Kat\Documents\Pictures - Shortcut.lnk
[2009/12/05 11:30:11 | 00,001,866 | —- | M] () – C:\Users\Public\Desktop\Safari.lnk
[2009/12/01 13:20:19 | 00,000,031 | —- | M] () – C:\Windows\WebUpdateSvc4.INI
[2009/12/01 13:20:14 | 00,002,385 | —- | M] () – C:\Users\Kat\Desktop\Electronic Bluebook.lnk
[2009/12/01 10:44:32 | 00,047,624 | —- | M] () – C:\Windows\SysWow64\wuwuninst.exe
[2009/12/01 10:42:59 | 00,000,301 | —- | M] () – C:\Windows\{F03C81CA-4445-4D53-B4B3-6B85CA0C5EB4}_WiseFW.ini
[2009/11/26 23:44:03 | 00,707,184 | —- | M] () – C:\Users\Kat\AppData\Local\rx_image.Cache
[2009/11/26 23:44:03 | 00,033,728 | —- | M] () – C:\Users\Kat\AppData\Local\rx_audio.Cache
[2009/11/26 00:41:28 | 00,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2009/11/26 00:41:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2009/11/26 00:41:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2009/11/26 00:41:27 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deploytk.dll
[2009/11/26 00:28:36 | 00,001,649 | —- | M] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2009/11/26 00:28:30 | 00,470,024 | —- | M] () – C:\Windows\SysNative\drivers\avgtdia.sys
[2009/11/26 00:28:30 | 00,422,920 | —- | M] () – C:\Windows\SysNative\drivers\avgldx64.sys
[2009/11/26 00:28:30 | 00,113,461 | —- | M] () – C:\Windows\SysNative\drivers\Avg\iavichjw.avm
[2009/11/26 00:28:30 | 00,034,248 | —- | M] () – C:\Windows\SysNative\drivers\avgmfx64.sys
[2009/11/26 00:28:30 | 00,012,464 | —- | M] () – C:\Windows\SysNative\avgrssta.dll

