Spyware / Malware / Virus Removal

[Resolved] Redirects

16 min read

Looking for the outcome? Ask AI

LDTate

Post #16December 13, 2009, 4:39 PM UTC

How's it running now?

jack2059

Post #17December 13, 2009, 5:01 PM UTC

Kept using google for 5 minutes and got 1 redirect so far. Used to happen a lot more than that

LDTate

Post #18December 13, 2009, 5:10 PM UTC

c:\users\Jack\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_d_ind.dll
c:\users\Jack\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_c_ind.dll
c:\users\Jack\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_b_ind.dll
c:\users\Jack\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_a_ind.dll
c:\users\Jack\AppData\Roaming\SystemRequirementsLab

Did you install this program? I can't find much info on it.

jack2059

Post #19December 13, 2009, 5:13 PM UTC

I think it might of installed a while ago as its for judging whether you can play certain games. Havent played games on this laptop for months.

LDTate

Post #20December 13, 2009, 5:30 PM UTC

Lets reset the settings. All your temporary internet files, probably including navigating history, will be deleted! Open Internet Explorer Go to Tools and choose for Internet Options Go to the Advanced tab Click on Reset… and allow if any warnings are given Let the computer do its work if it has to Now see whether the problem has stopped. Your Add-ons are also disabled at the moment so lets enable them:

jack2059

Post #21December 13, 2009, 6:25 PM UTC

Nope, still the same.

LDTate

Post #22December 13, 2009, 6:28 PM UTC

http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.

jack2059

Post #23December 13, 2009, 9:57 PM UTC

Tried it again and it froze on 71,000 files again, left it over an hour and it didnt move.

LDTate

Post #24December 14, 2009, 12:42 AM UTC

Using Internet Explorer, click on Kaspersky Online Scanner

* You will be prompted to install an ActiveX component from Kaspersky, Click 'Yes'.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save as Text' button:
* Save the file to your desktop.

Please post the Kaspersky report and a new HijackThis log.

jack2059

Post #25December 14, 2009, 1:44 PM UTC

Its unavailable while they update to a newer one.

LDTate

Post #26December 14, 2009, 4:55 PM UTC

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

jack2059

Post #27December 14, 2009, 6:58 PM UTC last edited December 14, 2009, 7:00 PM UTC

First, im getting this popup quite often, move to chest doesnt seem to affect it. A few different locations.
[external image: Posted Image]

OTL Scans.

Extras.txt

OTL Extras logfile created on: 14/12/2009 18:41:51 - Run 1
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Users\Jack\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.24 Gb Available Physical Memory | 62.19% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.57 Gb Total Space | 19.30 Gb Free Space | 17.30% Space Free | Partition Type: NTFS
Drive D: | 111.55 Gb Total Space | 111.46 Gb Free Space | 99.92% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 2.32 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: JACK-PC
Current User Name: Jack
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – "%SystemRoot%\hh.exe" %1
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
chm.file [open] – "%SystemRoot%\hh.exe" %1
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [TVersity] – "C:\Program Files\TVersity\Media Server\GUILaunch.exe" -type "folder" -url "%1" -title "" -tags "" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:UPnP System
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:UPnP System

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:UPnP System
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:UPnP System

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\River Past\Animated GIF Converter and Booster Pack\VideoCleaner.exe" = C:\Program Files\River Past\Animated GIF Converter and Booster Pack\VideoCleaner.exe:*:Enabled:River Past Animated GIF Converter – File not found

