Spyware / Malware / Virus Removal

[Resolved] Malwarebytes warning

13 min read

Looking for the outcome? Ask AI

silat Topic Starter

Post #1January 7, 2010, 8:59 AM UTC

I think Im clean but am not sure……. Been along time for me since Ive been here. Was a student in the "college" way back when..

Wondering about missing files in the log. Are they always safe to remove?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:25 AM, on 1/7/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\SysWOW64\HsMgr.exe
C:\Program Files (x86)\Flashnote\Flashnote.exe
C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\$ISR\$APP\ISRMonitor.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files (x86)\ESET\nod32kui.exe
C:\Program Files (x86)\Returnil\RVS3\rvsgui.exe
C:\Program Files (x86)\WordWeb\wweb32.exe
C:\Program Files (x86)\ClipCache\clipc.exe
C:\Program Files (x86)\DL Software\D-Color\dcolor.exe
C:\Program Files (x86)\FastStone\FSCapture.exe
F:\Programs\Pink Calendar\PinkCal.exe
C:\Program Files (x86)\PowerStrip\PStrip.exe
C:\Program Files\ASUS Xonar D1 Audio\Customapp\ASUSAUDIOCENTER.EXE
C:\Program Files (x86)\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files (x86)\NaturalPoint\TrackIR5\TrackIR5.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files (x86)\Maxthon2\Maxthon.exe
C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
C:\HijackThis\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files (x86)\IEPro\iepro.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\4.0.266.0\npchrome_tab.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [ISR_MONITOR] C:\$ISR\$APP\ISRMonitor.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files (x86)\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /install /silent
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Flashnote] C:\Program Files (x86)\Flashnote\flashnote.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [GBMPro8Agentx64] "C:\Program Files\Genie-Soft\GBMPro8x64\GBMAgent.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: ClipCache Pro.lnk = C:\Program Files (x86)\ClipCache\clipc.exe
O4 - Startup: dcolor.lnk = C:\Program Files (x86)\DL Software\D-Color\dcolor.exe
O4 - Startup: FastStone Capture.lnk = C:\Program Files (x86)\FastStone\FSCapture.exe
O4 - Startup: PinkCal.lnk = F:\Programs\Pink Calendar\PinkCal.exe
O4 - Startup: PowerStrip.lnk = C:\Program Files (x86)\PowerStrip\PStrip.exe
O4 - Global Startup: PowerStrip.lnk = C:\Program Files (x86)\PowerStrip\PStrip.exe
O4 - Global Startup: RVS 2010 BETA.lnk = C:\Program Files (x86)\Returnil\RVS3\rvsgui.exe
O4 - Global Startup: WordWeb Pro.lnk = C:\Program Files (x86)\WordWeb\wweb32.exe
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~2\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files (x86)\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files (x86)\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files (x86)\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files (x86)\IEPro\iepro.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~2\NEOTRA~1\NTXtoolbar.htm (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware workstation\vsocklib.dll
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlcdnet.asus.com/pub/ASUS/misc/dlm-…vex-2.2.5.0.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol hijack: cf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E}
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: FirstDefense-ISR Service (ISRService) - Leapfrog Software, Inc. - C:\$ISR\0\ISRService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: Look 'n' Stop Service (lnssvcVista) - Soft4Ever - C:\Program Files\Soft4Ever\looknstop\LnsSvcVista.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files (x86)\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: Returnil Virtual System Core Service (RVSMONBL) - CJSC Returnil Software - C:\Windows\SysWOW64\Returnil\RVS3\rvsmon.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2010\RpcAgentSrv.exe
O23 - Service: ShadowProtect Service (ShadowProtectSvc) - StorageCraft Technology Corporation - C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowProtectSvc.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: StorageCraft Image Manager - StorageCraft Technology Corporation - C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe
O23 - Service: Tropic Designs: Weather Pulse update permissions manager. 29862. - Unknown owner - C:\Program Files (x86)\Weather Pulse\TDClient.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: Viewpoint Service - Viewpoint Corporation - C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
O23 - Service: VMware vCenter Converter Agent (vmware-converter-agent) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe
O23 - Service: VMware vCenter Converter Server (vmware-converter-server) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe
O23 - Service: StorageCraft Shadow Copy Provider (VSNAPVSS) - StorageCraft Technology Corporation - C:\Windows\SysWOW64\vsnapvss.exe
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: XMouseButton Launcher - Highresolution Enterprises - C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonSvc.exe

–
End of file - 15692 bytes

CatByte

Post #2January 7, 2010, 6:22 PM UTC

Wondering about missing files in the log. Are they always safe to remove?

No, definitely not.

The files are not missing:

You have a 64bit system. HJT is unable to read that system.

Are you experiencing any symptoms that might lead you to believe you are infected?

If so post the required DDS and GMER logs from the links in the 'how to get help' topic

http://forums.whatthetech.com/you_Infected…745#entry589745

silat

Post #3January 8, 2010, 12:02 AM UTC

DDS doesnt work with 64bit

Ive attached a pic of the gmer window as most of the selections are greyed out and I cant tick them. Maybe it doesnt work with 64bit either…

📎Gmer.jpg

Gmer log:
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-07 16:01:10
Windows 6.0.6002 Service Pack 2
Running: gmer.exe

—- Registry - GMER 1.0.15 —-

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EE03653B-F2DC-C266-397E-B46209C00B22}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EE03653B-F2DC-C266-397E-B46209C00B22}@bbnkoobnlpmffcakcpfflohcmgdepebpabde 0x61 0x62 0x61 0x6B …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EE03653B-F2DC-C266-397E-B46209C00B22}@abnkoobnlpmffcakcpkfobamjcckciddhd 0x6B 0x62 0x65 0x6B …

—- EOF - GMER 1.0.15 —-

MBAM log

Malwarebytes' Anti-Malware 1.43
Database version: 3506
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18828

1/7/2010 3:42:16 PM
mbam-log-2010-01-07 (15-42-16).txt

Scan type: Quick Scan
Objects scanned: 98618
Time elapsed: 3 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

CatByte

Post #4January 8, 2010, 12:54 AM UTC

Did you actually try DDS as it's been updated to work with 64bit machines,

however,

run this instead:

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.

silat

Post #5January 9, 2010, 5:07 AM UTC

I knew DDS didnt work because I tried to install as you said and it gave me the warning that it didnt work with 64bit. It wouldnt work at all………

That being said here are the logs from OTL:

OTL logfile created on: 1/8/2010 8:56:59 PM - Run 1
OTL by OldTimer - Version 3.1.21.2 Folder = C:\Users\Lou\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

6.00 Gb Total Physical Memory | 5.00 Gb Available Physical Memory | 81.00% Memory free
12.00 Gb Paging File | 10.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 200.00 Gb Total Space | 49.98 Gb Free Space | 24.99% Space Free | Partition Type: NTFS
Drive D: | 992.33 Gb Total Space | 937.40 Gb Free Space | 94.46% Space Free | Partition Type: NTFS
Drive E: | 3.74 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 931.51 Gb Total Space | 483.08 Gb Free Space | 51.86% Space Free | Partition Type: NTFS
Drive G: | 3.17 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive H: | 931.51 Gb Total Space | 521.21 Gb Free Space | 55.95% Space Free | Partition Type: NTFS
Drive I: | 121.36 Mb Total Space | 96.37 Mb Free Space | 79.41% Space Free | Partition Type: FAT32

Computer Name: BLACKHOLE
Current User Name: Lou
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\$ISR\0\ISRService.exe File not found
PRC - C:\Users\Lou\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Lou\AppData\Local\Temp\mrt8BF2.tmp\stdrt.exe (InstallShield Corporation )
PRC - C:\Users\Lou\AppData\Local\Temp\mrt78.tmp\stdrt.exe (InstallShield Corporation )
PRC - C:\Users\Lou\AppData\Local\Temp\IXP001.TMP\adoberd.exe (InstallShield Corporation )
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Flashnote\Flashnote.exe ()
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Maxthon2\Maxthon.exe (Maxthon International ltd.)
PRC - C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Windows\SysWOW64\Returnil\RVS3\rvsmon.exe (CJSC Returnil Software)
PRC - C:\Program Files (x86)\Returnil\RVS3\rvsgui.exe (CJSC Returnil Software)
PRC - C:\Windows\SysWOW64\vsnapvss.exe (StorageCraft Technology Corporation)
PRC - C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowProtectSvc.exe (StorageCraft Technology Corporation)
PRC - C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\Weather Pulse\TDClient.exe ()
PRC - C:\Program Files (x86)\ESET\nod32kui.exe (Eset )
PRC - C:\Program Files (x86)\ESET\nod32krn.exe (Eset )
PRC - C:\Program Files (x86)\Winamp\winampa.exe ()
PRC - C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\$ISR\$APP\ISRMonitor.exe (Leapfrog Software, Inc.)
PRC - C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe (VMware, Inc.)
PRC - C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe (VMware, Inc.)
PRC - F:\Programs\Pink Calendar\PinkCal.exe (www.orangesoftware.net (email: [removed]))
PRC - C:\Program Files (x86)\FastStone\FSCapture.exe (FastStone Soft)
PRC - C:\Windows\SysWOW64\vmnetdhcp.exe (VMware, Inc.)
PRC - C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe (VMware, Inc.)
PRC - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe (VMware, Inc.)
PRC - C:\Windows\SysWOW64\vmnat.exe (VMware, Inc.)
PRC - C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe (VMware, Inc.)
PRC - C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe (StorageCraft Technology Corporation)
PRC - C:\Program Files (x86)\ClipCache\clipc.exe (XRayz Software)
PRC - C:\Program Files\ASUS Xonar D1 Audio\Customapp\AsusAudioCenter.exe (CMedia)
PRC - C:\Program Files (x86)\PowerStrip\PStrip.exe (EnTech Taiwan)
PRC - C:\Program Files (x86)\WordWeb\wweb32.exe (Antony Lewis)
PRC - C:\Windows\SysWOW64\HsMgr.exe ()
PRC - C:\Program Files (x86)\RocketDock\RocketDock.exe ()
PRC - C:\Program Files (x86)\DL Software\D-Color\dcolor.exe ()

========== Modules (SafeList) ==========

MOD - C:\Users\Lou\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\powrprof.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\dsound.dll (Microsoft Corporation)
MOD - C:\Program Files (x86)\PowerStrip\PShook.dll (EnTech Taiwan)
MOD - C:\Windows\SysWOW64\HsSrv.dll (C-Media Electronics Inc.)
MOD - C:\Program Files (x86)\RocketDock\RocketDock.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (lnssvcVista) – C:\Program Files\Soft4Ever\looknstop\LnsSvcVista.exe (Soft4Ever)
SRV:64bit: - (FontCache) – C:\Windows\SysNative\FntCache.dll (Microsoft Corporation)
SRV:64bit: - (SandraAgentSrv) – C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2010\RpcAgentSrv.exe (SiSoftware)
SRV:64bit: - (XMouseButton Launcher) – C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonSvc.exe (Highresolution Enterprises)
SRV:64bit: - (FLEXnet Licensing Service 64) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Acresso Software Inc.)
SRV:64bit: - (TuneUp.Defrag) – C:\Windows\SysNative\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV:64bit: - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (UxTuneUp) – C:\Windows\SysNative\uxtuneup.dll (TuneUp Software GmbH)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (gupdate) Google Update Service (gupdate) – C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (RVSMONBL) – C:\Windows\SysWOW64\Returnil\RVS3\rvsmon.exe (CJSC Returnil Software)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (VSNAPVSS) – C:\Windows\SysWOW64\vsnapvss.exe (StorageCraft Technology Corporation)
SRV - (ShadowProtectSvc) – C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowProtectSvc.exe (StorageCraft Technology Corporation)
SRV - (Tropic Designs: Weather Pulse update permissions manager. 29862.) – C:\Program Files (x86)\Weather Pulse\TDClient.exe ()
SRV - (NOD32krn) – C:\Program Files (x86)\Eset\nod32krn.exe (Eset )
SRV - (clr_optimization_v2.0.50727_64) – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (vmware-converter-server) – C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe (VMware, Inc.)
SRV - (vmware-converter-agent) – C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe (VMware, Inc.)
SRV - (VMnetDHCP) – C:\Windows\SysWOW64\vmnetdhcp.exe (VMware, Inc.)
SRV - (VMAuthdService) – C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe (VMware, Inc.)
SRV - (VMware NAT Service) – C:\Windows\SysWOW64\vmnat.exe (VMware, Inc.)
SRV - (NMSAccessU) – C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe ()
SRV - (ufad-ws60) – C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe (VMware, Inc.)
SRV - (StorageCraft Image Manager) – C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe (StorageCraft Technology Corporation)
SRV - (UxTuneUp) – C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software GmbH)
SRV - (Microsoft Office Groove Audit Service) – C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2006/11/02 05:34:14 | 00,000,000 | —D | M]
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (VSS) – C:\Windows\SysWOW64\wbem\vss.mof ()
SRV - (IDriverT) – C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://go.microsoft.com/fwlink/?LinkId=69157"
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.2
FF - prefs.js..extensions.enabledItems: {a76cd07b-f0d7-4ef9-9566-8faef6e290e4}:1.3.1
FF - prefs.js..extensions.enabledItems: [removed]:0.2.2
FF - prefs.js..extensions.enabledItems: [removed]:0.5.248Beta
FF - prefs.js..extensions.enabledItems: {21cfaec0-dbb3-11dc-95ff-0800200c9a66}:[removed]
FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:3.0.8
FF - prefs.js..extensions.enabledItems: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.3.1
FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2a}:1.3.7
FF - prefs.js..extensions.enabledItems: [removed]:2.7.1
FF - prefs.js..extensions.enabledItems: [removed]:3.0
FF - prefs.js..extensions.enabledItems: [removed]:2.0.3
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:0.5.6.1
FF - prefs.js..extensions.enabledItems: {8522e648-adce-469a-8c3a-18659a6ab6e3}:0.4.6
FF - prefs.js..extensions.enabledItems: [removed]:0.5.7
FF - prefs.js..extensions.enabledItems: {4aebcd37-f454-4928-9233-174a026ed367}:2.0
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.7
FF - prefs.js..extensions.enabledItems: [removed]:3.4.3
FF - prefs.js..extensions.enabledItems: {FBFB7597-9E32-46b4-A500-8B6B0412777F}:0.8

FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2009/03/14 00:45:34 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2009/12/06 14:37:57 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2009/12/19 22:53:06 | 00,000,000 | —D | M]

[2009/03/02 02:46:46 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Extensions
[2009/12/28 10:50:12 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions
[2009/05/10 23:57:57 | 00,000,000 | —D | M] (Image Zoom) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2009/09/03 10:13:16 | 00,000,000 | —D | M] (Easy DragToGo) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{21cfaec0-dbb3-11dc-95ff-0800200c9a66}
[2009/12/10 12:33:17 | 00,000,000 | —D | M] (AI Roboform Toolbar for Firefox) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{22119944-ED35-4ab1-910B-E619EA06A115}
[2009/11/23 15:47:42 | 00,000,000 | —D | M] (Linkification) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}
[2009/04/19 10:50:22 | 00,000,000 | —D | M] (No name found) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{3b71bd20-ee7e-11d9-8cd6-0800200c9a66}
[2009/11/05 01:03:53 | 00,000,000 | —D | M] (Stylish) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2009/04/28 20:57:32 | 00,000,000 | —D | M] (Send Tab URLs) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{4aebcd37-f454-4928-9233-174a026ed367}
[2009/09/03 10:13:16 | 00,000,000 | —D | M] (Speed Dial) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2009/04/19 10:50:22 | 00,000,000 | —D | M] (Save Text Area) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{8522e648-adce-469a-8c3a-18659a6ab6e3}
[2009/05/08 03:27:18 | 00,000,000 | —D | M] (Bookmark All) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{a76cd07b-f0d7-4ef9-9566-8faef6e290e4}
[2009/11/20 15:07:28 | 00,000,000 | —D | M] (Fast Video Download (with SearchMenu)) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}
[2009/12/28 10:50:06 | 00,000,000 | —D | M] (Adblock Plus) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009/05/10 23:57:57 | 00,000,000 | —D | M] (Zoom toolbar) – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\{FBFB7597-9E32-46b4-A500-8B6B0412777F}
[2009/09/03 10:13:12 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/09/03 10:13:12 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/09/03 10:13:16 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/12/28 10:50:11 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/04/19 01:44:54 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/12/28 10:50:06 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/04/28 20:57:32 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/11/05 01:03:51 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/04/19 01:44:53 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/12/28 10:50:12 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\mozilla\Firefox\Profiles\6wzxx6k1.default\extensions\[removed]
[2009/12/28 10:13:54 | 00,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2007/03/09 15:16:44 | 00,189,496 | —- | M] (Yahoo! Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npyaxmpb.dll

O1 HOSTS File: (702 bytes) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (IE7Pro BHO) - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files (x86)\IEPro\IEPro.dll (IE7Pro.com)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ChromeFrame BHO) - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\4.0.266.0\npchrome_tab.dll (@COMPANY_FULLNAME@)
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4:64bit: - HKLM..\Run: [Cmaudio8788] C:\Windows\Syswow64\cmicnfgp.DLL (C-Media Corporation)
O4:64bit: - HKLM..\Run: [Cmaudio8788GX] C:\Windows\syswow64\HsMgr.exe ()
O4:64bit: - HKLM..\Run: [Cmaudio8788GX64] C:\Windows\system\HsMgr64.exe ()
O4:64bit: - HKLM..\Run: [GBMPro8Agentx64] C:\Program Files\Genie-Soft\GBMPro8x64\GBMAgent.exe (Genie-soft)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Look 'n' Stop] C:\Program Files\Soft4Ever\looknstop\looknstop.exe (Soft4Ever)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\adoberd.exe (InstallShield Corporation )
O4 - HKLM..\Run: [explorers] C:\Windows\explorers.exe (TuneUp Software)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ISR_MONITOR] C:\$ISR\$APP\ISRMonitor.exe (Leapfrog Software, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [nod32kui] C:\Program Files (x86)\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [vmware-tray] C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe (VMware, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe ()
O4 - HKCU..\Run: [explorers] C:\Windows\explorers.exe (TuneUp Software)
O4 - HKCU..\Run: [Flashnote] C:\Program Files (x86)\Flashnote\Flashnote.exe ()
O4 - HKCU..\Run: [GBMPro8Agentx64] C:\Program Files\Genie-Soft\GBMPro8x64\GBMAgent.exe (Genie-soft)
O4 - HKCU..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\Lou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClipCache Pro.lnk = C:\Program Files (x86)\ClipCache\clipc.exe (XRayz Software)
O4 - Startup: C:\Users\Lou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dcolor.lnk = C:\Program Files (x86)\DL Software\D-Color\dcolor.exe ()
O4 - Startup: C:\Users\Lou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastStone Capture.lnk = C:\Program Files (x86)\FastStone\FSCapture.exe (FastStone Soft)
O4 - Startup: C:\Users\Lou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PinkCal.lnk = F:\Programs\Pink Calendar\PinkCal.exe (www.orangesoftware.net (email: [removed]))
O4 - Startup: C:\Users\Lou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerStrip.lnk = C:\Program Files (x86)\PowerStrip\PStrip.exe (EnTech Taiwan)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 177
O8:64bit: - Extra context menu item: &NeoTrace It! - C:\Program Files (x86)\NeoTracePro\NTXcontext.htm ()
O8:64bit: - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8:64bit: - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8:64bit: - Extra context menu item: RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8:64bit: - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: &NeoTrace It! - C:\Program Files (x86)\NeoTracePro\NTXcontext.htm ()
O8 - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files (x86)\IEPro\IEPro.dll (IE7Pro.com)
O9 - Extra 'Tools' menuitem : IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files (x86)\IEPro\IEPro.dll (IE7Pro.com)
O9 - Extra Button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files (x86)\IEPro\IEPro.dll (IE7Pro.com)
O9 - Extra 'Tools' menuitem : IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files (x86)\IEPro\IEPro.dll (IE7Pro.com)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysNative\imon.dll (Eset )
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\SysNative\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWow64\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\SysWow64\imon.dll (Eset )
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: watchersweb.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: 25 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlcdnet.asus.com/pub/ASUS/misc/dlm-…vex-2.2.5.0.cab (DLM Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…9932.0263888889 (Update Class)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\cf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\cf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\4.0.266.0\npchrome_tab.dll (@COMPANY_FULLNAME@)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll (Stardock)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{4a601482-8453-11de-aa20-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4a601482-8453-11de-aa20-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - comfile [open] – "%1" %* File not found
64bit: O35 - exefile [open] – "%1" %* File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs:64bit: Ias - C:\Windows\SysNative\ias [2008/01/20 19:06:38 | 00,000,000 | —D | M]
NetSvcs:64bit: Irmon - C:\Windows\SysNative\irmon.dll (Microsoft Corporation)
NetSvcs:64bit: Wmi - C:\Windows\SysNative\wmi.dll (Microsoft Corporation)
NetSvcs: Ias - C:\Windows\SysWOW64\ias [2008/01/20 19:08:35 | 00,000,000 | —D | M]
NetSvcs: Wmi - C:\Windows\SysWOW64\wmi.dll (Microsoft Corporation)
OTL cannot create restorepoints on Vista OSs!