========== Files Created - No Company Name ==========

[2009/12/20 21:05:18 | 00,709,336 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2009/12/17 22:42:07 | 00,102,660 | —- | C] () – C:\Users\Kat\Desktop\SystemLook.exe
[2009/12/12 15:19:20 | 00,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2009/12/11 16:04:59 | 00,524,288 | —- | C] () – C:\Users\Kat\Desktop\dds.scr
[2009/12/11 16:02:26 | 00,000,723 | —- | C] () – C:\Users\Kat\Desktop\NTREGOPT.lnk
[2009/12/11 16:02:25 | 00,000,704 | —- | C] () – C:\Users\Kat\Desktop\ERUNT.lnk
[2009/12/09 21:28:29 | 09,237,504 | —- | C] () – C:\Windows\SysNative\mshtml.dll
[2009/12/09 21:28:28 | 12,462,080 | —- | C] () – C:\Windows\SysNative\ieframe.dll
[2009/12/09 21:28:26 | 02,334,208 | —- | C] () – C:\Windows\SysNative\iertutil.dll
[2009/12/09 21:28:25 | 01,484,288 | —- | C] () – C:\Windows\SysNative\urlmon.dll
[2009/12/09 21:28:24 | 01,147,904 | —- | C] () – C:\Windows\SysNative\wininet.dll
[2009/12/09 21:28:24 | 00,459,776 | —- | C] () – C:\Windows\SysNative\iedkcs32.dll
[2009/12/09 21:28:24 | 00,243,712 | —- | C] () – C:\Windows\SysNative\occache.dll
[2009/12/09 21:28:22 | 01,538,560 | —- | C] () – C:\Windows\SysNative\inetcpl.cpl
[2009/12/09 21:28:22 | 00,700,928 | —- | C] () – C:\Windows\SysNative\msfeeds.dll
[2009/12/09 21:28:22 | 00,162,816 | —- | C] () – C:\Windows\SysNative\ieUnatt.exe
[2009/12/09 21:28:22 | 00,070,656 | —- | C] () – C:\Windows\SysNative\ie4uinit.exe
[2009/12/09 21:28:21 | 01,638,912 | —- | C] () – C:\Windows\SysNative\mshtml.tlb
[2009/12/09 21:28:21 | 00,252,416 | —- | C] () – C:\Windows\SysNative\iepeers.dll
[2009/12/09 21:28:21 | 00,219,136 | —- | C] () – C:\Windows\SysNative\ieui.dll
[2009/12/09 21:28:21 | 00,132,096 | —- | C] () – C:\Windows\SysNative\iesysprep.dll
[2009/12/09 21:28:21 | 00,077,312 | —- | C] () – C:\Windows\SysNative\iesetup.dll
[2009/12/09 21:28:21 | 00,072,192 | —- | C] () – C:\Windows\SysNative\iernonce.dll
[2009/12/09 21:28:21 | 00,071,680 | —- | C] () – C:\Windows\SysNative\msfeedsbs.dll
[2009/12/09 21:28:21 | 00,031,744 | —- | C] () – C:\Windows\SysNative\jsproxy.dll
[2009/12/09 21:28:21 | 00,012,288 | —- | C] () – C:\Windows\SysNative\msfeedssync.exe
[2009/12/08 22:43:49 | 00,032,768 | —- | C] () – C:\Windows\SysNative\nshhttp.dll
[2009/12/08 22:43:44 | 00,610,304 | —- | C] () – C:\Windows\SysNative\drivers\http.sys
[2009/12/08 22:43:44 | 00,033,792 | —- | C] () – C:\Windows\SysNative\httpapi.dll
[2009/12/08 22:42:40 | 00,442,368 | —- | C] () – C:\Windows\SysNative\winhttp.dll
[2009/12/08 22:42:00 | 00,295,936 | —- | C] () – C:\Windows\SysNative\raschap.dll
[2009/12/08 22:42:00 | 00,280,576 | —- | C] () – C:\Windows\SysNative\rastls.dll