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1B9E13E6-225F-41A8-902C-6ACDAD9410E8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2314E1EC-E77D-4C91-9E2B-BDC8B8350C72}" = lport=18899 | protocol=17 | dir=in | name=bitcomet 18899 udp |
"{243E66A3-2EE2-46C9-9270-EF6C709D463E}" = lport=18899 | protocol=17 | dir=in | name=bitcomet 18899 udp |
"{2C1A1DE1-86F5-407D-B19E-AF9E1F1B0DDA}" = rport=10243 | protocol=6 | dir=out | app=system |
"{35ABD830-8873-436E-BABA-6C3D2E561490}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{39BE19CF-0F77-44F7-AE24-C6183714E217}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{408C0E1A-8849-490F-9321-76062798CBFE}" = lport=18899 | protocol=6 | dir=in | name=bitcomet 18899 tcp |
"{42ED099B-E15A-4990-B743-88DC2E4BB1D1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{436E4932-E677-46A1-B094-7C41EDC3CDCC}" = lport=18899 | protocol=6 | dir=in | name=bitcomet 18899 tcp |
"{4E6838D9-7303-47B3-8F11-CEE82077FE17}" = rport=138 | protocol=17 | dir=out | app=system |
"{523DD1A8-4EF7-4DE4-93B2-F42F9BF0C0A5}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5A7A2127-3C72-436A-BDAD-0D4AF8CBCC5F}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{5BB7F120-D838-4F58-85B3-1DD8E13C0FB1}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{65644979-945A-429B-994A-989285067814}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{665957D9-52DE-4EA0-9645-5E89DA0812AF}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{723F7BA0-0B8E-4C58-8879-D8CC61EDB460}" = lport=10243 | protocol=6 | dir=in | app=system |
"{7AE706DF-64CC-45CC-8B37-3EF4A830922A}" = lport=139 | protocol=6 | dir=in | app=system |
"{849E0C1D-6A8E-464F-8A56-1EE62DA45B08}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{91DE19A8-2F10-44C2-B882-0E2C8CE5A47C}" = lport=137 | protocol=17 | dir=in | app=system |
"{923B9D1D-130D-4ADB-B576-7BC7D84E5B10}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{989CB912-D59B-48F8-BE98-08092D98EBAB}" = rport=139 | protocol=6 | dir=out | app=system |
"{9E486E24-53E2-41A9-9E72-BA2E78F2D094}" = rport=137 | protocol=17 | dir=out | app=system |
"{A7B32140-7FD7-450B-B822-D597A7A6F9DE}" = lport=445 | protocol=6 | dir=in | app=system |
"{AAE984B9-5CAB-425B-B87C-5580D67E98B3}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AF586DF9-4AE1-4205-8D9A-95B6501AB81A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B34A42F0-A437-4539-9363-6A3B4E9AC178}" = lport=138 | protocol=17 | dir=in | app=system |
"{B9AC2435-6B5B-404B-AAE2-D40440EA1C0A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C1C0F0D8-46B1-4E56-A3D2-E20E916CE04E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{D3E9ACD0-1CF7-476B-B980-9932A8E17433}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E45105A0-9E6D-46B2-B4C2-ADFCFFC1973C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EE8AF958-1AB3-4D14-A960-FC34814C1B74}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F44049FD-79F7-4401-8C0D-5077E9A707A9}" = rport=445 | protocol=6 | dir=out | app=system |
"{FBBF939B-F2DB-4003-A9F3-E7C3C535FE77}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C4C2AE9-A974-48A9-8A1A-D2693125CED5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{12C6C2E0-E184-4D89-8310-7327F6624CBC}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{1446A488-2452-4769-9F02-5F8E0E62730D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{176BF2B8-193F-47DA-83BE-340AEB8CB064}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{1D7D1E8D-03CB-4E30-AC3D-51BF68EAA777}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{211001DA-2E8C-41EB-A4BD-F9C0A0356954}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{236804D1-3027-4E69-9856-0D4F097674A3}" = protocol=6 | dir=in | app=c:\program files\sports interactive\football manager 2009\fm.exe |
"{27480808-AC70-4095-8647-9F9FE9589456}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{2B96FE96-251A-4DAB-904E-9BFAF0F46EB3}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{2BDCA502-6CE2-49F5-9270-66E29408EB61}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{2FB87990-D4D3-4245-A483-067F3C81CAE7}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{35DC9819-61E2-4D87-8866-A952D5528ACA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3E14A432-0D12-40F1-A325-D652791133CC}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{5275E554-6FD4-4FBF-AEF6-1E73CC065082}" = protocol=17 | dir=in | app=c:\program files\sports interactive\football manager 2010\fm.exe |
"{5646F8D3-58A9-4902-A893-A9CF9C174588}" = protocol=6 | dir=in | app=c:\program files\sports interactive\football manager 2010\fm.exe |
"{590290CE-C15A-48F1-943E-40DB3BD4839D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{5A89F71E-BE03-43F6-9D0D-A87395262BCC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5AFD8A8F-188E-4740-A1E9-8860219870FD}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{6011888E-FE8C-4471-95C7-1EEFD6F0D654}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{65ABB92D-51B2-4C38-9861-4FB5C2C2D909}" = protocol=17 | dir=in | app=c:\program files\sports interactive\football manager 2009\fm.exe |
"{65AE1D2D-DFB3-4E1A-BD21-4CB6FEC3F22F}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{65D3CD61-C76C-4051-B8F6-CBD2E29DCB5F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6686B083-7603-477A-8F21-E76F213BCDD5}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{67813074-F6DF-4706-9421-5D3AB0E75717}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{686F2312-FA6C-4DB0-A5E1-9F0520AF1B48}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{6C2487F9-D7A9-4647-AACF-AE1A042CAC89}" = protocol=6 | dir=out | app=system |
"{7257B8D4-C04F-4092-9CB5-5F2034FCFF96}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{78C0F7ED-AD03-4524-AA58-B94ADDC54609}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe |
"{7C912112-18F9-4DFC-B498-63FFB929B6F3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{80ED5668-D363-4F49-BACB-34AB8D640980}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{84D99925-BDB8-48FC-A046-B70A80C4DCBD}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{8B533F48-8C72-4A62-8CDE-5FFA8F8686E5}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{8D61AB43-04F5-47AA-BDCB-114345C4137A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{908E9BFA-47B8-4649-B13F-471B7BB14F9E}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{94C98CE0-9623-4FD5-B107-9CFCE7219193}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{9757E8EB-4726-419A-840D-8142ABA407DC}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{97C76B8D-EC7D-4093-9097-8D375809ECBA}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{9AAC521E-278C-470D-9755-3E2B45AEE29F}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{9E411653-7642-4C5D-A0F4-57C939EF3A49}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{A11B9686-D54D-4BDA-A762-5C1A440D8A65}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A463A7CF-96E5-431B-BF32-673214AFA956}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A7096495-6FD8-4C38-AB8D-1FD91A5B5046}" = protocol=6 | dir=in | app=c:\program files\tversity\media server\mediaserver.exe |
"{B1F916F2-1EA6-4FD9-9ABA-5D3D5F75A55F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B39A49E9-AADB-4276-A93B-4A234B3D69D2}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{B50ABF48-633B-4DA9-8620-D220FD65C28A}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version4\teamviewer.exe |
"{BF14971B-1CE3-40B5-92B9-16EAC521A9D0}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe |
"{C440B538-21A8-4860-9EA7-0FF7F6CC79F2}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{C5210FCA-89CD-4AC7-9B44-39887155FECB}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D2C044A4-134D-457B-BE57-EDCCD4D140BC}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{DA29A90D-6A4C-43DA-B1B2-AA560A47F397}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DAB44904-2ABE-423A-AC76-35882E87E0F6}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe |
"{E594FE92-42A4-4C04-A616-DFEE12BBD72C}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{ED32D0FF-C371-4E61-87B9-9D99132691A0}" = protocol=17 | dir=in | app=c:\program files\tversity\media server\mediaserver.exe |
"{F295E3EF-1393-45CB-BEF8-A90B65720B3E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F835774E-E87B-4723-9AAD-E995222D14E1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F9A7C703-DDF6-43B4-A56F-ECB11CDDAE5C}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version4\teamviewer.exe |
"TCP Query User{1447B8C5-FF95-4FBE-82EE-412E078456A1}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{1E13EC1E-921B-4486-8408-E9A9E76A2BAE}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{2DC5F5B9-E40A-466A-8AEE-5E49CB248980}C:\program files\privoxy\privoxy.exe" = protocol=6 | dir=in | app=c:\program files\privoxy\privoxy.exe |
"TCP Query User{2FC72BD1-A240-422D-959C-88D1C4D8E0C1}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{33165BB0-47FF-4BE4-AACB-8BBC3C1B4EB4}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{3E54CD7C-59C1-4855-8954-C6F8C5614791}C:\program files\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\program files\spotify\spotify.exe |