========== Files/Folders - Created Within 14 Days ==========

[2010/01/08 20:55:41 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Users\Lou\Desktop\OTL.exe
[2010/01/08 20:50:50 | 00,000,000 | —D | C] – C:\Program Files\WinRAR
[2010/01/08 14:46:27 | 00,715,164 | —- | C] (InstallShield Corporation ) – C:\adoberd.exe
[2010/01/08 14:41:23 | 21,540,168 | —- | C] (TuneUp Software) – C:\Windows\explorers.exe
[2010/01/08 01:26:30 | 00,000,000 | —D | C] – C:\Users\Lou\Desktop\WinRAR 3.91 x86 x64 AIO
[2010/01/08 01:25:49 | 00,000,000 | —D | C] – C:\Users\Lou\Desktop\Star Wars Screen Entertainment LucasArts - No ISO No Rar
[2010/01/07 00:39:18 | 00,000,000 | —D | C] – C:\HijackThis
[2010/01/07 00:35:53 | 00,000,000 | —D | C] – C:\Users\Lou\AppData\Local\FreeFixer
[2010/01/07 00:35:50 | 00,000,000 | —D | C] – C:\Program Files (x86)\FreeFixer
[2010/01/06 21:17:47 | 00,000,000 | —D | C] – C:\Users\Lou\AppData\Roaming\Malwarebytes
[2010/01/06 21:17:44 | 00,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/01/06 21:17:43 | 00,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/01/06 21:17:42 | 00,022,104 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/01/06 21:17:42 | 00,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/01/06 04:21:23 | 00,032,768 | —- | C] (PcWinTech.com) – C:\Windows\SysWow64\CleanMem.exe
[2010/01/06 04:21:21 | 00,000,000 | —D | C] – C:\Windows\CleanMem
[2010/01/06 04:21:21 | 00,000,000 | —D | C] – C:\Program Files (x86)\CleanMem
[2010/01/02 18:18:32 | 00,000,000 | —D | C] – C:\Program Files (x86)\Belarc
[2009/05/16 15:07:10 | 01,678,336 | —- | C] (CPUID) – C:\Program Files (x86)\HWMonitor.exe
[2009/04/13 11:41:45 | 00,630,784 | —- | C] (NTCore) – C:\Program Files (x86)\Vista4Experts.exe
[2009/04/07 22:29:25 | 00,436,560 | —- | C] (techPowerUp (www.techpowerup.com)) – C:\Program Files (x86)\GPU-Z.0.3.3.exe
[2009/03/12 23:03:20 | 00,086,328 | —- | C] (WinAbility® Software Corporation) – C:\Program Files (x86)\TweakUAC.exe
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/01/08 20:57:14 | 05,767,168 | -HS- | M] () – C:\Users\Lou\NTUSER.DAT
[2010/01/08 20:55:56 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Users\Lou\Desktop\OTL.exe
[2010/01/08 20:42:31 | 00,020,654 | —- | M] () – C:\Users\Lou\Desktop\VMware_Workstation_v7_0_0_203739-[Demonoid.com]_6138106.8846.torrent
[2010/01/08 20:42:16 | 00,001,141 | —- | M] () – C:\Users\Lou\Desktop\[Demonoid.com]-VMWare_Workstation_7_Keygens_Windows_Linux_both_32bit_64bit_6138106.8846.torrent
[2010/01/08 20:42:06 | 00,011,332 | —- | M] () – C:\Users\Lou\Desktop\Vmware_Workstation_7_Keygen-[[Demonoid.com]]_6138106.8846.torrent
[2010/01/08 20:37:47 | 00,003,840 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/01/08 20:37:47 | 00,003,840 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/01/08 20:26:03 | 07,813,460 | —- | M] () – C:\Users\Lou\Desktop\TreeSizePro531Fosi.zip
[2010/01/08 20:26:00 | 00,000,892 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/01/08 14:46:27 | 00,715,164 | —- | M] (InstallShield Corporation ) – C:\adoberd.exe
[2010/01/08 14:41:38 | 20,822,145 | -H– | M] () – C:\Users\Lou\AppData\Roaming\TU2010TrialEN-US.exe
[2010/01/08 14:38:56 | 00,017,845 | —- | M] () – C:\Users\Lou\AppData\Roaming\PStrip.ini
[2010/01/08 14:38:50 | 00,017,845 | —- | M] () – C:\Users\Lou\AppData\Roaming\PStrip.bak
[2010/01/08 14:38:49 | 00,034,705 | —- | M] () – C:\ProgramData\nvModes.dat
[2010/01/08 14:38:49 | 00,034,705 | —- | M] () – C:\ProgramData\nvModes.001
[2010/01/08 14:38:23 | 00,000,888 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/01/08 12:44:02 | 00,699,240 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/01/08 12:44:02 | 00,601,034 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/01/08 12:44:02 | 00,103,198 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/01/08 12:37:28 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/01/08 12:37:24 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/01/08 12:35:07 | 00,524,288 | -HS- | M] () – C:\Users\Lou\NTUSER.DAT{655f9f37-f723-11de-a839-000000000000}.TMContainer00000000000000000001.regtrans-ms
[2010/01/08 12:35:07 | 00,065,536 | -HS- | M] () – C:\Users\Lou\NTUSER.DAT{655f9f37-f723-11de-a839-000000000000}.TM.blf
[2010/01/08 12:34:59 | 00,136,362 | —- | M] () – C:\Users\Lou\AppData\Roaming\PStrip.bk!
[2010/01/08 12:34:57 | 03,211,370 | -H– | M] () – C:\Users\Lou\AppData\Local\IconCache.db
[2010/01/08 07:06:05 | 00,000,256 | —- | M] () – C:\Windows\tasks\Daily Snap 1.job
[2010/01/08 04:34:25 | 00,000,480 | —- | M] () – C:\Windows\tasks\GBM - WindowsMail-Full.job
[2010/01/08 02:05:13 | 00,000,414 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{E879F479-A170-426F-BB8E-F50F43F2FA14}.job
[2010/01/07 19:16:47 | 00,079,490 | —- | M] () – C:\Users\Lou\Desktop\Lewis, Dee.pdf
[2010/01/07 15:32:37 | 00,284,915 | —- | M] () – C:\Users\Lou\Desktop\gmer.zip
[2010/01/07 14:57:47 | 00,358,574 | —- | M] () – C:\Users\Lou\Desktop\1 OR Dept of Energy.pdf
[2010/01/07 14:57:47 | 00,273,408 | —- | M] () – C:\Users\Lou\Desktop\Lewis, Dee & Rick.doc
[2010/01/07 14:57:47 | 00,112,167 | —- | M] () – C:\Users\Lou\Desktop\1 ETO Form_300A.pdf
[2010/01/06 16:43:46 | 00,000,082 | —- | M] () – C:\Users\Lou\Desktop\Paprikas Csirke Recipe (Hungarian chicken paprikash) - Hungary - Whats4Eats.URL
[2010/01/06 14:09:59 | 02,133,430 | —- | M] () – C:\Users\Lou\Desktop\SharePod.zip
[2010/01/06 03:58:34 | 21,540,168 | —- | M] (TuneUp Software) – C:\Windows\explorers.exe
[2010/01/04 18:23:24 | 00,017,845 | —- | M] () – C:\Users\Lou\AppData\Roaming\PStrip.bko
[2010/01/03 19:02:17 | 00,000,206 | —- | M] () – C:\Program Files (x86)\hwmonitorw.ini
[2010/01/03 04:10:19 | 00,000,322 | —- | M] () – C:\Windows\tasks\Weekly #00.job
[2010/01/02 17:48:55 | 00,524,288 | -HS- | M] () – C:\Users\Lou\NTUSER.DAT{655f9f37-f723-11de-a839-000000000000}.TMContainer00000000000000000002.regtrans-ms
[2010/01/01 14:45:26 | 00,065,536 | -HS- | M] () – C:\Users\Lou\NTUSER.DAT{bca0fde8-f1ab-11de-a588-000000000000}.TM.blf
[2010/01/01 14:45:25 | 00,524,288 | -HS- | M] () – C:\Users\Lou\NTUSER.DAT{bca0fde8-f1ab-11de-a588-000000000000}.TMContainer00000000000000000001.regtrans-ms
[2010/01/01 06:24:19 | 00,004,096 | -HS- | M] () – C:\VSM000.IDX
[2010/01/01 04:10:47 | 00,000,332 | —- | M] () – C:\Windows\tasks\Monthly Job #01.job
[2009/12/30 14:55:24 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2009/12/30 14:55:06 | 00,022,104 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2009/12/30 12:27:06 | 14,223,562 | —- | M] () – C:\Users\Lou\Desktop\_diddle_-_Cam_Hot_Girls[1].flv
[2009/12/30 11:32:58 | 00,000,046 | —- | M] () – C:\Users\Lou\Desktop\The Dirty - Nik Richie + Dirty Army intel, opinions, gossip, satire, and celebrities.URL
[2009/12/29 03:03:13 | 00,000,073 | —- | M] () – C:\Users\Lou\Desktop\Being Erica.URL
[2009/12/25 23:59:23 | 00,000,074 | —- | M] () – C:\Users\Lou\Desktop\WhatBoysWant.com – The Best Amateur Porn Community.URL
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/08 20:42:31 | 00,020,654 | —- | C] () – C:\Users\Lou\Desktop\VMware_Workstation_v7_0_0_203739-[Demonoid.com]_6138106.8846.torrent
[2010/01/08 20:42:16 | 00,001,141 | —- | C] () – C:\Users\Lou\Desktop\[Demonoid.com]-VMWare_Workstation_7_Keygens_Windows_Linux_both_32bit_64bit_6138106.8846.torrent
[2010/01/08 20:42:06 | 00,011,332 | —- | C] () – C:\Users\Lou\Desktop\Vmware_Workstation_7_Keygen-[[Demonoid.com]]_6138106.8846.torrent
[2010/01/08 20:25:47 | 07,813,460 | —- | C] () – C:\Users\Lou\Desktop\TreeSizePro531Fosi.zip
[2010/01/08 14:41:43 | 00,032,768 | —- | C] () – C:\Users\Lou\AppData\Roaming\chrtmp
[2010/01/08 14:41:34 | 20,822,145 | -H– | C] () – C:\Users\Lou\AppData\Roaming\TU2010TrialEN-US.exe
[2010/01/07 19:16:51 | 00,079,490 | —- | C] () – C:\Users\Lou\Desktop\Lewis, Dee.pdf
[2010/01/07 15:35:18 | 00,293,376 | —- | C] () – C:\Users\Lou\Desktop\gmer.exe
[2010/01/07 15:32:34 | 00,284,915 | —- | C] () – C:\Users\Lou\Desktop\gmer.zip
[2010/01/07 14:57:47 | 00,358,574 | —- | C] () – C:\Users\Lou\Desktop\1 OR Dept of Energy.pdf
[2010/01/07 14:57:47 | 00,273,408 | —- | C] () – C:\Users\Lou\Desktop\Lewis, Dee & Rick.doc
[2010/01/07 14:57:47 | 00,112,167 | —- | C] () – C:\Users\Lou\Desktop\1 ETO Form_300A.pdf
[2010/01/06 16:43:46 | 00,000,082 | —- | C] () – C:\Users\Lou\Desktop\Paprikas Csirke Recipe (Hungarian chicken paprikash) - Hungary - Whats4Eats.URL
[2010/01/06 14:07:58 | 02,133,430 | —- | C] () – C:\Users\Lou\Desktop\SharePod.zip
[2010/01/01 18:11:48 | 00,524,288 | -HS- | C] () – C:\Users\Lou\NTUSER.DAT{655f9f37-f723-11de-a839-000000000000}.TMContainer00000000000000000002.regtrans-ms
[2010/01/01 18:11:48 | 00,524,288 | -HS- | C] () – C:\Users\Lou\NTUSER.DAT{655f9f37-f723-11de-a839-000000000000}.TMContainer00000000000000000001.regtrans-ms
[2010/01/01 18:11:48 | 00,065,536 | -HS- | C] () – C:\Users\Lou\NTUSER.DAT{655f9f37-f723-11de-a839-000000000000}.TM.blf
[2010/01/01 06:24:19 | 00,004,096 | -HS- | C] () – C:\VSM000.IDX
[2009/12/30 12:30:41 | 14,223,562 | —- | C] () – C:\Users\Lou\Desktop\_diddle_-_Cam_Hot_Girls[1].flv
[2009/12/30 11:32:58 | 00,000,046 | —- | C] () – C:\Users\Lou\Desktop\The Dirty - Nik Richie + Dirty Army intel, opinions, gossip, satire, and celebrities.URL
[2009/12/29 03:03:13 | 00,000,073 | —- | C] () – C:\Users\Lou\Desktop\Being Erica.URL
[2009/12/25 23:59:23 | 00,000,074 | —- | C] () – C:\Users\Lou\Desktop\WhatBoysWant.com – The Best Amateur Porn Community.URL
[2009/12/15 02:21:37 | 00,034,705 | —- | C] () – C:\ProgramData\nvModes.001
[2009/12/15 02:19:44 | 00,034,705 | —- | C] () – C:\ProgramData\nvModes.dat
[2009/11/28 11:05:33 | 12,255,232 | —- | C] () – C:\ProgramData\sandra.mda
[2009/10/28 13:12:24 | 00,014,848 | —- | C] () – C:\Windows\SysWow64\EuEpmGdi.dll
[2009/10/28 13:12:24 | 00,003,072 | —- | C] () – C:\Windows\SysWow64\EuGdiDrv.sys
[2009/10/28 13:12:23 | 00,009,728 | —- | C] () – C:\Windows\SysWow64\epmntdrv.sys
[2009/09/08 00:58:33 | 00,000,206 | —- | C] () – C:\Program Files (x86)\hwmonitorw.ini
[2009/09/03 10:55:04 | 00,000,025 | —- | C] () – C:\Windows\cdplayer.ini
[2009/08/31 14:34:41 | 00,237,568 | —- | C] () – C:\Windows\SysWow64\rmc_rtspdl.dll
[2009/08/14 14:07:06 | 00,001,960 | —- | C] () – C:\Program Files (x86)\EVGA GVT.lnk
[2009/05/27 12:12:55 | 00,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/05/27 12:12:33 | 00,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/05/10 21:31:36 | 00,000,858 | —- | C] () – C:\Program Files (x86)\HandBrake
[2009/04/30 08:57:44 | 00,000,021 | —- | C] () – C:\Program Files (x86)\config.dat
[2009/04/20 11:04:29 | 00,006,230 | —- | C] () – C:\Users\Lou\AppData\Local\Temp16.html
[2009/04/20 10:46:53 | 00,006,230 | —- | C] () – C:\Users\Lou\AppData\Local\Temp29.html
[2009/04/18 12:01:53 | 00,000,703 | —- | C] () – C:\Windows\NewsRover.INI
[2009/04/15 15:02:16 | 00,420,376 | —- | C] () – C:\Users\Lou\AppData\Local\dd_vcredistMSI0C54.txt
[2009/04/15 15:02:15 | 00,014,182 | —- | C] () – C:\Users\Lou\AppData\Local\dd_vcredistUI0C54.txt
[2009/04/07 13:39:20 | 00,000,906 | —- | C] () – C:\Windows\Cmicnfgp.ini.imi
[2009/04/07 13:39:17 | 00,005,287 | —- | C] () – C:\Windows\Cmicnfgp.ini.cfg
[2009/04/07 13:18:40 | 00,000,053 | —- | C] () – C:\Windows\SysWow64\cmasiop.ini
[2009/04/06 15:46:03 | 00,139,264 | —- | C] () – C:\Windows\SysWow64\VmixP8.dll
[2009/04/06 15:45:47 | 00,119,542 | —- | C] () – C:\Windows\Cmicnfgp.ini.cfl
[2009/03/31 18:03:23 | 00,000,778 | —- | C] () – C:\Users\Lou\AppData\Local\Temp1.html
[2009/03/29 15:11:54 | 00,000,625 | —- | C] () – C:\Windows\clipc.INI
[2009/03/21 01:05:13 | 00,001,944 | —- | C] () – C:\Program Files (x86)\TempConv2.lnk
[2009/03/21 01:03:49 | 00,001,297 | —- | C] () – C:\Windows\MultiTimer.ini
[2009/03/20 09:25:24 | 00,009,728 | —- | C] () – C:\Windows\SysWow64\BASSMOD.dll
[2009/03/18 06:38:15 | 00,000,140 | —- | C] () – C:\Windows\ODBC.INI
[2009/03/16 19:47:24 | 00,713,016 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2009/03/16 18:40:17 | 00,000,060 | —- | C] () – C:\Windows\wininit.ini
[2009/03/16 15:57:04 | 00,017,845 | —- | C] () – C:\Users\Lou\AppData\Roaming\PStrip.bko
[2009/03/16 15:53:30 | 00,136,362 | —- | C] () – C:\Users\Lou\AppData\Roaming\PStrip.bk!
[2009/03/16 15:53:26 | 00,017,845 | —- | C] () – C:\Users\Lou\AppData\Roaming\PStrip.bak
[2009/03/16 15:29:20 | 00,017,845 | —- | C] () – C:\Users\Lou\AppData\Roaming\PStrip.ini
[2009/03/12 23:22:38 | 00,057,344 | —- | C] () – C:\Users\Lou\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/03 21:04:46 | 00,000,680 | —- | C] () – C:\Users\Lou\AppData\Local\d3d9caps.dat
[2009/03/03 00:20:25 | 00,003,972 | —- | C] () – C:\Windows\SysWow64\drivers\PciBus.sys
[2009/03/02 02:17:20 | 00,001,460 | —- | C] () – C:\Users\Lou\AppData\Local\d3d9caps64.dat
[2009/01/26 01:53:02 | 00,499,712 | R— | C] () – C:\Windows\SysWow64\XmlSpyLib.dll
[2008/11/29 10:13:12 | 00,015,040 | —- | C] () – C:\Windows\SysWow64\uddriver.sys
[2008/10/07 09:13:30 | 00,197,912 | —- | C] () – C:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 09:13:22 | 00,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 00,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 00,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 00,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 00,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 00,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 00,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 00,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 00,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelFrench.dll
[2008/07/01 03:59:33 | 00,000,559 | —- | C] () – C:\Windows\cmudaxp.ini
[2008/01/20 18:50:05 | 00,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2007/11/02 21:52:39 | 00,000,108 | RHS- | C] () – C:\Windows\neoqaz2.dll