[2009/12/08 09:25:10 | 00,000,368 | —- | C] () – C:\Users\Kat\Documents\Pictures - Shortcut.lnk
[2009/12/01 10:45:04 | 00,000,031 | —- | C] () – C:\Windows\WebUpdateSvc4.INI
[2009/12/01 10:44:32 | 00,047,624 | —- | C] () – C:\Windows\SysWow64\wuwuninst.exe
[2009/12/01 10:42:25 | 00,002,385 | —- | C] () – C:\Users\Kat\Desktop\Electronic Bluebook.lnk
[2009/12/01 10:42:20 | 00,000,301 | —- | C] () – C:\Windows\{F03C81CA-4445-4D53-B4B3-6B85CA0C5EB4}_WiseFW.ini
[2009/11/26 00:28:36 | 00,001,649 | —- | C] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2009/11/25 06:47:54 | 00,002,048 | —- | C] () – C:\Windows\SysNative\tzres.dll
[2009/11/24 14:13:30 | 01,875,456 | —- | C] () – C:\Windows\SysNative\msxml3.dll
[2009/11/24 14:13:29 | 01,794,560 | —- | C] () – C:\Windows\SysNative\msxml6.dll
[2009/11/24 14:13:25 | 00,880,640 | —- | C] () – C:\Windows\SysNative\timedate.cpl
[2009/10/29 15:23:47 | 00,006,080 | —- | C] () – C:\Users\Kat\AppData\Local\d3d9caps.dat
[2009/10/05 18:11:42 | 00,707,184 | —- | C] () – C:\Users\Kat\AppData\Local\rx_image.Cache
[2009/10/05 18:11:42 | 00,033,728 | —- | C] () – C:\Users\Kat\AppData\Local\rx_audio.Cache
[2009/09/25 17:28:00 | 00,208,896 | —- | C] () – C:\Users\Kat\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/25 14:11:02 | 00,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/09/18 17:53:36 | 00,000,000 | —- | C] () – C:\Users\Kat\AppData\Local\QSwitch.txt
[2009/09/18 17:53:36 | 00,000,000 | —- | C] () – C:\Users\Kat\AppData\Local\DSwitch.txt
[2009/09/18 17:53:36 | 00,000,000 | —- | C] () – C:\Users\Kat\AppData\Local\AtStart.txt
[2008/01/20 20:50:05 | 00,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2008/01/20 20:49:49 | 00,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2009/09/26 08:20:52 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Blackberry Desktop
[2009/10/15 09:32:48 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Document Systems, Inc
[2009/09/25 15:54:28 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Megaupload
[2009/09/26 08:35:07 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Research In Motion
[2009/12/20 18:40:32 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\uTorrent
[2009/11/30 14:46:18 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\WebEx
[2009/12/19 23:17:41 | 00,030,250 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2009/10/04 13:27:10 | 00,000,000 | —D | M](C:\Users\Kat\AppData\Roaming\???????sAppData) – C:\Users\Kat\AppData\Roaming\敎潲䍄敔灭慬整sAppData
[2009/10/04 13:27:10 | 00,000,000 | —D | M](C:\Users\Kat\AppData\Roaming\???????sAppData) – C:\Users\Kat\AppData\Roaming\敎潲䍄敔灭慬整sAppData
(C:\Users\Kat\AppData\Roaming\???????sAppData) – C:\Users\Kat\AppData\Roaming\敎潲䍄敔灭慬整sAppData
< End of report >