"TCP Query User{50CDBD49-ADDC-4700-9721-FFBAF1D0C120}C:\program files\sports interactive\football manager 2009\fm.exe" = protocol=6 | dir=in | app=c:\program files\sports interactive\football manager 2009\fm.exe |
"TCP Query User{52FD76DE-2D8B-4716-ADBF-99E2AF2159A5}C:\program files\ventsrv\ventrilo_srv.exe" = protocol=6 | dir=in | app=c:\program files\ventsrv\ventrilo_srv.exe |
"TCP Query User{58F0772B-F039-45B5-AAC2-9E8908757144}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{67C62CB2-76A7-4276-9412-CB921C211EE8}C:\program files\bitcomet\bitcomet.exe" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"TCP Query User{7C9A4D8F-C400-484C-9FFE-9E76CEA29DCD}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{843F4F21-5F88-45F2-B841-A213FFFE49DF}C:\program files\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\program files\spotify\spotify.exe |
"TCP Query User{8A8776C5-4FB9-4CC4-A4B5-3AE19DB2D528}C:\program files\play2p\play2p.exe" = protocol=6 | dir=in | app=c:\program files\play2p\play2p.exe |
"TCP Query User{8CE9EBC7-BF71-4C7D-A1BD-0A0B235C6156}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{94E24D93-EA80-43E7-842A-C6292D90C075}C:\program files\play2p\play2p.exe" = protocol=6 | dir=in | app=c:\program files\play2p\play2p.exe |
"TCP Query User{951CCD76-2495-4300-A8A0-891F8528C654}C:\program files\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files\tvants\tvants.exe |
"TCP Query User{9AA75BB3-1157-4943-BC06-82538DC5C808}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{A53E67C7-89F4-4CBA-8B57-94F02B679BA5}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{A702F874-AA60-4A38-8B4F-FB59D0140E4D}C:\program files\bitcomet\bitcomet.exe" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"TCP Query User{AD148FE8-83FA-4207-A310-9109EF23370B}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{AFB2CEFE-07AA-43F0-84A8-7BE5380B783B}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{BD3343A5-A280-4142-A1C7-DB6F802F7FAE}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"TCP Query User{CFD284C3-742A-484D-B2AD-60E4FE4E1546}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{EDF61512-27BC-4DC9-BB10-5623FE3D280D}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{06D9541D-3467-497A-AE49-FE403199CC6E}C:\program files\ventsrv\ventrilo_srv.exe" = protocol=17 | dir=in | app=c:\program files\ventsrv\ventrilo_srv.exe |
"UDP Query User{091FE00A-493B-43CC-98E8-03857DBDFA95}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"UDP Query User{10D2BB06-80B5-4129-B0EE-51911A444624}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{126D4F63-DB34-4A59-959A-3F29DECC0B9F}C:\program files\bitcomet\bitcomet.exe" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"UDP Query User{2F512498-8F8C-43E7-A69D-71FDE191F1CD}C:\program files\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\program files\spotify\spotify.exe |
"UDP Query User{36B19A64-C037-4C61-A476-0619A5F98971}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{3B70AFDF-9DBF-4EC3-94F7-8C8CC0A84975}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{5296A1E6-3BCF-45E0-84F1-E183AB607EFF}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{558B02B1-E11E-498F-A672-9D2AC23CC447}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{5A2ABED9-2E0A-49B7-BE2B-2897B06B5B2A}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{6DC9732B-D419-405A-8672-6753C2947C60}C:\program files\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\program files\spotify\spotify.exe |
"UDP Query User{877D2529-8686-4469-95F1-F77410A787F8}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{8D01D1D2-6EB9-42F7-B2DD-9C651472271F}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{962CD38C-9B89-4481-B768-6D71F079B41A}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{ADC9DFDE-DC60-423B-8336-3593DB6AABFD}C:\program files\play2p\play2p.exe" = protocol=17 | dir=in | app=c:\program files\play2p\play2p.exe |
"UDP Query User{AEA484AA-C610-47A5-A14D-7EF2B7001027}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"UDP Query User{C185C82D-6277-4DAF-8FC7-A64F9263C26F}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{C5575EF6-9F7B-40D0-BFC2-12F25E044C70}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{CB94AD8C-1DEC-4F9D-8FA4-8CED9240CD06}C:\program files\privoxy\privoxy.exe" = protocol=17 | dir=in | app=c:\program files\privoxy\privoxy.exe |
"UDP Query User{CD5DA6D3-73B7-40F4-AE3C-305FA3949CF8}C:\program files\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files\tvants\tvants.exe |
"UDP Query User{D59E67D3-0301-4E46-B347-9CD1786BCF4B}C:\program files\sports interactive\football manager 2009\fm.exe" = protocol=17 | dir=in | app=c:\program files\sports interactive\football manager 2009\fm.exe |
"UDP Query User{E28D4D52-38C4-4623-B447-E40A28FD0280}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"UDP Query User{F7DDC900-93EB-4791-A1BE-BFA7F05FD4DA}C:\program files\play2p\play2p.exe" = protocol=17 | dir=in | app=c:\program files\play2p\play2p.exe |
"UDP Query User{FD9AE37E-3CFC-4B39-B0F6-A87E416F38E1}C:\program files\bitcomet\bitcomet.exe" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1D46A3A0-B37D-423A-91C2-101A49E2FF80}" = Ventrilo Server
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 14
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}" = Adobe Photoshop CS3
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{685A56F8-75B6-44AD-B3DA-FB0A3266B47C}" = Adobe Flash Player 9 ActiveX
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C4196CA-CA41-4F34-9C08-7724E7705D52}" = Jasc Animation Shop 3
"{7DFC1012-D346-46CE-B03E-FF79125AE029}" = Adobe Fireworks CS3
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111543617}" = Backspin Billiards
"{870F1750-BA89-11DA-A94D-0800200C9A66}_is1" = VSO CopyToDVD 4
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BD10681F-2764-4600-885C-62F658BB3D3F}" = FMRTE
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C92A5A89-B218-46F7-8898-77C52113FFE0}" = Adobe Setup
"{C994D98C-293D-4825-958E-EB684B4D413F}" = MSN Toolbar
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{D7A53E41-3F32-4A44-989C-53DDEBB2130C}" = Adobe Extension Manager CS3
"{DA20E1A8-07CB-4EE7-9B72-A7E28C953F0E}" = Acer Product Registration
"{DA507A38-4B2A-40C0-90AC-E30AAA0B757C}" = Vegas Movie Studio Platinum 9.0
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DC785DB7-D389-48C3-B146-96FE99BF4E2B}" = Vegas Pro 9.0
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}" = Adobe Setup
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Acer GameZone Console_is1" = Acer GameZone Console 2.0.1.1
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_719d6f144d0c086a0dfa7ff76bb9ac1" = Adobe Photoshop CS3
"Adobe_bbef028176efa5abf0233d3e1747be8" = Adobe Fireworks CS3
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Alarm_is1" = Alarm 2.0.4
"avast!" = avast! Antivirus
"Belarc Advisor" = Belarc Advisor 8.1
"BitComet" = BitComet 1.15
"CCleaner" = CCleaner (remove only)
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Decrypter" = DVD Decrypter (Remove Only)
"ESET Online Scanner" = ESET Online Scanner v3
"ffdshow_is1" = ffdshow [rev 2202] [2008-10-10]
"Football Manager 2009" = Football Manager 2009
"Football Manager 2010" = Football Manager 2010
"Free DVD Creator (by minidvdsoft)_is1" = Free DVD Creator version 2.0
"Google Chrome" = Google Chrome
"GridVista" = Acer GridVista
"HDMI" = Intel® Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"LManager" = Launch Manager
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Marvell Miniport Driver" = Marvell Miniport Driver
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mike Crash Vegas Filters" = Mike Crash's Vegas Filters Uninstall
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"NewBlue 3D Explosions for Vegas" = NewBlue 3D Explosions for Vegas
"NewBlue 3D Transformations for Vegas" = NewBlue 3D Transformations for Vegas
"NewBlue Art Blends 2.0 for Vegas" = NewBlue Art Blends 2.0 for Vegas
"NewBlue Art Effects 2.0 for Vegas" = NewBlue Art Effects 2.0 for Vegas
"NewBlue Film Effects for Vegas" = NewBlue Film Effects for Vegas
"NewBlue Motion Blends 2.0 for Vegas" = NewBlue Motion Blends 2.0 for Vegas
"NewBlue Motion Effects 2.0 for Vegas" = NewBlue Motion Effects 2.0 for Vegas
"Online Manuals for WinTV (English)" = Online Manuals for WinTV (English)
"OpenAL" = OpenAL
"PIE_is1" = PIE Demo v5.1
"PluginPac" = DebugMode PluginPac (remove only)
"PrettyMay Call Recorder for Skype - Professional" = PrettyMay Call Recorder for Skype - Professional [removed]
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 6.0" = RealPlayer
"RocketDock_is1" = RocketDock 1.3.5
"SopCast" = SopCast 3.0.3
"SpeedFan" = SpeedFan (remove only)
"SpiceMASTER 2.5 PRO for Vegas" = SpiceMASTER 2.5 PRO for Vegas
"Spotify" = Spotify
"Spyware Doctor" = Spyware Doctor 7.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"TeamViewer 4" = TeamViewer 4
"TVAnts 1.0" = TVAnts 1.0
"TVersity Media Server Pro" = TVersity Media Server Pro 1.6 Beta
"TVUPlayer" = TVUPlayer [removed]
"TVWiz" = Intel® TV Wizard
"UnityWebPlayer" = Unity Web Player
"VLC media player" = VLC media player 0.9.9
"VSO DivxToDVD_is1" = DivxToDVD 0.5.2b
"VTPlus32 for WinTV (English)" = VTPlus32 for WinTV (English)
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.0.2
"WinRAR archiver" = WinRAR archiver