========== LOP Check ==========

[2009/05/07 10:46:08 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Aduna
[2009/04/12 21:04:06 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\aignes
[2009/08/31 14:23:27 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\ALLCapture
[2009/05/13 04:09:15 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\App Launcher Gadget
[2009/04/06 15:46:18 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\ASUS
[2009/03/17 18:07:01 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Axialis
[2009/03/20 15:30:48 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Canneverbe_Limited
[2009/08/28 12:40:16 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\DassaultSystemes
[2010/01/08 14:38:42 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\flashnote
[2009/04/24 04:48:42 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Forte
[2009/11/12 10:41:45 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Genie-Soft
[2009/11/05 03:23:03 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\GetRightToGo
[2009/03/16 19:57:42 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Highresolution Enterprises
[2009/04/19 23:18:18 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\IcoFX
[2009/04/29 05:11:23 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\ImgBurn
[2009/03/16 14:19:04 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\JAM Software
[2009/04/11 00:30:49 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Locate32
[2010/01/01 06:05:47 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\MailWasherPro
[2010/01/08 20:54:03 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\MxBoost
[2009/11/27 17:56:37 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\PDF Writer
[2009/12/06 14:42:26 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Publish Providers
[2009/08/16 03:00:57 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Returnil
[2009/03/16 01:47:07 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\ShadowProtect
[2009/09/02 00:58:48 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Sharp World Clock
[2009/12/06 14:42:49 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Sony
[2009/09/01 16:19:42 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Spotify
[2009/09/03 19:29:53 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Stardock
[2009/09/03 20:07:34 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Stellarium
[2009/05/27 02:38:03 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\streamripper
[2009/03/19 22:25:17 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Tenebril
[2009/04/16 03:11:58 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Trillian
[2009/03/22 01:59:23 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\TuneUp Software
[2009/03/13 12:37:29 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\URSoft
[2009/08/15 22:18:21 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Weather Pulse
[2009/05/10 20:10:30 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\Windows Sidebar Styler
[2010/01/08 14:46:48 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\WordWeb
[2009/03/13 14:04:41 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\X-Setup Pro
[2009/03/13 15:16:35 | 00,000,000 | —D | M] – C:\Users\Lou\AppData\Roaming\XRayz
[2010/01/08 07:06:05 | 00,000,256 | —- | M] () – C:\Windows\Tasks\Daily Snap 1.job
[2010/01/08 04:34:25 | 00,000,480 | —- | M] () – C:\Windows\Tasks\GBM - WindowsMail-Full.job
[2010/01/01 04:10:47 | 00,000,332 | —- | M] () – C:\Windows\Tasks\Monthly Job #01.job
[2010/01/08 12:35:04 | 00,032,572 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/01/08 02:05:13 | 00,000,414 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{E879F479-A170-426F-BB8E-F50F43F2FA14}.job
[2010/01/03 04:10:19 | 00,000,322 | —- | M] () – C:\Windows\Tasks\Weekly #00.job

========== Purity Check ==========

========== Custom Scans ==========

< >

< %SYSTEMDRIVE%\*.exe >
[2010/01/08 14:46:27 | 00,715,164 | —- | M] (InstallShield Corporation ) – C:\adoberd.exe

< MD5 for: AGP440.SYS >
[2008/01/20 18:46:51 | 00,064,568 | —- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
[2008/01/20 18:46:51 | 00,064,568 | —- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_181d01cb743015fc\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/20 18:46:50 | 00,022,584 | —- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
[2009/04/10 23:15:00 | 00,020,952 | —- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_3b423ca9d7090b1e\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 03:16:48 | 00,014,848 | —- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 – C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006/11/02 01:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\SysWOW64\cngaudit.dll
[2006/11/02 01:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\SysWOW64\cngaudit.dll
[2006/11/02 01:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2008/01/20 18:46:59 | 00,290,872 | —- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2008/01/20 18:51:03 | 00,716,800 | —- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2009/04/10 22:28:23 | 00,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\SysWOW64\netlogon.dll
[2009/04/10 22:28:23 | 00,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\SysWOW64\netlogon.dll
[2009/04/10 22:28:23 | 00,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_6616762521d9e6d4\netlogon.dll
[2009/04/10 23:11:16 | 00,717,312 | —- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_5bc1cbd2ed7924d9\netlogon.dll
[2008/01/20 18:48:28 | 00,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2008/01/20 18:46:54 | 00,054,328 | —- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/20 18:50:28 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2008/01/20 18:49:49 | 00,235,520 | —- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
[2009/04/10 22:28:24 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\SysWOW64\scecli.dll
[2009/04/10 22:28:24 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\SysWOW64\scecli.dll
[2009/04/10 22:28:24 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_a06ca13dc2fb6d8f\scecli.dll
[2009/04/10 23:11:23 | 00,235,520 | —- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_9617f6eb8e9aab94\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 03:31:42 | 00,348,160 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\SysWOW64\dxtmsft.dll
[2009/03/08 03:31:37 | 00,216,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\SysWOW64\dxtrans.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:C974B928
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:BEC0D766
@Alternate Data Stream - 184 bytes -> C:\ProgramData\TEMP:B3D74A13
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:05EE1EEF
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:E2B2CFF7
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:6DFF1A8A
@Alternate Data Stream - 108 bytes -> C:\Windows:
< End of report >

OTL Extras logfile created on: 1/8/2010 8:56:59 PM - Run 1
OTL by OldTimer - Version 3.1.21.2 Folder = C:\Users\Lou\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

6.00 Gb Total Physical Memory | 5.00 Gb Available Physical Memory | 81.00% Memory free
12.00 Gb Paging File | 10.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 200.00 Gb Total Space | 49.98 Gb Free Space | 24.99% Space Free | Partition Type: NTFS
Drive D: | 992.33 Gb Total Space | 937.40 Gb Free Space | 94.46% Space Free | Partition Type: NTFS
Drive E: | 3.74 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 931.51 Gb Total Space | 483.08 Gb Free Space | 51.86% Space Free | Partition Type: NTFS
Drive G: | 3.17 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive H: | 931.51 Gb Total Space | 521.21 Gb Free Space | 55.95% Space Free | Partition Type: NTFS
Drive I: | 121.36 Mb Total Space | 96.37 Mb Free Space | 79.41% Space Free | Partition Type: FAT32

Computer Name: BLACKHOLE
Current User Name: Lou
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files (x86)\Maxthon2\Maxthon.exe (Maxthon International ltd.)
.url [@ = InternetShortcut] – C:\Program Files (x86)\Maxthon\Maxthon2.exe (Maxthon International ltd.)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [open_x2] – "C:\Program Files (x86)\xplorer2\xplorer2_64.exe" /S:x2solo /1 /N /M /T "%1" (ZabKat)
Directory [runas] – cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [SuperFinder] – "C:\Program Files (x86)\SuperFinder\SuperFinder.exe" "%1" (FSL)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [open_x2] – "C:\Program Files (x86)\xplorer2\xplorer2_64.exe" /S:x2solo /1 /N /M /T "%1" (ZabKat)
Directory [runas] – cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [SuperFinder] – "C:\Program Files (x86)\SuperFinder\SuperFinder.exe" "%1" (FSL)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = E1 63 B1 03 0B DF C9 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2011184300-1279364897-1593892099-1000]
"EnableNotificationsRef" = 3
"EnableNotifications" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2011184300-1279364897-1593892099-1001]
"EnableNotifications" = 1
"EnableNotificationsRef" = 2