The extras.txt did not pop open nor is it in the folder. I ran it again and same thing.

1.

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
========== FILES ==========
File\Folder C:\Users\Kat\AppData\Local\VirtualStore\Windows\SysWOW64\net.net not found.
File\Folder C:\Users\Kat\Music\T.I. - Paper Trail (Explicit) (2008)\11-t.i.-what_up_whats_haapnin.mp3 not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Kat
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 81920 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 0.11 mb


OTL by OldTimer - Version 3.1.17.0 log created on 12232009_074423

Files\Folders moved on Reboot…
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.

Registry entries deleted on Reboot…


2.

OTL logfile created on: 12/23/2009 7:46:44 AM - Run 3
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Users\Kat\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18865)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.90 Gb Total Physical Memory | 2.55 Gb Available Physical Memory | 65.40% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.65 Gb Total Space | 3.02 Gb Free Space | 1.06% Space Free | Partition Type: NTFS
Drive D: | 14.44 Gb Total Space | 2.16 Gb Free Space | 14.98% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KAT-PC
Current User Name: Kat
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Kat\AppData\Roaming\Document Systems, Inc\DocMagic Online\bin\dmlsvc.exe ()
PRC - C:\Users\Kat\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\SMINST\BLService.exe ()
PRC - C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe ()
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe ( Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
PRC - C:\Windows\SysWOW64\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
PRC - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG)
PRC - C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Program Files (x86)\Microsoft Office\OFFICE11\ONENOTEM.EXE (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Kat\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV:64bit: - (BthServ) – C:\Windows\SysNative\bthserv.dll ()
SRV:64bit: - (STacSV) – C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_5730ce9f\STacSV64.exe ()
SRV:64bit: - (AESTFilters) – C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_5730ce9f\AESTSr64.exe ()
SRV:64bit: - (hpsrv) – C:\Windows\SysNative\Hpservice.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (DML Service) – C:\Users\Kat\AppData\Roaming\Document Systems, Inc\DocMagic Online\bin\dmlsvc.exe ()
SRV - (avg9wd) – C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Recovery Service for Windows) – C:\Program Files (x86)\SMINST\BLService.exe ()
SRV - (Bonjour Service) – C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (Com4QLBEx) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Hewlett-Packard Development Company, L.P.)
SRV - (hpqwmiex) – C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
SRV - (HP Health Check Service) – c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe (Hewlett-Packard)
SRV - (clr_optimization_v2.0.50727_64) – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (LightScribeService) – C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (WebUpdate4) – C:\Windows\SysWOW64\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
SRV - (NBService) – C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe (Nero AG)
SRV - (NMIndexingService) – C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG)
SRV - (RoxLiveShare9) – C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (Sonic Solutions)
SRV - (RoxWatch9) – C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions)
SRV - (RoxMediaDB9) – C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (Sonic Solutions)
SRV - (Roxio UPnP Renderer 9) – C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe (Sonic Solutions)
SRV - (Roxio Upnp Server 9) – C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe (Sonic Solutions)
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2006/11/02 07:34:14 | 00,000,000 | —D | M]
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (VSS) – C:\Windows\SysWOW64\wbem\vss.mof ()
SRV - (IDriverT) – C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (AvgTdiA) – C:\Windows\SysNative\Drivers\avgtdia.sys ()
DRV:64bit: - (AvgLdx64) – C:\Windows\SysNative\Drivers\avgldx64.sys ()
DRV:64bit: - (AvgMfx64) – C:\Windows\SysNative\Drivers\avgmfx64.sys ()
DRV:64bit: - (BTHPORT) – C:\Windows\SysNative\Drivers\BTHport.sys ()
DRV:64bit: - (RFCOMM) Bluetooth Device (RFCOMM Protocol TDI) – C:\Windows\SysNative\DRIVERS\rfcomm.sys ()
DRV:64bit: - (BTHUSB) – C:\Windows\SysNative\Drivers\BTHUSB.sys ()
DRV:64bit: - (BthEnum) – C:\Windows\SysNative\DRIVERS\BthEnum.sys ()
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys ()
DRV:64bit: - (RimVSerPort) – C:\Windows\SysNative\DRIVERS\RimSerial_AMD64.sys ()
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys ()
DRV:64bit: - (STHDA) – C:\Windows\SysNative\DRIVERS\stwrt64.sys ()
DRV:64bit: - (enecir) – C:\Windows\SysNative\DRIVERS\enecir.sys ()
DRV:64bit: - (igfx) – C:\Windows\SysNative\DRIVERS\igdkmd64.sys ()
DRV:64bit: - (NETw5v64) Intel® – C:\Windows\SysNative\DRIVERS\NETw5v64.sys ()
DRV:64bit: - (JMCR) – C:\Windows\SysNative\DRIVERS\jmcr.sys ()
DRV:64bit: - (IntcHdmiAddService) Intel® – C:\Windows\SysNative\drivers\IntcHdmi.sys ()
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys ()
DRV:64bit: - (hpdskflt) – C:\Windows\SysNative\DRIVERS\hpdskflt.sys ()
DRV:64bit: - (Accelerometer) – C:\Windows\SysNative\DRIVERS\Accelerometer.sys ()
DRV:64bit: - (ApfiltrService) – C:\Windows\SysNative\DRIVERS\Apfiltr.sys ()
DRV:64bit: - (ROOTMODEM) – C:\Windows\SysNative\Drivers\RootMdm.sys ()
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys ()
DRV:64bit: - (usbvideo) USB Video Device (WDM) – C:\Windows\SysNative\Drivers\usbvideo.sys ()
DRV:64bit: - (BthPan) Bluetooth Device (Personal Area Network) – C:\Windows\SysNative\DRIVERS\bthpan.sys ()
DRV:64bit: - (NETw3v64) Intel® – C:\Windows\SysNative\DRIVERS\NETw3v64.sys ()
DRV:64bit: - (sdbus) – C:\Windows\SysNative\DRIVERS\sdbus.sys ()
DRV:64bit: - (CmBatt) – C:\Windows\SysNative\DRIVERS\CmBatt.sys ()
DRV:64bit: - (HpqKbFiltr) – C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys ()
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\Drivers\PxHlpa64.sys ()
DRV:64bit: - (HdAudAddService) – C:\Windows\SysNative\drivers\HdAudio.sys ()
DRV:64bit: - (yukonx64) – C:\Windows\SysNative\DRIVERS\yk60x64.sys ()
DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) – C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl (CyberLink Corp.)
DRV - (Tcpip) – C:\Windows\SysWOW64\wbem\tcpip.mof ()
DRV - (mpsdrv) – C:\Windows\SysWOW64\wbem\mpsdrv.mof ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716
FF - prefs.js..extensions.enabledItems: avg@igeared:3.011.025.005
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type;=yahoo_avg_hs2-tb-web_us&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2009/12/11 14:49:48 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files (x86)\AVG\AVG9\Toolbar\Firefox\avg@igeared [2009/12/16 10:53:40 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2009/12/17 23:12:43 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2009/12/17 23:12:43 | 00,000,000 | —D | M]

[2009/09/18 20:29:34 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Mozilla\Extensions
[2009/12/22 06:59:17 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Mozilla\Firefox\Profiles\yisqu8qt.default\extensions
[2009/12/20 23:40:18 | 00,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions

O1 HOSTS File: (98 bytes) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files (x86)\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe ()
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe ()
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DVDAgent] C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe ( Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TSMAgent] C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - Startup: C:\Users\Kat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files (x86)\Microsoft Office\OFFICE11\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O8:64bit: - Extra context menu item: Download Link Using Mega Manager… - C:\Program Files (x86)\Megaupload\Mega Manager\mm_file.htm ()
O8 - Extra context menu item: Download Link Using Mega Manager… - C:\Program Files (x86)\Megaupload\Mega Manager\mm_file.htm ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysNative\wshbth.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysWOW64\wshbth.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {2149D9FD-6788-49FF-981A-CB147D3CE521} http://go.autorealty.net/cgi-bin/ACWinAX.CAB (ACWinAX.AutoContract)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E1AC9563-A1E3-45B8-A5CE-5C19E34EC6AC} http://www.arirang.co.kr/AlwaysTop.cab (ComTop Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files (x86)\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll ()
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{00809676-b145-11de-b7b8-0026229b7131}\Shell - "" = AutoRun
O33 - MountPoints2\{00809676-b145-11de-b7b8-0026229b7131}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\AutoRun\command - "" = F:\Autorun.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\Shell00\Command - "" = F:\Autorun.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\Shell01\Command - "" = F:\Autorun.exe – File not found
O33 - MountPoints2\{943d09b0-d7d4-11de-80ab-0026229b7131}\Shell\Shell02\Command - "" = F:\Autorun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - comfile [open] – "%1" %* File not found
64bit: O35 - exefile [open] – "%1" %* File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009/12/20 18:41:10 | 00,000,000 | —D | C] – C:\Windows\Sun
[2009/12/20 15:43:04 | 00,000,000 | —D | C] – C:\Users\Kat\AppData\Roaming\vlc
[2009/12/20 15:41:19 | 00,000,000 | —D | C] – C:\Program Files\VLC
[2009/12/18 09:44:32 | 00,000,000 | —D | C] – C:\Users\Kat\AppData\Local\ICS
[2009/12/17 18:02:00 | 00,000,000 | —D | C] – C:\Visual Studio
[2009/12/17 17:55:47 | 00,000,000 | —D | C] – C:\Users\Kat\AppData\Local\Apps
[2009/12/16 19:53:50 | 00,000,000 | —D | C] – C:\Rooter$
[2009/12/16 19:49:53 | 00,173,119 | —- | C] (Eric_71) – C:\Users\Kat\Desktop\Rooter.exe
[2009/12/16 19:30:12 | 00,000,000 | —D | C] – C:\_OTL
[2009/12/16 19:28:47 | 00,538,112 | —- | C] (OldTimer Tools) – C:\Users\Kat\Desktop\OTL.exe
[2009/12/11 16:36:58 | 00,472,064 | —- | C] ( ) – C:\Users\Kat\Desktop\RootRepeal.exe
[2009/12/11 16:04:17 | 00,000,000 | —D | C] – C:\Windows\ERDNT
[2009/12/11 16:02:22 | 00,000,000 | —D | C] – C:\Program Files (x86)\ERUNT
[2009/12/09 21:28:25 | 00,916,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wininet.dll
[2009/12/09 21:28:24 | 00,594,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2009/12/09 21:28:24 | 00,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iedkcs32.dll
[2009/12/09 21:28:24 | 00,206,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2009/12/09 21:28:22 | 01,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2009/12/09 21:28:22 | 00,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2009/12/09 21:28:22 | 00,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2009/12/09 21:28:22 | 00,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2009/12/09 21:28:22 | 00,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2009/12/09 21:28:22 | 00,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedsbs.dll
[2009/12/09 21:28:21 | 00,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2009/12/09 21:28:21 | 00,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2009/12/09 21:28:21 | 00,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2009/12/09 21:28:21 | 00,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jsproxy.dll
[2009/12/09 21:28:21 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2009/12/08 22:43:49 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshhttp.dll
[2009/12/08 22:43:44 | 00,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\httpapi.dll
[2009/12/08 22:42:00 | 00,281,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\raschap.dll
[2009/12/08 22:42:00 | 00,244,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rastls.dll
[2009/12/01 13:22:02 | 00,000,000 | —D | C] – C:\Users\Kat\Documents\My Exams
[2009/12/01 10:42:23 | 00,000,000 | —D | C] – C:\Program Files (x86)\Electronic Bluebook
[2009/12/01 10:41:43 | 00,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2009/11/26 00:42:24 | 00,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deploytk.dll
[2009/11/26 00:42:24 | 00,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2009/11/26 00:42:24 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2009/11/26 00:42:24 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2009/11/26 00:29:13 | 00,000,000 | -H-D | C] – C:\$AVG
[2009/11/26 00:27:35 | 00,000,000 | —D | C] – C:\ProgramData\avg9
[2009/11/24 14:13:25 | 00,714,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\timedate.cpl