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 07/12/2009 10:05:28 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://wasteequip.com/search.php failed, 00000005.

Error - 07/12/2009 12:12:36 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://club.myce.com/ajax/userinfo_hover.php?userid=111277 failed, 00000005.

Error - 07/12/2009 17:11:38 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://uape.com/search.php failed, 00000005.

Error - 07/12/2009 17:12:28 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://xcount.com/search.php failed, 00000005.

Error - 08/12/2009 11:50:47 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://wvda.com/search.php failed, 00000005.

Error - 10/12/2009 16:10:03 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://sinatrahotel.com/search.php failed, 00000005.

Error - 10/12/2009 16:34:31 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://tradematrix.com/search.php failed, 00000005.

Error - 12/12/2009 12:47:40 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://thegoldenbowl.com/search.php failed, 00000005.

Error - 13/12/2009 10:23:05 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://tiborreels.com/search.php failed, 00000005.

Error - 14/12/2009 11:53:09 | Computer Name = Jack-PC | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://www.pctools.com/uk/mrc/infections/i…0%2E0%2E67&
failed, 00000005.

[ Application Events ]
Error - 12/12/2009 20:01:05 | Computer Name = Jack-PC | Source = SPP | ID = 16387
Description =

Error - 12/12/2009 20:01:05 | Computer Name = Jack-PC | Source = System Restore | ID = 8193
Description =

Error - 12/12/2009 20:01:22 | Computer Name = Jack-PC | Source = SPP | ID = 16387
Description =

Error - 12/12/2009 20:01:22 | Computer Name = Jack-PC | Source = System Restore | ID = 8193
Description =

Error - 12/12/2009 20:17:30 | Computer Name = Jack-PC | Source = SPP | ID = 16387
Description =

Error - 12/12/2009 20:17:30 | Computer Name = Jack-PC | Source = System Restore | ID = 8193
Description =

Error - 12/12/2009 20:21:57 | Computer Name = Jack-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/12/2009 20:23:24 | Computer Name = Jack-PC | Source = Application Error | ID = 1000
Description = Faulting application ePower_DMC.exe, version 3.0.3015.0, time stamp
0x48d848fd, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception
code 0xc0000005, fault offset 0x000111ff, process id 0x730, application start time
0x01ca7b8a72b3a01b.

Error - 12/12/2009 20:35:38 | Computer Name = Jack-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/12/2009 20:42:54 | Computer Name = Jack-PC | Source = EventSystem | ID = 4609
Description =

[ System Events ]
Error - 14/12/2009 09:36:03 | Computer Name = Jack-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 14/12/2009 09:36:03 | Computer Name = Jack-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 14/12/2009 09:36:38 | Computer Name = Jack-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 14/12/2009 09:36:38 | Computer Name = Jack-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 14/12/2009 09:37:51 | Computer Name = Jack-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 14/12/2009 09:37:51 | Computer Name = Jack-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 14/12/2009 10:49:19 | Computer Name = Jack-PC | Source = DCOM | ID = 10005
Description =

Error - 14/12/2009 10:49:19 | Computer Name = Jack-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 14/12/2009 10:49:48 | Computer Name = Jack-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 14/12/2009 14:40:36 | Computer Name = Jack-PC | Source = PlugPlayManager | ID = 11
Description = The device Root\LEGACY_CATCHME\0000 disappeared from the system without
first being prepared for removal.

< End of report >

jack2059

Post #28December 14, 2009, 6:59 PM UTC

OTL.txt

OTL logfile created on: 14/12/2009 18:41:51 - Run 1
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Users\Jack\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.24 Gb Available Physical Memory | 62.19% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.57 Gb Total Space | 19.30 Gb Free Space | 17.30% Space Free | Partition Type: NTFS
Drive D: | 111.55 Gb Total Space | 111.46 Gb Free Space | 99.92% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 2.32 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: JACK-PC
Current User Name: Jack
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Jack\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Jack\AppData\Local\temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
PRC - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
PRC - C:\Program Files\Skype\Plugin Manager\skypePM.exe (Skype Technologies)
PRC - C:\Windows\System32\igfxsrvc.exe (Intel Corporation)
PRC - C:\Windows\System32\hkcmd.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxext.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxpers.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxtray.exe (Intel Corporation)
PRC - C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Synaptics Incorporated)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)
PRC - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe (Skype Technologies S.A.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Windows\System32\PnkBstrA.exe ()
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
PRC - C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Program Files\RocketDock\RocketDock.exe ()
PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Cyberlink\Shared files\RichVideo.exe ()

========== Modules (SafeList) ==========

MOD - C:\Users\Jack\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Spyware Doctor\PCTGMhk.dll (PC Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Nero BackItUp Scheduler 4.0) – File not found
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (TeamViewer4) – C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (PnkBstrA) – C:\Windows\System32\PnkBstrA.exe ()
SRV - (gupdate1c9e779192abe64) Google Update Service (gupdate1c9e779192abe64) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (TVersityMediaServer) – C:\Program Files\TVersity\Media Server\MediaServer.exe ()
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (NTIBackupSvc) – C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (NTISchedulerSvc) – C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()
SRV - (AgereModemAudio) – C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (BUNAgentSvc) – C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (CLHNService) – C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (MobilityService) – C:\Acer\Mobility Center\MobilityService.exe ()
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (LightScribeService) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (RichVideo) Cyberlink RichVideo Service(CRVS) – C:\Program Files\Cyberlink\Shared files\RichVideo.exe ()
SRV - (Irmon) – C:\Windows\System32\irmon.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (pcouffin) – C:\Windows\System32\drivers\pcouffin.sys (VSO Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (ALWIL Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (PCTCore) – C:\Windows\system32\drivers\PCTCore.sys (PC Tools)
DRV - (hamachi) – C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (USBAAPL) – C:\Windows\System32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (SynTP) – C:\Windows\System32\drivers\SynTP.sys (Synaptics Incorporated)
DRV - (netr28) – C:\Windows\System32\drivers\netr28.sys (Ralink Technology, Corp.)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (PxHelp20) – C:\Windows\system32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (xusb21) – C:\Windows\System32\drivers\xusb21.sys (Microsoft Corporation)
DRV - (mcdbus) – C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (RTSTOR) – C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) – C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (yukonwlh) – C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (NTIDrvr) – C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (UBHelper) – C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (NSCIRDA) – C:\Windows\System32\drivers\nscirda.sys (National Semiconductor Corporation)
DRV - (HSF_DPV) – C:\Windows\System32\drivers\VSTDPV3.SYS (Conexant Systems, Inc.)
DRV - (winachsf) – C:\Windows\System32\drivers\VSTCNXT3.SYS (Conexant Systems, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (HSFHWAZL) – C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (NTIPPKernel) – C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)
DRV - (NPF) – C:\Windows\System32\drivers\npf.sys (CACE Technologies)
DRV - (Xponaut_WBD) Xponaut WaveBridge Device (WDM) – C:\Windows\System32\drivers\xpntwbd.sys (Xponaut)
DRV - (DKbFltr) – C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (speedfan) – C:\Windows\system32\speedfan.sys (Windows ® 2000 DDK provider)
DRV - (NuVision) Hauppauge WinTV USB Pro (PAL I,D/K) – C:\Windows\System32\drivers\Nuvision.sys (Hauppauge Computer Works)
DRV - (TPkd) – C:\Windows\System32\drivers\TPkd.sys (PACE Anti-Piracy, Inc.)
DRV - (giveio) – C:\Windows\system32\giveio.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5735