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"UACDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\IEPro\MiniDM.exe" = C:\Program Files (x86)\IEPro\MiniDM.exe:*:Enabled:MiniDM – (IE7Pro.com)
"C:\Windows\explorers.exe" = C:\Windows\explorers.exe:*:Enabled:explorers – (TuneUp Software)
"C:\Program Files (x86)\IEPro\MiniDM.exe" = C:\Program Files (x86)\IEPro\MiniDM.exe:*:Enabled:MiniDM – (IE7Pro.com)
"C:\Windows\explorers.exe" = C:\Windows\explorers.exe:*:Enabled:explorers – (TuneUp Software)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{502E9842-FDC3-4B1E-8288-86D1D7A7FCCB}" = lport=6258 | protocol=6 | dir=in | name=hfs tcp |
"{705113F9-33AC-4356-BE8D-CC2AC46B192E}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{E0E95F30-B1F2-4E79-AE28-6FE8C502AB27}" = lport=8080 | protocol=17 | dir=in | name=hfs udp |
"{FDE4C2BE-975A-4E5A-B8F8-71714F267C5E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0467CC10-FEB4-4348-88BD-043910307930}" = protocol=6 | dir=in | app=c:\program files (x86)\firetrust\mailwasher pro\mailwasher.exe |
"{0487570B-A197-46FB-A3A4-2D682224B2DA}" = protocol=17 | dir=in | app=d:\games64\steam\steamapps\common\arma armed assault\arma.exe |
"{12479BBF-C244-4641-BBFE-A5D3EF4B6F8A}" = protocol=17 | dir=in | app=d:\games64\steam\steamapps\common\arma armed assault\arma_server.exe |
"{2D637407-F817-4A96-A73B-19D65B7E64F9}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{2F152287-0396-4FA6-8ECE-E7ED16500950}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3BBFEC20-0F5D-4C77-8E0D-68F990B87947}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{3FEF948C-883F-474A-90A6-3FD8D2D84A22}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{451FEB98-55D6-446D-B3E6-6886E5699E57}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4D32E087-1AF3-41E0-A126-41670D2BCBDE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{592CCA5C-A5CF-4B5F-8F65-9746DCF85609}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5C69AA75-9968-4EAB-AC87-7771633245C5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6A9EF81B-92E7-435A-9CC5-CD8C1A3CA6E6}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{76EB4E64-963F-450B-9BB6-34E1756219B6}" = protocol=17 | dir=in | app=c:\program files (x86)\firetrust\mailwasher pro\mailwasher.exe |
"{787CB5B3-2926-413F-8678-B0883B6C9E04}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7F821B66-AB57-4D49-8A77-DCEFF33A85EA}" = protocol=6 | dir=in | app=d:\games64\steam\steamapps\common\arma armed assault\arma_server.exe |
"{81140610-A916-4A8B-8CF9-6B3282F6A498}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{89F90E0D-A14B-483F-9601-88B6BF65C036}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8C212389-1C7F-4324-A849-56174B888BA5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8CEF60AA-F2B9-4D8A-9407-A8FC6B2D02F5}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{961809C0-9CFB-429E-9976-C8CC0BC7CB80}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9A08FEF6-94F0-429C-8200-524BF5D44E5E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{9EF59602-0B74-4A42-86D0-4F589FB0852E}" = protocol=17 | dir=in | app=c:\program files (x86)\vmware\vmware workstation\vmware-authd.exe |
"{A2D0EFEF-1792-4DA9-B4AD-8F63A81E5F23}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A795BEA0-7205-4C84-ABB4-7AAB800026B0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{AB6ADCDD-90F8-4732-BDC5-2ED07C606340}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{AF36F233-0DF9-404A-87E4-0673836E00EE}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{B573D3DE-B976-4C3D-823C-763C19340333}" = protocol=6 | dir=in | app=d:\games64\steam\steamapps\common\arma armed assault\arma.exe |
"{CBADCF09-692E-4F1B-BEBB-56C923B968E7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{ECD5BE6A-EE58-4710-B2F1-03A11322F8DA}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{F0C5E9AA-B82D-4A77-8426-7FA1A50F3688}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F40D8E1F-F8B9-44FC-9A88-9BABABEDAE0C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FEFB3F20-4C95-4F0D-AF6A-A1EE13EEDAE5}" = protocol=6 | dir=in | app=c:\program files (x86)\vmware\vmware workstation\vmware-authd.exe |
"TCP Query User{322FC58E-4377-453B-8A37-142211BFB15D}C:\games\htc\aces high ii\aceshigh.exe" = protocol=6 | dir=in | app=c:\games\htc\aces high ii\aceshigh.exe |
"TCP Query User{3F2B7FCA-3E5D-4D32-A90B-92121E184C2E}C:\program files (x86)\stickynote\stickynote.exe" = protocol=6 | dir=in | app=c:\program files (x86)\stickynote\stickynote.exe |
"TCP Query User{5D00C9ED-157E-4D01-9156-A22BEB187708}C:\program files (x86)\storagecraft\imagemanager\imagemanagerclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\storagecraft\imagemanager\imagemanagerclient.exe |
"TCP Query User{763CF937-0EF7-469A-BB93-603E59FCDEF9}C:\program files (x86)\pfportchecker\pfportchecker.exe" = protocol=6 | dir=in | app=c:\program files (x86)\pfportchecker\pfportchecker.exe |
"TCP Query User{A43D3AA8-80F7-411C-9E4F-407274830E6A}C:\program files (x86)\maxthon\modules\mxdownloader\mxdownloadserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\maxthon\modules\mxdownloader\mxdownloadserver.exe |
"TCP Query User{B0DBFBD4-5A07-40A5-AD56-E8E3E9688812}C:\users\lou\desktop\hfs.exe" = protocol=6 | dir=in | app=c:\users\lou\desktop\hfs.exe |
"TCP Query User{BA39D511-133F-4E3A-974D-7A8B1EF8D71F}C:\program files (x86)\maxthon\modules\mxdownloader\mxdownloadserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\maxthon\modules\mxdownloader\mxdownloadserver.exe |
"TCP Query User{BBD5E3FE-C6DD-4DF7-BCCA-F0869811D8F3}C:\program files (x86)\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files (x86)\trillian\trillian.exe |
"TCP Query User{E45D54FD-0E1A-4863-869A-2D0887137678}C:\program files (x86)\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files (x86)\trillian\trillian.exe |
"UDP Query User{46BFD8F5-7727-4D0E-AA33-81A2821083A1}C:\program files (x86)\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files (x86)\trillian\trillian.exe |
"UDP Query User{4B17041E-DBC9-4F96-9453-79B3845127D1}C:\program files (x86)\stickynote\stickynote.exe" = protocol=17 | dir=in | app=c:\program files (x86)\stickynote\stickynote.exe |
"UDP Query User{53BD3787-8419-43DA-BAE8-64FF5EFAAB27}C:\program files (x86)\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files (x86)\trillian\trillian.exe |
"UDP Query User{62B0A21C-E6B4-4FF6-9811-BEA8A534DE42}C:\games\htc\aces high ii\aceshigh.exe" = protocol=17 | dir=in | app=c:\games\htc\aces high ii\aceshigh.exe |
"UDP Query User{89017000-D074-4038-8DAE-97FEEC362180}C:\program files (x86)\maxthon\modules\mxdownloader\mxdownloadserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\maxthon\modules\mxdownloader\mxdownloadserver.exe |
"UDP Query User{8F7AC79C-2973-4A28-864E-59382D112742}C:\program files (x86)\storagecraft\imagemanager\imagemanagerclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\storagecraft\imagemanager\imagemanagerclient.exe |
"UDP Query User{B6606859-F0C3-4E4F-A32D-4656C2B65016}C:\program files (x86)\maxthon\modules\mxdownloader\mxdownloadserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\maxthon\modules\mxdownloader\mxdownloadserver.exe |
"UDP Query User{EF5262D4-7BFA-4BEE-99E6-F2FAC1372EDA}C:\program files (x86)\pfportchecker\pfportchecker.exe" = protocol=17 | dir=in | app=c:\program files (x86)\pfportchecker\pfportchecker.exe |
"UDP Query User{F156F73D-B155-4EA9-AC06-33F885BB91ED}C:\users\lou\desktop\hfs.exe" = protocol=17 | dir=in | app=c:\users\lou\desktop\hfs.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.0.0 (r181)
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{23170F69-40C1-2702-0902-000001000000}" = 7-Zip 9.02 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86416013FF}" = Java™ 6 Update 13 (64-bit)
"{295CFB7C-A57E-4313-93E7-68E7CE1D0332}" = Adobe WinSoft Linguistics Plugin x64
"{299CC263-D4A2-4536-9874-9C9F75B2F475}_is1" = Genie Backup Manager Pro 8.0 (x64)
"{2D74E972-5A85-44DC-9193-8A302BA8C181}" = Photoshop Camera Raw_x64
"{6631325A-9B1B-4EE7-8E64-8CC4A6F10643}" = Adobe Fonts All x64
"{665E4A81-6A5E-40BA-B228-E04B6ED195F8}" = X-Mouse Button Control
"{6ACE7F46-FACE-4125-AE86-672F4F2A6A28}" = Bing Maps 3D
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{8753DF4D-64B0-474E-9A97-0AB5585D9A53}" = Logitech Gaming Software 5.04
"{8875A1C0-6308-4790-8CF6-D34E89880052}" = Adobe Linguistics CS4 x64
"{887797BF-37A5-4199-B0C9-0D38D6196E9A}" = Adobe Anchor Service x64 CS4
"{8C8D673B-20FB-43E6-BCB7-9B3F78F2E762}" = Adobe Type Support x64 CS4
"{8D273DE5-ABFA-4BD0-A9D7-EE9C971438C4}_is1" = PDF-Viewer
"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90BA8112-80B3-4617-A3C1-BD2771B60F74}" = Adobe CMaps x64 CS4
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9DAB307E-531F-4992-AB30-6F1AD39E6CF9}" = Desktop Restore
"{A3454894-144A-4D80-B605-C128FE0D7329}" = Adobe Drive CS4 x64
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2296}_is1" = SiSoftware Sandra Professional Business 2010
"{C7311329-C491-427B-8880-133E84869B3A}" = Vista Shortcut Manager x64
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF1EB598-B424-436A-B15F-B763846BA970}" = Dassault Systemes Software Prerequisites x86-x64
"{D2A0CBEE-8949-474E-9D2B-539726D20531}" = Microsoft IntelliPoint 6.3
"{D40172D6-CE2D-4B72-BF5F-26A04A900B7B}" = Adobe Photoshop CS4 (64 Bit)
"{DFFABE78-8173-4E97-9C5C-22FB26192FC5}" = Adobe PDF Library Files x64 CS4
"{E3F12925-A842-46A0-AFF0-E81B55FED045}" = Windows Sidebar Styler
"{F3F18612-7B5D-4C05-86C9-AB50F6F71727}" = KhalInstallWrapper
"C-Media Oxygen HD Audio Driver" = ASUS Xonar D1 Audio Driver
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.51
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.14
"FileMenu Tools_is1" = FileMenu Tools
"Locate" = Locate32
"Look 'n' Stop 2.07" = Look 'n' Stop 2.07
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"PerformanceTest_is1" = PerformanceTest v6.1 (64-bit)
"USBTrace_is1" = USBTrace V2.2.8
"WhoCrashed_is1" = WhoCrashed 1.01
"WinRAR archiver" = WinRAR archiver
"xplorer2p64" = xplorer² professional 64 bit

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{0286B55B-7CE1-4468-A407-2810B0539A0E}" = Temperature Conversion Solution
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{10CD364B-FFCC-48BE-B469-B9622A033075}" = Fences
"{111D203A-1474-488E-8128-5B7ED902083E}" = Altova XMLSpy® 2009 Enterprise Edition
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 15
"{2767F60B-61C7-4436-9544-CB5EF557909C}" = Returnil Virtual System 2010
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{32E50C3F-46FB-4827-9BC3-0429860F5288}_is1" = ALLCapture Enterprise 3.0
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{361000D5-6F06-43A2-8866-F982FFE4E70D}" = Aces High Pilot Stats
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3C74D5C3-EBB9-408E-972F-B9802F13D5E4}" = 3DVIA Shape for Maps
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4BCDD100-3029-42C3-B7F7-4A0DA414861D}" = DietPower 4.4
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{5888428E-699C-4E71-BF71-94EE06B497DA}" = TuneUp Utilities 2008
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7F3AD00A-1819-4B15-BB7D-08B3586336D7}" = 3DMark06
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{82C60527-B637-4557-AB3D-72BB025F98A0}" = ShadowProtect Desktop
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{8850DEC8-22FD-4F05-A3AA-49B91200C24F}" = ShadowProtect Desktop
"{8BFD2B0A-9BFF-4E0F-81DF-991ACCA4BB27}" = EVGA GPU Voltage Tuner
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{00C5525B-3CB3-467D-8100-2E6FB306CD86}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002A-0409-1000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0116-0409-1000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{944FF102-3AC8-45CF-AAC3-1BB5C2D8DE0A}" = AHII Aircraft Performance
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3FF5CB2-FB35-4658-8751-9EDE1D65B3AA}" = VMware Workstation
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA668889-AA01-AA01-AADC-65462C3DE344}" = FreeFixer
"{B047C9CE-1B9B-45A9-89A0-7E6F81C16FEF}" = Camtasia Studio 6
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B6164988-AA55-4099-BB9C-EC058210DAD6}" = ImageManager
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C10F500A-3575-4BD1-8AB1-FA7ADD6C1A8D}" = ShadowProtect Desktop
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C5344219-9988-480B-8D1F-EFAB0EEF3F3C}" = VMware vCenter Converter Standalone
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CD1DF19E-4ED2-43F5-9E07-D4DD22D1671E}" = EVGA E-LEET
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Professional
"{CF91A5A9-F10D-433D-A677-9505B84EAF1B}" = Stardock Impulse
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D727AC50-2836-4C8F-B849-41AB99E87A8A}" = FirstDefense-ISR
"{DA507A38-4B2A-40C0-90AC-E30AAA0B757C}" = Vegas Movie Studio Platinum 9.0
"{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX v2.1
"{DF29A0E2-DF76-4932-98A9-34B441F40486}" = Auction Sentry
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F3CA05B7-B4C0-4C9B-AAA6-16B868B35DF2}" = TrackIR5
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"7-Zip" = 7-Zip 4.65
"ACEMod" = ACEMod
"Aces High" = Aces High
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Agent Ransack_is1" = Agent Ransack Version 1.7.3
"AI RoboForm" = AI RoboForm (All Users)
"aignesamdeadlink" = AM-DeadLink 3.3
"Belarc Advisor" = Belarc Advisor 8.1
"CleanMem" = CleanMem
"ClipCache_is1" = ClipCache Pro 3.1.4
"CodeStuff Starter" = CodeStuff Starter
"D-Color" = D-Color 1.2 (remove only)
"DietPower 4.4" = DietPower 4.4
"dips64" = Desktop Icon Position Saver (64-bit)
"DriverCleanerDotNET" = DH Driver Cleaner.NET
"DTT Supporters Edition_is1" = Developer's Tips & Tricks 2.2.0.5
"DupDetector_is1" = DupDetector 3.201
"EASEUS Partition Master Server Edition_is1" = EASEUS Partition Master 4.0 Server Edition
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.01
"Fences" = Fences
"Flashnote" = Flashnote 3.4
"FormatFactory" = FormatFactory 2.15
"Forte Agent" = Forté Agent
"Foxit PDF Editor" = Foxit PDF Editor
"Foxit Reader" = Foxit Reader
"Fraps" = Fraps (remove only)
"GOM Player" = GOM Player
"Google Chrome Frame" = Google Chrome Frame
"HandBrake" = Handbrake 0.9.4
"HD Tach_is1" = HD Tach version 3
"HD Tune Pro_is1" = HD Tune Pro 3.50
"IcoFX_is1" = IcoFX 1.6.4
"IconWorkshop" = Axialis IconWorkshop 6.0
"IE7Pro" = IE7Pro
"ImgBurn" = ImgBurn
"IrfanView" = IrfanView (remove only)
"jv16 PowerTools 2009_is1" = jv16 PowerTools 2009
"Karen's Directory Printer" = Karen's Directory Printer
"Karen's LAN Monitor" = Karen's LAN Monitor
"Karen's Time Sync" = Karen's Time Sync
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"LogonStudio Vista" = LogonStudio Vista
"Magic ISO Maker v5.5 (build 0273)" = Magic ISO Maker v5.5 (build 0273)
"MailWasher Pro_is1" = MailWasher Pro
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Maxthon2" = Maxthon2
"MoffCalc2_is1" = Moffsoft Calculator 2
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"NeoTrace Pro 3.25" = NeoTrace Pro 3.25
"News Rover" = News Rover – Usenet newsreader
"NOD32" = NOD32 antivirus system
"No-IP.com DUC" = No-IP.com DUC (remove only)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"ObjectDock Plus" = ObjectDock Plus
"OCCT_is1" = OCCT Perestroika 3.1.0
"OpenAL" = OpenAL
"PFConfig" = PFConfig 1.0.251
"PFPortChecker" = PFPortChecker 1.0.28
"POP Peeper" = POP Peeper
"PowerStrip 3 (remove only)" = PowerStrip 3 (remove only)
"Precision" = EVGA Precision 1.6.0
"RealAlt_is1" = Real Alternative 1.9.0
"RealPlayer 12.0" = RealPlayer
"Replay Media Catcher2.30" = Replay Media Catcher
"SetBrowser" = SetBrowser (remove only)
"Sharp World Clock_is1" = Sharp World Clock 4.38
"Spotify" = Spotify
"SpywareBlaster_is1" = SpywareBlaster 4.2
"Stardock Impulse" = Stardock Impulse
"Steam App 2780" = ArmA: Armed Assault
"Steam App 33900" = ARMA 2
"Steam App 440" = Team Fortress 2
"Stellarium_is1" = Stellarium 0.10.2
"StickyNote_is1" = StickyNote 9
"Streamripper" = Streamripper (Remove only)
"Super Finder XT portable Supporters Edition_is1" = Super Finder XT [removed]
"SyncBackSE_is1" = SyncBackSE
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Total Uninstall 5_is1" = Total Uninstall 5.2.0
"TreeSize Professional_is1" = TreeSize Professional 5.2
"Trillian" = Trillian
"UltimateDefrag 2008" = UltimateDefrag 2008
"UnixUtils for Yahoo! Widgets" = Unix Utilities for Yahoo! Widgets
"VLC media player" = VLC media player 0.9.9
"Weather Pulse2.10" = Weather Pulse
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"WordWeb" = WordWeb Pro
"XdN Tweaker" = XdN Tweaker 0.9.2.1
"XMedia Recode" = XMedia Recode [removed]
"xqdcXSP_is1" = XQDC X-Setup Pro 9.1.100
"XYplorer" = XYplorer 8.70
"Yahoo! Widget Engine" = Yahoo! Widgets
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"nirsoft_installer" = NirSoft™ Freeware Installer 1.28
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/23/2009 8:50:57 PM | Computer Name = BLACKHOLE | Source = Application Error | ID = 1000
Description = Faulting application POPPeeper.exe, version 3.5.0.0, time stamp 0x4a899dd8,
faulting module WININET.dll, version 8.0.6001.18828, time stamp 0x4a961850, exception
code 0xc0000005, fault offset 0x0001f6ea, process id 0xf7c, application start time
0x01ca8433262e3546.