========== Files - Modified Within 30 Days ==========

[2009/12/23 07:47:08 | 02,359,296 | -HS- | M] () – C:\Users\Kat\NTUSER.DAT
[2009/12/23 07:45:35 | 00,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/12/23 07:45:35 | 00,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/12/23 07:45:33 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/12/23 07:45:21 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/12/23 07:45:16 | 41,932,10368 | -HS- | M] () – C:\hiberfil.sys
[2009/12/23 07:44:35 | 00,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2009/12/23 07:44:33 | 00,524,288 | -HS- | M] () – C:\Users\Kat\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms
[2009/12/23 07:44:33 | 00,065,536 | -HS- | M] () – C:\Users\Kat\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf
[2009/12/23 07:44:31 | 03,533,954 | -H– | M] () – C:\Users\Kat\AppData\Local\IconCache.db
[2009/12/22 18:43:47 | 46,921,834 | —- | M] () – C:\Windows\SysNative\drivers\Avg\incavi.avm
[2009/12/22 10:52:13 | 00,000,299 | —- | M] () – C:\Users\Kat\Desktop\DocMagic Online.url
[2009/12/22 09:54:42 | 00,127,709 | —- | M] () – C:\Windows\SysNative\drivers\Avg\microavi.avg
[2009/12/20 23:48:03 | 00,208,896 | —- | M] () – C:\Users\Kat\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/20 21:05:18 | 00,709,336 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2009/12/20 21:05:18 | 00,598,588 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2009/12/20 21:05:18 | 00,102,194 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2009/12/17 22:42:07 | 00,102,660 | —- | M] () – C:\Users\Kat\Desktop\SystemLook.exe
[2009/12/16 19:55:16 | 00,173,119 | —- | M] (Eric_71) – C:\Users\Kat\Desktop\Rooter.exe
[2009/12/16 19:28:47 | 00,538,112 | —- | M] (OldTimer Tools) – C:\Users\Kat\Desktop\OTL.exe
[2009/12/15 09:12:20 | 00,690,960 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2009/12/12 15:19:20 | 00,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2009/12/11 16:50:19 | 00,472,064 | —- | M] ( ) – C:\Users\Kat\Desktop\RootRepeal.exe
[2009/12/11 16:33:23 | 00,524,288 | —- | M] () – C:\Users\Kat\Desktop\dds.scr
[2009/12/11 16:02:26 | 00,000,723 | —- | M] () – C:\Users\Kat\Desktop\NTREGOPT.lnk
[2009/12/11 16:02:25 | 00,000,704 | —- | M] () – C:\Users\Kat\Desktop\ERUNT.lnk
[2009/12/08 09:25:10 | 00,000,368 | —- | M] () – C:\Users\Kat\Documents\Pictures - Shortcut.lnk
[2009/12/05 11:30:11 | 00,001,866 | —- | M] () – C:\Users\Public\Desktop\Safari.lnk
[2009/12/01 13:20:19 | 00,000,031 | —- | M] () – C:\Windows\WebUpdateSvc4.INI
[2009/12/01 13:20:14 | 00,002,385 | —- | M] () – C:\Users\Kat\Desktop\Electronic Bluebook.lnk
[2009/12/01 10:44:32 | 00,047,624 | —- | M] () – C:\Windows\SysWow64\wuwuninst.exe
[2009/12/01 10:42:59 | 00,000,301 | —- | M] () – C:\Windows\{F03C81CA-4445-4D53-B4B3-6B85CA0C5EB4}_WiseFW.ini
[2009/11/26 23:44:03 | 00,707,184 | —- | M] () – C:\Users\Kat\AppData\Local\rx_image.Cache
[2009/11/26 23:44:03 | 00,033,728 | —- | M] () – C:\Users\Kat\AppData\Local\rx_audio.Cache
[2009/11/26 00:41:28 | 00,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2009/11/26 00:41:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2009/11/26 00:41:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2009/11/26 00:41:27 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deploytk.dll
[2009/11/26 00:28:36 | 00,001,649 | —- | M] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2009/11/26 00:28:30 | 00,470,024 | —- | M] () – C:\Windows\SysNative\drivers\avgtdia.sys
[2009/11/26 00:28:30 | 00,422,920 | —- | M] () – C:\Windows\SysNative\drivers\avgldx64.sys
[2009/11/26 00:28:30 | 00,113,461 | —- | M] () – C:\Windows\SysNative\drivers\Avg\iavichjw.avm
[2009/11/26 00:28:30 | 00,034,248 | —- | M] () – C:\Windows\SysNative\drivers\avgmfx64.sys
[2009/11/26 00:28:30 | 00,012,464 | —- | M] () – C:\Windows\SysNative\avgrssta.dll