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.live.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.startup.homepage: "http://forum.consolegaming.eu/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.2
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.10
FF - prefs.js..extensions.enabledItems: {11483926-db67-4190-91b1-ef20fcec5f33}:0.3.2
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:3.6.1
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971
FF - prefs.js..extensions.enabledItems: [removed]:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..network.proxy.backup.ftp: "[removed]"
FF - prefs.js..network.proxy.backup.ftp_port: 3124
FF - prefs.js..network.proxy.backup.gopher: "[removed]"
FF - prefs.js..network.proxy.backup.gopher_port: 3124
FF - prefs.js..network.proxy.backup.socks: "[removed]"
FF - prefs.js..network.proxy.backup.socks_port: 3124
FF - prefs.js..network.proxy.backup.ssl: "[removed]"
FF - prefs.js..network.proxy.backup.ssl_port: 3124
FF - prefs.js..network.proxy.ftp: "[removed]"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.gopher: "[removed]"
FF - prefs.js..network.proxy.gopher_port: 3128
FF - prefs.js..network.proxy.http: "[removed]"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "[removed]"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "204.85.191.10"
FF - prefs.js..network.proxy.ssl_port: 3128

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/02 18:18:42 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/12/02 18:18:41 | 00,000,000 | —D | M]

[2009/04/14 15:14:20 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Mozilla\Extensions
[2009/12/14 13:37:37 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions
[2009/11/08 20:54:24 | 00,000,000 | —D | M] (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{11483926-db67-4190-91b1-ef20fcec5f33}
[2009/12/07 14:12:10 | 00,000,000 | —D | M] (ReloadEvery) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2009/11/06 20:47:10 | 00,000,000 | —D | M] (BitComet Video Downloader) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009/12/14 13:37:23 | 00,000,000 | —D | M] (Adblock Plus) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009/07/03 12:03:32 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\[removed]
[2009/11/10 11:43:06 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\[removed]
[2009/09/03 11:44:43 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\[removed]
[2009/12/13 16:42:58 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/07/17 08:40:12 | 00,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009/11/03 01:42:02 | 00,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/11/03 01:42:02 | 00,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/11/03 01:42:02 | 00,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/11/03 01:42:02 | 00,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (614006 bytes) - C:\Windows\System32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 software-online-scaner.net
O1 - Hosts: 127.0.0.1 directrdr.com
O1 - Hosts: 127.0.0.1 fr.a2dfp.net
O1 - Hosts: 127.0.0.1 m.fr.a2dfp.net
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 achmedia.com
O1 - Hosts: 127.0.0.1 aconti.net
O1 - Hosts: 127.0.0.1 secure.aconti.net
O1 - Hosts: 127.0.0.1 www.aconti.net #[Dialer.Aconti]
O1 - Hosts: 127.0.0.1 ads.active.com
O1 - Hosts: 127.0.0.1 am1.activemeter.com
O1 - Hosts: 127.0.0.1 www.activemeter.com #[eTrust.Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ads.activepower.net
O1 - Hosts: 127.0.0.1 data2.activshopper.com #[Trackware.ActivShopper]
O1 - Hosts: 127.0.0.1 stat.active24stats.nl #[eTrust.Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ad2games.com
O1 - Hosts: 127.0.0.1 cms.ad2click.nl
O1 - Hosts: 16129 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - No CLSID value found.
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O4 - Startup: C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &D;&ownload; &with; BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (Intertrust Technologies, Inc.)
O15 - HKLM\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} https://fixit.support.microsoft.com/ActiveX/FixItClient.CAB (FixItClient Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: Justin.tv Publisher http://www.justin.tv/plugins/justintv_publisher.CAB (Reg Error: Key error.)
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 00,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/07/30 08:30:42 | 00,000,154 | R— | M] () - X:\autorun.cfg – [ UDF ]
O32 - AutoRun File - [2008/11/27 12:02:24 | 00,214,280 | R— | M] (Sports Interactive) - X:\autorun.exe – [ UDF ]
O32 - AutoRun File - [2006/09/11 13:26:42 | 00,000,027 | R— | M] () - X:\autorun.inf – [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009/12/14 18:40:00 | 00,538,112 | —- | C] (OldTimer Tools) – C:\Users\Jack\Desktop\OTL.exe
[2009/12/13 18:13:05 | 00,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2009/12/13 17:56:51 | 00,000,000 | —D | C] – C:\Windows\temp
[2009/12/13 17:45:16 | 00,000,000 | —D | C] – C:\32788R22FWJFW
[2009/12/13 16:44:17 | 00,000,000 | —D | C] – C:\Program Files\Common Files\SWF Studio
[2009/12/13 16:26:05 | 00,000,000 | —D | C] – C:\Users\Jack\AppData\Local\temp
[2009/12/13 15:07:01 | 00,000,000 | —D | C] – C:\Users\Jack\AppData\Local\Apple
[2009/12/13 13:56:05 | 02,452,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2009/12/13 13:55:51 | 00,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2009/12/13 13:55:49 | 00,078,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieencode.dll
[2009/12/13 13:55:46 | 00,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2009/12/13 13:55:30 | 00,512,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2009/12/13 00:01:56 | 00,038,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\WdfLdr.sys
[2009/12/13 00:00:38 | 01,461,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WdfCoInstaller01009.dll
[2009/12/13 00:00:38 | 00,206,120 | —- | C] (Synaptics Incorporated) – C:\Windows\System32\SynCtrl.dll
[2009/12/13 00:00:38 | 00,120,104 | —- | C] (Synaptics Incorporated) – C:\Windows\System32\SynTPCo4.dll
[2009/12/13 00:00:37 | 00,228,784 | —- | C] (Synaptics Incorporated) – C:\Windows\System32\drivers\SynTP.sys
[2009/12/12 23:13:55 | 00,208,896 | —- | C] (Acer Inc.) – C:\Windows\System32\SysHook.dll
[2009/12/12 23:13:55 | 00,061,440 | —- | C] (Acer Inc.) – C:\Windows\System32\MCEPlugin.dll
[2009/12/12 23:12:18 | 00,000,000 | —D | C] – C:\Users\Jack\Desktop\Virus
[2009/12/12 22:02:53 | 00,000,000 | —D | C] – C:\Users\Jack\AppData\Local\Adobe
[2009/12/12 20:39:16 | 00,000,000 | —D | C] – C:\Program Files\ESET
[2009/12/12 18:11:36 | 00,000,000 | —D | C] – C:\Windows\Minidump
[2009/12/12 17:53:18 | 00,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2009/12/12 17:53:18 | 00,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2009/12/12 17:53:18 | 00,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2009/12/12 17:53:18 | 00,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2009/12/12 17:52:35 | 00,000,000 | —D | C] – C:\Windows\ERDNT
[2009/12/12 17:48:06 | 00,000,000 | —D | C] – C:\Qoobox
[2009/12/10 20:07:28 | 00,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\httpapi.dll
[2009/12/10 20:07:27 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nshhttp.dll
[2009/12/10 20:06:40 | 00,243,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rastls.dll
[2009/12/08 17:58:34 | 00,000,000 | —D | C] – C:\Users\Jack\Desktop\Episode 1.avi; Episode 2.avi; Episode 3.avi; Episode 4.avi; Episode 5.avi; Episode 6
[2009/12/07 21:17:31 | 00,000,000 | —D | C] – C:\ProgramData\Vso
[2009/12/07 21:15:06 | 00,047,360 | —- | C] (VSO Software) – C:\Windows\System32\drivers\pcouffin.sys
[2009/12/07 21:15:06 | 00,047,360 | —- | C] (VSO Software) – C:\Users\Jack\AppData\Roaming\pcouffin.sys
[2009/12/07 21:15:05 | 00,000,000 | —D | C] – C:\Users\Jack\AppData\Roaming\Vso
[2009/12/07 21:15:05 | 00,000,000 | —D | C] – C:\Users\Jack\Documents\PcSetup
[2009/12/07 19:47:44 | 00,000,000 | —D | C] – C:\Users\Jack\AppData\Local\Threat Expert