Error - 12/24/2009 11:00:22 AM | Computer Name = BLACKHOLE | Source = Genie Backup Manager Professional Edition 8.0 (x64) | ID = 1
Description = Data backup failed for Job "WindowsMail" Backup Size: 0 Bytes

Error - 12/26/2009 6:08:16 AM | Computer Name = BLACKHOLE | Source = Application Error | ID = 1000
Description = Faulting application aceshigh.exe, version 0.0.0.0, time stamp 0x4b1ea948,
faulting module aceshigh.exe, version 0.0.0.0, time stamp 0x4b1ea948, exception
code 0xc0000005, fault offset 0x000b7d7b, process id 0xbbc, application start time
0x01ca8608dd539449.

Error - 12/26/2009 4:53:03 PM | Computer Name = BLACKHOLE | Source = Application Error | ID = 1000
Description = Faulting application aceshigh.exe, version 0.0.0.0, time stamp 0x4b1ea948,
faulting module aceshigh.exe, version 0.0.0.0, time stamp 0x4b1ea948, exception
code 0xc0000005, fault offset 0x000b7d7b, process id 0x12a0, application start time
0x01ca866af5e8517c.

Error - 12/27/2009 11:00:23 AM | Computer Name = BLACKHOLE | Source = Genie Backup Manager Professional Edition 8.0 (x64) | ID = 1
Description = Data backup failed for Job "WindowsMail" Backup Size: 0 Bytes

Error - 12/28/2009 2:58:13 PM | Computer Name = BLACKHOLE | Source = Application Error | ID = 1000
Description = Faulting application Maxthon.exe, version 2.5.9.2246, time stamp 0x4ae16f36,
faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03824, exception
code 0xc0000005, fault offset 0x00038e7c, process id 0x15c0, application start time
0x01ca8767094a21b2.

Error - 12/29/2009 11:00:23 AM | Computer Name = BLACKHOLE | Source = Genie Backup Manager Professional Edition 8.0 (x64) | ID = 1
Description = Data backup failed for Job "WindowsMail" Backup Size: 0 Bytes

Error - 12/29/2009 8:19:45 PM | Computer Name = BLACKHOLE | Source = Application Error | ID = 1000
Description = Faulting application aceshigh.exe, version 0.0.0.0, time stamp 0x4b1ea948,
faulting module aceshigh.exe, version 0.0.0.0, time stamp 0x4b1ea948, exception
code 0xc0000005, fault offset 0x000b7d7b, process id 0x1630, application start time
0x01ca88cabfb8934d.

Error - 12/31/2009 11:00:23 AM | Computer Name = BLACKHOLE | Source = Genie Backup Manager Professional Edition 8.0 (x64) | ID = 1
Description = Data backup failed for Job "WindowsMail" Backup Size: 0 Bytes

Error - 1/2/2010 12:27:55 AM | Computer Name = BLACKHOLE | Source = Application Error | ID = 1000
Description = Faulting application aceshigh.exe, version 0.0.0.0, time stamp 0x4b1ea948,
faulting module aceshigh.exe, version 0.0.0.0, time stamp 0x4b1ea948, exception
code 0xc0000005, fault offset 0x000b7d7b, process id 0x130c, application start time
0x01ca8b5589c5a4fa.

[ System Events ]
Error - 1/8/2010 4:37:10 PM | Computer Name = BLACKHOLE | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 1/8/2010 4:37:10 PM | Computer Name = BLACKHOLE | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 1/8/2010 4:39:05 PM | Computer Name = BLACKHOLE | Source = Service Control Manager | ID = 7000
Description =

Error - 1/8/2010 4:39:05 PM | Computer Name = BLACKHOLE | Source = Service Control Manager | ID = 7026
Description =

Error - 1/8/2010 6:38:39 PM | Computer Name = BLACKHOLE | Source = Service Control Manager | ID = 7000
Description =

Error - 1/8/2010 6:38:39 PM | Computer Name = BLACKHOLE | Source = Service Control Manager | ID = 7000
Description =

Error - 1/8/2010 6:38:40 PM | Computer Name = BLACKHOLE | Source = Service Control Manager | ID = 7000
Description =

Error - 1/8/2010 6:38:39 PM | Computer Name = BLACKHOLE | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 1/8/2010 6:38:39 PM | Computer Name = BLACKHOLE | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 1/8/2010 6:38:40 PM | Computer Name = BLACKHOLE | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS has been blocked
from loading due to incompatibility with this system. Please contact your software
vendor for a compatible version of the driver.

< End of report >

CatByte

Post #6January 9, 2010, 1:25 PM UTC

Hi,

Please do the following:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
[2010/01/08 20:42:16 | 00,001,141 | —- | C] () – C:\Users\Lou\Desktop\[Demonoid.com]-VMWare_Workstation_7_Keygens_Windows_Linux_both_32bit_64bit_6138106.8846.torrent
[2010/01/08 20:42:06 | 00,011,332 | —- | C] () – C:\Users\Lou\Desktop\Vmware_Workstation_7_Keygen-[[Demonoid.com]]_6138106.8846.torrent
O4 - HKLM..\Run: [explorers] C:\Windows\explorers.exe (TuneUp Software)
O4 - HKCU..\Run: [explorers] C:\Windows\explorers.exe (TuneUp Software)
[2010/01/06 03:58:34 | 21,540,168 | —- | M] (TuneUp Software) – C:\Windows\explorers.exe
[2010/01/08 14:41:23 | 21,540,168 | —- | C] (TuneUp Software) – C:\Windows\explorers.exe

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Windows\explorers.exe" =-
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL log

NEXT

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:dir
C:\Users\Lou\AppData\Roaming\chrtmp /s
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

NEXT

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

silat

Post #7January 9, 2010, 11:53 PM UTC

File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.187\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.186\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.185\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.184\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.183\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.182\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.181\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.180\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.18\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.179\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.178\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.177\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.176\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.175\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.174\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.173\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.172\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.171\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.170\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.17\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.169\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.168\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.167\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.166\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.165\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.164\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.163\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.162\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.161\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.160\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.16\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.159\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.158\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.157\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.156\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.155\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.154\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.153\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.152\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.151\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.150\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.15\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.149\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.148\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.147\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.146\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.145\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.144\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.143\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.142\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.141\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.140\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.14\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.139\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.138\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.137\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.136\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.135\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.134\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.133\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.132\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.131\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.130\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.13\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.129\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.128\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.127\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.126\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.125\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.124\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.123\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.122\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.121\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.120\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.12\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.119\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.118\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.117\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.116\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.115\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.114\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.113\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.112\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.111\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.110\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.11\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.109\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.108\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.107\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.106\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.105\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.104\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.103\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.102\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.101\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.100\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.10\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.1\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig\reconfigurationDataStore.xml not found! C:\Windows\temp\vmware-SYSTEM\vmware-usbarb-SYSTEM-3564.log moved successfully. C:\Windows\temp\~DF9956.tmp moved successfully. Registry entries deleted on Reboot… NEXT: SystemLook v1.0 by jpshortstuff (29.08.09) Log created at 14:51 on 09/01/2010 by Lou (Administrator - Elevation successful) ========== dir ========== C:\Users\Lou\AppData\Roaming\chrtmp - Unable to find folder. -=End Of File=- NEXT: Malwarebytes' Anti-Malware 1.44 Database version: 3510 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18828 1/9/2010 3:24:56 PM mbam-log-2010-01-09 (15-24-56).txt Scan type: Quick Scan Objects scanned: 97554 Time elapsed: 2 minute(s), 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) NEXT Kapersky: Saturday, January 9, 2010 Operating system: Microsoft Windows Vista Home Premium Edition, 64-bit Service Pack 2 (build 6002) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Saturday, January 09, 2010 23:04:23 Records in database: 3299326 Scan settings scan using the following database extended Scan archives yes Scan e-mail databases yes Scan area My Computer C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics Objects scanned 355487 Threats found 10 Infected objects found 10 Suspicious objects found 0 Scan duration 00:12:27 File name Threat Threats count C:\Program Files\NirSoft Utilities\astlog.exe Infected: not-a-virus:PSWTool.Win32.Asterisk.c 1 C:\Program Files\NirSoft Utilities\GDIView.exe Infected: not-a-virus:PSWTool.Win32.NetPass.lu 1 C:\Program Files\NirSoft Utilities\mzcv.exe Infected: not-a-virus:PSWTool.Win32.NetPass.lm 1 C:\Program Files\NirSoft Utilities\PasswordFox.exe Infected: not-a-virus:PSWTool.Win32.NetPass.oo 1 C:\Program Files\NirSoft Utilities\pspv.exe Infected: not-a-virus:PSWTool.Win32.PassView.bj 1 C:\Program Files\NirSoft Utilities\RecentFilesView.exe Infected: not-a-virus:PSWTool.Win32.WinPassViewer.w 1 C:\Program Files\NirSoft Utilities\SniffPass.exe Infected: not-a-virus:PSWTool.Win32.SniffPass.a 1 C:\Program Files\NirSoft Utilities\SpecialFoldersView.exe Infected: not-a-virus:PSWTool.Win32.NetPass.ln 1 C:\Program Files\NirSoft Utilities\VideoCacheView.exe Infected: not-a-virus:PSWTool.Win32.NetPass.lr 1 C:\Program Files\NirSoft Utilities\WirelessKeyView.exe Infected: not-a-virus:PSWTool.Win32.Messen.eq 1 Selected area has been scanned.

CatByte

Post #8January 9, 2010, 11:59 PM UTC

Was the Password Finder tool something you have downloaded yourself?

How is your computer running?

Are there any outstanding issues?

Update Java:

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 17. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.

Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u17-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
Click OK on Delete Temporary Files Window

Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

silat

Post #9January 10, 2010, 12:33 AM UTC

The Password program is legit.. I have updated Java with JavaRa. So did I have any problems?? And the machine is running fine.. Thanks for your help……

CatByte

Post #10January 10, 2010, 1:12 AM UTC

Hi, Most of the OTL log was cut off when it was posted, yes there was an infection on your machine. If you could post that OTL results log again.

silat

Post #11January 13, 2010, 5:02 AM UTC last edited January 13, 2010, 3:43 PM UTC

📎Attach.txt Here is the FULL otl log.. All processes killed ========== OTL ========== File C:\Users\Lou\Desktop\[Demonoid.com]-VMWare_Workstation_7_Keygens_Windows_Linux_both_32bit_64bit_6138106.8846.torrent not found. File C:\Users\Lou\Desktop\Vmware_Workstation_7_Keygen-[[Demonoid.com]]_6138106.8846.torrent not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\explorers not found. File C:\Windows\explorers.exe not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\explorers not found. File C:\Windows\explorers.exe not found. File C:\Windows\explorers.exe not found. File C:\Windows\explorers.exe not found. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Windows\explorers.exe not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Lou ->Temp folder emptied: 6794987 bytes ->Temporary Internet Files folder emptied: 59928274 bytes ->Java cache emptied: 13249540 bytes ->FireFox cache emptied: 14718113 bytes ->Google Chrome cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes Windows Temp folder emptied: 8791593 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 6802176650 bytes Total Files Cleaned = 6,586.00 mb OTL by OldTimer - Version 3.1.21.2 log created on 01122010_205543 Files\Folders moved on Reboot… File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.5\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.4\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.3\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.2\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig.1\reconfigurationDataStore.xml not found! File\Folder C:\Windows\temp\vmware-temp\vmware-SYSTEM\sysReconfig\reconfigurationDataStore.xml not found! C:\Windows\temp\vmware-SYSTEM\vmware-usbarb-SYSTEM-3096.log moved successfully. C:\Windows\temp\~DF1960.tmp moved successfully. Registry entries deleted on Reboot… Retried DDS: DDS (Ver_09-12-01.01) - NTFSX64 Run by [removed] at 7:37:36.10 on Wed 01/13/2010 Internet Explorer: 8.0.6001.18828 BrowserJavaVersion: 1.6.0_17 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6134.3224 [GMT -8:00] AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\nvvsvc.exe C:\Program Files\Soft4Ever\looknstop\LnsSvcVista.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Soft4Ever\looknstop\looknstop.exe C:\Windows\SysWOW64\HsMgr.exe C:\Windows\system\HsMgr64.exe C:\Program Files\Genie-Soft\GBMPro8x64\GBMAgent.exe C:\Windows\ehome\ehtray.exe C:\Program Files (x86)\Flashnote\Flashnote.exe C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe C:\Program Files (x86)\Input Director\IDWinService.exe C:\$ISR\0\ISRService.exe C:\Program Files (x86)\Input Director\InputDirectorSessionHelper.exe C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe C:\Program Files (x86)\Eset\nod32krn.exe C:\Program Files (x86)\ClipCache\clipc.exe C:\Windows\ehome\ehmsas.exe C:\$ISR\$APP\ISRMonitor.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\DL Software\D-Color\dcolor.exe C:\Program Files (x86)\Winamp\winampa.exe C:\Windows\SysWOW64\Returnil\RVS3\rvsmon.exe C:\Program Files (x86)\FastStone\FSCapture.exe F:\Programs\Pink Calendar\PinkCal.exe C:\Program Files (x86)\PowerStrip\PStrip.exe C:\Program Files (x86)\ESET\nod32kui.exe C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowProtectSvc.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowProtectSvc.exe C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe C:\Program Files (x86)\Weather Pulse\TDClient.exe C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe C:\Windows\SysWOW64\vmnat.exe C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonSvc.exe C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe C:\Windows\system32\WUDFHost.exe C:\Windows\SysWOW64\vmnetdhcp.exe C:\Windows\SysWOW64\vsnapvss.exe C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\ASUS Xonar D1 Audio\Customapp\ASUSAUDIOCENTER.EXE C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files (x86)\xplorer2\xplorer2_64.exe C:\Program Files (x86)\Trillian Astra\Trillian\trillian.exe C:\Windows\splwow64.exe C:\Program Files (x86)\Maxthon2\Maxthon.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\vssvc.exe C:\Windows\System32\svchost.exe -k swprv C:\Users\Lou\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = about:blank mLocal Page = c:\windows\syswow64\blank.htm BHO: IE7Pro BHO: {00011268-e188-40df-a514-835fcd78b1bf} - c:\program files (x86)\iepro\iepro.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files (x86)\real\realplayer\rpbrowserrecordplugin.dll BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files (x86)\siber systems\ai roboform\roboform.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files (x86)\microsoft office\office12\GrooveShellExtensions.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll BHO: ChromeFrame BHO: {ecb3c477-1a0a-44bd-bb57-78f9efe34fa7} - c:\program files (x86)\google\chrome frame\application\4.0.266.0\npchrome_tab.dll TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files (x86)\siber systems\ai roboform\roboform.dll uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [Flashnote] c:\program files (x86)\flashnote\flashnote.exe uRun: [SUPERAntiSpyware] c:\program files (x86)\superantispyware\SUPERAntiSpyware.exe uRun: [RoboForm] "c:\program files (x86)\siber systems\ai roboform\RoboTaskBarIcon.exe" uRun: [GBMPro8Agentx64] "c:\program files\genie-soft\gbmpro8x64\GBMAgent.exe" mRun: [ISR_MONITOR] c:\$isr\$app\ISRMonitor.exe mRun: [WinampAgent] "c:\program files (x86)\winamp\winampa.exe" mRun: [GrooveMonitor] "c:\program files (x86)\microsoft office\office12\GrooveMonitor.exe" mRun: [nod32kui] "c:\program files (x86)\eset\nod32kui.exe" /WAITSERVICE mRun: [TkBellExe] "c:\program files (x86)\common files\real\update_ob\realsched.exe" -osboot mRun: [Malwarebytes' Anti-Malware] "c:\program files (x86)\malwarebytes' anti-malware\mbamgui.exe" /starttray mRun: [SunJavaUpdateSched] "c:\program files (x86)\java\jre6\bin\jusched.exe" StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\clipca~1.lnk - c:\program files (x86)\clipcache\clipc.exe StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\dcolor.lnk - c:\program files (x86)\dl software\d-color\dcolor.exe StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\fastst~1.lnk - c:\program files (x86)\faststone\FSCapture.exe StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\pinkcal.lnk - f:\programs\pink calendar\PinkCal.exe StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\powers~1.lnk - c:\program files (x86)\powerstrip\PStrip.exe StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\clipca~1.lnk - c:\program files (x86)\clipcache\clipc.exe StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\dcolor.lnk - c:\program files (x86)\dl software\d-color\dcolor.exe StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\fastst~1.lnk - c:\program files (x86)\faststone\FSCapture.exe StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\pinkcal.lnk - f:\programs\pink calendar\PinkCal.exe StartupFolder: c:\users\lou\appdata\roaming\micros~1\windows\startm~1\programs\startup\powers~1.lnk - c:\program files (x86)\powerstrip\PStrip.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: SoftwareSASGeneration = 3 (0x3) IE: &NeoTrace It! - c:\progra~2\neotra~1\NTXcontext.htm IE: Customize Menu - file://c:\program files (x86)\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html IE: E&xport to Microsoft Excel - c:\progra~2\micros~1\office12\EXCEL.EXE/3000 IE: Fill Forms - file://c:\program files (x86)\siber systems\ai roboform\RoboFormComFillForms.html IE: RoboForm Toolbar - file://c:\program files (x86)\siber systems\ai roboform\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files (x86)\siber systems\ai roboform\RoboFormComSavePass.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files (x86)\siber systems\ai roboform\RoboFormComFillForms.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files (x86)\siber systems\ai roboform\RoboFormComSavePass.html IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files (x86)\siber systems\ai roboform\RoboFormComShowToolbar.html IE: {000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709} - c:\program files (x86)\iepro\iepro.dll IE: {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - {B119EB0C-C021-46CF-85B0-34A760E0D5FE} - c:\program files (x86)\iepro\iepro.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~2\micros~1\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~1\office12\REFIEBAR.DLL LSP: c:\windows\system32\imon.dll LSP: c:\program files (x86)\vmware\vmware workstation\vsocklib.dll Trusted Zone: watchersweb.com\www DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files (x86)\yahoo!\common\Yinsthelper.dll DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlcdnet.asus.com/pub/ASUS/misc/dlm-activex-2.2.5.0.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?39932.0263888889 DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files (x86)\belarc\advisor\system\BAVoilaX.dll Handler: cf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files (x86)\google\chrome frame\application\4.0.266.0\npchrome_tab.dll Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files (x86)\microsoft office\office12\GrooveSystemServices.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL Notify: !SASWinLogon - c:\program files (x86)\superantispyware\SASWINLO.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files (x86)\microsoft office\office12\GrooveShellExtensions.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files (x86)\superantispyware\SASSEH.DLL BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll TB-X64: {724D43A0-0D85-11D4-9908-00400523E39A} - No File mRun-x64: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide mRun-x64: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun-x64: [Look 'n' Stop] "c:\program files\soft4ever\looknstop\looknstop.exe" -auto mRun-x64: [Cmaudio8788] c:\windows\syswow64\rundll32.exe c:\windows\syswow64\cmicnfgp.dll,CMICtrlWnd mRun-x64: [Cmaudio8788GX] c:\windows\syswow64\HsMgr.exe Envoke mRun-x64: [Cmaudio8788GX64] c:\windows\system\HsMgr64.exe Envoke mRun-x64: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun-x64: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun-x64: [RtHDVCpl] c:\program files\realtek\audio\hda\RAVCpl64.exe mRun-x64: [Skytel] c:\program files\realtek\audio\hda\Skytel.exe mRun-x64: [GBMPro8Agentx64] "c:\program files\genie-soft\gbmpro8x64\GBMAgent.exe" IE-X64: {9885224C-1217-4c5f-83C2-00002E6CEF2B} - c:\progra~2\neotra~1\NTXtoolbar.htm STS-X64: FencesShlExt Class: {1984DD45-52CF-49cd-AB77-18F378FEA264} - c:\program files (x86)\stardock\fences\FencesMenu64.dll ================= FIREFOX =================== FF - ProfilePath - c:\users\lou\appdata\roaming\mozilla\firefox\profiles\6wzxx6k1.default\ FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157 FF - component: c:\program files (x86)\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll FF - component: c:\users\lou\appdata\roaming\mozilla\firefox\profiles\6wzxx6k1.default\extensions\{22119944-ed35-4ab1-910b-e619ea06a115}\components\rfproxy_31.dll FF - plugin: c:\program files (x86)\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npyaxmpb.dll FF - plugin: c:\program files (x86)\nvidia corporation\3d vision\npnv3dv.dll FF - plugin: c:\program files (x86)\virtual earth 3d\npVE3D.dll FF - plugin: c:\windows\syswow64\adobe\director\np32dsw.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R0 RVSystem;RVSystem;c:\windows\system32\drivers\rvsystem.sys [2009-8-16 49736] R0 stcvsm;stcvsm;c:\windows\system32\drivers\stcvsm.sys [2009-3-12 199712] R1 lnsfw1;lnsfw1;c:\windows\system32\drivers\lnsfw1.sys [2009-11-10 82784] R1 PStrip64;PStrip64;c:\windows\system32\drivers\pstrip64.sys [2009-3-16 13008] R1 rvsmon;rvsmon;c:\windows\system32\drivers\rvsmon.sys [2009-9-21 151752] R1 rvsmonf;rvsmonf;c:\windows\system32\drivers\rvsmonf.sys [2009-9-21 1325904] R1 sbmount;StorageCraft Image Mount Driver;c:\windows\system32\drivers\sbmount.sys [2009-3-12 114720] R2 InputDirector;Input Director Service;c:\program files (x86)\input director\IDWinService.exe [2009-10-9 32768] R2 ISRService;FirstDefense-ISR Service;c:\$isr\0\ISRService.exe [] R2 lnssvcVista;Look 'n' Stop Service;c:\program files\soft4ever\looknstop\lnssvcvista.exe -r –> c:\program files\soft4ever\looknstop\LnsSvcVista.exe -r [?] R2 MBAMService;MBAMService;c:\program files (x86)\malwarebytes' anti-malware\mbamservice.exe [2010-1-6 236368] R2 NOD32krn;NOD32 Kernel Service;c:\program files (x86)\eset\nod32krn.exe [2009-4-16 549256] R2 RVSMONBL;Returnil Virtual System Core Service;c:\windows\syswow64\returnil\rvs3\rvsmon.exe [2009-9-18 1210528] R2 rvsmonn;rvsmonn;c:\windows\system32\drivers\rvsmonn2.sys [2009-9-21 21936] R2 ShadowProtectSvc;ShadowProtect Service;c:\program files (x86)\storagecraft\shadowprotect\ShadowProtectSvc.exe [2009-3-12 1497632] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\nvidia corporation\3d vision\nvSCPAPISvr.exe [2009-11-20 240232] R2 StorageCraft Image Manager;StorageCraft Image Manager;c:\program files (x86)\storagecraft\imagemanager\ImageManager.exe [2008-9-23 90112] R2 Tropic Designs: Weather Pulse update permissions manager. 29862.;Tropic Designs: Weather Pulse update permissions manager. 29862.;c:\program files (x86)\weather pulse\tdclient.exe -permissionmanagerrun –> c:\program files (x86)\weather pulse\TDClient.exe -PermissionManagerRun [?] R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2010-1-9 80944] R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\common files\vmware\usb\vmware-usbarbitrator.exe [2009-10-22 563760] R2 vmware-converter-agent;VMware vCenter Converter Agent;c:\program files (x86)\vmware\vmware vcenter converter standalone\vmware-converter-a.exe [2009-2-5 428592] R2 vmware-converter-server;VMware vCenter Converter Server;c:\program files (x86)\vmware\vmware vcenter converter standalone\vmware-converter.exe [2009-2-5 428592] R2 VSNAPVSS;StorageCraft Shadow Copy Provider;c:\windows\syswow64\vsnapvss.exe [2009-3-12 67616] R2 vstor2-mntapi10;Vstor2 MntApi 1.0 Driver;c:\program files (x86)\vmware\vmware vcenter converter standalone\vstor2-mntapi10.sys [2009-2-5 32816] R2 XMouseButton Launcher;XMouseButton Launcher;c:\program files\highresolution enterprises\x-mouse button control\XMouseButtonSvc.exe [2009-5-6 84480] R3 cmudaxp;ASUS Xonar D1 Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2009-4-7 1363968] R3 lnsfw;Look 'n' Stop Driver;c:\windows\system32\drivers\lnsfw.sys [2009-11-10 66400] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-1-6 22104] R3 npusbio;npusbio;c:\windows\system32\drivers\npusbio_x64.sys [2009-5-4 55328] S1 SASDIFSV;SASDIFSV;c:\program files (x86)\superantispyware\sasdifsv.sys [2009-2-17 8944] S1 SASKUTIL;SASKUTIL;c:\program files (x86)\superantispyware\SASKUTIL.SYS [2009-2-17 55024] S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\google\update\GoogleUpdate.exe [2009-12-10 135664] S3 bmdrvr;Modified Clusters Tracking Driver;c:\windows\syswow64\drivers\bmdrvr.sys [2009-2-5 34864] S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe [2009-5-27 89920] S3 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x64.sys [2009-5-2 19432] S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-10-28 16776] S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-10-28 9096] S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\common files\macrovision shared\flexnet publisher\FNPLicensingService64.exe [2009-3-27 1038088] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648] S3 IDVistaService;Input Director Vista Service;c:\program files (x86)\input director\IDVistaService.exe [2009-2-7 13824] S3 pbfilter;pbfilter;c:\program files (x86)\peerblock\pbfilter.sys [2009-9-28 19544] S3 PerfHost;Performance Counter DLL Host;c:\windows\syswow64\perfhost.exe [2008-1-20 19968] S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\drivers\point64k.sys [2008-12-4 33160] S3 PORTMON;PORTMON;c:\program files\sysinternals suite\PORTMSYS.SYS [2009-11-10 28656] S3 RivaTuner64;RivaTuner64;c:\program files (x86)\rivatuner v2.24\RivaTuner64.sys [2009-2-25 19952] S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\sisoftware\sisoftware sandra professional business 2010\RpcAgentSrv.exe [2009-11-28 93336] S3 SASENUM;SASENUM;c:\program files (x86)\superantispyware\SASENUM.SYS [2009-2-17 7408] S3 utdrv;utdrv;c:\windows\system32\drivers\utdrv.sys [2009-8-23 29008] ============== File Associations =============== JSEFile=c:\windows\syswow64\WScript.exe "%1" %* =============== Created Last 30 ================ 2010-01-10 21:55:29 0 d—–w- c:\users\lou\appdata\roaming\LockHunter 2010-01-10 21:39:37 0 d—–w- c:\users\lou\appdata\roaming\USBSafelyRemove 2010-01-10 21:39:27 0 d—–w- c:\programdata\USBSRService 2010-01-10 21:33:36 0 d—–w- c:\program files\LockHunter 2010-01-10 18:18:48 0 d—–w- c:\program files (x86)\Input Director 2010-01-09 22:45:00 0 d—–w- C:\_OTL 2010-01-09 21:49:35 80944 —-a-w- c:\windows\system32\drivers\vmci.sys 2010-01-09 21:49:03 68144 —-a-w- c:\windows\system32\drivers\vmx86.sys 2010-01-09 21:48:20 55344 —-a-w- c:\windows\system32\vnetinst.dll 2010-01-09 21:48:20 20016 —-a-w- c:\windows\system32\drivers\vmnetadapter.sys 2010-01-09 21:48:18 395824 —-a-w- c:\windows\syswow64\vmnat.exe 2010-01-09 21:48:18 334384 —-a-w- c:\windows\syswow64\vmnetdhcp.exe 2010-01-09 21:48:18 30256 —-a-w- c:\windows\system32\drivers\vmnetuserif.sys 2010-01-09 21:48:16 56880 —-a-r- c:\windows\system32\vmnetbridge.dll 2010-01-09 21:48:16 45104 —-a-r- c:\windows\system32\drivers\vmnetbridge.sys 2010-01-09 21:48:16 24112 —-a-r- c:\windows\system32\drivers\vmnet.sys 2010-01-09 21:48:15 958000 —-a-w- c:\windows\system32\vnetlib64.dll 2010-01-09 21:47:54 29744 —-a-w- c:\windows\system32\drivers\VMkbd.sys 2010-01-09 21:47:53 38960 —-a-w- c:\windows\system32\drivers\hcmon.sys 2010-01-09 21:47:33 0 d—–w- c:\program files (x86)\common files\VMware 2010-01-09 21:45:16 884 —-a-w- C:\tubelist.dat 2010-01-09 04:50:50 0 d—–w- c:\program files\WinRAR 2010-01-08 22:41:34 20822145 —ha-w- c:\users\lou\appdata\roaming\TU2010TrialEN-US.exe 2010-01-07 08:39:18 0 d—–w- C:\HijackThis 2010-01-07 08:35:50 0 d—–w- c:\program files (x86)\FreeFixer 2010-01-07 05:17:47 0 d—–w- c:\users\lou\appdata\roaming\Malwarebytes 2010-01-07 05:17:43 0 d—–w- c:\programdata\Malwarebytes 2010-01-07 05:17:42 22104 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-01-07 05:17:42 0 d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2010-01-03 02:18:32 0 d—–w- c:\program files (x86)\Belarc 2010-01-02 02:11:48 65536 –sha-w- c:\users\lou\NTUSER.DAT{655f9f37-f723-11de-a839-000000000000}.TM.blf 2010-01-02 02:11:48 524288 –sha-w- c:\users\lou\NTUSER.DAT{655f9f37-f723-11de-a839-000000000000}.TMContainer00000000000000000002.regtrans-ms 2010-01-02 02:11:48 524288 –sha-w- c:\users\lou\NTUSER.DAT{655f9f37-f723-11de-a839-000000000000}.TMContainer00000000000000000001.regtrans-ms 2010-01-01 14:24:19 4096 –sha-w- C:\VSM000.IDX 2009-12-25 23:18:43 65536 –sha-w- c:\users\lou\NTUSER.DAT{bca0fde8-f1ab-11de-a588-000000000000}.TM.blf 2009-12-25 23:18:43 524288 –sha-w- c:\users\lou\NTUSER.DAT{bca0fde8-f1ab-11de-a588-000000000000}.TMContainer00000000000000000002.regtrans-ms 2009-12-25 23:18:43 524288 –sha-w- c:\users\lou\NTUSER.DAT{bca0fde8-f1ab-11de-a588-000000000000}.TMContainer00000000000000000001.regtrans-ms 2009-12-23 05:25:42 19431936 —-a-w- c:\windows\system32\imageres.dll 2009-12-15 10:19:44 34705 —-a-w- c:\programdata\nvModes.dat 2009-12-15 10:14:22 0 d—–w- c:\program files (x86)\NVIDIA Corporation 2009-12-15 10:13:26 0 d—–w- c:\program files\NVIDIA Corporation ==================== Find3M ==================== 2010-01-09 21:48:41 51200 —-a-w- c:\windows\inf\infpub.dat 2010-01-09 21:48:41 143360 —-a-w- c:\windows\inf\infstrng.dat 2010-01-09 21:48:20 86016 —-a-w- c:\windows\inf\infstor.dat 2010-01-04 03:02:17 206 —-a-w- c:\program files (x86)\hwmonitorw.ini 2009-11-21 09:30:06 86016 —-a-w- c:\windows\syswow64\frapsvid.dll 2009-11-21 09:30:04 84992 —-a-w- c:\windows\system32\frapsv64.dll 2009-11-21 05:31:00 886376 —-a-w- c:\windows\system32\nvsvc64.dll 2009-11-21 05:31:00 61032 —-a-w- c:\windows\system32\nvshext.dll 2009-11-21 05:31:00 151144 —-a-w- c:\windows\system32\nvvsvc.exe 2009-11-21 05:31:00 13825128 —-a-w- c:\windows\system32\nvcpl.dll 2009-11-21 05:31:00 115816 —-a-w- c:\windows\system32\nvmctray.dll 2009-11-20 05:43:02 645736 —-a-w- c:\windows\system32\NVUNINST.EXE 2009-11-10 19:29:45 47104 —-a-w- c:\windows\system32\fwapi.dll 2009-11-03 04:42:06 226688 ——w- c:\windows\system32\MpSigStub.exe 2009-10-30 11:46:39 665600 —-a-w- c:\windows\inf\drvindex.dat 2009-10-22 11:22:38 252464 —-a-w- c:\windows\syswow64\vmnc.dll 2009-09-08 06:04:58 1678336 —-a-w- c:\program files (x86)\HWMonitor.exe 2009-08-14 22:07:06 1960 —-a-w- c:\program files (x86)\EVGA GVT.lnk 2009-05-11 12:24:05 21 —-a-w- c:\program files (x86)\config.dat 2009-05-11 05:31:36 858 —-a-w- c:\program files (x86)\HandBrake.lnk 2009-04-08 06:29:37 436560 —-a-w- c:\program files (x86)\GPU-Z.0.3.3.exe 2009-03-21 09:05:13 1944 —-a-w- c:\program files (x86)\TempConv2.lnk 2009-03-13 07:03:21 86328 —-a-w- c:\program files (x86)\TweakUAC.exe 2008-07-21 18:10:18 630784 —-a-w- c:\program files (x86)\Vista4Experts.exe 2008-01-21 03:21:59 174 –sha-w- c:\program files\desktop.ini 2008-01-21 03:21:59 174 –sha-w- c:\program files (x86)\desktop.ini 2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2007-11-03 05:52:39 108 –sha-r- c:\windows\neoqaz2.dll 2009-08-24 18:56:46 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2009-08-24 18:56:46 32768 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2009-08-24 18:56:46 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat 2009-08-24 18:56:46 245760 –sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2009-04-30 21:56:09 16384 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2009-04-30 21:56:09 32768 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2009-04-30 21:56:09 16384 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat 2009-04-30 21:56:09 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat ============= FINISH: 7:37:52.63 ===============