========== Files Created - No Company Name ==========

[2009/12/20 21:05:18 | 00,709,336 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2009/12/17 22:42:07 | 00,102,660 | —- | C] () – C:\Users\Kat\Desktop\SystemLook.exe
[2009/12/12 15:19:20 | 00,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2009/12/11 16:04:59 | 00,524,288 | —- | C] () – C:\Users\Kat\Desktop\dds.scr
[2009/12/11 16:02:26 | 00,000,723 | —- | C] () – C:\Users\Kat\Desktop\NTREGOPT.lnk
[2009/12/11 16:02:25 | 00,000,704 | —- | C] () – C:\Users\Kat\Desktop\ERUNT.lnk
[2009/12/09 21:28:29 | 09,237,504 | —- | C] () – C:\Windows\SysNative\mshtml.dll
[2009/12/09 21:28:28 | 12,462,080 | —- | C] () – C:\Windows\SysNative\ieframe.dll
[2009/12/09 21:28:26 | 02,334,208 | —- | C] () – C:\Windows\SysNative\iertutil.dll
[2009/12/09 21:28:25 | 01,484,288 | —- | C] () – C:\Windows\SysNative\urlmon.dll
[2009/12/09 21:28:24 | 01,147,904 | —- | C] () – C:\Windows\SysNative\wininet.dll
[2009/12/09 21:28:24 | 00,459,776 | —- | C] () – C:\Windows\SysNative\iedkcs32.dll
[2009/12/09 21:28:24 | 00,243,712 | —- | C] () – C:\Windows\SysNative\occache.dll
[2009/12/09 21:28:22 | 01,538,560 | —- | C] () – C:\Windows\SysNative\inetcpl.cpl
[2009/12/09 21:28:22 | 00,700,928 | —- | C] () – C:\Windows\SysNative\msfeeds.dll
[2009/12/09 21:28:22 | 00,162,816 | —- | C] () – C:\Windows\SysNative\ieUnatt.exe
[2009/12/09 21:28:22 | 00,070,656 | —- | C] () – C:\Windows\SysNative\ie4uinit.exe
[2009/12/09 21:28:21 | 01,638,912 | —- | C] () – C:\Windows\SysNative\mshtml.tlb
[2009/12/09 21:28:21 | 00,252,416 | —- | C] () – C:\Windows\SysNative\iepeers.dll
[2009/12/09 21:28:21 | 00,219,136 | —- | C] () – C:\Windows\SysNative\ieui.dll
[2009/12/09 21:28:21 | 00,132,096 | —- | C] () – C:\Windows\SysNative\iesysprep.dll
[2009/12/09 21:28:21 | 00,077,312 | —- | C] () – C:\Windows\SysNative\iesetup.dll
[2009/12/09 21:28:21 | 00,072,192 | —- | C] () – C:\Windows\SysNative\iernonce.dll
[2009/12/09 21:28:21 | 00,071,680 | —- | C] () – C:\Windows\SysNative\msfeedsbs.dll
[2009/12/09 21:28:21 | 00,031,744 | —- | C] () – C:\Windows\SysNative\jsproxy.dll
[2009/12/09 21:28:21 | 00,012,288 | —- | C] () – C:\Windows\SysNative\msfeedssync.exe
[2009/12/08 22:43:49 | 00,032,768 | —- | C] () – C:\Windows\SysNative\nshhttp.dll
[2009/12/08 22:43:44 | 00,610,304 | —- | C] () – C:\Windows\SysNative\drivers\http.sys
[2009/12/08 22:43:44 | 00,033,792 | —- | C] () – C:\Windows\SysNative\httpapi.dll
[2009/12/08 22:42:40 | 00,442,368 | —- | C] () – C:\Windows\SysNative\winhttp.dll
[2009/12/08 22:42:00 | 00,295,936 | —- | C] () – C:\Windows\SysNative\raschap.dll
[2009/12/08 22:42:00 | 00,280,576 | —- | C] () – C:\Windows\SysNative\rastls.dll