[2009/12/07 19:17:43 | 00,000,000 | —D | C] – C:\ProgramData\NtiDvdCopy
[2009/12/07 16:17:15 | 00,000,000 | —D | C] – C:\Users\Jack\Desktop\The Damned United
[2009/12/07 16:16:12 | 00,000,000 | —D | C] – C:\Program Files\vso
[2009/12/02 21:04:21 | 00,000,000 | —D | C] – C:\SDFix
[2009/12/02 18:25:17 | 00,000,000 | —D | C] – C:\Program Files\iPod
[2009/12/02 18:25:09 | 00,000,000 | —D | C] – C:\Program Files\iTunes
[2009/12/02 18:17:39 | 00,000,000 | —D | C] – C:\Program Files\QuickTime
[2009/11/30 17:46:42 | 00,233,136 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctgntdi.sys
[2009/11/30 17:46:42 | 00,098,600 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctwfpfilter.sys
[2009/11/30 17:46:39 | 00,207,792 | —- | C] (PC Tools) – C:\Windows\System32\drivers\PCTCore.sys
[2009/11/30 17:46:39 | 00,087,784 | —- | C] (PC Tools) – C:\Windows\System32\drivers\PCTAppEvent.sys
[2009/11/30 17:46:30 | 00,070,408 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctplsg.sys
[2009/11/30 17:46:09 | 00,000,000 | —D | C] – C:\Program Files\Spyware Doctor
[2009/11/30 17:46:09 | 00,000,000 | —D | C] – C:\Users\Jack\AppData\Roaming\PC Tools
[2009/11/30 17:46:09 | 00,000,000 | —D | C] – C:\ProgramData\PC Tools
[2009/11/30 17:46:09 | 00,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2009/11/30 17:13:44 | 00,000,000 | -HSD | C] – C:\Users\Jack\AppData\Roaming\lowsec
[2009/11/29 13:42:03 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/11/28 20:44:47 | 00,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2009/11/28 20:44:47 | 00,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2009/11/28 13:03:02 | 00,000,000 | —D | C] – C:\Users\Jack\AppData\Roaming\Malwarebytes
[2009/11/28 13:02:58 | 00,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2009/11/28 13:02:57 | 00,019,160 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2009/11/28 13:02:57 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/11/28 13:02:57 | 00,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2009/11/27 23:02:18 | 00,000,000 | —D | C] – C:\Users\Jack\Documents\Pamela
[2009/11/27 23:01:54 | 00,000,000 | —D | C] – C:\Users\Jack\AppData\Roaming\Pamela
[2009/11/25 16:52:34 | 00,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2009/11/25 13:24:01 | 00,714,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\timedate.cpl
[2009/11/18 03:24:40 | 00,000,000 | —D | C] – C:\Program Files\Windows Portable Devices
[2009/11/18 03:02:58 | 03,023,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UIRibbon.dll
[2009/11/18 03:02:58 | 01,164,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UIRibbonRes.dll
[2009/11/18 03:02:58 | 00,092,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UIAnimation.dll
[2009/11/18 03:02:33 | 00,369,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMPhoto.dll
[2009/11/18 03:02:33 | 00,037,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2009/11/18 03:02:32 | 00,829,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2009/11/18 03:02:32 | 00,828,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2009/11/18 03:02:32 | 00,280,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2009/11/18 03:02:32 | 00,189,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WindowsCodecsExt.dll
[2009/11/18 03:02:32 | 00,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsRasterService.dll
[2009/11/18 03:02:32 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelineprxy.dll
[2009/11/18 03:02:31 | 01,554,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xpsservices.dll
[2009/11/18 03:02:31 | 01,064,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2009/11/18 03:02:31 | 00,974,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WindowsCodecs.dll
[2009/11/18 03:02:31 | 00,847,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\OpcServices.dll
[2009/11/18 03:02:31 | 00,793,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FntCache.dll
[2009/11/18 03:02:31 | 00,667,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelinesvc.exe
[2009/11/18 03:02:31 | 00,519,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d11.dll
[2009/11/18 03:02:31 | 00,486,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10level9.dll
[2009/11/18 03:02:31 | 00,481,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxgi.dll
[2009/11/18 03:02:31 | 00,351,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2009/11/18 03:02:31 | 00,321,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PhotoMetadataHandler.dll
[2009/11/18 03:02:31 | 00,252,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxdiag.exe
[2009/11/18 03:02:31 | 00,218,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2009/11/18 03:02:31 | 00,195,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxdiagn.dll
[2009/11/18 03:02:31 | 00,190,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10core.dll
[2009/11/18 03:02:31 | 00,161,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2009/11/18 03:02:30 | 01,030,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10.dll
[2009/11/18 03:02:05 | 00,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\BthMtpContextHandler.dll
[2009/11/18 03:02:05 | 00,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WPDShextAutoplay.exe
[2009/11/18 03:01:59 | 00,060,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceConnectApi.dll
[2009/11/18 03:01:55 | 00,546,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wpd_ci.dll
[2009/11/18 03:01:55 | 00,350,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WPDSp.dll
[2009/11/18 03:01:55 | 00,334,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceApi.dll
[2009/11/18 03:01:55 | 00,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceWMDRM.dll
[2009/11/18 03:01:55 | 00,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceTypes.dll
[2009/11/18 03:01:55 | 00,100,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceClassExtension.dll
[2009/11/18 03:00:36 | 00,555,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UIAutomationCore.dll
[2009/11/18 03:00:36 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\oleaccrc.dll
[2008/12/20 20:59:40 | 00,049,152 | —- | C] ( ) – C:\Windows\Interop.IWshRuntimeLibrary.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009/12/14 18:52:02 | 00,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2009/12/14 18:52:00 | 09,175,040 | -HS- | M] () – C:\Users\Jack\ntuser.dat
[2009/12/14 18:40:05 | 00,538,112 | —- | M] (OldTimer Tools) – C:\Users\Jack\Desktop\OTL.exe
[2009/12/14 17:35:10 | 00,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/12/14 17:35:10 | 00,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/12/14 15:53:34 | 00,781,021 | —- | M] () – C:\Users\Jack\Desktop\ye.htm
[2009/12/14 13:41:42 | 00,690,960 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2009/12/14 13:41:42 | 00,600,378 | —- | M] () – C:\Windows\System32\perfh009.dat
[2009/12/14 13:41:42 | 00,105,852 | —- | M] () – C:\Windows\System32\perfc009.dat
[2009/12/14 13:35:30 | 00,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2009/12/14 13:35:23 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/12/14 13:34:52 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/12/14 13:34:48 | 31,466,29120 | -HS- | M] () – C:\hiberfil.sys
[2009/12/14 02:09:19 | 00,524,288 | -HS- | M] () – C:\Users\Jack\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms
[2009/12/14 02:09:19 | 00,065,536 | -HS- | M] () – C:\Users\Jack\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf
[2009/12/14 02:09:17 | 02,063,831 | -H– | M] () – C:\Users\Jack\AppData\Local\IconCache.db
[2009/12/13 17:57:10 | 00,000,215 | —- | M] () – C:\Windows\system.ini
[2009/12/13 17:43:29 | 00,000,064 | —- | M] () – C:\Users\Jack\defogger_reenable
[2009/12/13 15:58:04 | 00,050,621 | —- | M] () – C:\Users\Jack\Desktop\Defogger.exe
[2009/12/13 14:57:48 | 34,096,1837 | —- | M] () – C:\Windows\MEMORY.DMP
[2009/12/13 00:03:49 | 00,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_Kernel_SynTP_01009.Wdf
[2009/12/13 00:02:20 | 00,000,000 | -H– | M] () – C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2009/12/12 23:42:17 | 03,850,336 | R— | M] () – C:\Users\Jack\Desktop\ComboFix.exe