silat

Post #12January 14, 2010, 1:07 AM UTC

Not sure if this is related to ongoing issues. Ive attached pictures of the issue. Suddenly a "programs" folder has appeared in my start/all programs menu. It is a exact copy of my "all programs" menu… 📎ProgramswithinALLPROGRAMS.jpg 📎start_menu_all_programs.jpg

CatByte

Post #13January 14, 2010, 4:57 AM UTC

Try this for the "programs" folder:

click the Start Menu (Orb), right-click "All Programs" and choose "Properties". Then click the "Customize" button and uncheck the "Default Programs" checkbox.

How is the computer running and are there any outstanding issues.

silat

Post #14January 14, 2010, 8:00 AM UTC

Well the programs folder disappeared . thanks Everything is fine as far as I can tell. Can you tell me what was wrong ? What was the infection. And I really do appreciate your help. Its been a while since I was in the game.

CatByte

Post #15January 14, 2010, 8:22 PM UTC

Hi,

You had a couple of trojans on your system.

Likely came on board by downloading cracked programs through torrents - thats' usually how they appear.

Not a practice we condone.

we have some cleanup to do now:

Please do the following:

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

NEXT

Create a new system restore point:

Click the Start Menu > right-click Computer > select Properties This will take you into the System area of Control Panel.
Click the System Protection link on the left hand side.
select the System Protection tab to get to the System Restore section.
Click the Create button to create a new restore point. You’ll be prompted for a name, name it something you will be able to easily identify later.
Click the Create button, the system will create the new restore point.
When it’s finished, you’ll get a message saying it’s completed successfully

Remove old restore points

Click Start, type Cleanmgr.exe and press ENTER
Select the drive-letter (C:\) from the list and click OK
Click Clean up system files This restarts Disk Cleanup to run in elevated mode.
Select the drive-letter (C:\ ) from the list and click OK
Click the More Options tab
Click the Clean up… button under System Restore and Shadow Copies.
Click OK.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Malwarebytes warning

✨ Ask AI

Ask AI