[2009/12/08 09:25:10 | 00,000,368 | —- | C] () – C:\Users\Kat\Documents\Pictures - Shortcut.lnk
[2009/12/01 10:45:04 | 00,000,031 | —- | C] () – C:\Windows\WebUpdateSvc4.INI
[2009/12/01 10:44:32 | 00,047,624 | —- | C] () – C:\Windows\SysWow64\wuwuninst.exe
[2009/12/01 10:42:25 | 00,002,385 | —- | C] () – C:\Users\Kat\Desktop\Electronic Bluebook.lnk
[2009/12/01 10:42:20 | 00,000,301 | —- | C] () – C:\Windows\{F03C81CA-4445-4D53-B4B3-6B85CA0C5EB4}_WiseFW.ini
[2009/11/26 00:28:36 | 00,001,649 | —- | C] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2009/11/25 06:47:54 | 00,002,048 | —- | C] () – C:\Windows\SysNative\tzres.dll
[2009/11/24 14:13:30 | 01,875,456 | —- | C] () – C:\Windows\SysNative\msxml3.dll
[2009/11/24 14:13:29 | 01,794,560 | —- | C] () – C:\Windows\SysNative\msxml6.dll
[2009/11/24 14:13:25 | 00,880,640 | —- | C] () – C:\Windows\SysNative\timedate.cpl
[2009/10/05 18:11:42 | 00,707,184 | —- | C] () – C:\Users\Kat\AppData\Local\rx_image.Cache
[2009/10/05 18:11:42 | 00,033,728 | —- | C] () – C:\Users\Kat\AppData\Local\rx_audio.Cache
[2009/09/25 17:28:00 | 00,208,896 | —- | C] () – C:\Users\Kat\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/25 14:11:02 | 00,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/09/18 17:53:36 | 00,000,000 | —- | C] () – C:\Users\Kat\AppData\Local\QSwitch.txt
[2009/09/18 17:53:36 | 00,000,000 | —- | C] () – C:\Users\Kat\AppData\Local\DSwitch.txt
[2009/09/18 17:53:36 | 00,000,000 | —- | C] () – C:\Users\Kat\AppData\Local\AtStart.txt
[2008/01/20 20:50:05 | 00,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2008/01/20 20:49:49 | 00,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2009/09/26 08:20:52 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Blackberry Desktop
[2009/10/15 09:32:48 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Document Systems, Inc
[2009/09/25 15:54:28 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Megaupload
[2009/09/26 08:35:07 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\Research In Motion
[2009/12/20 18:40:32 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\uTorrent
[2009/11/30 14:46:18 | 00,000,000 | —D | M] – C:\Users\Kat\AppData\Roaming\WebEx
[2009/12/23 07:44:36 | 00,031,010 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2009/10/04 13:27:10 | 00,000,000 | —D | M](C:\Users\Kat\AppData\Roaming\???????sAppData) – C:\Users\Kat\AppData\Roaming\敎潲䍄敔灭慬整sAppData
[2009/10/04 13:27:10 | 00,000,000 | —D | M](C:\Users\Kat\AppData\Roaming\???????sAppData) – C:\Users\Kat\AppData\Roaming\敎潲䍄敔灭慬整sAppData
(C:\Users\Kat\AppData\Roaming\???????sAppData) – C:\Users\Kat\AppData\Roaming\敎潲䍄敔灭慬整sAppData
< End of report >


3. My computer seems to be working fine. No tab pops up with that error.