[2009/12/12 23:28:41 | 00,028,251 | —- | M] () – C:\Users\Jack\Desktop\Untitled.jpg
[2009/12/12 23:26:05 | 00,096,256 | —- | M] () – C:\Users\Jack\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/10 20:11:29 | 00,614,006 | —- | M] () – C:\Windows\System32\drivers\etc\HOSTS
[2009/12/09 22:54:07 | 00,261,632 | —- | M] () – C:\Windows\PEV.exe
[2009/12/07 21:15:06 | 00,047,360 | —- | M] (VSO Software) – C:\Windows\System32\drivers\pcouffin.sys
[2009/12/07 21:15:06 | 00,047,360 | —- | M] (VSO Software) – C:\Users\Jack\AppData\Roaming\pcouffin.sys
[2009/12/07 21:15:06 | 00,007,887 | —- | M] () – C:\Users\Jack\AppData\Roaming\pcouffin.cat
[2009/12/07 21:15:06 | 00,001,144 | —- | M] () – C:\Users\Jack\AppData\Roaming\pcouffin.inf
[2009/12/07 21:14:56 | 00,000,767 | —- | M] () – C:\Users\Jack\Desktop\CopyToDVD.lnk
[2009/12/07 19:53:45 | 00,001,024 | RH– | M] () – C:\Users\Public\Documents\NTIMP3.dll
[2009/12/07 16:16:13 | 00,000,844 | —- | M] () – C:\Users\Jack\Desktop\VSO DivxToDVD.lnk
[2009/12/03 16:14:06 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2009/12/03 16:13:56 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2009/11/29 15:08:20 | 00,006,080 | —- | M] () – C:\Users\Jack\AppData\Local\d3d9caps.dat
[2009/11/27 23:58:30 | 00,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2009/11/26 14:22:00 | 00,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf
[2009/11/26 13:05:41 | 00,000,000 | —- | M] () – C:\Windows\System32\LogConfigTemp.xml
[2009/11/24 23:54:29 | 01,280,480 | —- | M] (ALWIL Software) – C:\Windows\System32\aswBoot.exe
[2009/11/24 23:50:12 | 00,114,768 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswSP.sys
[2009/11/24 23:50:00 | 00,020,560 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2009/11/24 23:49:48 | 00,053,328 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2009/11/24 23:49:07 | 00,048,560 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswTdi.sys
[2009/11/24 23:48:57 | 00,023,120 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswRdr.sys
[2009/11/24 23:47:28 | 00,097,480 | —- | M] (ALWIL Software) – C:\Windows\System32\AvastSS.scr
[2009/11/18 03:24:31 | 00,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/12/14 15:53:32 | 00,781,021 | —- | C] () – C:\Users\Jack\Desktop\ye.htm
[2009/12/13 18:15:44 | 31,466,29120 | -HS- | C] () – C:\hiberfil.sys
[2009/12/13 15:58:44 | 00,000,064 | —- | C] () – C:\Users\Jack\defogger_reenable
[2009/12/13 15:58:03 | 00,050,621 | —- | C] () – C:\Users\Jack\Desktop\Defogger.exe
[2009/12/13 13:57:17 | 00,000,802 | —- | C] () – C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk
[2009/12/13 00:03:49 | 00,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_Kernel_SynTP_01009.Wdf
[2009/12/13 00:02:20 | 00,000,000 | -H– | C] () – C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2009/12/13 00:02:02 | 00,000,003 | —- | C] () – C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf
[2009/12/12 23:41:50 | 03,850,336 | R— | C] () – C:\Users\Jack\Desktop\ComboFix.exe
[2009/12/12 23:28:41 | 00,028,251 | —- | C] () – C:\Users\Jack\Desktop\Untitled.jpg
[2009/12/12 18:11:14 | 34,096,1837 | —- | C] () – C:\Windows\MEMORY.DMP
[2009/12/12 17:53:18 | 00,261,632 | —- | C] () – C:\Windows\PEV.exe
[2009/12/12 17:53:18 | 00,098,816 | —- | C] () – C:\Windows\sed.exe
[2009/12/12 17:53:18 | 00,080,412 | —- | C] () – C:\Windows\grep.exe
[2009/12/12 17:53:18 | 00,077,312 | —- | C] () – C:\Windows\MBR.exe
[2009/12/12 17:53:18 | 00,068,096 | —- | C] () – C:\Windows\zip.exe
[2009/12/07 21:16:00 | 00,000,034 | —- | C] () – C:\Users\Jack\AppData\Roaming\pcouffin.log
[2009/12/07 21:15:06 | 00,007,887 | —- | C] () – C:\Users\Jack\AppData\Roaming\pcouffin.cat
[2009/12/07 21:15:06 | 00,001,144 | —- | C] () – C:\Users\Jack\AppData\Roaming\pcouffin.inf
[2009/12/07 21:14:56 | 00,000,767 | —- | C] () – C:\Users\Jack\Desktop\CopyToDVD.lnk
[2009/12/07 16:16:13 | 00,000,844 | —- | C] () – C:\Users\Jack\Desktop\VSO DivxToDVD.lnk
[2009/11/30 17:46:43 | 00,007,387 | —- | C] () – C:\Windows\System32\drivers\pctgntdi.cat
[2009/11/30 17:46:39 | 00,007,412 | —- | C] () – C:\Windows\System32\drivers\PCTAppEvent.cat
[2009/11/30 17:46:39 | 00,007,383 | —- | C] () – C:\Windows\System32\drivers\pctcore.cat
[2009/11/30 17:46:30 | 00,007,383 | —- | C] () – C:\Windows\System32\drivers\pctplsg.cat
[2009/11/29 15:00:32 | 00,143,660 | —- | C] () – C:\Users\Jack\AppData\Local\edsinstaller.txt-20091129.log
[2009/11/26 14:22:00 | 00,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf
[2009/11/18 03:24:31 | 00,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2009/09/17 12:13:56 | 00,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/23 18:13:41 | 00,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2009/08/21 19:32:47 | 00,002,905 | —- | C] () – C:\Users\Jack\AppData\Local\edsinstaller.txt-20090821.log
[2009/07/30 22:08:35 | 00,000,000 | -H– | C] () – C:\Users\Jack\AppData\Roaming\Cricket2009.exe.lock
[2009/07/16 19:36:54 | 00,000,369 | —- | C] () – C:\ProgramData\hpzinstall.log
[2009/07/03 12:39:37 | 00,139,152 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2009/07/03 12:39:37 | 00,139,152 | —- | C] () – C:\Users\Jack\AppData\Roaming\PnkBstrK.sys
[2009/07/01 13:22:20 | 00,000,143 | —- | C] () – C:\Users\Jack\AppData\Roaming\default.rss
[2009/07/01 12:58:38 | 00,000,039 | —- | C] () – C:\Windows\Irremote.ini
[2009/06/29 14:50:29 | 00,003,528 | —- | C] () – C:\ProgramData\ArcadeDeluxe2.log
[2009/06/16 15:14:30 | 00,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/06/13 21:09:29 | 00,404,480 | —- | C] () – C:\Windows\System32\libmplayer.dll
[2009/06/13 21:09:29 | 00,200,704 | —- | C] () – C:\Windows\System32\TomsMoComp_ff.dll
[2009/06/13 21:09:29 | 00,114,688 | —- | C] () – C:\Windows\System32\libmpeg2_ff.dll
[2009/06/13 21:03:00 | 00,057,344 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/06/13 21:03:00 | 00,000,547 | —- | C] () – C:\Windows\System32\ff_vfw.dll.manifest
[2009/05/17 16:58:03 | 00,000,349 | —- | C] () – C:\Windows\vtplus32.ini
[2009/05/17 16:57:47 | 00,000,569 | —- | C] () – C:\Windows\HCWPNP.INI
[2009/05/17 16:56:17 | 00,009,206 | —- | C] () – C:\Windows\NTTuner.ini
[2009/04/30 09:00:45 | 00,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/04/25 21:12:24 | 00,140,288 | —- | C] () – C:\Windows\System32\igfxtvcx.dll
[2009/04/17 21:09:54 | 00,006,080 | —- | C] () – C:\Users\Jack\AppData\Local\d3d9caps.dat
[2009/04/16 00:04:44 | 00,096,256 | —- | C] () – C:\Users\Jack\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/15 20:04:08 | 00,069,632 | —- | C] () – C:\Windows\System32\xmltok.dll
[2009/04/15 20:04:08 | 00,036,864 | —- | C] () – C:\Windows\System32\xmlparse.dll
[2009/04/14 22:09:06 | 00,024,206 | —- | C] () – C:\Users\Jack\AppData\Roaming\UserTile.png
[2008/12/20 20:44:52 | 00,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1527.dll
[2008/12/20 20:13:23 | 00,001,694 | —- | C] () – C:\Windows\RtDefLvl.ini
[2008/05/15 05:47:54 | 00,001,024 | RH– | C] () – C:\Windows\System32\NTIOFM4.dll
[2008/05/15 05:47:54 | 00,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN5.dll
[2008/05/14 12:48:18 | 01,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2008/05/14 12:48:14 | 00,872,448 | —- | C] () – C:\Windows\iconv.dll
[2008/05/14 12:48:14 | 00,743,424 | —- | C] () – C:\Windows\libxml2.dll
[2008/05/14 12:48:13 | 00,000,042 | —- | C] () – C:\Windows\Prelaunch.ini
[2007/11/06 20:19:28 | 00,053,299 | —- | C] () – C:\Windows\System32\pthreadVC.dll
[2006/11/02 07:40:29 | 00,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2003/09/11 20:11:22 | 00,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2001/12/26 23:12:30 | 00,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 06:46:38 | 00,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/30 23:33:56 | 00,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 05:04:36 | 00,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll
[1996/04/03 19:33:26 | 00,005,248 | —- | C] () – C:\Windows\System32\giveio.sys

========== LOP Check ==========

[2008/05/15 05:46:38 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Acer GameZone Console
[2009/07/01 15:27:40 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Azureus
[2009/04/27 10:28:09 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Big Fish Games
[2009/08/13 12:13:48 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\BraCa_Soft
[2009/08/26 13:06:12 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Clone2Go DVD Ripper
[2009/07/29 20:44:52 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\DAEMON Tools Pro
[2009/10/11 22:03:19 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\EA
[2009/04/14 18:40:06 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\eSobi
[2009/04/14 23:36:30 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\FloodLightGames
[2009/09/11 16:02:17 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\GetRightToGo
[2009/05/17 16:59:07 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\InterTrust
[2009/08/09 15:05:38 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Jasc
[2009/07/18 20:54:52 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\JPEGsnoop
[2009/11/30 19:29:21 | 00,000,000 | -HSD | M] – C:\Users\Jack\AppData\Roaming\lowsec
[2009/05/04 15:07:54 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\MessengerGadget
[2009/06/10 18:40:59 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\NavNet Solutions
[2009/11/27 23:21:28 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Pamela
[2009/04/14 22:09:06 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\PeerNetworking
[2009/09/27 19:05:17 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\play2p
[2009/06/29 14:51:11 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\PowerCinema
[2009/04/15 01:09:16 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\PrettyMay
[2009/08/27 20:04:32 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\proDAD
[2009/04/23 23:18:00 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Publish Providers
[2009/08/31 15:30:52 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\River Past G5
[2009/08/27 21:20:45 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Sony
[2009/10/30 20:11:57 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Sports Interactive
[2009/12/08 21:13:24 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Spotify
[2009/08/26 17:05:21 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\TeamViewer
[2009/08/28 10:30:30 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Unity
[2009/09/30 12:04:29 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\vghd
[2009/12/11 20:13:54 | 00,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Vso
[2009/12/14 02:09:22 | 00,032,624 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:861A898F
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:8AB6C1D7
@Alternate Data Stream - 196 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 159 bytes -> C:\ProgramData\TEMP:B623B5B8
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:443E07A5
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:FEBEC560
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:4CF61E54
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:888AFB86
< End of report >

jack2059

Post #29December 14, 2009, 7:29 PM UTC

First, im getting this popup quite often, move to chest doesnt seem to affect it. A few different locations.
[external image: Posted Image]

Every time it pops up to tell me, it makes a new folder here - C:\Windows\temp

****.tmp

Deleted loads of them, all empty.

[external image: Posted Image]

LDTate

Post #30December 14, 2009, 7:43 PM UTC

Read this whole post first.

1. Hit “Start”, search for “Notepad”.
2. Right click “Notepad” and select “Run as administrator”.
3. Click “Continue” on the warning.
4. Hit “Ctrl + o” to open a file.
5. Browse to “C:\Windows\System32\Drivers\etc”.
6. Change the drop down box from “Text Documents (*.txt)” to “All Files (*.*)”.
7. Select “hosts” and click “Open”.
8. Make your changes and close Notepad.
9. Hit “Ctrl +s” to save.

Delete every line (select each line and click 'Delete line(s)') except the very first top lines beginning with # and: 127.0.0.1 localhost

Once finished, click the 'Open in Notepad' button. It should look like this:

You want your host file to look like this:

# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

Reboot and let me know how it's running.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Redirects

✨ Ask AI

Ask AI